@hasna/skills 0.10.61 → 0.10.62

package/dist/sdk/index.js

@@ -323,13 +323,13 @@ var require_directives = __commonJS((exports) => {
             onError(0, "%YAML directive should contain exactly one part");
             return false;
           }
-          const [version] = parts;
-          if (version === "1.1" || version === "1.2") {
-            this.yaml.version = version;
+          const [version2] = parts;
+          if (version2 === "1.1" || version2 === "1.2") {
+            this.yaml.version = version2;
             return true;
           } else {
-            const isValid = /^\d+\.\d+$/.test(version);
-            onError(6, `Unsupported YAML version ${version}`, isValid);
+            const isValid = /^\d+\.\d+$/.test(version2);
+            onError(6, `Unsupported YAML version ${version2}`, isValid);
             return false;
           }
         }
@@ -3248,14 +3248,14 @@ var require_Document = __commonJS((exports) => {
         version: "1.2"
       }, options);
       this.options = opt;
-      let { version } = opt;
+      let { version: version2 } = opt;
       if (options?._directives) {
         this.directives = options._directives.atDocument();
         if (this.directives.yaml.explicit)
-          version = this.directives.yaml.version;
+          version2 = this.directives.yaml.version;
       } else
-        this.directives = new directives.Directives({ version });
-      this.setSchema(version, options);
+        this.directives = new directives.Directives({ version: version2 });
+      this.setSchema(version2, options);
       this.contents = value === undefined ? null : this.createNode(value, _replacer, options);
     }
     clone() {
@@ -3371,11 +3371,11 @@ var require_Document = __commonJS((exports) => {
         this.contents.setIn(path, value);
       }
     }
-    setSchema(version, options = {}) {
-      if (typeof version === "number")
-        version = String(version);
+    setSchema(version2, options = {}) {
+      if (typeof version2 === "number")
+        version2 = String(version2);
       let opt;
-      switch (version) {
+      switch (version2) {
         case "1.1":
           if (this.directives)
             this.directives.yaml.version = "1.1";
@@ -3386,9 +3386,9 @@ var require_Document = __commonJS((exports) => {
         case "1.2":
         case "next":
           if (this.directives)
-            this.directives.yaml.version = version;
+            this.directives.yaml.version = version2;
           else
-            this.directives = new directives.Directives({ version });
+            this.directives = new directives.Directives({ version: version2 });
           opt = { resolveKnownTags: true, schema: "core" };
           break;
         case null:
@@ -3397,7 +3397,7 @@ var require_Document = __commonJS((exports) => {
           opt = null;
           break;
         default: {
-          const sv = JSON.stringify(version);
+          const sv = JSON.stringify(version2);
           throw new Error(`Expected '1.1', '1.2' or null as first argument, but found: ${sv}`);
         }
       }
@@ -8727,8 +8727,8 @@ var require_client = __commonJS((exports) => {
     }
   };
   var warningEmitted = false;
-  var emitWarningIfUnsupportedVersion = (version) => {
-    if (version && !warningEmitted && parseInt(version.substring(1, version.indexOf("."))) < 16) {
+  var emitWarningIfUnsupportedVersion = (version2) => {
+    if (version2 && !warningEmitted && parseInt(version2.substring(1, version2.indexOf("."))) < 16) {
       warningEmitted = true;
     }
   };
@@ -16782,19 +16782,19 @@ var require_client2 = __commonJS((exports) => {
   var state = {
     warningEmitted: false
   };
-  var emitWarningIfUnsupportedVersion = (version) => {
-    if (version && !state.warningEmitted) {
+  var emitWarningIfUnsupportedVersion = (version2) => {
+    if (version2 && !state.warningEmitted) {
       if (process.env.AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED === "true") {
         state.warningEmitted = true;
         return;
       }
-      const userMajorVersion = parseInt(version.substring(1, version.indexOf(".")));
+      const userMajorVersion = parseInt(version2.substring(1, version2.indexOf(".")));
       const vv = 22;
       if (userMajorVersion < vv) {
         state.warningEmitted = true;
         process.emitWarning(`NodeVersionSupportWarning: The AWS SDK for JavaScript (v3)
 versions published after the first week of January 2027
-will require node >=${vv}. You are running node ${version}.
+will require node >=${vv}. You are running node ${version2}.
 
 To continue receiving updates to AWS services, bug fixes,
 and security updates please upgrade to node >=${vv}.
@@ -17431,14 +17431,14 @@ More information can be found at: https://a.co/c895JFp`);
   };
   var escapeUserAgent = (userAgentPair) => {
     const name = userAgentPair[0].split(UA_NAME_SEPARATOR).map((part) => part.replace(UA_NAME_ESCAPE_REGEX, UA_ESCAPE_CHAR)).join(UA_NAME_SEPARATOR);
-    const version = userAgentPair[1]?.replace(UA_VALUE_ESCAPE_REGEX, UA_ESCAPE_CHAR);
+    const version2 = userAgentPair[1]?.replace(UA_VALUE_ESCAPE_REGEX, UA_ESCAPE_CHAR);
     const prefixSeparatorIndex = name.indexOf(UA_NAME_SEPARATOR);
     const prefix = name.substring(0, prefixSeparatorIndex);
     let uaName = name.substring(prefixSeparatorIndex + 1);
     if (prefix === "api") {
       uaName = uaName.toLowerCase();
     }
-    return [prefix, uaName, version].filter((item) => item && item.length > 0).reduce((acc, item, index) => {
+    return [prefix, uaName, version2].filter((item) => item && item.length > 0).reduce((acc, item, index) => {
       switch (index) {
         case 0:
           return item;
@@ -26111,9 +26111,9 @@ var require_sso_oidc = __commonJS((exports) => {
     Region: { type: "builtInParams", name: "region" },
     UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
   };
-  var version = "3.997.43";
+  var version2 = "3.997.43";
   var packageInfo = {
-    version
+    version: version2
   };
   var k2 = "ref";
   var a2 = -1;
@@ -26986,7 +26986,7 @@ var awsEndpointFunctions2, emitWarningIfUnsupportedVersion$1, createDefaultUserA
     useFipsEndpoint: options.useFipsEndpoint ?? false,
     defaultSigningName: "awsssoportal"
   });
-}, commonParams2, version = "3.997.43", packageInfo, k2 = "ref", a2 = -1, b2 = true, c2 = "isSet", d2 = "PartitionResult", e3 = "booleanEquals", f2 = "getAttr", g2, h2, i2, j2, _data2, root3 = 2, r3 = 1e8, nodes2, bdd2, cache2, defaultEndpointResolver2 = (endpointParams, context = {}) => {
+}, commonParams2, version2 = "3.997.43", packageInfo, k2 = "ref", a2 = -1, b2 = true, c2 = "isSet", d2 = "PartitionResult", e3 = "booleanEquals", f2 = "getAttr", g2, h2, i2, j2, _data2, root3 = 2, r3 = 1e8, nodes2, bdd2, cache2, defaultEndpointResolver2 = (endpointParams, context = {}) => {
   return cache2.get(endpointParams, () => decideEndpoint2(bdd2, {
     endpointParams,
     logger: context.logger
@@ -27118,7 +27118,7 @@ var init_sso = __esm(() => {
     UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
   };
   packageInfo = {
-    version
+    version: version2
   };
   g2 = { [k2]: "Endpoint" };
   h2 = { [k2]: d2 };
@@ -27951,9 +27951,9 @@ var require_sts = __commonJS((exports) => {
     Region: { type: "builtInParams", name: "region" },
     UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
   };
-  var version2 = "3.997.43";
+  var version3 = "3.997.43";
   var packageInfo2 = {
-    version: version2
+    version: version3
   };
 
   class STSServiceException extends ServiceException2 {
@@ -28788,9 +28788,9 @@ var require_signin = __commonJS((exports) => {
     Region: { type: "builtInParams", name: "region" },
     UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
   };
-  var version2 = "3.997.43";
+  var version3 = "3.997.43";
   var packageInfo2 = {
-    version: version2
+    version: version3
   };
   var s2 = "ref";
   var a3 = -1;
@@ -30227,9 +30227,9 @@ var require_sts2 = __commonJS((exports) => {
     Region: { type: "builtInParams", name: "region" },
     UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
   };
-  var version2 = "3.997.43";
