@hasna/skills 0.10.75 → 0.10.77

package/dist/sdk/index.js

@@ -16765,7 +16765,7 @@ var require_client2 = __commonJS((exports) => {
   var { HttpRequest, parseUrl } = require_protocols();
   var { InvokeStore } = require_invoke_store();
   var { normalizeProvider } = require_dist_cjs2();
-  var { platform, release } = __require("os");
+  var { platform, release: release2 } = __require("os");
   var { versions, env } = __require("process");
   var { isValidHostLabel, isIpAddress, customEndpointFunctions } = require_endpoints();
   var { EndpointError, resolveEndpoint } = require_endpoints();
@@ -17485,7 +17485,7 @@ More information can be found at: https://a.co/c895JFp`);
       const sections = [
         ["aws-sdk-js", clientVersion],
         ["ua", "2.1"],
-        [`os/${platform()}`, release()],
+        [`os/${platform()}`, release2()],
         ["lang/js"],
         runtimeUserAgentPair
       ];
@@ -24586,7 +24586,7 @@ var require_httpAuthSchemes = __commonJS((exports) => {
 });
 
 // node_modules/@aws-sdk/credential-provider-env/dist-es/fromEnv.js
-var import_client8, import_config9, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET = "AWS_SECRET_ACCESS_KEY", ENV_SESSION = "AWS_SESSION_TOKEN", ENV_EXPIRATION = "AWS_CREDENTIAL_EXPIRATION", ENV_CREDENTIAL_SCOPE = "AWS_CREDENTIAL_SCOPE", ENV_ACCOUNT_ID = "AWS_ACCOUNT_ID", fromEnv = (init) => async () => {
+var import_client9, import_config10, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET = "AWS_SECRET_ACCESS_KEY", ENV_SESSION = "AWS_SESSION_TOKEN", ENV_EXPIRATION = "AWS_CREDENTIAL_EXPIRATION", ENV_CREDENTIAL_SCOPE = "AWS_CREDENTIAL_SCOPE", ENV_ACCOUNT_ID = "AWS_ACCOUNT_ID", fromEnv = (init) => async () => {
   init?.logger?.debug("@aws-sdk/credential-provider-env - fromEnv");
   const accessKeyId = process.env[ENV_KEY];
   const secretAccessKey = process.env[ENV_SECRET];
@@ -24603,14 +24603,14 @@ var import_client8, import_config9, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET =
       ...credentialScope && { credentialScope },
       ...accountId && { accountId }
     };
-    import_client8.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS", "g");
+    import_client9.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS", "g");
     return credentials;
   }
-  throw new import_config9.CredentialsProviderError("Unable to find environment variable credentials.", { logger: init?.logger });
+  throw new import_config10.CredentialsProviderError("Unable to find environment variable credentials.", { logger: init?.logger });
 };
 var init_fromEnv = __esm(() => {
-  import_client8 = __toESM(require_client2(), 1);
-  import_config9 = __toESM(require_config(), 1);
+  import_client9 = __toESM(require_client2(), 1);
+  import_config10 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-env/dist-es/index.js
@@ -24653,17 +24653,17 @@ function httpRequest(options) {
       hostname: options.hostname?.replace(/^\[(.+)\]$/, "$1")
     });
     req.on("error", (err) => {
-      reject(Object.assign(new import_config10.ProviderError("Unable to connect to instance metadata service"), err));
+      reject(Object.assign(new import_config11.ProviderError("Unable to connect to instance metadata service"), err));
       req.destroy();
     });
     req.on("timeout", () => {
-      reject(new import_config10.ProviderError("TimeoutError from instance metadata service"));
+      reject(new import_config11.ProviderError("TimeoutError from instance metadata service"));
       req.destroy();
     });
     req.on("response", (res) => {
       const { statusCode = 400 } = res;
       if (statusCode < 200 || 300 <= statusCode) {
-        reject(Object.assign(new import_config10.ProviderError("Error response received from instance metadata service"), { statusCode }));
+        reject(Object.assign(new import_config11.ProviderError("Error response received from instance metadata service"), { statusCode }));
         req.destroy();
       }
       const chunks = [];
@@ -24678,10 +24678,10 @@ function httpRequest(options) {
     req.end();
   });
 }
-var import_config10;
+var import_config11;
 var init_httpRequest = __esm(() => {
   init_node_http();
-  import_config10 = __toESM(require_config(), 1);
+  import_config11 = __toESM(require_config(), 1);
 });
 
