@hasna/skills 0.10.26 → 0.10.28

package/dist/index.js

@@ -9101,8 +9101,8 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
-      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2")
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3")
         requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute2(source.path) && resolve2(source.path) === source.path && basename2(source.path) === "config.toml");
       if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute2(source.path) && resolve2(source.path) === source.path && basename2(source.path) === "settings.json");
@@ -9141,7 +9141,7 @@ function assertAgentPolicyCollections(policy) {
 import { createHash as createHash18 } from "crypto";
 import { lstatSync as lstatSync21, readFileSync as readFileSync17, readdirSync as readdirSync10, realpathSync as realpathSync7 } from "fs";
 import { basename as basename9, dirname as dirname17, isAbsolute as isAbsolute16, join as join27, resolve as resolve15, sep as sep6 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
 
 // node_modules/yaml/dist/index.js
 var composer = require_composer();
@@ -10914,7 +10914,7 @@ function replaceSkillSession(expected, replacement, plan, options = {}, beforeCo
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.26",
+  version: "0.10.28",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -12749,6 +12749,72 @@ import {
 import { homedir as homedir3 } from "os";
 import { basename as basename6, dirname as dirname12, join as join18 } from "path";
 
+// src/lib/codex-local-mcp-controls.ts
+function isCodexLocalStdioMcpServer(name, server) {
+  const identifier2 = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(value);
+  const refuse = () => {
+    throw new Error("Unsupported Codex local stdio MCP controls");
+  };
+  const object4 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v) && !(v instanceof Date));
+  const textField = (v, empty = false) => typeof v === "string" && (empty || Boolean(v.trim())) && Buffer.byteLength(v) <= 16384 && !/[\x00-\x1f\x7f]/.test(v);
+  const envName = (v) => typeof v === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(v);
+  const optional = (v, valid) => v === undefined || v === null || valid(v);
+  const stringList = (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => textField(item));
+  const approval = (v) => ["auto", "prompt", "writes", "approve"].includes(v);
+  const duration = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+  const positiveInteger = (v) => Number.isSafeInteger(v) && v > 0;
+  const fields = [
+    "command",
+    "args",
+    "cwd",
+    "env",
+    "env_vars",
+    "enabled",
+    "required",
+    "environment_id",
+    "startup_readiness",
+    "supports_parallel_tool_calls",
+    "tool_input_schema_max_bytes",
+    "startup_timeout_sec",
+    "startup_timeout_ms",
+    "tool_timeout_sec",
+    "default_tools_approval_mode",
+    "enabled_tools",
+    "disabled_tools",
+    "omit_tools_from",
+    "tools",
+    "name"
+  ];
+  try {
+    if (!identifier2(name) || !object4(server) || !Object.keys(server).every((key) => fields.includes(key)) || !textField(server.command) || !optional(server.args, (v) => Array.isArray(v) && v.length <= 256 && v.every((arg) => textField(arg, true))) || !optional(server.cwd, textField) || !optional(server.env, (v) => object4(v) && Object.keys(v).length <= 256 && Object.entries(v).every(([key, value]) => envName(key) && textField(value, true))) || !["enabled", "required", "supports_parallel_tool_calls"].every((key) => optional(server[key], (v) => typeof v === "boolean")) || !optional(server.environment_id, (v) => v === "local") || !optional(server.startup_readiness, (v) => ["connection", "catalog"].includes(v)) || !optional(server.tool_input_schema_max_bytes, positiveInteger) || !["startup_timeout_sec", "tool_timeout_sec"].every((key) => optional(server[key], duration)) || !optional(server.startup_timeout_ms, (v) => Number.isSafeInteger(v) && v >= 0) || !optional(server.default_tools_approval_mode, approval) || !["enabled_tools", "disabled_tools"].every((key) => optional(server[key], stringList)) || !optional(server.omit_tools_from, (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => ["code_mode", "deferred", "direct"].includes(item))) || !optional(server.name, textField))
+      refuse();
+    if (server.env_vars !== undefined && server.env_vars !== null) {
+      if (!Array.isArray(server.env_vars) || server.env_vars.length > 256)
+        refuse();
+      const names = server.env_vars.map((entry) => {
+        if (envName(entry))
+          return entry;
+        if (!object4(entry) || !Object.keys(entry).every((key) => ["name", "source"].includes(key)) || !envName(entry.name) || !optional(entry.source, (v) => v === "local"))
+          refuse();
+        return entry.name;
+      });
+      if (new Set(names).size !== names.length)
+        refuse();
+    }
+    if (server.tools !== undefined && server.tools !== null) {
+      if (!object4(server.tools) || Object.keys(server.tools).length > 256)
+        refuse();
+      for (const [tool, config] of Object.entries(server.tools)) {
+        if (!textField(tool) || !object4(config) || !Object.keys(config).every((key) => ["approval_mode", "output_token_limit"].includes(key)) || !optional(config.approval_mode, approval) || !optional(config.output_token_limit, positiveInteger))
+          refuse();
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/lib/claude-settings-witness.ts
 import { createHash as createHash8 } from "crypto";
 import { closeSync as closeSync6, constants as constants5, fstatSync as fstatSync6, lstatSync as lstatSync11, openSync as openSync6, readSync as readSync4 } from "fs";
@@ -13430,65 +13496,14 @@ function mcpControls(path, read2) {
     refuse2();
   }
   const object5 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v));
-  const textField = (v, empty = false) => typeof v === "string" && (empty || Boolean(v.trim())) && Buffer.byteLength(v) <= 16384 && !/[\x00-\x1f\x7f]/.test(v);
-  const envName = (v) => typeof v === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(v);
-  const optional = (v, valid) => v === undefined || v === null || valid(v);
-  const stringList = (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => textField(item));
-  const approval = (v) => ["auto", "prompt", "writes", "approve"].includes(v);
-  const duration = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
-  const positiveInteger = (v) => Number.isSafeInteger(v) && v > 0;
-  const fields = [
-    "command",
-    "args",
-    "cwd",
-    "env",
-    "env_vars",
-    "enabled",
-    "required",
-    "environment_id",
-    "startup_readiness",
-    "supports_parallel_tool_calls",
-    "tool_input_schema_max_bytes",
-    "startup_timeout_sec",
-    "startup_timeout_ms",
-    "tool_timeout_sec",
-    "default_tools_approval_mode",
-    "enabled_tools",
-    "disabled_tools",
-    "omit_tools_from",
-    "tools",
-    "name"
-  ];
   if (!object5(value) || Object.keys(value).length !== 1 || !object5(value.mcpServers))
     refuse2();
   const servers = Object.entries(value.mcpServers);
   if (!servers.length || servers.length > 256)
     refuse2();
-  for (const [name, server] of servers) {