+  var version3 = "3.997.43";
   var packageInfo2 = {
-    version: version2
+    version: version3
   };
 
   class STSServiceException extends ServiceException2 {
@@ -31503,14 +31503,14 @@ function signPayload(secret, timestamp, body4) {
 }
 function isPrivateAddress(address) {
   const normalized = stripZoneId(address);
-  const version2 = isIP3(normalized);
-  if (version2 === 4) {
+  const version3 = isIP3(normalized);
+  if (version3 === 4) {
     const integer = ipv4ToInt(normalized);
     if (integer === undefined)
       return true;
     return IPV4_PRIVATE_RANGES.some(([low, high]) => integer >= low && integer <= high);
   }
-  if (version2 === 6) {
+  if (version3 === 6) {
     const groups = ipv6Groups(normalized);
     if (!groups)
       return true;
@@ -31550,8 +31550,8 @@ async function resolveWebhookTarget(url, policy = {}) {
     const addresses = resolved2.map((entry) => normalizeHostname(entry.address));
     return { hostname: hostname2, addresses };
   }
-  const version2 = isIP3(hostname2);
-  if (version2 === 4 || version2 === 6) {
+  const version3 = isIP3(hostname2);
+  if (version3 === 4 || version3 === 6) {
     if (isPrivateAddress(hostname2)) {
       throw new Error(`Webhook target ${hostname2} is a private or special-use address`);
     }
@@ -32371,9 +32371,10 @@ var init_event_sink = __esm(() => {
   init_dist();
 });
 // package.json
+var version = "0.10.62";
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.61",
+  version,
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -32414,6 +32415,7 @@ var package_default = {
     "migrations/",
     "docs/skill-standard.md",
     "docs/plugin-admission.md",
+    "docs/runtime-activation.md",
     "schemas/",
     "LICENSE",
     "README.md",
@@ -32424,8 +32426,8 @@ var package_default = {
   types: "./dist/index.d.ts",
   scripts: {
     clean: "rm -rf bin/ dist/",
-    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
-    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
+    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
+    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
     test: "bun test --timeout 30000",
     dev: "bun run ./src/cli/index.tsx",
     "dev:watch": "bun --watch run ./src/cli/index.tsx",
@@ -32502,6 +32504,10 @@ var package_default = {
   homepage: "https://github.com/hasna/skills/tree/main/apps/skills",
   bugs: {
     url: "https://github.com/hasna/skills/issues"
+  },
+  skillsRuntimePrerequisites: {
+    version: 1,
+    entry: "dist/runtime-prerequisites.js"
   }
 };
 
@@ -33870,24 +33876,24 @@ class CloudExecutionClient {
     }
     return response;
   }
-  async eligibility(slug, version, bundleDigest) {
-    if (!/^[a-z0-9-]+$/.test(slug) || !/^\d+\.\d+\.\d+$/.test(version) || bundleDigest !== undefined && !/^(sha256:)?[a-f0-9]{64}$/.test(bundleDigest))
+  async eligibility(slug, version2, bundleDigest) {
+    if (!/^[a-z0-9-]+$/.test(slug) || !/^\d+\.\d+\.\d+$/.test(version2) || bundleDigest !== undefined && !/^(sha256:)?[a-f0-9]{64}$/.test(bundleDigest))
       throw Error("Cloud eligibility requires an exact skill version and valid digest");
-    const query = new URLSearchParams({ version, ...bundleDigest ? { bundleDigest } : {} });
+    const query = new URLSearchParams({ version: version2, ...bundleDigest ? { bundleDigest } : {} });
     const v = await jsonBody(await this.request(`${slug}/eligibility?${query}`));
-    if (!v || v.contractVersion !== 1 || typeof v.eligible !== "boolean" || v.skill !== slug || v.version !== version || !/^[a-f0-9]{64}$/.test(v.bundleDigest) || bundleDigest && bundleDigest.replace(/^sha256:/, "") !== v.bundleDigest || v.eligible && (!v.executionContract || !["pdf.v1", "regex-test.v1"].includes(v.executionContract.id)))
+    if (!v || v.contractVersion !== 1 || typeof v.eligible !== "boolean" || v.skill !== slug || v.version !== version2 || !/^[a-f0-9]{64}$/.test(v.bundleDigest) || bundleDigest && bundleDigest.replace(/^sha256:/, "") !== v.bundleDigest || v.eligible && (!v.executionContract || !["pdf.v1", "regex-test.v1"].includes(v.executionContract.id)))
       throw Error("Invalid cloud eligibility receipt");
     return v;
   }
-  async submit(slug, version, input, key, selection) {
-    if (!/^[a-z0-9-]+$/.test(slug) || !/^\d+\.\d+\.\d+$/.test(version))
+  async submit(slug, version2, input, key, selection) {
+    if (!/^[a-z0-9-]+$/.test(slug) || !/^\d+\.\d+\.\d+$/.test(version2))
       throw Error("Cloud execution requires skill@exact-version");
     if (!/^[A-Za-z0-9._:-]{1,128}$/.test(key))
       throw Error("Invalid idempotency key");
     if (selection?.authority && selection.authority !== skillsApiRequestUrl(this.apiOrigin, "/api/v1/").replace(/\/$/, ""))
       throw Error("Selected skill belongs to another Skills authority");
     const execution = parseExecution(await jsonBody(await this.request(slug, "POST", {
-      version,
+      version: version2,
       input,
       idempotencyKey: key,
       ...selection ? {
@@ -33895,7 +33901,7 @@ class CloudExecutionClient {
         workspaceId: selection.workspaceId
       } : {}
     })));
-    if (execution.skill !== slug || execution.version !== version || selection && execution.bundleDigest.replace(/^sha256:/, "") !== selection.bundleDigest.replace(/^sha256:/, ""))
+    if (execution.skill !== slug || execution.version !== version2 || selection && execution.bundleDigest.replace(/^sha256:/, "") !== selection.bundleDigest.replace(/^sha256:/, ""))
       throw Error("Cloud execution receipt does not match the selected exact skill");
     return execution;
   }
@@ -34912,9 +34918,9 @@ function resolvedProfileSnapshot(profile, authority) {
   };
 }
 function profileSelectionSnapshot(selections) {
-  return selections.map(({ slug, version, bundleDigest, aliases, triggers }) => ({
+  return selections.map(({ slug, version: version2, bundleDigest, aliases, triggers }) => ({
     slug,
-    version,
+    version: version2,
     bundleDigest,
     ...aliases !== undefined ? { aliases } : {},
     ...triggers !== undefined ? { triggers } : {}
@@ -35088,8 +35094,8 @@ async function verifySelectionBundleResponse(selection, response, signal, deadli
   if (!response?.ok)
     throw new SkillSelectionError("BUNDLE_UNAVAILABLE", `The selected skill bundle is unavailable${response ? ` (HTTP ${response.status})` : ""}.`);
   const declared = response.headers.get("X-Skill-Bundle-Sha256");
-  const version = response.headers.get("X-Skill-Version");
-  if (declared && `sha256:${declared}` !== selection.bundleDigest || version && version !== selection.version) {
+  const version2 = response.headers.get("X-Skill-Version");
+  if (declared && `sha256:${declared}` !== selection.bundleDigest || version2 && version2 !== selection.version) {
     await response.body?.cancel();
     throw new SkillSelectionError("BUNDLE_IDENTITY_MISMATCH", "The returned bundle does not match the selected version and digest.");
   }
@@ -36982,10 +36988,10 @@ function selectedSecretBindingsTemplate(scope, names, createClient = createSecre
   } catch {
     return refuse("LOCAL_SECRET_UNAVAILABLE", "Configure the Secrets CLI authority and authentication before preparing execution bindings.");
   }
-  const { authority, workspaceId, profileRevision, slug, version, bundleDigest } = scope.selection;
+  const { authority, workspaceId, profileRevision, slug, version: version2, bundleDigest } = scope.selection;
   return {
     schema: "hasna.skills-secret-bindings.v1",
-    selection: { authority, workspaceId, profileId: scope.profileId, profileRevision, slug, version, bundleDigest },
+    selection: { authority, workspaceId, profileId: scope.profileId, profileRevision, slug, version: version2, bundleDigest },
     consumer: { stationId: process.env.HASNA_STATION || stationHostname(), workspaceDirectory: realpathSync2(scope.cwd) },
     secretsAuthority,
     bindings: Object.fromEntries(names.map((name) => [name, ""]))
@@ -37451,10 +37457,10 @@ class HttpProfileClient {
       invalid2();
     return result;
   }
-  async getBundle(slug, version) {
-    if (!identifier2(slug) || !/^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/.test(version) || version.includes(".."))
