@hasna/skills 0.10.26 → 0.10.28

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.26",
+    version: "0.10.28",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -38316,8 +38316,8 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
-      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2")
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3")
         requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve2(source.path) === source.path && basename3(source.path) === "config.toml");
       if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve2(source.path) === source.path && basename3(source.path) === "settings.json");
@@ -47237,6 +47237,72 @@ async function prepareSkillDependencies(skillPath, env, timeoutMs = DEFAULT_PREP
 var DEPENDENCY_PREPARATION_MARKER = ".skills-dependency-preparation", RECOVERY = "Skill dependency preparation is incomplete. Confirm no installer is running, successfully run bun install --no-save in the skill directory, then remove only .skills-dependency-preparation. See docs/skill-standard.md#recovering-interrupted-dependency-preparation.", DEFAULT_PREPARATION_TIMEOUT_MS = 60000;
 var init_dependency_preparation = () => {};
 
+// src/lib/codex-local-mcp-controls.ts
+function isCodexLocalStdioMcpServer(name, server) {
+  const identifier2 = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(value);
+  const refuse = () => {
+    throw new Error("Unsupported Codex local stdio MCP controls");
+  };
+  const object7 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v) && !(v instanceof Date));
+  const textField = (v, empty = false) => typeof v === "string" && (empty || Boolean(v.trim())) && Buffer.byteLength(v) <= 16384 && !/[\x00-\x1f\x7f]/.test(v);
+  const envName = (v) => typeof v === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(v);
+  const optional3 = (v, valid) => v === undefined || v === null || valid(v);
+  const stringList = (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => textField(item));
+  const approval = (v) => ["auto", "prompt", "writes", "approve"].includes(v);
+  const duration3 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+  const positiveInteger = (v) => Number.isSafeInteger(v) && v > 0;
+  const fields = [
+    "command",
+    "args",
+    "cwd",
+    "env",
+    "env_vars",
+    "enabled",
+    "required",
+    "environment_id",
+    "startup_readiness",
+    "supports_parallel_tool_calls",
+    "tool_input_schema_max_bytes",
+    "startup_timeout_sec",
+    "startup_timeout_ms",
+    "tool_timeout_sec",
+    "default_tools_approval_mode",
+    "enabled_tools",
+    "disabled_tools",
+    "omit_tools_from",
+    "tools",
+    "name"
+  ];
+  try {
+    if (!identifier2(name) || !object7(server) || !Object.keys(server).every((key) => fields.includes(key)) || !textField(server.command) || !optional3(server.args, (v) => Array.isArray(v) && v.length <= 256 && v.every((arg) => textField(arg, true))) || !optional3(server.cwd, textField) || !optional3(server.env, (v) => object7(v) && Object.keys(v).length <= 256 && Object.entries(v).every(([key, value]) => envName(key) && textField(value, true))) || !["enabled", "required", "supports_parallel_tool_calls"].every((key) => optional3(server[key], (v) => typeof v === "boolean")) || !optional3(server.environment_id, (v) => v === "local") || !optional3(server.startup_readiness, (v) => ["connection", "catalog"].includes(v)) || !optional3(server.tool_input_schema_max_bytes, positiveInteger) || !["startup_timeout_sec", "tool_timeout_sec"].every((key) => optional3(server[key], duration3)) || !optional3(server.startup_timeout_ms, (v) => Number.isSafeInteger(v) && v >= 0) || !optional3(server.default_tools_approval_mode, approval) || !["enabled_tools", "disabled_tools"].every((key) => optional3(server[key], stringList)) || !optional3(server.omit_tools_from, (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => ["code_mode", "deferred", "direct"].includes(item))) || !optional3(server.name, textField))
+      refuse();
+    if (server.env_vars !== undefined && server.env_vars !== null) {
+      if (!Array.isArray(server.env_vars) || server.env_vars.length > 256)
+        refuse();
+      const names = server.env_vars.map((entry) => {
+        if (envName(entry))
+          return entry;
+        if (!object7(entry) || !Object.keys(entry).every((key) => ["name", "source"].includes(key)) || !envName(entry.name) || !optional3(entry.source, (v) => v === "local"))
+          refuse();
+        return entry.name;
+      });
+      if (new Set(names).size !== names.length)
+        refuse();
+    }
+    if (server.tools !== undefined && server.tools !== null) {
+      if (!object7(server.tools) || Object.keys(server.tools).length > 256)
+        refuse();
+      for (const [tool, config2] of Object.entries(server.tools)) {
+        if (!textField(tool) || !object7(config2) || !Object.keys(config2).every((key) => ["approval_mode", "output_token_limit"].includes(key)) || !optional3(config2.approval_mode, approval) || !optional3(config2.output_token_limit, positiveInteger))
+          refuse();
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/lib/claude-settings-witness.ts
 import { createHash as createHash8 } from "crypto";
 import { closeSync as closeSync8, constants as constants5, fstatSync as fstatSync8, lstatSync as lstatSync10, openSync as openSync8, readSync as readSync4 } from "fs";
@@ -47688,6 +47754,71 @@ var init_codex_settings_witness_v1 = __esm(() => {
   VERBOSITY = new Set(["low", "medium", "high"]);
 });
 
+// src/lib/codex-mcp-discovery-projection.ts
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+function record4(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
+}
+function localStdio(name, row) {
+  return name !== "codex_apps" && name !== "_codex_apps" && isCodexLocalStdioMcpServer(name, row);
+}
+function stripEmptyParent(config2) {
+  if (record4(config2.mcp_servers) && !Object.keys(config2.mcp_servers).length)
+    delete config2.mcp_servers;
+  return config2;
+}
+function projectRegularCodexMcp(config2, source) {
+  const unchanged2 = { config: config2, numericSource: source };
+  if (!record4(config2.mcp_servers))
+    return unchanged2;