-    if (!identifier2(name) || !object5(server) || !Object.keys(server).every((key) => fields.includes(key)) || !textField(server.command) || !optional(server.args, (v) => Array.isArray(v) && v.length <= 256 && v.every((arg) => textField(arg, true))) || !optional(server.cwd, textField) || !optional(server.env, (v) => object5(v) && Object.keys(v).length <= 256 && Object.entries(v).every(([key, value2]) => envName(key) && textField(value2, true))) || !["enabled", "required", "supports_parallel_tool_calls"].every((key) => optional(server[key], (v) => typeof v === "boolean")) || !optional(server.environment_id, (v) => v === "local") || !optional(server.startup_readiness, (v) => ["connection", "catalog"].includes(v)) || !optional(server.tool_input_schema_max_bytes, positiveInteger) || !["startup_timeout_sec", "tool_timeout_sec"].every((key) => optional(server[key], duration)) || !optional(server.startup_timeout_ms, (v) => Number.isSafeInteger(v) && v >= 0) || !optional(server.default_tools_approval_mode, approval) || !["enabled_tools", "disabled_tools"].every((key) => optional(server[key], stringList)) || !optional(server.omit_tools_from, (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => ["code_mode", "deferred", "direct"].includes(item))) || !optional(server.name, textField))
+  for (const [name, server] of servers)
+    if (!isCodexLocalStdioMcpServer(name, server))
       refuse2();
-    if (server.env_vars !== undefined && server.env_vars !== null) {
-      if (!Array.isArray(server.env_vars) || server.env_vars.length > 256)
-        refuse2();
-      const names = server.env_vars.map((entry) => {
-        if (envName(entry))
-          return entry;
-        if (!object5(entry) || !Object.keys(entry).every((key) => ["name", "source"].includes(key)) || !envName(entry.name) || !optional(entry.source, (v) => v === "local"))
-          refuse2();
-        return entry.name;
-      });
-      if (new Set(names).size !== names.length)
-        refuse2();
-    }
-    if (server.tools !== undefined && server.tools !== null) {
-      if (!object5(server.tools) || Object.keys(server.tools).length > 256)
-        refuse2();
-      for (const [tool, config] of Object.entries(server.tools)) {
-        if (!textField(tool) || !object5(config) || !Object.keys(config).every((key) => ["approval_mode", "output_token_limit"].includes(key)) || !optional(config.approval_mode, approval) || !optional(config.output_token_limit, positiveInteger))
-          refuse2();
-      }
-    }
-  }
   return sha2562;
 }
 function rootControls(root, read2) {
@@ -13858,6 +13873,69 @@ function captureCodexSettings(path, budget = { remaining: 256 * 1024 * 1024 }) {
   const text2 = readNativeSettingsWitnessFile(path, budget, "config.toml");
   return { path, hashMode: "codex-settings-v1", sha256: hashCodexSettingsReplacement(text2) };
 }
+// src/lib/codex-mcp-discovery-projection.ts
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+function record2(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
+}
+function localStdio(name, row) {
+  return name !== "codex_apps" && name !== "_codex_apps" && isCodexLocalStdioMcpServer(name, row);
+}
+function stripEmptyParent(config) {
+  if (record2(config.mcp_servers) && !Object.keys(config.mcp_servers).length)
+    delete config.mcp_servers;
+  return config;
+}
+function projectRegularCodexMcp(config, source) {
+  const unchanged2 = { config, numericSource: source };
+  if (!record2(config.mcp_servers))
+    return unchanged2;
+  const candidates = Object.entries(config.mcp_servers).filter(([name, row]) => localStdio(name, row)).map(([name]) => name);
+  if (!candidates.length)
+    return unchanged2;
+  const headers = [];
+  let attempts = 0;
+  for (const match of source.matchAll(/^[ \t]*\[{1,2}[^\r\n]*\]{1,2}[ \t]*(?:#[^\r\n]*)?(?:\r?\n|$)/gm)) {
+    if (++attempts > 256)
+      return unchanged2;
+    try {
+      Bun.TOML.parse(source.slice(0, match.index));
+    } catch {
+      continue;
+    }
+    let header;
+    try {
+      header = Bun.TOML.parse(match[0]);
+    } catch {
+      return unchanged2;
+    }
+    const path = [];
+    while (record2(header) && Object.keys(header).length === 1) {
+      const key = Object.keys(header)[0];
+      path.push(key);
+      header = header[key];
+    }
+    headers.push({ start: match.index, path });
+  }
+  const names = candidates.filter((name) => headers.filter((header) => header.path.length === 2 && header.path[0] === "mcp_servers" && header.path[1] === name).length === 1);
+  if (!names.length)
+    return unchanged2;
+  const selected = headers.map((header, index) => ({ ...header, end: headers[index + 1]?.start ?? source.length })).filter((header) => header.path[0] === "mcp_servers" && names.includes(header.path[1]));
+  let numericSource = source;
+  for (const range of selected.reverse())
+    numericSource = numericSource.slice(0, range.start) + numericSource.slice(range.end);
+  const expected = structuredClone(config);
+  for (const name of names)
+    delete expected.mcp_servers[name];
+  stripEmptyParent(expected);
+  try {
+    if (!isDeepStrictEqual2(stripEmptyParent(Bun.TOML.parse(numericSource)), expected))
+      return unchanged2;
+  } catch {
+    return unchanged2;
+  }
+  return { config: expected, numericSource };
+}
 
 // src/lib/codex-settings-witness.ts
 import { createHash as createHash10 } from "crypto";
@@ -13937,7 +14015,7 @@ function canonical4(value, depth = 0, budget = { remaining: 65536 }) {
   need4(isRecord3(value));
   return ["object", Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, child]) => [key, canonical4(child, depth + 1, budget)])];
 }
-function normalize3(config) {
+function normalize3(config, version = 2) {
   if (isRecord3(config.hooks)) {
     delete config.hooks.state;
     if (!Object.keys(config.hooks).length)
@@ -13955,11 +14033,11 @@ function normalize3(config) {
     if (!Object.keys(skills).length)
       delete config.skills;
   }
-  inference(config);
+  inference(config, version);
   if (isRecord3(config.profiles)) {
     for (const profile of Object.values(config.profiles))
       if (isRecord3(profile))
-        inference(profile);
+        inference(profile, version);
   }
 }
 function disablesOneSkill(entry) {
@@ -13971,18 +14049,25 @@ function disablesOneSkill(entry) {
   const selector = ["path", "name"].filter((key) => Object.hasOwn(entry, key));
   return selector.length === 1 && typeof entry[selector[0]] === "string" && entry[selector[0]].length > 0;
 }
-function inference(target) {
-  for (const key of INFERENCE)
+function inference(target, version) {
+  const keys = version === 3 ? [...INFERENCE, "service_tier", "plan_mode_reasoning_effort", "personality"] : INFERENCE;
+  for (const key of keys)
     if (Object.hasOwn(target, key)) {
       const value = target[key];
       if (key === "model")
         need4(typeof value === "string" && MODEL.test(value));
-      else
+      else if (key === "personality")
+        need4(typeof value === "string" && ["none", "friendly", "pragmatic"].includes(value));
+      else if (version === 3 && key !== "model_verbosity") {
+        need4(typeof value === "string" && value.length <= 128 && !/[\x00-\x1f\x7f]/.test(value));
+        if (key !== "service_tier")
+          need4(value.length > 0);
+      } else
         need4(typeof value === "string" && (key === "model_reasoning_effort" ? EFFORT2.has(value) : VERBOSITY2.has(value)));
       delete target[key];
     }
 }
-function settingsDigest2(text2) {
+function settingsDigest2(text2, version = 2) {
   let config;
   try {
     config = Bun.TOML.parse(text2);
@@ -13990,8 +14075,9 @@ function settingsDigest2(text2) {
     throw new Error("Invalid Codex settings witness");
   }
   need4(isRecord3(config));
-  normalize3(config);
-  return sha2(`hasna.skills.codex-settings.v2\x00${JSON.stringify([canonical4(config), numericTokens2(text2)])}`);
+  const projected = version === 3 ? projectRegularCodexMcp(config, text2) : { config, numericSource: text2 };
+  normalize3(projected.config, version);