+  async getBundle(slug, version2) {
+    if (!identifier2(slug) || !/^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/.test(version2) || version2.includes(".."))
       throw new Error("Invalid immutable skill reference");
-    return this.request(`/skills/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}/bundle`);
+    return this.request(`/skills/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version2)}/bundle`);
   }
 }
 async function createProfileClient(signal) {
@@ -38548,7 +38554,7 @@ function assertClaudeHookEventsReplacement(before, replacement, events) {
   need(JSON.stringify(withoutOwnedEvents(original)) === JSON.stringify(withoutOwnedEvents(next)), `${label} update changed settings outside hooks.${label}`);
 }
 var PERSISTED_EFFORT_LEVELS = new Set(["low", "medium", "high", "xhigh"]);
-function inferencePreference(key, child, version) {
+function inferencePreference(key, child, version2) {
   if (key === "skipDangerousModePermissionPrompt") {
     need(child.kind === "literal" && (child.value === "true" || child.value === "false"), "contains an invalid dialog acknowledgment");
     return false;
@@ -38561,7 +38567,7 @@ function inferencePreference(key, child, version) {
     return false;
   need(child.kind === "object", "requires an object of model preferences");
   child.entries = child.entries.filter(([model, preferences]) => {
-    if (version === 2 && !BUILTIN_MODEL_SELECTIONS.has(model) || preferences.kind !== "object" || preferences.entries.length !== 1 || preferences.entries[0][0] !== "effortLevel")
+    if (version2 === 2 && !BUILTIN_MODEL_SELECTIONS.has(model) || preferences.kind !== "object" || preferences.entries.length !== 1 || preferences.entries[0][0] !== "effortLevel")
       return true;
     const effort = preferences.entries[0][1];
     need(effort.kind === "string" && PERSISTED_EFFORT_LEVELS.has(effort.value), "contains an invalid persisted model effort level");
@@ -38569,12 +38575,12 @@ function inferencePreference(key, child, version) {
   });
   return child.entries.length === 0;
 }
-function settingsDigest(text, version = 1) {
+function settingsDigest(text, version2 = 1) {
   const value = parse3(text);
   value.entries = value.entries.filter(([key, child]) => {
-    if (version === 4 && key === "theme" && child.kind === "string" && BUILTIN_THEMES.has(child.value))
+    if (version2 === 4 && key === "theme" && child.kind === "string" && BUILTIN_THEMES.has(child.value))
       return false;
-    if (version !== 1 && inferencePreference(key, child, version === 4 ? 3 : version))
+    if (version2 !== 1 && inferencePreference(key, child, version2 === 4 ? 3 : version2))
       return false;
     if (key === "model") {
       need(child.kind === "string", "contains an invalid model selection");
@@ -38590,7 +38596,7 @@ function settingsDigest(text, version = 1) {
     }
     return true;
   });
-  return createHash7("sha256").update(`hasna.skills.claude-settings.v${version}\x00`).update(JSON.stringify(canonical(value))).digest("hex");
+  return createHash7("sha256").update(`hasna.skills.claude-settings.v${version2}\x00`).update(JSON.stringify(canonical(value))).digest("hex");
 }
 function hashClaudeSettingsReplacement(text, budget) {
   need(typeof text === "string", "requires settings text");
@@ -38803,10 +38809,10 @@ var MEASURED_CODEX_CAPABILITIES = {
   "codex-cli 0.161.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
   "codex-cli 0.162.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
 };
-function supportsCodexNativeCapability(version, capability) {
-  return typeof version === "string" && Object.hasOwn(MEASURED_CODEX_CAPABILITIES, version) && MEASURED_CODEX_CAPABILITIES[version].includes(capability);
+function supportsCodexNativeCapability(version2, capability) {
+  return typeof version2 === "string" && Object.hasOwn(MEASURED_CODEX_CAPABILITIES, version2) && MEASURED_CODEX_CAPABILITIES[version2].includes(capability);
 }
-var SUPPORTED_CODEX_HOOK_VERSIONS = Object.freeze(Object.keys(MEASURED_CODEX_CAPABILITIES).filter((version) => supportsCodexNativeCapability(version, "hooks")));
+var SUPPORTED_CODEX_HOOK_VERSIONS = Object.freeze(Object.keys(MEASURED_CODEX_CAPABILITIES).filter((version2) => supportsCodexNativeCapability(version2, "hooks")));
 
 // src/lib/codex-native-skill-catalog.ts
 import { realpathSync as realpathSync6 } from "fs";
@@ -38828,14 +38834,14 @@ async function connectCodexHookRpc(options) {
   const binary = realpathSync5(found), stat = statSync4(binary);
   if (!stat.isFile() || (stat.mode & 18) !== 0)
     throw new Error("CODEX_HOOK_TRUST_UNSAFE_EXECUTABLE");
-  let version;
+  let version2;
   try {
     const output = await promisify(execFile)(binary, ["--version"], { timeout: Math.min(5000, timeoutMs), maxBuffer: 4096 });
-    version = output.stdout.trim();
+    version2 = output.stdout.trim();
   } catch {
     throw new Error("CODEX_HOOK_TRUST_NATIVE_UNAVAILABLE");
   }
-  if (!supportsCodexNativeCapability(version, "hooks"))
+  if (!supportsCodexNativeCapability(version2, "hooks"))
     throw new Error("CODEX_HOOK_TRUST_NATIVE_UNSUPPORTED_VERSION");
   const current = statSync4(binary);
   if (realpathSync5(found) !== binary || ["dev", "ino", "size", "mtimeMs", "ctimeMs"].some((k) => stat[k] !== current[k]))
@@ -38915,7 +38921,7 @@ async function connectCodexHookRpc(options) {
     }
   });
   const rpc = {
-    version,
+    version: version2,
     processId: child.pid,
     request(method, params) {
       if (stopped)
@@ -38954,7 +38960,7 @@ async function connectCodexHookRpc(options) {
   };
   try {
     const initialized = await rpc.request("initialize", { clientInfo: { name: "skills-native-hook-enrollment", version: "1" }, capabilities: { experimentalApi: true } });
-    const nativeVersion = version.slice("codex-cli ".length);
+    const nativeVersion = version2.slice("codex-cli ".length);
     if (typeof initialized?.userAgent !== "string" || !(initialized.userAgent === `skills-native-hook-enrollment/${nativeVersion}` || initialized.userAgent.startsWith(`skills-native-hook-enrollment/${nativeVersion} `)))
       throw new Error("CODEX_HOOK_TRUST_NATIVE_VERSION_MISMATCH");
     child.stdin.write(`{"method":"initialized"}
@@ -40395,7 +40401,7 @@ function canonical3(value, depth = 0, budget2 = { remaining: 65536 }) {
   need3(isRecord(value));
   return ["object", Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, child]) => [key, canonical3(child, depth + 1, budget2)])];
 }
-function normalize2(config, version = 2) {
+function normalize2(config, version2 = 2) {
   if (isRecord(config.hooks)) {
     delete config.hooks.state;
     if (!Object.keys(config.hooks).length)
@@ -40413,11 +40419,11 @@ function normalize2(config, version = 2) {
     if (!Object.keys(skills).length)
       delete config.skills;
   }
-  inference(config, version);
+  inference(config, version2);
   if (isRecord(config.profiles)) {
     for (const profile of Object.values(config.profiles))
       if (isRecord(profile))
-        inference(profile, version);
+        inference(profile, version2);
   }
 }
 function disablesOneSkill(entry) {
@@ -40429,8 +40435,8 @@ function disablesOneSkill(entry) {
   const selector = ["path", "name"].filter((key) => Object.hasOwn(entry, key));
   return selector.length === 1 && typeof entry[selector[0]] === "string" && entry[selector[0]].length > 0;
 }
-function inference(target, version) {
-  const keys2 = version >= 3 ? [...INFERENCE, "service_tier", "plan_mode_reasoning_effort", "personality"] : INFERENCE;
+function inference(target, version2) {
+  const keys2 = version2 >= 3 ? [...INFERENCE, "service_tier", "plan_mode_reasoning_effort", "personality"] : INFERENCE;
   for (const key of keys2)
     if (Object.hasOwn(target, key)) {
       const value = target[key];
@@ -40438,7 +40444,7 @@ function inference(target, version) {
         need3(typeof value === "string" && MODEL.test(value));
       else if (key === "personality")