+  const candidates = Object.entries(config2.mcp_servers).filter(([name, row]) => localStdio(name, row)).map(([name]) => name);
+  if (!candidates.length)
+    return unchanged2;
+  const headers = [];
+  let attempts = 0;
+  for (const match of source.matchAll(/^[ \t]*\[{1,2}[^\r\n]*\]{1,2}[ \t]*(?:#[^\r\n]*)?(?:\r?\n|$)/gm)) {
+    if (++attempts > 256)
+      return unchanged2;
+    try {
+      Bun.TOML.parse(source.slice(0, match.index));
+    } catch {
+      continue;
+    }
+    let header;
+    try {
+      header = Bun.TOML.parse(match[0]);
+    } catch {
+      return unchanged2;
+    }
+    const path = [];
+    while (record4(header) && Object.keys(header).length === 1) {
+      const key = Object.keys(header)[0];
+      path.push(key);
+      header = header[key];
+    }
+    headers.push({ start: match.index, path });
+  }
+  const names = candidates.filter((name) => headers.filter((header) => header.path.length === 2 && header.path[0] === "mcp_servers" && header.path[1] === name).length === 1);
+  if (!names.length)
+    return unchanged2;
+  const selected = headers.map((header, index) => ({ ...header, end: headers[index + 1]?.start ?? source.length })).filter((header) => header.path[0] === "mcp_servers" && names.includes(header.path[1]));
+  let numericSource = source;
+  for (const range of selected.reverse())
+    numericSource = numericSource.slice(0, range.start) + numericSource.slice(range.end);
+  const expected = structuredClone(config2);
+  for (const name of names)
+    delete expected.mcp_servers[name];
+  stripEmptyParent(expected);
+  try {
+    if (!isDeepStrictEqual2(stripEmptyParent(Bun.TOML.parse(numericSource)), expected))
+      return unchanged2;
+  } catch {
+    return unchanged2;
+  }
+  return { config: expected, numericSource };
+}
+var init_codex_mcp_discovery_projection = () => {};
+
 // src/lib/codex-settings-witness.ts
 import { createHash as createHash10 } from "crypto";
 function need4(value) {
@@ -47760,7 +47891,7 @@ function canonical4(value, depth = 0, budget = { remaining: 65536 }) {
   need4(isRecord3(value));
   return ["object", Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, child]) => [key, canonical4(child, depth + 1, budget)])];
 }
-function normalize2(config2) {
+function normalize2(config2, version2 = 2) {
   if (isRecord3(config2.hooks)) {
     delete config2.hooks.state;
     if (!Object.keys(config2.hooks).length)
@@ -47778,11 +47909,11 @@ function normalize2(config2) {
     if (!Object.keys(skills).length)
       delete config2.skills;
   }
-  inference(config2);
+  inference(config2, version2);
   if (isRecord3(config2.profiles)) {
     for (const profile of Object.values(config2.profiles))
       if (isRecord3(profile))
-        inference(profile);
+        inference(profile, version2);
   }
 }
 function disablesOneSkill(entry) {
@@ -47794,18 +47925,25 @@ function disablesOneSkill(entry) {
   const selector = ["path", "name"].filter((key) => Object.hasOwn(entry, key));
   return selector.length === 1 && typeof entry[selector[0]] === "string" && entry[selector[0]].length > 0;
 }
-function inference(target) {
-  for (const key of INFERENCE)
+function inference(target, version2) {
+  const keys = version2 === 3 ? [...INFERENCE, "service_tier", "plan_mode_reasoning_effort", "personality"] : INFERENCE;
+  for (const key of keys)
     if (Object.hasOwn(target, key)) {
       const value = target[key];
       if (key === "model")
         need4(typeof value === "string" && MODEL.test(value));
-      else
+      else if (key === "personality")
+        need4(typeof value === "string" && ["none", "friendly", "pragmatic"].includes(value));
+      else if (version2 === 3 && key !== "model_verbosity") {
+        need4(typeof value === "string" && value.length <= 128 && !/[\x00-\x1f\x7f]/.test(value));
+        if (key !== "service_tier")
+          need4(value.length > 0);
+      } else
         need4(typeof value === "string" && (key === "model_reasoning_effort" ? EFFORT2.has(value) : VERBOSITY2.has(value)));
       delete target[key];
     }
 }
-function settingsDigest2(text2) {
+function settingsDigest2(text2, version2 = 2) {
   let config2;
   try {
     config2 = Bun.TOML.parse(text2);
@@ -47813,8 +47951,9 @@ function settingsDigest2(text2) {
     throw new Error("Invalid Codex settings witness");
   }
   need4(isRecord3(config2));
-  normalize2(config2);
-  return sha2(`hasna.skills.codex-settings.v2\x00${JSON.stringify([canonical4(config2), numericTokens2(text2)])}`);
+  const projected = version2 === 3 ? projectRegularCodexMcp(config2, text2) : { config: config2, numericSource: text2 };
+  normalize2(projected.config, version2);
+  return sha2(`hasna.skills.codex-settings.v${version2}\x00${JSON.stringify([canonical4(projected.config), numericTokens2(projected.numericSource)])}`);
 }
 function hashCodexSettingsReplacementV2(text2, budget = { remaining: 256 * 1024 * 1024 }) {
   need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text2));
@@ -47825,10 +47964,19 @@ function captureCodexSettingsV2(path, budget = { remaining: 256 * 1024 * 1024 })
   const text2 = readNativeSettingsWitnessFile(path, budget, "config.toml");
   return { path, hashMode: "codex-settings-v2", sha256: settingsDigest2(text2) };
 }
+function hashCodexSettingsReplacementV3(text2, budget = { remaining: 256 * 1024 * 1024 }) {
+  need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text2));
+  budget.remaining -= Buffer.byteLength(text2);
+  return settingsDigest2(text2, 3);
+}
+function captureCodexSettingsV3(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "codex-settings-v3", sha256: settingsDigest2(readNativeSettingsWitnessFile(path, budget, "config.toml"), 3) };
+}
 var sha2 = (text2) => createHash10("sha256").update(text2).digest("hex"), EFFORT2, VERBOSITY2, MODEL, CODEX_DISCOVERY_PROJECTION_FIELDS, INFERENCE;
 var init_codex_settings_witness = __esm(() => {
   init_codex_settings_witness_v1();
   init_codex_settings_witness_v1();
+  init_codex_mcp_discovery_projection();
   init_claude_settings_witness();
   EFFORT2 = new Set(["none", "minimal", "low", "medium", "high", "xhigh"]);
   VERBOSITY2 = new Set(["low", "medium", "high"]);
@@ -49585,7 +49733,7 @@ var init_codex_hook_discovery_recovery = __esm(() => {