 // node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/retry.js
@@ -24694,13 +24694,13 @@ var retry = (toRetry, maxRetries) => {
 };
 
 // node_modules/@smithy/credential-provider-imds/dist-es/fromContainerMetadata.js
-var import_config11, ENV_CMDS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", ENV_CMDS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", ENV_CMDS_AUTH_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromContainerMetadata = (init = {}) => {
+var import_config12, ENV_CMDS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", ENV_CMDS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", ENV_CMDS_AUTH_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromContainerMetadata = (init = {}) => {
   const { timeout: timeout2, maxRetries } = providerConfigFromInit(init);
   return () => retry(async () => {
     const requestOptions = await getCmdsUri({ logger: init.logger });
     const credsResponse = JSON.parse(await requestFromEcsImds(timeout2, requestOptions));
     if (!isImdsCredentials(credsResponse)) {
-      throw new import_config11.CredentialsProviderError("Invalid response received from instance metadata service.", {
+      throw new import_config12.CredentialsProviderError("Invalid response received from instance metadata service.", {
         logger: init.logger
       });
     }
@@ -24730,16 +24730,16 @@ var import_config11, ENV_CMDS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", E
     try {
       parsed = new URL(process.env[ENV_CMDS_FULL_URI]);
     } catch {
-      throw new import_config11.CredentialsProviderError(`${process.env[ENV_CMDS_FULL_URI]} is not a valid container metadata service URL`, { tryNextLink: false, logger });
+      throw new import_config12.CredentialsProviderError(`${process.env[ENV_CMDS_FULL_URI]} is not a valid container metadata service URL`, { tryNextLink: false, logger });
     }
     if (!parsed.hostname || !GREENGRASS_HOSTS.has(parsed.hostname)) {
-      throw new import_config11.CredentialsProviderError(`${parsed.hostname} is not a valid container metadata service hostname`, {
+      throw new import_config12.CredentialsProviderError(`${parsed.hostname} is not a valid container metadata service hostname`, {
         tryNextLink: false,
         logger
       });
     }
     if (!parsed.protocol || !GREENGRASS_PROTOCOLS.has(parsed.protocol)) {
-      throw new import_config11.CredentialsProviderError(`${parsed.protocol} is not a valid container metadata service protocol`, {
+      throw new import_config12.CredentialsProviderError(`${parsed.protocol} is not a valid container metadata service protocol`, {
         tryNextLink: false,
         logger
       });
@@ -24751,23 +24751,23 @@ var import_config11, ENV_CMDS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", E
       port: parsed.port ? parseInt(parsed.port, 10) : undefined
     };
   }
-  throw new import_config11.CredentialsProviderError("The container metadata credential provider cannot be used unless" + ` the ${ENV_CMDS_RELATIVE_URI} or ${ENV_CMDS_FULL_URI} environment` + " variable is set", {
+  throw new import_config12.CredentialsProviderError("The container metadata credential provider cannot be used unless" + ` the ${ENV_CMDS_RELATIVE_URI} or ${ENV_CMDS_FULL_URI} environment` + " variable is set", {
     tryNextLink: false,
     logger
   });
 };
 var init_fromContainerMetadata = __esm(() => {
   init_httpRequest();
-  import_config11 = __toESM(require_config(), 1);
+  import_config12 = __toESM(require_config(), 1);
   GREENGRASS_HOSTS = new Set(["localhost", "127.0.0.1"]);
   GREENGRASS_PROTOCOLS = new Set(["http:", "https:"]);
 });
 