+  return sha2(`hasna.skills.codex-settings.v${version}\x00${JSON.stringify([canonical4(projected.config), numericTokens2(projected.numericSource)])}`);
 }
 function hashCodexSettingsReplacementV2(text2, budget = { remaining: 256 * 1024 * 1024 }) {
   need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text2));
@@ -14015,10 +14101,29 @@ function upgradeCodexSettingsWitness(previous, reviewedSettingsPath) {
     throw new Error("Codex non-preference settings changed; explicit discovery review required");
   return { path: previous.path, hashMode: "codex-settings-v2", sha256: sha2562 };
 }
+function hashCodexSettingsReplacementV3(text2, budget = { remaining: 256 * 1024 * 1024 }) {
+  need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text2));
+  budget.remaining -= Buffer.byteLength(text2);
+  return settingsDigest2(text2, 3);
+}
+function captureCodexSettingsV3(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "codex-settings-v3", sha256: settingsDigest2(readNativeSettingsWitnessFile(path, budget, "config.toml"), 3) };
+}
+function upgradeCodexSettingsWitnessV3(previous, reviewedSettingsPath) {
+  need4(previous && Object.keys(previous).every((key) => ["path", "hashMode", "sha256"].includes(key)) && (previous.hashMode === undefined || ["bytes", "codex-settings-v1", "codex-settings-v2"].includes(previous.hashMode)) && /^[a-f0-9]{64}$/.test(previous.sha256));
+  const budget = { remaining: 2 * 1024 * 1024 };
+  const before = readNativeSettingsWitnessFile(reviewedSettingsPath, budget, "config.toml"), current = readNativeSettingsWitnessFile(previous.path, budget, "config.toml");
+  const original = previous.hashMode === "codex-settings-v2" ? settingsDigest2(before) : previous.hashMode === "codex-settings-v1" ? hashCodexSettingsReplacement(before) : sha2(before);
+  need4(original === previous.sha256);
+  const sha2562 = settingsDigest2(current, 3);
+  if (settingsDigest2(before, 3) !== sha2562)
+    throw new Error("Codex settings outside the reviewed V3 contract changed; explicit discovery review required");
+  return { path: previous.path, hashMode: "codex-settings-v3", sha256: sha2562 };
+}
 
 // src/lib/agent-integration.ts
 import { createHash as createHash12, randomUUID as randomUUID2 } from "crypto";
-import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
 import { existsSync as existsSync8, lstatSync as lstatSync15, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync12, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync6, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync8, closeSync as closeSync8, fsyncSync as fsyncSync2, fstatSync as fstatSync8, readSync as readSync6, constants as constants7, linkSync } from "fs";
 import { dirname as dirname11, join as join17, resolve as resolve10, relative as relative5, isAbsolute as isAbsolute11, sep as sep5 } from "path";
 import { homedir as homedir2 } from "os";
@@ -14147,7 +14252,7 @@ function isOwnedCliBridge(path, expectedPaths) {
 }
 
 // src/lib/agent-codex.ts
-import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 var CODEX_SKILL_CONFIG_SECTIONS = /^\[\[skills\.config\]\][^\n]*(?:\n(?!\s*\[)[^\n]*)*/gm;
 var codexPathConfigRefusal = () => new Error("Codex skill path controls require ordinary [[skills.config]] TOML tables or a native single-line inline array; preserve and review unsupported inline, dotted, or malformed definitions before running skills hook install");
 function splitTopLevel(value, delimiter) {
@@ -14278,7 +14383,7 @@ function normalizeCodexInlinePathConfig(text2) {
   const expectedWithoutConfig = structuredClone(before);
   delete expectedWithoutConfig.skills.config;
   try {
-    if (isDeepStrictEqual2(Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, "")), expectedWithoutConfig))
+    if (isDeepStrictEqual3(Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, "")), expectedWithoutConfig))
       return text2;
   } catch {}
   const matches = [];
@@ -14331,7 +14436,7 @@ function normalizeCodexInlinePathConfig(text2) {
     try {
       const after = Bun.TOML.parse(candidate);
       const expected = structuredClone(before);
-      if (isDeepStrictEqual2(after, expected))
+      if (isDeepStrictEqual3(after, expected))
         matches.push(candidate);
     } catch {}
   }
@@ -14347,11 +14452,11 @@ function assertCodexPathConfigEditable(text2) {
   delete expected.skills.config;
   try {
     const withoutSections = Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
-    if (isDeepStrictEqual2(withoutSections, expected))
+    if (isDeepStrictEqual3(withoutSections, expected))
       return;
     const normalized = normalizeCodexInlinePathConfig(text2);
     const withoutNormalizedSections = Bun.TOML.parse(normalized.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
-    if (isDeepStrictEqual2(withoutNormalizedSections, expected))
+    if (isDeepStrictEqual3(withoutNormalizedSections, expected))
       return;
   } catch {}
   throw codexPathConfigRefusal();
@@ -14389,7 +14494,7 @@ function disableCodexBundledSkills(text2) {
   const candidates = new Set;
   const consider = (candidate) => {
     try {
-      if (isDeepStrictEqual2(Bun.TOML.parse(candidate), expected))
+      if (isDeepStrictEqual3(Bun.TOML.parse(candidate), expected))
         candidates.add(candidate);
     } catch {}
   };
@@ -15200,6 +15305,8 @@ function atomicWrite2(path, content) {
   }
 }
 function planAgentSettingsWitnessUpgrade(options) {
+  if (options.targetCodexVersion !== undefined && (options.agent !== "codex" || ![2, 3].includes(options.targetCodexVersion)))
+    throw new Error("Invalid Codex witness target version");
   const home = resolve10(options.home ?? homedir2()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
   const snapshot = readManagedSkillPolicySnapshot(dataDir2);
   if (!snapshot || sha3(snapshot.text) !== options.expectedPolicySha256)
@@ -15221,21 +15328,21 @@ function planAgentSettingsWitnessUpgrade(options) {
     throw new Error("Settings witness upgrade requires a preserved settings preimage");
   const replaced = [previous];
   if (options.agent === "codex") {
-    if (previous.hashMode !== undefined && previous.hashMode !== "bytes" && previous.hashMode !== "codex-settings-v1")
-      throw new Error("Codex settings witness upgrade requires a preserved raw or codex-settings-v1 configuration witness");
+    if (previous.hashMode !== undefined && previous.hashMode !== "bytes" && previous.hashMode !== "codex-settings-v1" && !(options.targetCodexVersion === 3 && previous.hashMode === "codex-settings-v2"))
+      throw new Error("Codex settings witness upgrade requires an eligible preserved configuration witness");
     const preimage = readCodexSettingsPreimage(options.reviewedPreimage);
     for (const source of binding.sources) {
       if (source === previous || source.path !== configPath)
         continue;
       const fields = source.fields;
-      if (source.hashMode !== undefined || source.format !== "toml" || !Array.isArray(fields) || !isDeepStrictEqual3(fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]) || typeof source.sha256 !== "string")
+      if (source.hashMode !== undefined || source.format !== "toml" || !Array.isArray(fields) || !isDeepStrictEqual4(fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]) || typeof source.sha256 !== "string")
         throw new Error("Codex settings witness upgrade found an unrecognized configuration witness");
       if (projectNativeDiscoveryFields(preimage, "toml", fields, configPath) !== source.sha256)
         throw new Error("Reviewed preimage does not explain the Codex discovery projection witness");
       replaced.push(source);
     }
   }
-  const next = options.agent === "claude" ? upgradeClaudeSettingsWitness(previous, options.reviewedPreimage) : upgradeCodexSettingsWitness(previous, options.reviewedPreimage);