         need3(typeof value === "string" && ["none", "friendly", "pragmatic"].includes(value));
-      else if (version >= 3 && key !== "model_verbosity") {
+      else if (version2 >= 3 && key !== "model_verbosity") {
         need3(typeof value === "string" && value.length <= 128 && !/[\x00-\x1f\x7f]/.test(value));
         if (key !== "service_tier")
           need3(value.length > 0);
@@ -40556,7 +40562,7 @@ function projectModelAvailabilityNux(config, text) {
   }
   return { config, numericSource: text };
 }
-function settingsDigest2(text, version = 2) {
+function settingsDigest2(text, version2 = 2) {
   let config;
   try {
     config = Bun.TOML.parse(text);
@@ -40564,10 +40570,10 @@ function settingsDigest2(text, version = 2) {
     throw new Error("Invalid Codex settings witness");
   }
   need3(isRecord(config));
-  const mcp = version >= 3 ? projectRegularCodexMcp(config, text) : { config, numericSource: text };
-  const projected = version === 4 ? projectModelAvailabilityNux(mcp.config, mcp.numericSource) : mcp;
-  normalize2(projected.config, version);
-  return sha2(`hasna.skills.codex-settings.v${version}\x00${JSON.stringify([canonical3(projected.config), numericTokens2(projected.numericSource)])}`);
+  const mcp = version2 >= 3 ? projectRegularCodexMcp(config, text) : { config, numericSource: text };
+  const projected = version2 === 4 ? projectModelAvailabilityNux(mcp.config, mcp.numericSource) : mcp;
+  normalize2(projected.config, version2);
+  return sha2(`hasna.skills.codex-settings.v${version2}\x00${JSON.stringify([canonical3(projected.config), numericTokens2(projected.numericSource)])}`);
 }
 function hashCodexSettingsReplacementV2(text, budget2 = { remaining: 256 * 1024 * 1024 }) {
   need3(Buffer.byteLength(text) <= 1024 * 1024 && budget2.remaining >= Buffer.byteLength(text));
@@ -43143,8 +43149,8 @@ class Deadline {
 async function bundle(selection2, api, deadline) {
   const response = await deadline.wait(api.getBundle(selection2.slug, selection2.version));
   pluginNeed(response?.ok, "Selected plugin or migrated payload bundle is unavailable");
-  const declared = response.headers.get("X-Skill-Bundle-Sha256"), version = response.headers.get("X-Skill-Version");
-  if (declared && `sha256:${declared}` !== selection2.bundleDigest || version && version !== selection2.version) {
+  const declared = response.headers.get("X-Skill-Bundle-Sha256"), version2 = response.headers.get("X-Skill-Version");
+  if (declared && `sha256:${declared}` !== selection2.bundleDigest || version2 && version2 !== selection2.version) {
     await response.body?.cancel();
     pluginRefusal("Selected plugin bundle identity differs from the API response");
   }
@@ -43315,9 +43321,9 @@ function readRegistry(path) {
     closeSync15(fd);
   }
 }
-function nativeVersionMatches(version, receipt) {
+function nativeVersionMatches(version2, receipt) {
   const upstream = receipt.plan.manifest.upstream.version;
-  return upstream === null ? /^[a-f0-9]{12}$/.test(version) : version.startsWith(`${upstream}-`);
+  return upstream === null ? /^[a-f0-9]{12}$/.test(version2) : version2.startsWith(`${upstream}-`);
 }
 function hashManagedPluginRegistry(path, managed) {
   validateManagedPluginWitnesses(managed);
@@ -43385,14 +43391,14 @@ function hashManagedPluginRegistry(path, managed) {
     } finally {
       directory.closeSync();
     }
-    for (const version of names.sort()) {
-      const files = pluginFileWitnesses(snapshotPluginTree(join25(cacheRoot, version), { nativeRuntime: `claude-${target.native.version}` }));
+    for (const version2 of names.sort()) {
+      const files = pluginFileWitnesses(snapshotPluginTree(join25(cacheRoot, version2), { nativeRuntime: `claude-${target.native.version}` }));
       verifiedBytes += files.reduce((total, file) => total + file.size, 0);
       pluginNeed(verifiedBytes <= 256 * 1024 * 1024, "Managed plugin verification exceeds its aggregate byte budget");
       const serialized = JSON.stringify(files);
-      const expected = currentFiles.get(join25(cacheRoot, version));
+      const expected = currentFiles.get(join25(cacheRoot, version2));
       pluginNeed(expected === undefined || serialized === expected, "Current native cache differs from its exact registered producer receipt");
-      pluginNeed([...approvals.values()].some((receipt) => nativeVersionMatches(version, receipt) && JSON.stringify(receipt.plan.files) === serialized), "A retained native plugin cache version differs from every approved projection");
+      pluginNeed([...approvals.values()].some((receipt) => nativeVersionMatches(version2, receipt) && JSON.stringify(receipt.plan.files) === serialized), "A retained native plugin cache version differs from every approved projection");
     }
     for (const row of rows)
       pluginNeed(names.includes(row.version), "Managed native plugin installation is missing");
@@ -43547,9 +43553,9 @@ function textField(value) {
   need6(value?.kind === "string" && value.value.length > 0 && !/[\x00-\x1f\x7f]/.test(value.value), "contains an invalid recognized field");
   return value.value;
 }
-function normalizeRow(row, version = 1) {
+function normalizeRow(row, version2 = 1) {
   if (!exactKeys2(row, ["source", "installLocation", "lastUpdated"])) {
-    if (version !== 2 || !exactKeys2(row, ["source", "installLocation", "lastUpdated", "autoUpdate"]))
+    if (version2 !== 2 || !exactKeys2(row, ["source", "installLocation", "lastUpdated", "autoUpdate"]))
       return;
     const autoUpdate = field2(row, "autoUpdate");
     need6(autoUpdate?.kind === "literal" && (autoUpdate.value === "true" || autoUpdate.value === "false"), "contains an invalid automatic-update preference");
@@ -47593,7 +47599,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
   const pkg = existsSync9(pkgPath) ? readJsonObject(pkgPath) : undefined;
   const name = normalizeName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
   const description = stringField(jsonManifest, "description") ?? frontmatter?.description ?? stringValue(pkg?.description) ?? `${name} skill`;
-  const version = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
+  const version2 = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
   const kind = parseSkillKind(stringField(jsonManifest, "kind") ?? frontmatter?.kind);
   const commands = parseManifestCommands(jsonManifest) ?? (kind === "instruction" ? [] : inferPackageCommands(pkg, name)) ?? [];
   const runtime = parseManifestRuntime(jsonManifest) ?? inferRuntimeFromCommands(commands);
@@ -47602,7 +47608,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
     standard: stringField(jsonManifest, "standard") ?? PORTABLE_SKILL_STANDARD,
     name,
     description,
-    version,
+    version: version2,
     displayName: stringField(jsonManifest, "displayName") ?? frontmatter?.displayName ?? displayName(name),
     category: stringField(jsonManifest, "category") ?? frontmatter?.category ?? "Development Tools",
     tags: stringArrayField(jsonManifest, "tags") ?? frontmatter?.tags ?? ["custom"],
@@ -49572,8 +49578,8 @@ function installSkill(name, options = {}) {
     };
   }
   const meta = getSkill(canonicalName);
-  const version = readBundledSkillVersion(name);
-  pinProjectSkill(skillName, { version, source: meta?.source ?? "official" }, targetDir);
+  const version2 = readBundledSkillVersion(name);
+  pinProjectSkill(skillName, { version: version2, source: meta?.source ?? "official" }, targetDir);
   warnMissingDependencies(canonicalName, targetDir);
   return { skill: canonicalName, success: true, path: getProjectConfigPath(targetDir), mode: "pin", source: meta?.source ?? "official" };
 }
@@ -50259,9 +50265,9 @@ function exactProfileSelection(spec, profile) {
   validateResolvedProfile(profile);
   const at = spec.lastIndexOf("@");
   const slug = at > 0 ? spec.slice(0, at) : spec;
-  const version = at > 0 ? spec.slice(at + 1) : undefined;