 // node_modules/@smithy/credential-provider-imds/dist-es/error/InstanceMetadataV1FallbackError.js
-var import_config12, InstanceMetadataV1FallbackError;
+var import_config13, InstanceMetadataV1FallbackError;
 var init_InstanceMetadataV1FallbackError = __esm(() => {
-  import_config12 = __toESM(require_config(), 1);
-  InstanceMetadataV1FallbackError = class InstanceMetadataV1FallbackError extends import_config12.CredentialsProviderError {
+  import_config13 = __toESM(require_config(), 1);
+  InstanceMetadataV1FallbackError = class InstanceMetadataV1FallbackError extends import_config13.CredentialsProviderError {
     tryNextLink;
     name = "InstanceMetadataV1FallbackError";
     constructor(message, tryNextLink = true) {
@@ -24818,8 +24818,8 @@ var init_EndpointModeConfigOptions = __esm(() => {
 });
 
 // node_modules/@smithy/credential-provider-imds/dist-es/utils/getInstanceMetadataEndpoint.js
-var import_config13, import_protocols, getInstanceMetadataEndpoint = async () => import_protocols.parseUrl(await getFromEndpointConfig() || await getFromEndpointModeConfig()), getFromEndpointConfig = async () => import_config13.loadConfig(ENDPOINT_CONFIG_OPTIONS)(), getFromEndpointModeConfig = async () => {
-  const endpointMode = await import_config13.loadConfig(ENDPOINT_MODE_CONFIG_OPTIONS)();
+var import_config14, import_protocols, getInstanceMetadataEndpoint = async () => import_protocols.parseUrl(await getFromEndpointConfig() || await getFromEndpointModeConfig()), getFromEndpointConfig = async () => import_config14.loadConfig(ENDPOINT_CONFIG_OPTIONS)(), getFromEndpointModeConfig = async () => {
+  const endpointMode = await import_config14.loadConfig(ENDPOINT_MODE_CONFIG_OPTIONS)();
   switch (endpointMode) {
     case EndpointMode.IPv4:
       return Endpoint.IPv4;
@@ -24834,7 +24834,7 @@ var init_getInstanceMetadataEndpoint = __esm(() => {
   init_EndpointConfigOptions();
   init_EndpointMode();
   init_EndpointModeConfigOptions();
-  import_config13 = __toESM(require_config(), 1);
+  import_config14 = __toESM(require_config(), 1);
   import_protocols = __toESM(require_protocols(), 1);
 });
 
@@ -24884,7 +24884,7 @@ var init_staticStabilityProvider = __esm(() => {
 });
 