+  const next = options.agent === "claude" ? upgradeClaudeSettingsWitness(previous, options.reviewedPreimage) : options.targetCodexVersion === 3 ? upgradeCodexSettingsWitnessV3(previous, options.reviewedPreimage) : upgradeCodexSettingsWitness(previous, options.reviewedPreimage);
   const rebound = [];
   for (const source of binding.sources) {
     if (!replaced.includes(source)) {
@@ -15272,7 +15379,7 @@ function applyAgentIntegration(plan) {
     const upgrade = plan.settingsWitnessUpgrade;
     if (!plan.managedAgentChecks || !plan.observedPolicy?.before)
       throw new Error("Invalid settings witness upgrade plan");
-    const verified = planAgentSettingsWitnessUpgrade({ agent: upgrade.agent, reviewedPreimage: upgrade.reviewedPreimage, home: plan.managedAgentChecks.home, dataDir: plan.dataDir, expectedPolicySha256: sha3(plan.observedPolicy.before), expectedSettingsSha256: upgrade.currentSettingsSha256 });
+    const verified = planAgentSettingsWitnessUpgrade({ agent: upgrade.agent, ...upgrade.agent === "codex" ? { targetCodexVersion: upgrade.toHashMode === "codex-settings-v3" ? 3 : 2 } : {}, reviewedPreimage: upgrade.reviewedPreimage, home: plan.managedAgentChecks.home, dataDir: plan.dataDir, expectedPolicySha256: sha3(plan.observedPolicy.before), expectedSettingsSha256: upgrade.currentSettingsSha256 });
     if (JSON.stringify(verified.changes) !== JSON.stringify(plan.changes) || JSON.stringify(verified.settingsWitnessUpgrade) !== JSON.stringify(upgrade))
       throw new Error("Settings witness upgrade plan changed");
     provenDiscovery = verified.discoveryBefore[0];
@@ -18248,19 +18355,19 @@ function projectNativeDiscoveryFields(text2, format, fields2, path) {
   return digest(JSON.stringify(Object.fromEntries(fields2.map((field2) => [field2, object5[field2] ?? null]))));
 }
 function isSupersededCodexProjection(agent, configPath, source) {
-  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual4(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
+  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual5(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
 }
 function supersedesCodexProjection(sources, configPath) {
-  return sources.some((source) => source.path === configPath && source.hashMode === "codex-settings-v2");
+  return sources.some((source) => source.path === configPath && (source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"));
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
-  if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2") {
+  if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Codex settings witnesses require exact typed metadata");
-    const current = (source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
+    const current = (source.hashMode === "codex-settings-v3" ? captureCodexSettingsV3 : source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
     if (current !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
-    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current;
+    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v3" ? hashCodexSettingsReplacementV3 : source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current;
   }
   if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
@@ -18360,7 +18467,7 @@ function codexInstallationRoots(binding) {
   });
 }
 function assertMarketplaceBinding(binding, source) {
-  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename9(source.path) !== "config.toml"))
+  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename9(source.path) !== "config.toml"))
     throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
   if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename9(source.path) !== "settings.json"))
     throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
@@ -18510,10 +18617,10 @@ function resolveAgentDiscovery(options) {
     verifyAgentDiscovery(retained);
     if (!retained.sources.some((source) => source.path === canonical6(configPath) && source.format === undefined && source.fields === undefined))
       unresolved("retained review is missing the full agent configuration source");
-    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2"))) && source.path !== canonical6(configPath)))
+    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
       unresolved("retained settings witness names another configuration source");
     const covered = supersedesCodexProjection(retained.sources, canonical6(configPath)) ? sources.filter((source) => !isSupersededCodexProjection(agent, canonical6(configPath), source)) : sources;
-    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual4(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
+    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual5(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
       unresolved("retained review is missing current runtime discovery coverage");
     return retained;
   }
@@ -18527,7 +18634,7 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2"))) && source.path !== canonical6(configPath)))
+    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
       throw new Error("Semantic settings witnesses must name the configured Claude configuration source");
     if (!review.sources.some((source) => source.path === canonical6(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
@@ -19505,7 +19612,7 @@ function createSkillRun(params, targetDir = process.cwd()) {
   mkdirSync10(logsDir, { recursive: true });
   mkdirSync10(exportDir, { recursive: true });
   mkdirSync10(join31(root2, "tmp"), { recursive: true });
-  const record2 = {
+  const record3 = {
     id,
     skill: skillName,
     status: params.status ?? "running",
@@ -19523,10 +19630,10 @@ function createSkillRun(params, targetDir = process.cwd()) {
       logsDir: toProjectRelative(targetDir, logsDir)
     }
   };
-  const context = { targetDir, runDir, exportDir, logsDir, record: record2 };
+  const context = { targetDir, runDir, exportDir, logsDir, record: record3 };
   writeRunRecord(context);
   writeArtifactsManifest(context, []);
-  appendRunEvent(context, "created", { status: record2.status });
+  appendRunEvent(context, "created", { status: record3.status });
   return context;
 }
 function completeSkillRun(context, patch) {
@@ -19576,9 +19683,9 @@ function listSkillRuns(targetDir = process.cwd(), limit = 50) {
     if (!statSync11(dayDir).isDirectory())
       continue;
     for (const runId of readdirSync13(dayDir).sort().reverse()) {
-      const record2 = readRunRecord(join31(dayDir, runId));
-      if (record2)
-        records.push(record2);
+      const record3 = readRunRecord(join31(dayDir, runId));
+      if (record3)
+        records.push(record3);
       if (records.length >= limit)
         return records;
     }
@@ -19590,9 +19697,9 @@ function findSkillRun(runId, targetDir = process.cwd()) {
   if (!existsSync15(runsRoot))
     return null;
   for (const day of readdirSync13(runsRoot)) {
-    const record2 = readRunRecord(join31(runsRoot, day, runId));
-    if (record2)
-      return record2;
+    const record3 = readRunRecord(join31(runsRoot, day, runId));
+    if (record3)
+      return record3;
   }
   return null;
 }
@@ -19733,7 +19840,7 @@ __export(exports_external, {
   regexes: () => exports_regexes,
   regex: () => _regex,
   refine: () => refine,
-  record: () => record2,
+  record: () => record3,
   readonly: () => readonly,
   property: () => _property,
   properties: () => _properties,
@@ -35507,8 +35614,8 @@ function rewriteKeyNames(ctx) {
       bySchema.set(entry.schema, entry);
   }
   const rewrites = new Map;