-  const selection2 = profile.selections.find((entry) => (entry.slug === slug || entry.aliases?.includes(slug)) && (version === undefined || version === entry.version));
-  if (!selection2 || version === "")
+  const version2 = at > 0 ? spec.slice(at + 1) : undefined;
+  const selection2 = profile.selections.find((entry) => (entry.slug === slug || entry.aliases?.includes(slug)) && (version2 === undefined || version2 === entry.version));
+  if (!selection2 || version2 === "")
     throw new SkillSelectionError("SKILL_NOT_SELECTED", "The requested exact skill version is not selected by this profile or project lock.");
   return selection2;
 }
@@ -50361,16 +50367,16 @@ async function executeSelectedLocal(selected, options = {}) {
   env.SKILLS_WORKSPACE_DIR = resolve24(options.cwd ?? process.cwd());
   env.SKILLS_RUN_DIR = runDirectory;
   if (runtime.version) {
-    const version = await subprocess([executable2, ...runtimeName === "bun" ? ["--no-env-file"] : [], "--version"], runDirectory, env, "", Math.min(timeoutMs, 5000));
-    const actual = version.stdout.trim().replace(/^v/, "").replace(/^Python /, "");
-    if (version.exitCode !== 0 || actual !== runtime.version)
+    const version2 = await subprocess([executable2, ...runtimeName === "bun" ? ["--no-env-file"] : [], "--version"], runDirectory, env, "", Math.min(timeoutMs, 5000));
+    const actual = version2.stdout.trim().replace(/^v/, "").replace(/^Python /, "");
+    if (version2.exitCode !== 0 || actual !== runtime.version)
       throw new SkillSelectionError("LOCAL_RUNTIME_VERSION_MISMATCH", "The installed runtime version differs from the version selected by the skill.");
   }
   let executionGrant;
   if (shared) {
-    const { authority: authority2, workspaceId, profileRevision, slug, version, bundleDigest } = selection2;
+    const { authority: authority2, workspaceId, profileRevision, slug, version: version2, bundleDigest } = selection2;
     const request2 = {
-      selection: { authority: authority2, workspaceId, profileId, profileRevision, slug, version, bundleDigest },
+      selection: { authority: authority2, workspaceId, profileId, profileRevision, slug, version: version2, bundleDigest },
       consumer: { stationId: process.env.HASNA_STATION || stationHostname2(), workspaceDirectory: realpathSync16(options.cwd ?? process.cwd()) }
     };
     const grant = await (options.resolveExecutionGrant ?? resolveExecutionGrant)(request2);
@@ -60216,26 +60222,26 @@ class ArtifactStorage {
   keyFor(run, relativePath) {
     return this.objectKeyFor(run.orgId, run.id, relativePath);
   }
-  async putVersionObjects(orgId, slug, version2, bytes, manifest, contentType = "application/gzip") {
+  async putVersionObjects(orgId, slug, version3, bytes, manifest, contentType = "application/gzip") {
     if (!this.bucket || !this.s3)
       return { storageKind: "db" };
-    const key = this.versionKeyFor(orgId, slug, version2, "bundle.tar.gz");
+    const key = this.versionKeyFor(orgId, slug, version3, "bundle.tar.gz");
     await this.s3.send(new PutObjectCommand({ Bucket: this.bucket, Key: key, Body: bytes, ContentType: contentType }));
     await this.s3.send(new PutObjectCommand({
       Bucket: this.bucket,
-      Key: this.versionKeyFor(orgId, slug, version2, "manifest.json"),
+      Key: this.versionKeyFor(orgId, slug, version3, "manifest.json"),
       Body: new TextEncoder().encode(JSON.stringify(manifest, null, 2)),
       ContentType: "application/json"
     }));
     return { storageKind: "s3", storageKey: key };
   }
-  versionPlacement(orgId, slug, version2) {
+  versionPlacement(orgId, slug, version3) {
     if (!this.bucket || !this.s3)
       return { storageKind: "db" };
-    return { storageKind: "s3", storageKey: this.versionKeyFor(orgId, slug, version2, "bundle.tar.gz") };
+    return { storageKind: "s3", storageKey: this.versionKeyFor(orgId, slug, version3, "bundle.tar.gz") };
   }
-  versionKeyFor(orgId, slug, version2, file) {
-    return `${this.prefix}/skills/${encodeURIComponent(orgId)}/${encodeURIComponent(slug)}/${encodeURIComponent(version2)}/${file}`;
+  versionKeyFor(orgId, slug, version3, file) {
+    return `${this.prefix}/skills/${encodeURIComponent(orgId)}/${encodeURIComponent(slug)}/${encodeURIComponent(version3)}/${file}`;
   }
   bundleKeyFor(orgId, sha2563) {
     return `${this.prefix}/bundles/${encodeURIComponent(orgId)}/${sha2563}.tar.gz`;
@@ -61055,10 +61061,10 @@ class SkillVersionExistsError extends Error {
   version;
   existingSha256;
   attemptedSha256;
-  constructor(slug, version2, existingSha256, attemptedSha256) {
-    super(`version conflict for '${slug}@${version2}': already published with bundle ${existingSha256}, ` + `refusing to overwrite it with ${attemptedSha256}. Publish a new version instead.`);
+  constructor(slug, version3, existingSha256, attemptedSha256) {
+    super(`version conflict for '${slug}@${version3}': already published with bundle ${existingSha256}, ` + `refusing to overwrite it with ${attemptedSha256}. Publish a new version instead.`);
     this.slug = slug;
-    this.version = version2;
+    this.version = version3;
     this.existingSha256 = existingSha256;
     this.attemptedSha256 = attemptedSha256;
     this.name = "SkillVersionExistsError";
@@ -61719,8 +61725,8 @@ class SqliteSkillsStore {
   async listSkillVersions(principal, slug) {
     return this.all("SELECT * FROM skills_versions WHERE org_id = ? AND slug = ? ORDER BY created_at DESC, version DESC", [principal.orgId, slug]).map(rowToSkillVersion);
   }
-  async getSkillVersion(principal, slug, version2) {
-    const row = this.get("SELECT * FROM skills_versions WHERE org_id = ? AND slug = ? AND version = ? LIMIT 1", [principal.orgId, slug, version2]);
+  async getSkillVersion(principal, slug, version3) {
+    const row = this.get("SELECT * FROM skills_versions WHERE org_id = ? AND slug = ? AND version = ? LIMIT 1", [principal.orgId, slug, version3]);
     return row ? rowToSkillVersion(row) : null;
   }
   async getPublishedSelectionStates(principal, selections2) {
@@ -61728,7 +61734,7 @@ class SqliteSkillsStore {
       throw new RangeError("Published selection lookup exceeds the profile selection limit");
     if (!selections2.length)
       return [];
-    const requested = JSON.stringify(selections2.map(({ slug, version: version2 }) => ({ slug, version: version2 })));
+    const requested = JSON.stringify(selections2.map(({ slug, version: version3 }) => ({ slug, version: version3 })));
     return this.all(`SELECT json_extract(q.value, '$.slug') AS slug, json_extract(q.value, '$.version') AS version,
          r.slug IS NOT NULL AS skill_exists, r.lifecycle, r.tombstoned_at, r.authorization_epoch,
          v.bundle_sha256, b.sha256 IS NOT NULL AS bundle_available
@@ -61806,18 +61812,18 @@ function applySqliteMigrations(db, migrationsDir = resolveMigrationsDir("sqlite"
   }
   const appliedNow = [];
   for (const file of files) {
-    const version2 = file.replace(/\.sql$/, "");
+    const version3 = file.replace(/\.sql$/, "");
     const text2 = readFileSync27(join42(migrationsDir, file), "utf8");
     const apply = db.transaction(() => {
-      const already = db.query("SELECT 1 AS present FROM schema_migrations WHERE version = ? LIMIT 1").get(version2);
+      const already = db.query("SELECT 1 AS present FROM schema_migrations WHERE version = ? LIMIT 1").get(version3);
       if (already)
         return false;
       db.exec(text2);
-      db.run("INSERT INTO schema_migrations (version) VALUES (?)", [version2]);
+      db.run("INSERT INTO schema_migrations (version) VALUES (?)", [version3]);
       return true;
     });
     if (apply.immediate())
-      appliedNow.push(version2);
+      appliedNow.push(version3);
   }
   return appliedNow;
 }
@@ -62589,18 +62595,18 @@ function byteLength(value) {
 function titleize(name) {
   return name.replace(/[-_]+/g, " ").replace(/\b\w/g, (char) => char.toUpperCase());
 }
-function skillVersionPayload(version2, currentSha) {