 // node_modules/@smithy/credential-provider-imds/dist-es/fromInstanceMetadata.js
-var import_config14, IMDS_PATH = "/latest/meta-data/iam/security-credentials/", IMDS_TOKEN_PATH = "/latest/api/token", AWS_EC2_METADATA_V1_DISABLED = "AWS_EC2_METADATA_V1_DISABLED", PROFILE_AWS_EC2_METADATA_V1_DISABLED = "ec2_metadata_v1_disabled", X_AWS_EC2_METADATA_TOKEN = "x-aws-ec2-metadata-token", fromInstanceMetadata = (init = {}) => staticStabilityProvider(getInstanceMetadataProvider(init), { logger: init.logger }), getInstanceMetadataProvider = (init = {}) => {
+var import_config15, IMDS_PATH = "/latest/meta-data/iam/security-credentials/", IMDS_TOKEN_PATH = "/latest/api/token", AWS_EC2_METADATA_V1_DISABLED = "AWS_EC2_METADATA_V1_DISABLED", PROFILE_AWS_EC2_METADATA_V1_DISABLED = "ec2_metadata_v1_disabled", X_AWS_EC2_METADATA_TOKEN = "x-aws-ec2-metadata-token", fromInstanceMetadata = (init = {}) => staticStabilityProvider(getInstanceMetadataProvider(init), { logger: init.logger }), getInstanceMetadataProvider = (init = {}) => {
   let disableFetchToken = false;
   const { logger, profile } = init;
   const { timeout: timeout2, maxRetries } = providerConfigFromInit(init);
@@ -24893,12 +24893,12 @@ var import_config14, IMDS_PATH = "/latest/meta-data/iam/security-credentials/",
     if (isImdsV1Fallback) {
       let fallbackBlockedFromProfile = false;
       let fallbackBlockedFromProcessEnv = false;
-      const configValue = await import_config14.loadConfig({
+      const configValue = await import_config15.loadConfig({
         environmentVariableSelector: (env) => {
           const envValue = env[AWS_EC2_METADATA_V1_DISABLED];
           fallbackBlockedFromProcessEnv = !!envValue && envValue !== "false";
           if (envValue === undefined) {
-            throw new import_config14.CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`, { logger: init.logger });
+            throw new import_config15.CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`, { logger: init.logger });
           }
           return fallbackBlockedFromProcessEnv;
         },
@@ -24989,7 +24989,7 @@ var import_config14, IMDS_PATH = "/latest/meta-data/iam/security-credentials/",
     path: IMDS_PATH + profile
   })).toString());
   if (!isImdsCredentials(credentialsResponse)) {
-    throw new import_config14.CredentialsProviderError("Invalid response received from instance metadata service.", {
+    throw new import_config15.CredentialsProviderError("Invalid response received from instance metadata service.", {
       logger: init.logger
     });
   }
@@ -25000,7 +25000,7 @@ var init_fromInstanceMetadata = __esm(() => {
   init_httpRequest();
   init_getInstanceMetadataEndpoint();
   init_staticStabilityProvider();
-  import_config14 = __toESM(require_config(), 1);
+  import_config15 = __toESM(require_config(), 1);
 });
 
 // node_modules/@smithy/credential-provider-imds/dist-es/index.js
@@ -25853,7 +25853,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
 });
 
 // node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/checkUrl.js
-var import_config15, ECS_CONTAINER_HOST = "169.254.170.2", EKS_CONTAINER_HOST_IPv4 = "169.254.170.23", EKS_CONTAINER_HOST_IPv6 = "[fd00:ec2::23]", checkUrl = (url, logger) => {
+var import_config16, ECS_CONTAINER_HOST = "169.254.170.2", EKS_CONTAINER_HOST_IPv4 = "169.254.170.23", EKS_CONTAINER_HOST_IPv6 = "[fd00:ec2::23]", checkUrl = (url, logger) => {
   if (url.protocol === "https:") {
     return;
   }
@@ -25877,13 +25877,13 @@ var import_config15, ECS_CONTAINER_HOST = "169.254.170.2", EKS_CONTAINER_HOST_IP
       return;
     }
   }
-  throw new import_config15.CredentialsProviderError(`URL not accepted. It must either be HTTPS or match one of the following:
+  throw new import_config16.CredentialsProviderError(`URL not accepted. It must either be HTTPS or match one of the following:
   - loopback CIDR 127.0.0.0/8 or [::1/128]
   - ECS container host 169.254.170.2
   - EKS container host 169.254.170.23 or [fd00:ec2::23]`, { logger });
 };
 var init_checkUrl = __esm(() => {
-  import_config15 = __toESM(require_config(), 1);
+  import_config16 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/requestHelpers.js
@@ -25906,7 +25906,7 @@ async function getCredentials(response, logger) {
   if (response.statusCode === 200) {
     const parsed = JSON.parse(str);
     if (typeof parsed.AccessKeyId !== "string" || typeof parsed.SecretAccessKey !== "string" || typeof parsed.Token !== "string" || typeof parsed.Expiration !== "string") {
-      throw new import_config16.CredentialsProviderError("HTTP credential provider response not of the required format, an object matching: " + "{ AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }", { logger });
+      throw new import_config17.CredentialsProviderError("HTTP credential provider response not of the required format, an object matching: " + "{ AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }", { logger });
     }
     return {
       accessKeyId: parsed.AccessKeyId,
@@ -25920,16 +25920,16 @@ async function getCredentials(response, logger) {
     try {
       parsedBody = JSON.parse(str);
     } catch (e3) {}
-    throw Object.assign(new import_config16.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger }), {
+    throw Object.assign(new import_config17.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger }), {
       Code: parsedBody.Code,
       Message: parsedBody.Message
     });
   }
-  throw new import_config16.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger });
+  throw new import_config17.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger });
 }
-var import_config16, import_protocols2, import_serde, import_serde2;
+var import_config17, import_protocols2, import_serde, import_serde2;
 var init_requestHelpers = __esm(() => {
-  import_config16 = __toESM(require_config(), 1);
+  import_config17 = __toESM(require_config(), 1);
   import_protocols2 = __toESM(require_protocols(), 1);
   import_serde = __toESM(require_serde(), 1);
   import_serde2 = __toESM(require_serde(), 1);
@@ -25951,7 +25951,7 @@ var retryWrapper = (toRetry, maxRetries, delayMs) => {
 