 import { createHash as createHash16 } from "crypto";
 import { lstatSync as lstatSync17, readFileSync as readFileSync15, readdirSync as readdirSync7, realpathSync as realpathSync4 } from "fs";
 import { basename as basename8, dirname as dirname15, isAbsolute as isAbsolute13, join as join24, resolve as resolve14, sep as sep5 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 function parseConfig(text2, path, toml = false) {
   try {
     const value = toml ? Bun.TOML.parse(text2) : JSON.parse(text2);
@@ -49624,19 +49772,19 @@ function projectNativeDiscoveryFields(text2, format, fields2, path) {
   return digest(JSON.stringify(Object.fromEntries(fields2.map((field2) => [field2, object7[field2] ?? null]))));
 }
 function isSupersededCodexProjection(agent, configPath, source) {
-  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual2(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
+  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual3(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
 }
 function supersedesCodexProjection(sources, configPath) {
-  return sources.some((source) => source.path === configPath && source.hashMode === "codex-settings-v2");
+  return sources.some((source) => source.path === configPath && (source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"));
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
-  if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2") {
+  if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Codex settings witnesses require exact typed metadata");
-    const current = (source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
+    const current = (source.hashMode === "codex-settings-v3" ? captureCodexSettingsV3 : source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
     if (current !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
-    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current;
+    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v3" ? hashCodexSettingsReplacementV3 : source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current;
   }
   if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
@@ -49736,7 +49884,7 @@ function codexInstallationRoots(binding) {
   });
 }
 function assertMarketplaceBinding(binding, source) {
-  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename8(source.path) !== "config.toml"))
+  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename8(source.path) !== "config.toml"))
     throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
   if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename8(source.path) !== "settings.json"))
     throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
@@ -49819,10 +49967,10 @@ function resolveAgentDiscovery(options) {
     verifyAgentDiscovery(retained);
     if (!retained.sources.some((source) => source.path === canonical6(configPath) && source.format === undefined && source.fields === undefined))
       unresolved("retained review is missing the full agent configuration source");
-    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2"))) && source.path !== canonical6(configPath)))
+    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
       unresolved("retained settings witness names another configuration source");
     const covered = supersedesCodexProjection(retained.sources, canonical6(configPath)) ? sources.filter((source) => !isSupersededCodexProjection(agent, canonical6(configPath), source)) : sources;
-    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual2(saved, source))) || [...roots].some((root) => !retained.roots.includes(root)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
+    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual3(saved, source))) || [...roots].some((root) => !retained.roots.includes(root)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
       unresolved("retained review is missing current runtime discovery coverage");
     return retained;
   }
@@ -49836,7 +49984,7 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2"))) && source.path !== canonical6(configPath)))
+    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
       throw new Error("Semantic settings witnesses must name the configured Claude configuration source");
     if (!review.sources.some((source) => source.path === canonical6(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
@@ -51410,13 +51558,13 @@ var init_remote_recurring = __esm(() => {
 
 // src/lib/remote-invitations.ts
 function invitationFailure(value, status) {
-  if (!record4(value) || typeof value.code !== "string" || !Object.hasOwn(invitationFailures, value.code))
+  if (!record5(value) || typeof value.code !== "string" || !Object.hasOwn(invitationFailures, value.code))
     return null;
   const code = value.code;
   return invitationFailures[code][0] === status ? code : null;
 }
 function invitationInput(action, input2) {
-  if (!record4(input2))
+  if (!record5(input2))
     return inputFailure();
   const keys = {
     list: ["after"],
@@ -51467,7 +51615,7 @@ function invalid2() {
   throw new RemoteWorkspaceInvitationReadError;
 }
 function projection(v, organizationId) {
-  if (!record4(v) || !uuid5(v.id) || v.organizationId !== organizationId || !email3(v.email) || v.email !== v.email.trim().toLowerCase() || !role(v.role) || !Number.isInteger(v.generation) || Number(v.generation) < 1 || Number(v.generation) > 10 || typeof v.status !== "string" || !["pending", "expired", "accepted", "revoked"].includes(v.status) || !timestamp(v.expiresAt) || !timestamp(v.createdAt) || !record4(v.delivery) || typeof v.delivery.state !== "string" || !["queued", "sending", "uncertain", "provider_accepted", "failed", "cancelled"].includes(v.delivery.state) || !Number.isInteger(v.delivery.attempts) || Number(v.delivery.attempts) < 0 || Number(v.delivery.attempts) > 5)
+  if (!record5(v) || !uuid5(v.id) || v.organizationId !== organizationId || !email3(v.email) || v.email !== v.email.trim().toLowerCase() || !role(v.role) || !Number.isInteger(v.generation) || Number(v.generation) < 1 || Number(v.generation) > 10 || typeof v.status !== "string" || !["pending", "expired", "accepted", "revoked"].includes(v.status) || !timestamp(v.expiresAt) || !timestamp(v.createdAt) || !record5(v.delivery) || typeof v.delivery.state !== "string" || !["queued", "sending", "uncertain", "provider_accepted", "failed", "cancelled"].includes(v.delivery.state) || !Number.isInteger(v.delivery.attempts) || Number(v.delivery.attempts) < 0 || Number(v.delivery.attempts) > 5)