-  for (const record2 of pendingRecords.get(ctx) ?? []) {
-    const seen = ctx.seen.get(record2);
+  for (const record3 of pendingRecords.get(ctx) ?? []) {
+    const seen = ctx.seen.get(record3);
     const names = (seen?.def ?? seen?.schema)?.propertyNames;
     if (!names || names === true || rewrites.has(names))
       continue;
@@ -35835,7 +35942,7 @@ __export(exports_schemas2, {
   strictObject: () => strictObject,
   set: () => set,
   refine: () => refine,
-  record: () => record2,
+  record: () => record3,
   readonly: () => readonly,
   promise: () => promise,
   preprocess: () => preprocess,
@@ -37005,7 +37112,7 @@ var ZodRecord = /* @__PURE__ */ $constructor("ZodRecord", (inst, def) => {
   inst.keyType = def.keyType;
   inst.valueType = def.valueType;
 });
-function record2(keyType, valueType, params) {
+function record3(keyType, valueType, params) {
   if (!valueType || !valueType._zod) {
     return new ZodRecord({
       type: "record",
@@ -37471,7 +37578,7 @@ var stringbool = (...args) => _stringbool({
 }, ...args);
 function json(params) {
   const jsonSchema = lazy(() => {
-    return union([string2(params), number2(), boolean2(), _null3(), array2(jsonSchema), record2(string2(), jsonSchema)]);
+    return union([string2(params), number2(), boolean2(), _null3(), array2(jsonSchema), record3(string2(), jsonSchema)]);
   });
   return jsonSchema;
 }
@@ -39459,12 +39566,12 @@ class RemoteWorkspaceInvitationReadError extends Error {
   }
 }
 function invitationFailure(value, status) {
-  if (!record3(value) || typeof value.code !== "string" || !Object.hasOwn(invitationFailures, value.code))
+  if (!record4(value) || typeof value.code !== "string" || !Object.hasOwn(invitationFailures, value.code))
     return null;
   const code = value.code;
   return invitationFailures[code][0] === status ? code : null;
 }
-var record3 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var record4 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var uuid5 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
 var role = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v);
 var email3 = (v) => typeof v === "string" && v.length <= 254 && !/[\p{Cc}\p{Cs}\u2028\u2029\s]/u.test(v) && /^[^@]+@[^@]+\.[^@]+$/.test(v);
@@ -39473,7 +39580,7 @@ var inputFailure = () => {
   throw new WorkspaceInvitationInputError;
 };
 function invitationInput(action, input2) {
-  if (!record3(input2))
+  if (!record4(input2))
     return inputFailure();
   const keys = {
     list: ["after"],
@@ -39524,7 +39631,7 @@ function invalid2() {
   throw new RemoteWorkspaceInvitationReadError;
 }
 function projection(v, organizationId) {
-  if (!record3(v) || !uuid5(v.id) || v.organizationId !== organizationId || !email3(v.email) || v.email !== v.email.trim().toLowerCase() || !role(v.role) || !Number.isInteger(v.generation) || Number(v.generation) < 1 || Number(v.generation) > 10 || typeof v.status !== "string" || !["pending", "expired", "accepted", "revoked"].includes(v.status) || !timestamp(v.expiresAt) || !timestamp(v.createdAt) || !record3(v.delivery) || typeof v.delivery.state !== "string" || !["queued", "sending", "uncertain", "provider_accepted", "failed", "cancelled"].includes(v.delivery.state) || !Number.isInteger(v.delivery.attempts) || Number(v.delivery.attempts) < 0 || Number(v.delivery.attempts) > 5)
+  if (!record4(v) || !uuid5(v.id) || v.organizationId !== organizationId || !email3(v.email) || v.email !== v.email.trim().toLowerCase() || !role(v.role) || !Number.isInteger(v.generation) || Number(v.generation) < 1 || Number(v.generation) > 10 || typeof v.status !== "string" || !["pending", "expired", "accepted", "revoked"].includes(v.status) || !timestamp(v.expiresAt) || !timestamp(v.createdAt) || !record4(v.delivery) || typeof v.delivery.state !== "string" || !["queued", "sending", "uncertain", "provider_accepted", "failed", "cancelled"].includes(v.delivery.state) || !Number.isInteger(v.delivery.attempts) || Number(v.delivery.attempts) < 0 || Number(v.delivery.attempts) > 5)
     return invalid2();
   return {
     id: v.id,
@@ -39539,7 +39646,7 @@ function projection(v, organizationId) {
   };
 }
 function parseInvitationResult(action, value, input2, organizationId) {
-  if (!record3(value))
+  if (!record4(value))
     return invalid2();
   const request = input2;
   if (action === "accept") {
@@ -39572,7 +39679,7 @@ function parseInvitationResult(action, value, input2, organizationId) {
 }
 
 // src/lib/remote-workspace-selection.ts
-var record4 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var record5 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var uuid8 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
 var text2 = (v, max = 1024) => typeof v === "string" && !!v.trim() && v.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v);
 var role2 = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v);
@@ -39597,7 +39704,7 @@ function workspaceExpectedUserId(value) {
   return value;
 }
 function workspaceContext(value) {
-  if (!record4(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid8(value.userId) || !uuid8(value.membershipId))
+  if (!record5(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid8(value.userId) || !uuid8(value.membershipId))
     throw new WorkspaceContextInputError;
   return { userId: value.userId, membershipId: value.membershipId };
 }
@@ -39605,15 +39712,15 @@ function invalid3() {
   throw new Error(invalidWorkspaceResult);
 }
 function organization(v) {
-  if (!record4(v) || !uuid8(v.id) || !text2(v.slug) || !text2(v.name))
+  if (!record5(v) || !uuid8(v.id) || !text2(v.slug) || !text2(v.name))
     return invalid3();
   return { id: v.id, slug: v.slug, name: v.name };
 }
 function parseAccountWorkspaces(value) {
-  if (!record4(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
+  if (!record5(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
     return invalid3();
   const workspaces = value.workspaces.map((v) => {
-    if (!record4(v) || !uuid8(v.membershipId) || !role2(v.role) || typeof v.current !== "boolean")
+    if (!record5(v) || !uuid8(v.membershipId) || !role2(v.role) || typeof v.current !== "boolean")
       return invalid3();
     return { membershipId: v.membershipId, organization: organization(v.organization), role: v.role, current: v.current };
   });
@@ -39622,10 +39729,10 @@ function parseAccountWorkspaces(value) {
   return { workspaces };
 }
 function parseWorkspaceIdentity(value, expectedUserId) {
-  if (!record4(value))
+  if (!record5(value))
     return invalid3();
   const user = value.user;
-  if (!record4(user) || !uuid8(user.id) || !uuid8(user.membershipId) || !text2(user.email, 320) || !(user.displayName === null || text2(user.displayName)) || !role2(user.role))
+  if (!record5(user) || !uuid8(user.id) || !uuid8(user.membershipId) || !text2(user.email, 320) || !(user.displayName === null || text2(user.displayName)) || !role2(user.role))
     return invalid3();
   if (user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
@@ -39643,8 +39750,8 @@ function parseWorkspaceSession(value, expected) {
   return { token: sessionToken(value.token), ...identity4 };
 }
 function parseWorkspaceLogin(value, expectedUserId) {
-  const user = record4(value) && value.user;
-  if (!record4(value) || !record4(user) || !uuid8(user.id))
+  const user = record5(value) && value.user;
+  if (!record5(value) || !record5(user) || !uuid8(user.id))
     return invalid3();
   if (expectedUserId !== undefined && user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
@@ -39659,18 +39766,18 @@ var workspaceSelectionFailures = {
   WORKSPACE_BUSY: [503, "Workspace is busy. Refresh before retrying."]