 // node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/fromHttp.js
 import fs from "fs/promises";
-var import_client9, import_config17, import_node_http_handler, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2", AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromHttp = (options = {}) => {
+var import_client10, import_config18, import_node_http_handler, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2", AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromHttp = (options = {}) => {
   options.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");
   let host;
   const relative12 = options.awsContainerCredentialsRelativeUri ?? process.env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI];
@@ -25972,7 +25972,7 @@ var import_client9, import_config17, import_node_http_handler, AWS_CONTAINER_CRE
   } else if (full) {
     host = full;
   } else {
-    throw new import_config17.CredentialsProviderError(`No HTTP credential provider host provided.
+    throw new import_config18.CredentialsProviderError(`No HTTP credential provider host provided.
 Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`, { logger: options.logger });
   }
   const url = new URL(host);
@@ -25988,9 +25988,9 @@ Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
     }
     try {
       const result = await requestHandler.handle(request2, { requestTimeout });
-      return getCredentials(result.response).then((creds) => import_client9.setCredentialFeature(creds, "CREDENTIALS_HTTP", "z"));
+      return getCredentials(result.response).then((creds) => import_client10.setCredentialFeature(creds, "CREDENTIALS_HTTP", "z"));
     } catch (e3) {
-      throw new import_config17.CredentialsProviderError(String(e3), { logger: options.logger });
+      throw new import_config18.CredentialsProviderError(String(e3), { logger: options.logger });
     }
   }, options.maxRetries ?? 3, options.timeout ?? 1000);
   return async () => {
@@ -26003,15 +26003,15 @@ Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
 }, validateToken = (token) => {
   if (token.includes(`\r
 `)) {
-    throw new import_config17.CredentialsProviderError("Authorization token contains invalid \\r\\n sequence.");
+    throw new import_config18.CredentialsProviderError("Authorization token contains invalid \\r\\n sequence.");
   }
   return token;
 };
 var init_fromHttp = __esm(() => {
   init_checkUrl();
   init_requestHelpers();
-  import_client9 = __toESM(require_client2(), 1);
-  import_config17 = __toESM(require_config(), 1);
+  import_client10 = __toESM(require_client2(), 1);
+  import_config18 = __toESM(require_config(), 1);
   import_node_http_handler = __toESM(require_dist_cjs6(), 1);
 });
 
@@ -26814,70 +26814,70 @@ var getNewSsoOidcToken = async (ssoToken, ssoRegion, init = {}, callerClientConf
 var init_getNewSsoOidcToken = () => {};
 