     return invalid2();
   return {
     id: v.id,
@@ -51482,7 +51630,7 @@ function projection(v, organizationId) {
   };
 }
 function parseInvitationResult(action, value, input2, organizationId) {
-  if (!record4(value))
+  if (!record5(value))
     return invalid2();
   const request = input2;
   if (action === "accept") {
@@ -51513,7 +51661,7 @@ function parseInvitationResult(action, value, input2, organizationId) {
     return invalid2();
   return { invitation, changed: value.changed };
 }
-var WorkspaceInvitationInputError, invitationFailures, RemoteWorkspaceInvitationError, RemoteWorkspaceInvitationUnconfirmedError, RemoteWorkspaceInvitationReadError, record4 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid5 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), role = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), email3 = (v) => typeof v === "string" && v.length <= 254 && !/[\p{Cc}\p{Cs}\u2028\u2029\s]/u.test(v) && /^[^@]+@[^@]+\.[^@]+$/.test(v), timestamp = (v) => typeof v === "string" && v.length <= 40 && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d{1,6})?(?:Z|[+-]\d\d:\d\d)$/.test(v) && Number.isFinite(Date.parse(v)), inputFailure = () => {
+var WorkspaceInvitationInputError, invitationFailures, RemoteWorkspaceInvitationError, RemoteWorkspaceInvitationUnconfirmedError, RemoteWorkspaceInvitationReadError, record5 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid5 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), role = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), email3 = (v) => typeof v === "string" && v.length <= 254 && !/[\p{Cc}\p{Cs}\u2028\u2029\s]/u.test(v) && /^[^@]+@[^@]+\.[^@]+$/.test(v), timestamp = (v) => typeof v === "string" && v.length <= 40 && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d{1,6})?(?:Z|[+-]\d\d:\d\d)$/.test(v) && Number.isFinite(Date.parse(v)), inputFailure = () => {
   throw new WorkspaceInvitationInputError;
 };
 var init_remote_invitations = __esm(() => {
@@ -51572,7 +51720,7 @@ function workspaceExpectedUserId(value) {
   return value;
 }
 function workspaceContext(value) {
-  if (!record5(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid8(value.userId) || !uuid8(value.membershipId))
+  if (!record6(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid8(value.userId) || !uuid8(value.membershipId))
     throw new WorkspaceContextInputError;
   return { userId: value.userId, membershipId: value.membershipId };
 }
@@ -51580,15 +51728,15 @@ function invalid3() {
   throw new Error(invalidWorkspaceResult);
 }
 function organization(v) {
-  if (!record5(v) || !uuid8(v.id) || !text2(v.slug) || !text2(v.name))
+  if (!record6(v) || !uuid8(v.id) || !text2(v.slug) || !text2(v.name))
     return invalid3();
   return { id: v.id, slug: v.slug, name: v.name };
 }
 function parseAccountWorkspaces(value) {
-  if (!record5(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
+  if (!record6(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
     return invalid3();
   const workspaces = value.workspaces.map((v) => {
-    if (!record5(v) || !uuid8(v.membershipId) || !role2(v.role) || typeof v.current !== "boolean")
+    if (!record6(v) || !uuid8(v.membershipId) || !role2(v.role) || typeof v.current !== "boolean")
       return invalid3();
     return { membershipId: v.membershipId, organization: organization(v.organization), role: v.role, current: v.current };
   });
@@ -51597,10 +51745,10 @@ function parseAccountWorkspaces(value) {
   return { workspaces };
 }
 function parseWorkspaceIdentity(value, expectedUserId) {
-  if (!record5(value))
+  if (!record6(value))
     return invalid3();
   const user = value.user;
-  if (!record5(user) || !uuid8(user.id) || !uuid8(user.membershipId) || !text2(user.email, 320) || !(user.displayName === null || text2(user.displayName)) || !role2(user.role))
+  if (!record6(user) || !uuid8(user.id) || !uuid8(user.membershipId) || !text2(user.email, 320) || !(user.displayName === null || text2(user.displayName)) || !role2(user.role))
     return invalid3();
   if (user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
@@ -51618,20 +51766,20 @@ function parseWorkspaceSession(value, expected) {
   return { token: sessionToken(value.token), ...identity3 };
 }
 function parseWorkspaceLogin(value, expectedUserId) {
-  const user = record5(value) && value.user;
-  if (!record5(value) || !record5(user) || !uuid8(user.id))
+  const user = record6(value) && value.user;
+  if (!record6(value) || !record6(user) || !uuid8(user.id))
     return invalid3();
   if (expectedUserId !== undefined && user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
   return { token: sessionToken(value.token), userId: user.id };
 }
 function workspaceSelectionFailure(value, status) {
-  if (!record5(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
+  if (!record6(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
     return null;
   const code = value.code;
   return workspaceSelectionFailures[code][0] === status ? code : null;
 }
-var record5 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid8 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), text2 = (v, max = 1024) => typeof v === "string" && !!v.trim() && v.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v), role2 = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), invalidWorkspaceResult = "The server returned an invalid workspace selection result.", WorkspaceContextInputError, WorkspaceIdentityMismatchError, workspaceSelectionFailures;
+var record6 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid8 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), text2 = (v, max = 1024) => typeof v === "string" && !!v.trim() && v.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v), role2 = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), invalidWorkspaceResult = "The server returned an invalid workspace selection result.", WorkspaceContextInputError, WorkspaceIdentityMismatchError, workspaceSelectionFailures;