+function skillVersionPayload(version3, currentSha) {
   return {
-    slug: version2.slug,
-    version: version2.version,
-    bundleSha256: version2.bundleSha256,
-    bundleByteSize: version2.bundleByteSize,
-    storageKind: version2.storageKind,
-    ...version2.storageKey ? { storageKey: version2.storageKey } : {},
-    manifest: version2.manifest,
-    ...version2.publishedByUserId ? { publishedByUserId: version2.publishedByUserId } : {},
-    createdAt: version2.createdAt,
-    current: currentSha !== undefined && currentSha === version2.bundleSha256
+    slug: version3.slug,
+    version: version3.version,
+    bundleSha256: version3.bundleSha256,
+    bundleByteSize: version3.bundleByteSize,
+    storageKind: version3.storageKind,
+    ...version3.storageKey ? { storageKey: version3.storageKey } : {},
+    manifest: version3.manifest,
+    ...version3.publishedByUserId ? { publishedByUserId: version3.publishedByUserId } : {},
+    createdAt: version3.createdAt,
+    current: currentSha !== undefined && currentSha === version3.bundleSha256
   };
 }
 async function listSkillVersionsPayload(store, principal, slug) {
@@ -62614,21 +62620,21 @@ async function listSkillVersionsPayload(store, principal, slug) {
     slug,
     ...record4?.version ? { currentVersion: record4.version } : {},
     ...currentSha ? { currentBundleSha256: currentSha } : {},
-    versions: versions.map((version2) => skillVersionPayload(version2, currentSha))
+    versions: versions.map((version3) => skillVersionPayload(version3, currentSha))
   };
 }
-async function readSkillVersion(store, principal, slug, version2) {
+async function readSkillVersion(store, principal, slug, version3) {
   assertPublishableSlug(slug);
-  if (!isValidSkillVersion(version2)) {
-    throw new SkillRequestError(400, "INVALID_VERSION", `version '${version2.slice(0, 40)}' is not a valid skill version (${SKILL_VERSION_RULE})`);
+  if (!isValidSkillVersion(version3)) {
+    throw new SkillRequestError(400, "INVALID_VERSION", `version '${version3.slice(0, 40)}' is not a valid skill version (${SKILL_VERSION_RULE})`);
   }
-  const found = await store.getSkillVersion(principal, slug, version2);
+  const found = await store.getSkillVersion(principal, slug, version3);
   if (!found)
-    throw new SkillRequestError(404, "SKILL_VERSION_NOT_FOUND", `no published version '${version2}' of '${slug}'`);
+    throw new SkillRequestError(404, "SKILL_VERSION_NOT_FOUND", `no published version '${version3}' of '${slug}'`);
   return found;
 }
-async function readSkillVersionBundle(store, artifactStorage, principal, slug, version2) {
-  const found = await readSkillVersion(store, principal, slug, version2);
+async function readSkillVersionBundle(store, artifactStorage, principal, slug, version3) {
+  const found = await readSkillVersion(store, principal, slug, version3);
   const resolved = await resolvePublishedSkill(store, artifactStorage, principal, slug);
   if (resolved.kind === "tombstone")
     throw new SkillRequestError(410, "SKILL_DELETED", `'${slug}' was deleted; its version bundles are withheld while the slug is deleted`);
@@ -62642,18 +62648,18 @@ async function readSkillVersionBundle(store, artifactStorage, principal, slug, v
     throw new SkillRequestError(503, "BUNDLE_BACKEND_UNAVAILABLE", "bundle storage backend unavailable");
   const actual = createHash33("sha256").update(bytes).digest("hex");
   if (actual !== found.bundleSha256) {
-    throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}@${version2}' hashes to ${actual} but was published as ${found.bundleSha256}`);
+    throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}@${version3}' hashes to ${actual} but was published as ${found.bundleSha256}`);
   }
   return { version: found, bytes, authorizationEpoch: resolved.record.authorizationEpoch };
 }
 function publishVersionOf(manifest) {
-  const version2 = optionalString(manifest.version);
-  if (version2 === undefined)
+  const version3 = optionalString(manifest.version);
+  if (version3 === undefined)
     return;
-  if (!isValidSkillVersion(version2)) {
-    throw new SkillRequestError(400, "INVALID_VERSION", `version '${version2.slice(0, 40)}' is not a valid skill version (${SKILL_VERSION_RULE})`);
+  if (!isValidSkillVersion(version3)) {
+    throw new SkillRequestError(400, "INVALID_VERSION", `version '${version3.slice(0, 40)}' is not a valid skill version (${SKILL_VERSION_RULE})`);
   }
-  return version2;
+  return version3;
 }
 
 // src/server/execution-grants-api.ts
@@ -68031,8 +68037,8 @@ function publicJob(job) {
     artifacts: (job.result?.artifacts ?? []).map(({ base64, ...meta }) => meta)
   };
 }
-function findReview(service, tenant, slug, version2, sha2563) {
-  return service.config.reviewedBundles.find((b4) => b4.slug === slug && b4.version === version2 && b4.sha256 === sha2563 && (!b4.executionContract || b4.tenantId === tenant && b4.imageDigest === service.config.imageDigest));
+function findReview(service, tenant, slug, version3, sha2563) {
+  return service.config.reviewedBundles.find((b4) => b4.slug === slug && b4.version === version3 && b4.sha256 === sha2563 && (!b4.executionContract || b4.tenantId === tenant && b4.imageDigest === service.config.imageDigest));
 }
 function sameContract(admission, contract, image) {
   return digestInput(admission.executionContract ?? null) === digestInput(contract ?? null) && (!contract || admission.runtimeImageDigest === image);
@@ -68078,13 +68084,13 @@ async function handleRuntimeApiRequest(request2, principal, service) {
       const skill = await service.productStore.getSkill(principal, id2);
       if (skill?.lifecycle === "archived")
         return refusal2("SKILL_ARCHIVED", 410);
-      const version2 = skill && !skill.tombstonedAt && await service.productStore.getSkillVersion(principal, id2, versionName);
-      if (!version2)
+      const version3 = skill && !skill.tombstonedAt && await service.productStore.getSkillVersion(principal, id2, versionName);
+      if (!version3)
         return refusal2("SKILL_VERSION_NOT_FOUND", 404);
       const pinned = query.get("bundleDigest");
-      if (pinned && pinned.replace(/^sha256:/, "") !== version2.bundleSha256)
+      if (pinned && pinned.replace(/^sha256:/, "") !== version3.bundleSha256)
         return refusal2("SELECTION_DIGEST_MISMATCH", 409);
-      const review = findReview(service, principal.orgId, id2, versionName, version2.bundleSha256);
+      const review = findReview(service, principal.orgId, id2, versionName, version3.bundleSha256);
       if (!review)
         return json3({
           contractVersion: 1,
@@ -68092,10 +68098,10 @@ async function handleRuntimeApiRequest(request2, principal, service) {
           reason: "BUNDLE_NOT_REVIEWED_FOR_CLOUD",
           skill: id2,
           version: versionName,
-          bundleDigest: version2.bundleSha256
+          bundleDigest: version3.bundleSha256
         });
       if (review.executionContract) {
-        const bytes = await reviewedBytes(service, principal, version2.bundleSha256);
+        const bytes = await reviewedBytes(service, principal, version3.bundleSha256);
         await inspectPureBundle(bytes, review.executionContract);
       }
       return json3({
@@ -68103,7 +68109,7 @@ async function handleRuntimeApiRequest(request2, principal, service) {
         eligible: true,
         skill: id2,
         version: versionName,
-        bundleDigest: version2.bundleSha256,
+        bundleDigest: version3.bundleSha256,
         runtimeImageDigest: service.config.imageDigest,
         executionContract: review.executionContract ?? { id: "pdf.v1" },
         secrets: "none",
@@ -68133,12 +68139,12 @@ async function handleRuntimeApiRequest(request2, principal, service) {
         return refusal2("SKILL_NOT_FOUND", 404);
       if (skill.lifecycle === "archived")
         return refusal2("SKILL_ARCHIVED", 410);
-      const version2 = await service.productStore.getSkillVersion(principal, id2, raw.version);