 // node_modules/@aws-sdk/token-providers/dist-es/validateTokenExpiry.js
-var import_config19, validateTokenExpiry = (token) => {
+var import_config20, validateTokenExpiry = (token) => {
   if (token.expiration && token.expiration.getTime() < Date.now()) {
-    throw new import_config19.TokenProviderError(`Token is expired. ${REFRESH_MESSAGE}`, false);
+    throw new import_config20.TokenProviderError(`Token is expired. ${REFRESH_MESSAGE}`, false);
   }
 };
 var init_validateTokenExpiry = __esm(() => {
   init_constants();
-  import_config19 = __toESM(require_config(), 1);
+  import_config20 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/token-providers/dist-es/validateTokenKey.js
-var import_config20, validateTokenKey = (key2, value, forRefresh = false) => {
+var import_config21, validateTokenKey = (key2, value, forRefresh = false) => {
   if (typeof value === "undefined") {
-    throw new import_config20.TokenProviderError(`Value not present for '${key2}' in SSO Token${forRefresh ? ". Cannot refresh" : ""}. ${REFRESH_MESSAGE}`, false);
+    throw new import_config21.TokenProviderError(`Value not present for '${key2}' in SSO Token${forRefresh ? ". Cannot refresh" : ""}. ${REFRESH_MESSAGE}`, false);
   }
 };
 var init_validateTokenKey = __esm(() => {
   init_constants();
-  import_config20 = __toESM(require_config(), 1);
+  import_config21 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/token-providers/dist-es/writeSSOTokenToFile.js
 import { promises as fsPromises } from "fs";
-var import_config21, writeFile, writeSSOTokenToFile = (id2, ssoToken) => {
-  const tokenFilepath = import_config21.getSSOTokenFilepath(id2);
+var import_config22, writeFile, writeSSOTokenToFile = (id2, ssoToken) => {
+  const tokenFilepath = import_config22.getSSOTokenFilepath(id2);
   const tokenString = JSON.stringify(ssoToken, null, 2);
   return writeFile(tokenFilepath, tokenString);
 };
 var init_writeSSOTokenToFile = __esm(() => {
-  import_config21 = __toESM(require_config(), 1);
+  import_config22 = __toESM(require_config(), 1);
   ({ writeFile } = fsPromises);
 });
 
 // node_modules/@aws-sdk/token-providers/dist-es/fromSso.js
-var import_config22, lastRefreshAttemptTimes, fromSso = (init = {}) => async ({ callerClientConfig } = {}) => {
+var import_config23, lastRefreshAttemptTimes, fromSso = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/token-providers - fromSso");
-  const profiles = await import_config22.parseKnownFiles(init);
-  const profileName = import_config22.getProfileName({
+  const profiles = await import_config23.parseKnownFiles(init);
+  const profileName = import_config23.getProfileName({
     profile: init.profile ?? callerClientConfig?.profile
   });
   const profile = profiles[profileName];
   if (!profile) {
-    throw new import_config22.TokenProviderError(`Profile '${profileName}' could not be found in shared credentials file.`, false);
+    throw new import_config23.TokenProviderError(`Profile '${profileName}' could not be found in shared credentials file.`, false);
   } else if (!profile["sso_session"]) {
-    throw new import_config22.TokenProviderError(`Profile '${profileName}' is missing required property 'sso_session'.`);
+    throw new import_config23.TokenProviderError(`Profile '${profileName}' is missing required property 'sso_session'.`);
   }
   const ssoSessionName = profile["sso_session"];
-  const ssoSessions = await import_config22.loadSsoSessionData(init);
+  const ssoSessions = await import_config23.loadSsoSessionData(init);
   const ssoSession = ssoSessions[ssoSessionName];
   if (!ssoSession) {
-    throw new import_config22.TokenProviderError(`Sso session '${ssoSessionName}' could not be found in shared credentials file.`, false);
+    throw new import_config23.TokenProviderError(`Sso session '${ssoSessionName}' could not be found in shared credentials file.`, false);
   }
   for (const ssoSessionRequiredKey of ["sso_start_url", "sso_region"]) {
     if (!ssoSession[ssoSessionRequiredKey]) {
-      throw new import_config22.TokenProviderError(`Sso session '${ssoSessionName}' is missing required property '${ssoSessionRequiredKey}'.`, false);
+      throw new import_config23.TokenProviderError(`Sso session '${ssoSessionName}' is missing required property '${ssoSessionRequiredKey}'.`, false);
     }
   }
   const ssoStartUrl = ssoSession["sso_start_url"];
   const ssoRegion = ssoSession["sso_region"];
   let ssoToken;
   try {
-    ssoToken = await import_config22.getSSOTokenFromFile(ssoSessionName);
+    ssoToken = await import_config23.getSSOTokenFromFile(ssoSessionName);
   } catch (e3) {
-    throw new import_config22.TokenProviderError(`The SSO session token associated with profile=${profileName} was not found or is invalid. ${REFRESH_MESSAGE}`, false);
+    throw new import_config23.TokenProviderError(`The SSO session token associated with profile=${profileName} was not found or is invalid. ${REFRESH_MESSAGE}`, false);
   }
   validateTokenKey("accessToken", ssoToken.accessToken);
   validateTokenKey("expiresAt", ssoToken.expiresAt);
@@ -26926,7 +26926,7 @@ var init_fromSso = __esm(() => {
   init_validateTokenExpiry();
   init_validateTokenKey();
   init_writeSSOTokenToFile();
-  import_config22 = __toESM(require_config(), 1);
+  import_config23 = __toESM(require_config(), 1);
   lastRefreshAttemptTimes = new Map;
 });
 