 var init_remote_workspace_selection = __esm(() => {
   WorkspaceContextInputError = class WorkspaceContextInputError extends Error {
     constructor() {
@@ -51657,7 +51805,7 @@ var init_remote_workspace_selection = __esm(() => {
 
 // src/lib/remote-workspace.ts
 function workspaceMembersQuery(options = {}) {
-  if (!record6(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+  if (!record7(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
     throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
   const query = new URLSearchParams;
   if (options.limit !== undefined)
@@ -51673,7 +51821,7 @@ function timestamp2(value) {
   return Number.isFinite(time3) && new Date(time3).toISOString().slice(0, 23) === value.slice(0, 23);
 }
 function parseMember(row, fail) {
-  if (!record6(row) || !uuid10(row.membershipId) || !uuid10(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp2(row.createdAt))
+  if (!record7(row) || !uuid10(row.membershipId) || !uuid10(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp2(row.createdAt))
     return fail();
   return {
     membershipId: row.membershipId,
@@ -51685,7 +51833,7 @@ function parseMember(row, fail) {
   };
 }
 function mutationInput(membershipId, input2, roleChange) {
-  if (typeof membershipId !== "string" || !uuid10(membershipId) || membershipId !== membershipId.toLowerCase() || !record6(input2) || Object.keys(input2).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+  if (typeof membershipId !== "string" || !uuid10(membershipId) || membershipId !== membershipId.toLowerCase() || !record7(input2) || Object.keys(input2).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
     throw new WorkspaceMemberInputError;
   const expectedRole = input2.expectedRole, role3 = roleChange ? input2.role : undefined;
   if (!isRole(expectedRole) || roleChange && !isRole(role3))
@@ -51704,7 +51852,7 @@ function parseWorkspaceMemberRoleResult(value, membershipId, role3) {
   const fail = () => {
     throw new Error(invalidMemberResult);
   };
-  if (!record6(value) || !uuid10(value.organizationId) || typeof value.changed !== "boolean")
+  if (!record7(value) || !uuid10(value.organizationId) || typeof value.changed !== "boolean")
     return fail();
   const member = parseMember(value.member, fail);
   if (member.membershipId !== membershipId || member.role !== role3)
@@ -51712,12 +51860,12 @@ function parseWorkspaceMemberRoleResult(value, membershipId, role3) {
   return { organizationId: value.organizationId, member, changed: value.changed };
 }
 function parseWorkspaceMemberRemovalResult(value, membershipId) {
-  if (!record6(value) || !uuid10(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+  if (!record7(value) || !uuid10(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
     throw new Error(invalidMemberResult);
   return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
 }
 function workspaceMemberFailure(value, status) {
-  if (!record6(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+  if (!record7(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
     return null;
   const code = value.code;
   return workspaceMemberFailures[code][0] === status ? code : null;
@@ -51726,14 +51874,14 @@ function parseWorkspaceMembersPage(value) {
   const fail = () => {
     throw new Error("The server returned an invalid workspace roster.");
   };
-  if (!record6(value) || !uuid10(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+  if (!record7(value) || !uuid10(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
     return fail();
   const members2 = value.members.map((row) => parseMember(row, fail));
   if (new Set(members2.map((row) => row.membershipId)).size !== members2.length)
     return fail();
   return { organizationId: value.organizationId, members: members2, nextCursor: value.nextCursor };
 }
-var record6 = (value) => !!value && typeof value === "object" && !Array.isArray(value), cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value), uuid10 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value), isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value), WorkspaceMemberInputError, invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.", workspaceMemberFailures;
+var record7 = (value) => !!value && typeof value === "object" && !Array.isArray(value), cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value), uuid10 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value), isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value), WorkspaceMemberInputError, invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.", workspaceMemberFailures;
 var init_remote_workspace = __esm(() => {
   WorkspaceMemberInputError = class WorkspaceMemberInputError extends Error {
     constructor() {
@@ -51856,44 +52004,44 @@ var init_auth_store = __esm(() => {
 
 // src/lib/remote-run-contract.ts
 function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
-  const record7 = isRecord4(payload) ? payload : {};
+  const record8 = isRecord4(payload) ? payload : {};
   return {
     contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
-    ...pickString(record7, "id"),
-    skill: pickStringValue(record7, "skill") ?? fallbackSkill,
-    ...pickString(record7, "requestedSlug"),
-    ...pickString(record7, "status"),
-    ...pickNumber(record7, "exitCode"),
-    ...pickString(record7, "correlationId"),
-    ...pickString(record7, "createdAt"),
-    ...pickString(record7, "startedAt"),
-    ...pickString(record7, "completedAt"),
-    ...pickNumber(record7, "durationMs"),
-    ...pickString(record7, "outputType"),
-    ...hasOwn(record7, "outputPreview") ? { outputPreview: record7.outputPreview } : {},
-    ...pickString(record7, "errorCode"),
-    ...pickString(record7, "errorMessage"),
-    ...pickString(record7, "error"),
-    ...pickString(record7, "code"),
-    ...hasOwn(record7, "details") ? { details: record7.details } : {}
+    ...pickString(record8, "id"),
+    skill: pickStringValue(record8, "skill") ?? fallbackSkill,
+    ...pickString(record8, "requestedSlug"),
+    ...pickString(record8, "status"),
+    ...pickNumber(record8, "exitCode"),