-      if (!version2)
+      const version3 = await service.productStore.getSkillVersion(principal, id2, raw.version);
+      if (!version3)
         return refusal2("SKILL_VERSION_NOT_FOUND", 404);
-      if (raw.bundleDigest !== undefined && (typeof raw.bundleDigest !== "string" || raw.bundleDigest.replace(/^sha256:/, "") !== version2.bundleSha256))
+      if (raw.bundleDigest !== undefined && (typeof raw.bundleDigest !== "string" || raw.bundleDigest.replace(/^sha256:/, "") !== version3.bundleSha256))
         return refusal2("SELECTION_DIGEST_MISMATCH", 409);
-      const review = findReview(service, principal.orgId, id2, raw.version, version2.bundleSha256);
+      const review = findReview(service, principal.orgId, id2, raw.version, version3.bundleSha256);
       if (!review)
         return refusal2("BUNDLE_NOT_REVIEWED_FOR_CLOUD", 403);
       const contract = review.executionContract;
@@ -68146,9 +68152,9 @@ async function handleRuntimeApiRequest(request2, principal, service) {
         return refusal2("PURE_SELECTION_REQUIRED", 400);
       const input = contract ? pureInput(raw.input) : runtimeInput(raw.input);
       const existing = await service.store.getRunByKey(principal.orgId, key);
-      if (existing && (existing.admission.skillId !== id2 || existing.admission.skillVersion !== raw.version || existing.admission.bundleDigest !== version2.bundleSha256 || existing.admission.inputDigest !== digestInput(input) || !sameContract(existing.admission, contract, service.config.imageDigest)))
+      if (existing && (existing.admission.skillId !== id2 || existing.admission.skillVersion !== raw.version || existing.admission.bundleDigest !== version3.bundleSha256 || existing.admission.inputDigest !== digestInput(input) || !sameContract(existing.admission, contract, service.config.imageDigest)))
         return refusal2("IDEMPOTENCY_CONFLICT", 409);
-      const bytes = await reviewedBytes(service, principal, version2.bundleSha256);
+      const bytes = await reviewedBytes(service, principal, version3.bundleSha256);
       if (contract)
         await inspectPureBundle(bytes, contract);
       const admission = createSubmitRunService({
@@ -68168,7 +68174,7 @@ async function handleRuntimeApiRequest(request2, principal, service) {
         tenantId: principal.orgId,
         skillId: id2,
         skillVersion: raw.version,
-        bundleDigest: version2.bundleSha256,
+        bundleDigest: version3.bundleSha256,
         input,
         idempotencyKey: key,
         runtime: "bun",
@@ -68178,7 +68184,7 @@ async function handleRuntimeApiRequest(request2, principal, service) {
           maxArtifactsBytes: RUNTIME_MAX_ARTIFACT_BYTES
         }
       });
-      if (run.tenantId !== principal.orgId || run.skillId !== id2 || run.skillVersion !== raw.version || run.bundleDigest !== version2.bundleSha256 || run.inputDigest !== digestInput(input) || !sameContract(run, contract, service.config.imageDigest))
+      if (run.tenantId !== principal.orgId || run.skillId !== id2 || run.skillVersion !== raw.version || run.bundleDigest !== version3.bundleSha256 || run.inputDigest !== digestInput(input) || !sameContract(run, contract, service.config.imageDigest))
         return refusal2("IDEMPOTENCY_CONFLICT", 409);
       await service.store.mutate(run.runId, (j4) => {
         if (!j4.input) {
@@ -68776,20 +68782,20 @@ class MemorySkillsStore {
   async listSkillVersions(principal, slug) {
     return Array.from(this.versions.values()).filter((v2) => v2.orgId === principal.orgId && v2.slug === slug).sort((a4, b4) => b4.createdAt.localeCompare(a4.createdAt) || b4.version.localeCompare(a4.version));
   }
-  async getSkillVersion(principal, slug, version2) {
-    const found = this.versions.get(versionKey(principal.orgId, slug, version2));
+  async getSkillVersion(principal, slug, version3) {
+    const found = this.versions.get(versionKey(principal.orgId, slug, version3));
     return found && found.orgId === principal.orgId ? found : null;
   }
   async getPublishedSelectionStates(principal, selections2) {
     if (selections2.length > MAX_PROFILE_SELECTIONS)
       throw new RangeError("Published selection lookup exceeds the profile selection limit");
-    return selections2.map(({ slug, version: version2 }) => {
+    return selections2.map(({ slug, version: version3 }) => {
       const current = this.skills.get(skillKey(principal.orgId, slug));
-      const selectedVersion = this.versions.get(versionKey(principal.orgId, slug, version2));
+      const selectedVersion = this.versions.get(versionKey(principal.orgId, slug, version3));
       const bundle2 = selectedVersion && this.bundles.get(skillKey(principal.orgId, selectedVersion.bundleSha256));
       return {
         slug,
-        version: version2,
+        version: version3,
         current: current?.orgId === principal.orgId ? {
           authorizationEpoch: current.authorizationEpoch,
           lifecycle: current.lifecycle,
@@ -68950,8 +68956,8 @@ function skillKey(orgId, slug) {
 function pinKey(orgId, principal, slug) {
   return `${orgId.length}:${orgId}:${principal.length}:${principal}:${slug}`;
 }
-function versionKey(orgId, slug, version2) {
-  return `${orgId.length}:${orgId}:${slug.length}:${slug}:${version2}`;
+function versionKey(orgId, slug, version3) {
+  return `${orgId.length}:${orgId}:${slug.length}:${slug}:${version3}`;
 }
 
 class PostgresSkillsStore {
@@ -69605,9 +69611,9 @@ class PostgresSkillsStore {
     `;
     return rows.map((row) => rowToSkillVersion(row));
   }
-  async getSkillVersion(principal, slug, version2) {
+  async getSkillVersion(principal, slug, version3) {
     const rows = await this.sql`
-      SELECT * FROM skills_versions WHERE org_id = ${principal.orgId} AND slug = ${slug} AND version = ${version2} LIMIT 1
+      SELECT * FROM skills_versions WHERE org_id = ${principal.orgId} AND slug = ${slug} AND version = ${version3} LIMIT 1
     `;
     return rows[0] ? rowToSkillVersion(rows[0]) : null;
   }
@@ -69616,7 +69622,7 @@ class PostgresSkillsStore {
       throw new RangeError("Published selection lookup exceeds the profile selection limit");
     if (!selections2.length)
       return [];
-    const requested = JSON.stringify(selections2.map(({ slug, version: version2 }) => ({ slug, version: version2 })));
+    const requested = JSON.stringify(selections2.map(({ slug, version: version3 }) => ({ slug, version: version3 })));
     const rows = await this.sql`
       SELECT q.value->>'slug' AS slug, q.value->>'version' AS version,
         r.slug IS NOT NULL AS skill_exists, r.lifecycle, r.tombstoned_at, r.authorization_epoch,
@@ -69910,20 +69916,20 @@ async function handleApiV1(store, governanceStore, principal, request2, parts, c
       return updated ? json4(publishedPayload(updated), { headers: { ETag: revisionEtag(updated.revisionId) } }) : json4({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
     }
     if (request2.method === "GET" && id2 && subresource === "versions" && childId && !parts[4]) {
-      const version2 = await readSkillVersion(store, principal, id2, childId);
+      const version3 = await readSkillVersion(store, principal, id2, childId);
       const current = (await store.getSkill(principal, id2))?.bundleSha256;
-      return json4(skillVersionPayload(version2, current));
+      return json4(skillVersionPayload(version3, current));
     }
     if (request2.method === "GET" && id2 && subresource === "versions" && childId && parts[4] === "bundle" && !parts[5]) {
-      const { version: version2, bytes, authorizationEpoch } = await readSkillVersionBundle(store, artifactStorage, principal, id2, childId);
+      const { version: version3, bytes, authorizationEpoch } = await readSkillVersionBundle(store, artifactStorage, principal, id2, childId);
       const headers = {
         "Content-Type": "application/gzip",
         "Content-Length": String(bytes.byteLength),
-        "Content-Disposition": `attachment; filename="${version2.slug}-${version2.version}.tar.gz"`,