 };
 function workspaceSelectionFailure(value, status) {
-  if (!record4(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
+  if (!record5(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
     return null;
   const code = value.code;
   return workspaceSelectionFailures[code][0] === status ? code : null;
 }
 
 // src/lib/remote-workspace.ts
-var record5 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+var record6 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
 var cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value);
 var uuid10 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value);
 function workspaceMembersQuery(options = {}) {
-  if (!record5(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+  if (!record6(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
     throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
   const query = new URLSearchParams;
   if (options.limit !== undefined)
@@ -39686,7 +39793,7 @@ function timestamp2(value) {
   return Number.isFinite(time3) && new Date(time3).toISOString().slice(0, 23) === value.slice(0, 23);
 }
 function parseMember(row, fail) {
-  if (!record5(row) || !uuid10(row.membershipId) || !uuid10(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp2(row.createdAt))
+  if (!record6(row) || !uuid10(row.membershipId) || !uuid10(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp2(row.createdAt))
     return fail();
   return {
     membershipId: row.membershipId,
@@ -39706,7 +39813,7 @@ class WorkspaceMemberInputError extends Error {
   }
 }
 function mutationInput(membershipId, input2, roleChange) {
-  if (typeof membershipId !== "string" || !uuid10(membershipId) || membershipId !== membershipId.toLowerCase() || !record5(input2) || Object.keys(input2).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+  if (typeof membershipId !== "string" || !uuid10(membershipId) || membershipId !== membershipId.toLowerCase() || !record6(input2) || Object.keys(input2).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
     throw new WorkspaceMemberInputError;
   const expectedRole = input2.expectedRole, role3 = roleChange ? input2.role : undefined;
   if (!isRole(expectedRole) || roleChange && !isRole(role3))
@@ -39726,7 +39833,7 @@ function parseWorkspaceMemberRoleResult(value, membershipId, role3) {
   const fail = () => {
     throw new Error(invalidMemberResult);
   };
-  if (!record5(value) || !uuid10(value.organizationId) || typeof value.changed !== "boolean")
+  if (!record6(value) || !uuid10(value.organizationId) || typeof value.changed !== "boolean")
     return fail();
   const member = parseMember(value.member, fail);
   if (member.membershipId !== membershipId || member.role !== role3)
@@ -39734,7 +39841,7 @@ function parseWorkspaceMemberRoleResult(value, membershipId, role3) {
   return { organizationId: value.organizationId, member, changed: value.changed };
 }
 function parseWorkspaceMemberRemovalResult(value, membershipId) {
-  if (!record5(value) || !uuid10(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+  if (!record6(value) || !uuid10(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
     throw new Error(invalidMemberResult);
   return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
 }
@@ -39751,7 +39858,7 @@ var workspaceMemberFailures = {
   MEMBERSHIP_BUSY: [503, "Membership is busy. Refresh the roster before another action."]
 };
 function workspaceMemberFailure(value, status) {
-  if (!record5(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+  if (!record6(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
     return null;
   const code = value.code;
   return workspaceMemberFailures[code][0] === status ? code : null;
@@ -39760,7 +39867,7 @@ function parseWorkspaceMembersPage(value) {
   const fail = () => {
     throw new Error("The server returned an invalid workspace roster.");
   };
-  if (!record5(value) || !uuid10(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+  if (!record6(value) || !uuid10(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
     return fail();
   const members2 = value.members.map((row) => parseMember(row, fail));
   if (new Set(members2.map((row) => row.membershipId)).size !== members2.length)
@@ -39836,44 +39943,44 @@ function getApiUrl(action, env = process.env, options = {}) {
 // src/lib/remote-run-contract.ts
 var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
 function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
-  const record6 = isRecord4(payload) ? payload : {};
+  const record7 = isRecord4(payload) ? payload : {};
   return {
     contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
-    ...pickString(record6, "id"),
-    skill: pickStringValue(record6, "skill") ?? fallbackSkill,
-    ...pickString(record6, "requestedSlug"),
-    ...pickString(record6, "status"),
-    ...pickNumber(record6, "exitCode"),
-    ...pickString(record6, "correlationId"),
-    ...pickString(record6, "createdAt"),
-    ...pickString(record6, "startedAt"),
-    ...pickString(record6, "completedAt"),
-    ...pickNumber(record6, "durationMs"),
-    ...pickString(record6, "outputType"),
-    ...hasOwn(record6, "outputPreview") ? { outputPreview: record6.outputPreview } : {},
-    ...pickString(record6, "errorCode"),
-    ...pickString(record6, "errorMessage"),
-    ...pickString(record6, "error"),
-    ...pickString(record6, "code"),
-    ...hasOwn(record6, "details") ? { details: record6.details } : {}
+    ...pickString(record7, "id"),
+    skill: pickStringValue(record7, "skill") ?? fallbackSkill,
+    ...pickString(record7, "requestedSlug"),
+    ...pickString(record7, "status"),
+    ...pickNumber(record7, "exitCode"),
+    ...pickString(record7, "correlationId"),
+    ...pickString(record7, "createdAt"),
+    ...pickString(record7, "startedAt"),
+    ...pickString(record7, "completedAt"),
+    ...pickNumber(record7, "durationMs"),
+    ...pickString(record7, "outputType"),
+    ...hasOwn(record7, "outputPreview") ? { outputPreview: record7.outputPreview } : {},
+    ...pickString(record7, "errorCode"),
+    ...pickString(record7, "errorMessage"),
+    ...pickString(record7, "error"),
+    ...pickString(record7, "code"),
+    ...hasOwn(record7, "details") ? { details: record7.details } : {}
   };
 }
 function isRecord4(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function hasOwn(record6, key) {
-  return Object.prototype.hasOwnProperty.call(record6, key);
+function hasOwn(record7, key) {
+  return Object.prototype.hasOwnProperty.call(record7, key);
 }
-function pickString(record6, key) {
-  const value = pickStringValue(record6, key);
+function pickString(record7, key) {
+  const value = pickStringValue(record7, key);
   return value === undefined ? {} : { [key]: value };
 }
-function pickStringValue(record6, key) {
-  const value = record6[key];
+function pickStringValue(record7, key) {
+  const value = record7[key];
   return typeof value === "string" ? value : undefined;
 }
-function pickNumber(record6, key) {
-  const value = record6[key];
+function pickNumber(record7, key) {
+  const value = record7[key];
   return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
 }
 
@@ -40093,11 +40200,11 @@ var permissionNames = [
   "executionGrantsWrite",
   "executionGrantsResolve"
 ];
-var record6 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var record7 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 function parseSkillsAccess(value) {
   if (value === undefined)
     return {};
-  if (!record6(value))
+  if (!record7(value))
     throw new Error("Invalid Skills permission contract");
   const result = {};
   if (value.scopes !== undefined) {
@@ -40106,7 +40213,7 @@ function parseSkillsAccess(value) {
     result.scopes = [...value.scopes];
   }
   if (value.permissions !== undefined) {
-    if (!record6(value.permissions))
+    if (!record7(value.permissions))
       throw new Error("Invalid Skills permission contract");
     result.permissions = {};
     for (const name of permissionNames) {
@@ -41003,13 +41110,13 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record7, field2) {