+    ...pickString(record8, "correlationId"),
+    ...pickString(record8, "createdAt"),
+    ...pickString(record8, "startedAt"),
+    ...pickString(record8, "completedAt"),
+    ...pickNumber(record8, "durationMs"),
+    ...pickString(record8, "outputType"),
+    ...hasOwn(record8, "outputPreview") ? { outputPreview: record8.outputPreview } : {},
+    ...pickString(record8, "errorCode"),
+    ...pickString(record8, "errorMessage"),
+    ...pickString(record8, "error"),
+    ...pickString(record8, "code"),
+    ...hasOwn(record8, "details") ? { details: record8.details } : {}
   };
 }
 function isRecord4(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function hasOwn(record7, key) {
-  return Object.prototype.hasOwnProperty.call(record7, key);
+function hasOwn(record8, key) {
+  return Object.prototype.hasOwnProperty.call(record8, key);
 }
-function pickString(record7, key) {
-  const value = pickStringValue(record7, key);
+function pickString(record8, key) {
+  const value = pickStringValue(record8, key);
   return value === undefined ? {} : { [key]: value };
 }
-function pickStringValue(record7, key) {
-  const value = record7[key];
+function pickStringValue(record8, key) {
+  const value = record8[key];
   return typeof value === "string" ? value : undefined;
 }
-function pickNumber(record7, key) {
-  const value = record7[key];
+function pickNumber(record8, key) {
+  const value = record8[key];
   return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
 }
 var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
@@ -52116,7 +52264,7 @@ var init_remote_quote_errors = __esm(() => {
 function parseSkillsAccess(value) {
   if (value === undefined)
     return {};
-  if (!record7(value))
+  if (!record8(value))
     throw new Error("Invalid Skills permission contract");
   const result = {};
   if (value.scopes !== undefined) {
@@ -52125,7 +52273,7 @@ function parseSkillsAccess(value) {
     result.scopes = [...value.scopes];
   }
   if (value.permissions !== undefined) {
-    if (!record7(value.permissions))
+    if (!record8(value.permissions))
       throw new Error("Invalid Skills permission contract");
     result.permissions = {};
     for (const name of permissionNames) {
@@ -52143,7 +52291,7 @@ function assertSkillsPermission(access, permission) {
   if (access.permissions?.[permission] === false)
     throw new RemoteSkillsPermissionError(permission);
 }
-var permissionNames, record7 = (value) => value !== null && typeof value === "object" && !Array.isArray(value), RemoteSkillsPermissionError;
+var permissionNames, record8 = (value) => value !== null && typeof value === "object" && !Array.isArray(value), RemoteSkillsPermissionError;
 var init_remote_permissions = __esm(() => {
   permissionNames = [
     "read",
@@ -52958,13 +53106,13 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record8, field2) {
-  if (record8[field2] === undefined)
+function requireOptionalString(record9, field2) {
+  if (record9[field2] === undefined)
     return;
-  if (typeof record8[field2] !== "string") {
+  if (typeof record9[field2] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field2} must be a string when present)`);
   }
-  return record8[field2];
+  return record9[field2];
 }
 function isVersionRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -52986,19 +53134,19 @@ function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record8 = entry;
-  const slug2 = typeof record8.slug === "string" && record8.slug.trim() ? record8.slug.trim() : undefined;
+  const record9 = entry;
+  const slug2 = typeof record9.slug === "string" && record9.slug.trim() ? record9.slug.trim() : undefined;
   if (!slug2) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record8.metadata !== undefined) {
-    if (!record8.metadata || typeof record8.metadata !== "object" || Array.isArray(record8.metadata)) {
+  if (record9.metadata !== undefined) {
+    if (!record9.metadata || typeof record9.metadata !== "object" || Array.isArray(record9.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record8.metadata;
+    metadata = record9.metadata;
   }
-  const pinnedAt = requireOptionalString(record8, "pinnedAt");
+  const pinnedAt = requireOptionalString(record9, "pinnedAt");
   return {
     slug: slug2,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -53015,16 +53163,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record8 = entry;
-  const slug2 = typeof record8.slug === "string" && record8.slug.trim() ? record8.slug.trim() : undefined;
+  const record9 = entry;
+  const slug2 = typeof record9.slug === "string" && record9.slug.trim() ? record9.slug.trim() : undefined;
   if (!slug2) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug: slug2,
-    ...requireOptionalString(record8, "name") !== undefined ? { name: requireOptionalString(record8, "name") } : {},
-    ...requireOptionalString(record8, "version") !== undefined ? { version: requireOptionalString(record8, "version") } : {},
-    ...requireOptionalString(record8, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record8, "updatedAt") } : {}
+    ...requireOptionalString(record9, "name") !== undefined ? { name: requireOptionalString(record9, "name") } : {},
+    ...requireOptionalString(record9, "version") !== undefined ? { version: requireOptionalString(record9, "version") } : {},
+    ...requireOptionalString(record9, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record9, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -53081,12 +53229,12 @@ function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record8 = payload;
-  if (!Array.isArray(record8.skills)) {
+  const record9 = payload;
+  if (!Array.isArray(record9.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record8.skills.map(normalizeSkillSummary);
-  const nextCursor = record8.nextCursor === undefined || record8.nextCursor === null ? null : record8.nextCursor;
+  const skills = record9.skills.map(normalizeSkillSummary);
+  const nextCursor = record9.nextCursor === undefined || record9.nextCursor === null ? null : record9.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -53207,7 +53355,7 @@ function invitationEmailIds(invitationId, challengeId) {
 }