-        "X-Skill-Bundle-Sha256": version2.bundleSha256,
-        "X-Skill-Version": version2.version,
+        "Content-Disposition": `attachment; filename="${version3.slug}-${version3.version}.tar.gz"`,
+        "X-Skill-Bundle-Sha256": version3.bundleSha256,
+        "X-Skill-Version": version3.version,
         ...authorizationEpoch ? { "X-Skill-Authorization-Epoch": authorizationEpoch } : {},
-        ETag: `"${version2.bundleSha256}"`,
+        ETag: `"${version3.bundleSha256}"`,
         "Cache-Control": "no-store"
       };
       if (config.bundleSigningKey)
@@ -71173,11 +71179,11 @@ function datetimeRegex(args) {
   regex = `${regex}(${opts.join("|")})`;
   return new RegExp(`^${regex}$`);
 }
-function isValidIP(ip, version2) {
-  if ((version2 === "v4" || !version2) && ipv4Regex.test(ip)) {
+function isValidIP(ip, version3) {
+  if ((version3 === "v4" || !version3) && ipv4Regex.test(ip)) {
     return true;
   }
-  if ((version2 === "v6" || !version2) && ipv6Regex.test(ip)) {
+  if ((version3 === "v6" || !version3) && ipv6Regex.test(ip)) {
     return true;
   }
   return false;
@@ -71204,11 +71210,11 @@ function isValidJWT(jwt, alg) {
     return false;
   }
 }
-function isValidCidr(ip, version2) {
-  if ((version2 === "v4" || !version2) && ipv4CidrRegex.test(ip)) {
+function isValidCidr(ip, version3) {
+  if ((version3 === "v4" || !version3) && ipv4CidrRegex.test(ip)) {
     return true;
   }
-  if ((version2 === "v6" || !version2) && ipv6CidrRegex.test(ip)) {
+  if ((version3 === "v6" || !version3) && ipv6CidrRegex.test(ip)) {
     return true;
   }
   return false;
@@ -74445,8 +74451,8 @@ function createRunEventEmitter(options = {}) {
   const { sink, versionFor, failOpen = false } = options;
   return {
     async emit(type, run) {
-      const version2 = versionFor ? await versionFor(run) : undefined;
-      const event = buildRunLifecycleEvent(type, run, { version: version2 });
+      const version3 = versionFor ? await versionFor(run) : undefined;
+      const event = buildRunLifecycleEvent(type, run, { version: version3 });
       validateRunLifecycleEvent(event);
       try {
         if (sink) {
@@ -74790,7 +74796,7 @@ __export(exports_external2, {
 // node_modules/zod/v4/core/index.js
 var exports_core2 = {};
 __export(exports_core2, {
-  version: () => version2,
+  version: () => version3,
   validateAsync: () => validateAsync,
   validate: () => validate2,
   util: () => exports_util,
@@ -76467,10 +76473,10 @@ function nanoidOfLength(length) {
 var duration = /^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/;
 var extendedDuration = /^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/;
 var guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
-var uuid = (version2) => {
-  if (!version2)
+var uuid = (version3) => {
+  if (!version3)
     return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
-  return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version2}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
+  return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version3}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
 };
 var uuid4 = /* @__PURE__ */ uuid(4);
 var uuid6 = /* @__PURE__ */ uuid(6);
@@ -77136,7 +77142,7 @@ ${content.join(`
 }
 
 // node_modules/zod/v4/core/versions.js
-var version2 = {
+var version3 = {
   major: 4,
   minor: 5,
   patch: 4
@@ -77148,7 +77154,7 @@ var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
   inst ?? (inst = {});
   inst._zod.def = def;
   inst._zod.bag = inst._zod.bag || {};
-  inst._zod.version = version2;
+  inst._zod.version = version3;
   const defChecks = inst._zod.def.checks;
   const checks = inst._zod.traits.has("$ZodCheck") ? [inst, ...defChecks ?? []] : defChecks?.length ? [...defChecks] : [];
   for (const ch of checks) {
@@ -92895,10 +92901,10 @@ function fromJSONSchema(schema, params) {
   } catch {
     throw new Error("fromJSONSchema input is not valid JSON (possibly cyclic); use $defs/$ref for recursive schemas");
   }
-  const version3 = detectVersion(normalized, params?.defaultTarget);
+  const version4 = detectVersion(normalized, params?.defaultTarget);
   const defs = normalized.$defs || normalized.definitions || {};
   const ctx = {
-    version: version3,
+    version: version4,
     defs,
     refs: new Map,
     processing: new Set,
@@ -94971,8 +94977,8 @@ class RemoteSkillsClient {
   async downloadSkillBundle(slug2) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug2)}/bundle`, { method: "GET" });
   }
-  async getBundle(slug2, version3) {
-    const path2 = version3 ? `/api/v1/skills/${encodeURIComponent(slug2)}/versions/${encodeURIComponent(version3)}/bundle` : `/api/v1/skills/${encodeURIComponent(slug2)}/bundle`;
+  async getBundle(slug2, version4) {
+    const path2 = version4 ? `/api/v1/skills/${encodeURIComponent(slug2)}/versions/${encodeURIComponent(version4)}/bundle` : `/api/v1/skills/${encodeURIComponent(slug2)}/bundle`;
     const response = await this.request(path2, { method: "GET" });
     if (response.status === 404)
       return null;
@@ -94989,13 +94995,13 @@ class RemoteSkillsClient {
       throw new Error(INVALID_SKILL_VERSION_RESPONSE);
     return body4.versions.map((entry) => normalizeSkillVersion(entry, slug2));
   }
-  async getSkillVersion(slug2, version3) {
-    const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug2)}/versions/${encodeURIComponent(version3)}`, undefined, { domainNotFoundCodes: ["SKILL_NOT_FOUND", "SKILL_VERSION_NOT_FOUND"] });
+  async getSkillVersion(slug2, version4) {
+    const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug2)}/versions/${encodeURIComponent(version4)}`, undefined, { domainNotFoundCodes: ["SKILL_NOT_FOUND", "SKILL_VERSION_NOT_FOUND"] });
     if (response.status === 404)
       return null;
     if (!response.ok)
       throw new Error(`version request failed: ${response.status}`);
-    return normalizeSkillVersion(await readSkillVersionPayload(response), slug2, version3);
+    return normalizeSkillVersion(await readSkillVersionPayload(response), slug2, version4);
   }
   async listPins() {
     const response = await this.requestNewRoute("/api/v1/pins");
@@ -95062,8 +95068,8 @@ async function readSkillVersionPayload(response) {
     throw new Error(INVALID_SKILL_VERSION_RESPONSE);
   }
 }
-function normalizeSkillVersion(entry, slug2, version3) {
-  if (!isVersionRecord(entry) || typeof entry.slug !== "string" || !entry.slug.trim() || entry.slug !== slug2 || typeof entry.version !== "string" || !entry.version.trim() || version3 !== undefined && entry.version !== version3 || typeof entry.bundleSha256 !== "string" || !/^[a-f0-9]{64}$/i.test(entry.bundleSha256) || typeof entry.bundleByteSize !== "number" || !Number.isSafeInteger(entry.bundleByteSize) || entry.bundleByteSize < 0 || typeof entry.createdAt !== "string" || !entry.createdAt.trim() || entry.current !== undefined && typeof entry.current !== "boolean" || entry.storageKind !== undefined && typeof entry.storageKind !== "string" || entry.manifest !== undefined && !isVersionRecord(entry.manifest)) {
+function normalizeSkillVersion(entry, slug2, version4) {
+  if (!isVersionRecord(entry) || typeof entry.slug !== "string" || !entry.slug.trim() || entry.slug !== slug2 || typeof entry.version !== "string" || !entry.version.trim() || version4 !== undefined && entry.version !== version4 || typeof entry.bundleSha256 !== "string" || !/^[a-f0-9]{64}$/i.test(entry.bundleSha256) || typeof entry.bundleByteSize !== "number" || !Number.isSafeInteger(entry.bundleByteSize) || entry.bundleByteSize < 0 || typeof entry.createdAt !== "string" || !entry.createdAt.trim() || entry.current !== undefined && typeof entry.current !== "boolean" || entry.storageKind !== undefined && typeof entry.storageKind !== "string" || entry.manifest !== undefined && !isVersionRecord(entry.manifest)) {
     throw new Error(INVALID_SKILL_VERSION_RESPONSE);
   }
   return entry;