-  if (record7[field2] === undefined)
+function requireOptionalString(record8, field2) {
+  if (record8[field2] === undefined)
     return;
-  if (typeof record7[field2] !== "string") {
+  if (typeof record8[field2] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field2} must be a string when present)`);
   }
-  return record7[field2];
+  return record8[field2];
 }
 var INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 function isVersionRecord(value) {
@@ -41032,19 +41139,19 @@ function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record7 = entry;
-  const slug2 = typeof record7.slug === "string" && record7.slug.trim() ? record7.slug.trim() : undefined;
+  const record8 = entry;
+  const slug2 = typeof record8.slug === "string" && record8.slug.trim() ? record8.slug.trim() : undefined;
   if (!slug2) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record7.metadata !== undefined) {
-    if (!record7.metadata || typeof record7.metadata !== "object" || Array.isArray(record7.metadata)) {
+  if (record8.metadata !== undefined) {
+    if (!record8.metadata || typeof record8.metadata !== "object" || Array.isArray(record8.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record7.metadata;
+    metadata = record8.metadata;
   }
-  const pinnedAt = requireOptionalString(record7, "pinnedAt");
+  const pinnedAt = requireOptionalString(record8, "pinnedAt");
   return {
     slug: slug2,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -41061,16 +41168,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record7 = entry;
-  const slug2 = typeof record7.slug === "string" && record7.slug.trim() ? record7.slug.trim() : undefined;
+  const record8 = entry;
+  const slug2 = typeof record8.slug === "string" && record8.slug.trim() ? record8.slug.trim() : undefined;
   if (!slug2) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug: slug2,
-    ...requireOptionalString(record7, "name") !== undefined ? { name: requireOptionalString(record7, "name") } : {},
-    ...requireOptionalString(record7, "version") !== undefined ? { version: requireOptionalString(record7, "version") } : {},
-    ...requireOptionalString(record7, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record7, "updatedAt") } : {}
+    ...requireOptionalString(record8, "name") !== undefined ? { name: requireOptionalString(record8, "name") } : {},
+    ...requireOptionalString(record8, "version") !== undefined ? { version: requireOptionalString(record8, "version") } : {},
+    ...requireOptionalString(record8, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record8, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -41127,12 +41234,12 @@ function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record7 = payload;
-  if (!Array.isArray(record7.skills)) {
+  const record8 = payload;
+  if (!Array.isArray(record8.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record7.skills.map(normalizeSkillSummary);
-  const nextCursor = record7.nextCursor === undefined || record7.nextCursor === null ? null : record7.nextCursor;
+  const skills = record8.skills.map(normalizeSkillSummary);
+  const nextCursor = record8.nextCursor === undefined || record8.nextCursor === null ? null : record8.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -41371,8 +41478,8 @@ function revisionIdOf(content) {
   const canonical6 = JSON.stringify(canonicalContent);
   return createHash21("sha256").update(canonical6).digest("hex");
 }
-function revisionIdOfRecord(record7) {
-  return revisionIdOf(record7);
+function revisionIdOfRecord(record8) {
+  return revisionIdOf(record8);
 }
 // src/lib/pull.ts
 import { existsSync as existsSync17, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync3, readFileSync as readFileSync21, renameSync as renameSync6, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "fs";
@@ -41748,16 +41855,16 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
   }
   return { path: target, created };
 }
-function writePullMarker(dir, record7) {
+function writePullMarker(dir, record8) {
   const marker = {
     managedBy: "@hasna/skills",
-    skill: record7.skill,
-    source: record7.source ?? "pull",
-    ...record7.version ? { version: record7.version } : {},
-    ...record7.contentHash ? { contentHash: record7.contentHash } : {},
-    ...record7.sourceCommit ? { sourceCommit: record7.sourceCommit } : {},
-    ...record7.signature ? { signature: record7.signature } : {},
-    ...record7.revisionId ? { revisionId: record7.revisionId } : {},
+    skill: record8.skill,
+    source: record8.source ?? "pull",
+    ...record8.version ? { version: record8.version } : {},
+    ...record8.contentHash ? { contentHash: record8.contentHash } : {},
+    ...record8.sourceCommit ? { sourceCommit: record8.sourceCommit } : {},
+    ...record8.signature ? { signature: record8.signature } : {},
+    ...record8.revisionId ? { revisionId: record8.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
   writeFileSync11(join33(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
@@ -41772,19 +41879,19 @@ async function safeMeta(client2, slug2) {
   }
   if (!raw || typeof raw !== "object")
     return null;
-  const record7 = raw;
-  const kind = record7.kind === "instruction" || record7.kind === "executable" ? record7.kind : undefined;
-  const tags = Array.isArray(record7.tags) ? record7.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
+  const record8 = raw;
+  const kind = record8.kind === "instruction" || record8.kind === "executable" ? record8.kind : undefined;
+  const tags = Array.isArray(record8.tags) ? record8.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
   return {
-    ...str(record7.displayName) ? { displayName: str(record7.displayName) } : {},
-    ...str(record7.description) ? { description: str(record7.description) } : {},
-    ...str(record7.category) ? { category: str(record7.category) } : {},
+    ...str(record8.displayName) ? { displayName: str(record8.displayName) } : {},
+    ...str(record8.description) ? { description: str(record8.description) } : {},
+    ...str(record8.category) ? { category: str(record8.category) } : {},
     ...tags && tags.length ? { tags } : {},
-    ...str(record7.version) ? { version: str(record7.version) } : {},
+    ...str(record8.version) ? { version: str(record8.version) } : {},
     ...kind ? { kind } : {},
-    ...REVISION_ID_PATTERN.test(str(record7.revisionId) ?? "") ? { revisionId: str(record7.revisionId) } : {},
-    ...typeof record7.skillMd === "string" && record7.skillMd.length > 0 ? { skillMd: record7.skillMd } : {},
-    ...str(record7.publishedSource) ? { publishedSource: str(record7.publishedSource) } : {}
+    ...REVISION_ID_PATTERN.test(str(record8.revisionId) ?? "") ? { revisionId: str(record8.revisionId) } : {},
+    ...typeof record8.skillMd === "string" && record8.skillMd.length > 0 ? { skillMd: record8.skillMd } : {},
+    ...str(record8.publishedSource) ? { publishedSource: str(record8.publishedSource) } : {}
   };
 }
 function pickCorpusOptions(options) {
@@ -41793,8 +41900,8 @@ function pickCorpusOptions(options) {
 function extractSlug(entry) {
   if (!entry || typeof entry !== "object")
     return;
-  const record7 = entry;
-  return str(record7.slug) ?? str(record7.name);
+  const record8 = entry;
+  return str(record8.slug) ?? str(record8.name);
 }
 function dedupe(values) {
   return [...new Set(values)];
@@ -41851,7 +41958,7 @@ class RemoteInvitationEmailUnconfirmedError extends Error {
     this.name = "RemoteInvitationEmailUnconfirmedError";
   }
 }
-var record7 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var record8 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var uuid11 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
 function invitationEmailIds(invitationId, challengeId) {
   if (!uuid11(invitationId) || !uuid11(challengeId))
@@ -41860,7 +41967,7 @@ function invitationEmailIds(invitationId, challengeId) {
 }
 function invitationEmailInput(action, input2) {
   const keys = ["invitationId", "token", "challengeId", "confirm", ...action === "accept" ? ["code"] : []];