 function invitationEmailInput(action, input2) {
   const keys = ["invitationId", "token", "challengeId", "confirm", ...action === "accept" ? ["code"] : []];
-  if (!record8(input2) || Object.keys(input2).length !== keys.length || keys.some((key) => !Object.hasOwn(input2, key)))
+  if (!record9(input2) || Object.keys(input2).length !== keys.length || keys.some((key) => !Object.hasOwn(input2, key)))
     throw new InvitationEmailInputError;
   const value = { ...input2 };
   const ids = invitationEmailIds(value.invitationId, value.challengeId);
@@ -53236,12 +53384,12 @@ async function requestInvitationEmail(origin, action, input2) {
       signal: AbortSignal.timeout(15000)
     });
     const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 4096)));
-    if (!response.ok && record8(parsed) && typeof parsed.code === "string" && Object.hasOwn(refusals, parsed.code)) {
+    if (!response.ok && record9(parsed) && typeof parsed.code === "string" && Object.hasOwn(refusals, parsed.code)) {
       const code = parsed.code;
       if (response.status === refusals[code][0])
         throw new RemoteInvitationEmailError(code);
     }
-    if (!record8(parsed))
+    if (!record9(parsed))
       throw new RemoteInvitationEmailUnconfirmedError(action);
     if (action === "challenge" && response.status === 202 && parsed.challengeId === value.challengeId && parsed.expiresIn === 600 && typeof parsed.message === "string" && parsed.message.length <= 256) {
       return { challengeId: value.challengeId, message: "If this invitation is eligible, a verification code will arrive. Delivery is not confirmed.", expiresIn: 600 };
@@ -53260,7 +53408,7 @@ function invitationEmailCustomerError(error61) {
     return { code: error61.code, error: error61.message };
   return { code: "INVITATION_EMAIL_UNAVAILABLE", error: "Unable to prepare this recovery action. Check the explicit server and stable profile. No credential was saved." };
 }
-var InvitationEmailInputError, refusals, RemoteInvitationEmailError, RemoteInvitationEmailUnconfirmedError, record8 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid11 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
+var InvitationEmailInputError, refusals, RemoteInvitationEmailError, RemoteInvitationEmailUnconfirmedError, record9 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid11 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
 var init_remote_invitation_recovery = __esm(() => {
   init_fleet_credentials();
   init_remote_files();
@@ -53307,7 +53455,7 @@ function checkedPublicationDeclaration(value) {
     return bad();
   try {
     const manifest = JSON.parse(value.manifestText);
-    if (!record9(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash3(manifest.provenance?.content_hash))
+    if (!record10(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash3(manifest.provenance?.content_hash))
       return bad();
   } catch {
     return bad();
@@ -53365,7 +53513,7 @@ async function boundedJson(url2, init, token, mutation, budget2 = 15000, signal)
         return invalid4();
       }
       if (!response.ok) {
-        const code = record9(body) && typeof body.code === "string" && Object.hasOwn(failures2, body.code) ? body.code : null;
+        const code = record10(body) && typeof body.code === "string" && Object.hasOwn(failures2, body.code) ? body.code : null;
         if (code && failures2[code][0] === response.status)
           throw new PrivatePublicationError(code, failures2[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
         throw new PrivatePublicationError("PUBLICATION_REQUEST_FAILED", "The publication request was refused. Inspect its status before retrying.", mutation && response.status >= 500, response.status);
@@ -53420,8 +53568,8 @@ class RemotePrivatePublicationsClient {
     if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
       return bad();
     const response = await boundedJson(skillsApiRequestUrl(this.apiOrigin, "/api/v1/capabilities"), {}, this.#token, false, options.timeoutMs, options.signal);
-    const p = record9(response) && response.privatePublishing;
-    if (!record9(response) || response.contractVersion !== 1 || response.apiVersion !== 1 || !exact(p, ["contractVersion", "enabled", "authentication", "maxArchiveBytes", "uploadMaxTtlSeconds", "executionEnabled"]) || p.contractVersion !== 1 || typeof p.enabled !== "boolean" || p.authentication !== "interactive-session" || p.maxArchiveBytes !== PRIVATE_PUBLICATION_MAX_BYTES || p.uploadMaxTtlSeconds !== 300 || typeof p.executionEnabled !== "boolean")
+    const p = record10(response) && response.privatePublishing;
+    if (!record10(response) || response.contractVersion !== 1 || response.apiVersion !== 1 || !exact(p, ["contractVersion", "enabled", "authentication", "maxArchiveBytes", "uploadMaxTtlSeconds", "executionEnabled"]) || p.contractVersion !== 1 || typeof p.enabled !== "boolean" || p.authentication !== "interactive-session" || p.maxArchiveBytes !== PRIVATE_PUBLICATION_MAX_BYTES || p.uploadMaxTtlSeconds !== 300 || typeof p.executionEnabled !== "boolean")
       throw new PrivatePublicationError("PUBLICATION_CONTRACT_UNAVAILABLE", "This server does not support the hosted private publication contract.");
     return Object.freeze({ ...p });
   }
@@ -53437,7 +53585,7 @@ class RemotePrivatePublicationsClient {
   async#view(path, method, skillId, intentId, declaration, options = {}) {
     const value = await boundedJson(path, { method, ...method === "GET" ? {} : { body: JSON.stringify(declaration ?? {}) } }, this.#token, method !== "GET", options.timeoutMs, options.signal);
     try {
-      if (!record9(value) || !Object.keys(value).every((k) => k === "upload" || k === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
+      if (!record10(value) || !Object.keys(value).every((k) => k === "upload" || k === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
         return invalid4();
       return checkedPublicationView(value.upload, skillId, intentId, declaration);
     } catch (error61) {
@@ -53562,7 +53710,7 @@ var PRIVATE_PUBLICATION_MAX_BYTES, failures2, PrivatePublicationError, bad = ()
   throw new PrivatePublicationError("INVALID_PUBLICATION_INPUT", "Invalid publication input or recovery data.");