-  if (!record7(input2) || Object.keys(input2).length !== keys.length || keys.some((key) => !Object.hasOwn(input2, key)))
+  if (!record8(input2) || Object.keys(input2).length !== keys.length || keys.some((key) => !Object.hasOwn(input2, key)))
     throw new InvitationEmailInputError;
   const value = { ...input2 };
   const ids = invitationEmailIds(value.invitationId, value.challengeId);
@@ -41889,12 +41996,12 @@ async function requestInvitationEmail(origin, action, input2) {
       signal: AbortSignal.timeout(15000)
     });
     const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 4096)));
-    if (!response.ok && record7(parsed) && typeof parsed.code === "string" && Object.hasOwn(refusals, parsed.code)) {
+    if (!response.ok && record8(parsed) && typeof parsed.code === "string" && Object.hasOwn(refusals, parsed.code)) {
       const code = parsed.code;
       if (response.status === refusals[code][0])
         throw new RemoteInvitationEmailError(code);
     }
-    if (!record7(parsed))
+    if (!record8(parsed))
       throw new RemoteInvitationEmailUnconfirmedError(action);
     if (action === "challenge" && response.status === 202 && parsed.challengeId === value.challengeId && parsed.expiresIn === 600 && typeof parsed.message === "string" && parsed.message.length <= 256) {
       return { challengeId: value.challengeId, message: "If this invitation is eligible, a verification code will arrive. Delivery is not confirmed.", expiresIn: 600 };
@@ -41954,8 +42061,8 @@ var invalid4 = () => {
 };
 var publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
 var hash3 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v);
-var record8 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-var exact = (v, keys) => record8(v) && Object.keys(v).sort().join(",") === keys.sort().join(",");
+var record9 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var exact = (v, keys) => record9(v) && Object.keys(v).sort().join(",") === keys.sort().join(",");
 var date5 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v));
 var publicationSha256 = (bytes) => createHash22("sha256").update(bytes).digest("hex");
 function checkedPublicationDeclaration(value) {
@@ -41963,7 +42070,7 @@ function checkedPublicationDeclaration(value) {
     return bad();
   try {
     const manifest = JSON.parse(value.manifestText);
-    if (!record8(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash3(manifest.provenance?.content_hash))
+    if (!record9(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash3(manifest.provenance?.content_hash))
       return bad();
   } catch {
     return bad();
@@ -42021,7 +42128,7 @@ async function boundedJson(url2, init, token, mutation, budget2 = 15000, signal)
         return invalid4();
       }
       if (!response.ok) {
-        const code = record8(body) && typeof body.code === "string" && Object.hasOwn(failures2, body.code) ? body.code : null;
+        const code = record9(body) && typeof body.code === "string" && Object.hasOwn(failures2, body.code) ? body.code : null;
         if (code && failures2[code][0] === response.status)
           throw new PrivatePublicationError(code, failures2[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
         throw new PrivatePublicationError("PUBLICATION_REQUEST_FAILED", "The publication request was refused. Inspect its status before retrying.", mutation && response.status >= 500, response.status);
@@ -42076,8 +42183,8 @@ class RemotePrivatePublicationsClient {
     if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
       return bad();
     const response = await boundedJson(skillsApiRequestUrl(this.apiOrigin, "/api/v1/capabilities"), {}, this.#token, false, options.timeoutMs, options.signal);
-    const p = record8(response) && response.privatePublishing;
-    if (!record8(response) || response.contractVersion !== 1 || response.apiVersion !== 1 || !exact(p, ["contractVersion", "enabled", "authentication", "maxArchiveBytes", "uploadMaxTtlSeconds", "executionEnabled"]) || p.contractVersion !== 1 || typeof p.enabled !== "boolean" || p.authentication !== "interactive-session" || p.maxArchiveBytes !== PRIVATE_PUBLICATION_MAX_BYTES || p.uploadMaxTtlSeconds !== 300 || typeof p.executionEnabled !== "boolean")
+    const p = record9(response) && response.privatePublishing;
+    if (!record9(response) || response.contractVersion !== 1 || response.apiVersion !== 1 || !exact(p, ["contractVersion", "enabled", "authentication", "maxArchiveBytes", "uploadMaxTtlSeconds", "executionEnabled"]) || p.contractVersion !== 1 || typeof p.enabled !== "boolean" || p.authentication !== "interactive-session" || p.maxArchiveBytes !== PRIVATE_PUBLICATION_MAX_BYTES || p.uploadMaxTtlSeconds !== 300 || typeof p.executionEnabled !== "boolean")
       throw new PrivatePublicationError("PUBLICATION_CONTRACT_UNAVAILABLE", "This server does not support the hosted private publication contract.");
     return Object.freeze({ ...p });
   }
@@ -42093,7 +42200,7 @@ class RemotePrivatePublicationsClient {
   async#view(path, method, skillId, intentId, declaration, options = {}) {
     const value = await boundedJson(path, { method, ...method === "GET" ? {} : { body: JSON.stringify(declaration ?? {}) } }, this.#token, method !== "GET", options.timeoutMs, options.signal);
     try {
-      if (!record8(value) || !Object.keys(value).every((k) => k === "upload" || k === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
+      if (!record9(value) || !Object.keys(value).every((k) => k === "upload" || k === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
         return invalid4();
       return checkedPublicationView(value.upload, skillId, intentId, declaration);
     } catch (error61) {
@@ -42256,10 +42363,10 @@ async function requestAuthApi(instance, path, options) {
   const text3 = await res.text();
   const body = text3 ? parseJsonBody(text3) : {};
   if (!res.ok) {
-    const record9 = isRecord6(body) ? body : {};
-    const detail = typeof record9.detail === "string" ? record9.detail : undefined;
-    const error61 = typeof record9.error === "string" ? record9.error : undefined;
-    const code = typeof record9.code === "string" ? record9.code : undefined;
+    const record10 = isRecord6(body) ? body : {};
+    const detail = typeof record10.detail === "string" ? record10.detail : undefined;
+    const error61 = typeof record10.error === "string" ? record10.error : undefined;
+    const code = typeof record10.code === "string" ? record10.code : undefined;
     throw new HostedApiError(detail || error61 || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -44068,7 +44175,7 @@ class SkillsPostgresSyncStore {
   }
   async upsertRecords(records) {
     let count = 0;
-    for (const record9 of records) {
+    for (const record10 of records) {
       await this.client.query([
         "INSERT INTO skills_sync_records",
         "(scope, kind, id, updated_at, deleted_at, source, payload)",
@@ -44079,13 +44186,13 @@ class SkillsPostgresSyncStore {
         "source = EXCLUDED.source,",
         "payload = EXCLUDED.payload"
       ].join(" "), [
-        record9.scope,
-        record9.kind,
-        record9.id,
-        record9.updatedAt,
-        record9.deletedAt ?? null,
-        record9.source ?? null,
-        JSON.stringify(record9.payload)
+        record10.scope,
+        record10.kind,
+        record10.id,
+        record10.updatedAt,
+        record10.deletedAt ?? null,
+        record10.source ?? null,
+        JSON.stringify(record10.payload)
       ]);
       count += 1;
     }
@@ -45489,6 +45596,7 @@ export {
   validateCron,
   validateBlogArticleRunOptions,
   uploadSkillsSnapshotFilesToS3,
+  upgradeCodexSettingsWitnessV3,
   upgradeCodexSettingsWitness,
   upgradeClaudeSettingsWitness,
   updateSkillRun,
@@ -45674,6 +45782,7 @@ export {
   captureDiscoveryPathSources,
   captureDiscoveryDirectories,
   captureDiscoveryByteSources,
+  captureCodexSettingsV3,
   captureCodexSettingsV2,
   captureCodexSettings,
   captureCodexNativeSkillCatalog,