 }, invalid4 = () => {
   throw new PrivatePublicationError("INVALID_PUBLICATION_RESPONSE", "The server returned an invalid publication result.");
-}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash3 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record9 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys) => record9(v) && Object.keys(v).sort().join(",") === keys.sort().join(","), date6 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash18("sha256").update(bytes).digest("hex");
+}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash3 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record10 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys) => record10(v) && Object.keys(v).sort().join(",") === keys.sort().join(","), date6 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash18("sha256").update(bytes).digest("hex");
 var init_remote_private_publications = __esm(() => {
   init_fleet_credentials();
   init_remote_workspace_selection();
@@ -53626,10 +53774,10 @@ async function requestAuthApi(instance, path, options) {
   const text3 = await res.text();
   const body = text3 ? parseJsonBody(text3) : {};
   if (!res.ok) {
-    const record10 = isRecord6(body) ? body : {};
-    const detail = typeof record10.detail === "string" ? record10.detail : undefined;
-    const error61 = typeof record10.error === "string" ? record10.error : undefined;
-    const code = typeof record10.code === "string" ? record10.code : undefined;
+    const record11 = isRecord6(body) ? body : {};
+    const detail = typeof record11.detail === "string" ? record11.detail : undefined;
+    const error61 = typeof record11.error === "string" ? record11.error : undefined;
+    const code = typeof record11.code === "string" ? record11.code : undefined;
     throw new HostedApiError(detail || error61 || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -56327,7 +56475,7 @@ function createSkillRun(params, targetDir = process.cwd()) {
   mkdirSync11(logsDir, { recursive: true });
   mkdirSync11(exportDir, { recursive: true });
   mkdirSync11(join30(root, "tmp"), { recursive: true });
-  const record10 = {
+  const record11 = {
     id,
     skill: skillName,
     status: params.status ?? "running",
@@ -56345,10 +56493,10 @@ function createSkillRun(params, targetDir = process.cwd()) {
       logsDir: toProjectRelative(targetDir, logsDir)
     }
   };
-  const context2 = { targetDir, runDir, exportDir, logsDir, record: record10 };
+  const context2 = { targetDir, runDir, exportDir, logsDir, record: record11 };
   writeRunRecord(context2);
   writeArtifactsManifest(context2, []);
-  appendRunEvent(context2, "created", { status: record10.status });
+  appendRunEvent(context2, "created", { status: record11.status });
   return context2;
 }
 function completeSkillRun(context2, patch) {
@@ -56393,9 +56541,9 @@ function findSkillRun(runId, targetDir = process.cwd()) {
   if (!existsSync14(runsRoot))
     return null;
   for (const day of readdirSync10(runsRoot)) {
-    const record10 = readRunRecord(join30(runsRoot, day, runId));
-    if (record10)
-      return record10;
+    const record11 = readRunRecord(join30(runsRoot, day, runId));
+    if (record11)
+      return record11;
   }
   return null;
 }
@@ -58020,7 +58168,7 @@ function selectedSecretBindingsTemplate(scope, names, createClient = createSecre
 function refuse2(code2, message) {
   throw new SkillSelectionError(code2, message);
 }
-function record10(value) {
+function record11(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function exactKeys2(value, keys) {
@@ -58041,7 +58189,7 @@ function declaredSecretNames(value) {
   return value;
 }
 function validateSelectedSecretBindings(value, scope, names) {
-  if (!record10(value) || !exactKeys2(value, ["schema", "selection", "consumer", "secretsAuthority", "bindings"]) || value.schema !== "hasna.skills-secret-bindings.v1" || !record10(value.selection) || !exactKeys2(value.selection, ["authority", "workspaceId", "profileId", "profileRevision", "slug", "version", "bundleDigest"]) || !record10(value.consumer) || !exactKeys2(value.consumer, ["stationId", "workspaceDirectory"]) || !record10(value.bindings)) {
+  if (!record11(value) || !exactKeys2(value, ["schema", "selection", "consumer", "secretsAuthority", "bindings"]) || value.schema !== "hasna.skills-secret-bindings.v1" || !record11(value.selection) || !exactKeys2(value.selection, ["authority", "workspaceId", "profileId", "profileRevision", "slug", "version", "bundleDigest"]) || !record11(value.consumer) || !exactKeys2(value.consumer, ["stationId", "workspaceDirectory"]) || !record11(value.bindings)) {
     return refuse2("INVALID_SECRET_BINDINGS", "Secret bindings do not match the hasna.skills-secret-bindings.v1 contract.");
   }
   for (const [key, expected] of Object.entries({ authority: scope.selection.authority, workspaceId: scope.selection.workspaceId, profileId: scope.profileId, profileRevision: scope.selection.profileRevision, slug: scope.selection.slug, version: scope.selection.version, bundleDigest: scope.selection.bundleDigest })) {
@@ -58179,7 +58327,7 @@ var init_execution_grants = __esm(() => {
 });
 
 // src/lib/execution-grant-client.ts
-import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
 function id(value) {
   if (!grantIdentifier(value))
     throw new Error("Invalid execution grant profile or revision identifier.");
@@ -58222,7 +58370,7 @@ async function resolveExecutionGrant(input2) {
   if (!grantRecord(value) || Object.keys(value).length !== 3 || !grantIdentifier(value.policyRevision) || !grantIdentifier(value.grantId) || !grantRecord(value.bindings)) {
     throw new SkillSelectionError("INVALID_EXECUTION_GRANT", "The Skills API returned an invalid execution grant.");
   }
-  if (!isDeepStrictEqual3(value.bindings.selection, snapshot2.selection) || !isDeepStrictEqual3(value.bindings.consumer, snapshot2.consumer)) {
+  if (!isDeepStrictEqual4(value.bindings.selection, snapshot2.selection) || !isDeepStrictEqual4(value.bindings.consumer, snapshot2.consumer)) {
     throw new SkillSelectionError("EXECUTION_GRANT_SCOPE_MISMATCH", "The Skills API returned a grant for a different selection or consumer.");
   }
   return value;