@@ -27394,7 +27394,7 @@ var init_loadSso = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-sso/dist-es/resolveSSOCredentials.js
-var import_client10, import_config23, SHOULD_FAIL_CREDENTIAL_CHAIN = false, resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger }) => {
+var import_client11, import_config24, SHOULD_FAIL_CREDENTIAL_CHAIN = false, resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger }) => {
   let token;
   const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
   if (ssoSession) {
@@ -27413,23 +27413,23 @@ var import_client10, import_config23, SHOULD_FAIL_CREDENTIAL_CHAIN = false, reso
         expiresAt: new Date(_token.expiration).toISOString()
       };
     } catch (e4) {
-      throw new import_config23.CredentialsProviderError(e4.message, {
+      throw new import_config24.CredentialsProviderError(e4.message, {
         tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
         logger
       });
     }
   } else {
     try {
-      token = await import_config23.getSSOTokenFromFile(ssoStartUrl);
+      token = await import_config24.getSSOTokenFromFile(ssoStartUrl);
     } catch (e4) {
-      throw new import_config23.CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, {
+      throw new import_config24.CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, {
         tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
         logger
       });
     }
   }
   if (new Date(token.expiresAt).getTime() - Date.now() <= 0) {
-    throw new import_config23.CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, {
+    throw new import_config24.CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, {
       tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
       logger
     });
@@ -27449,14 +27449,14 @@ var import_client10, import_config23, SHOULD_FAIL_CREDENTIAL_CHAIN = false, reso
       accessToken
     }));
   } catch (e4) {
-    throw new import_config23.CredentialsProviderError(e4, {
+    throw new import_config24.CredentialsProviderError(e4, {
       tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
       logger
     });
   }
   const { roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration, credentialScope, accountId } = {} } = ssoResp;
   if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {
-    throw new import_config23.CredentialsProviderError("SSO returns an invalid temporary credential.", {
+    throw new import_config24.CredentialsProviderError("SSO returns an invalid temporary credential.", {
       tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
       logger
     });
@@ -27470,62 +27470,62 @@ var import_client10, import_config23, SHOULD_FAIL_CREDENTIAL_CHAIN = false, reso
     ...accountId && { accountId }
   };
   if (ssoSession) {
-    import_client10.setCredentialFeature(credentials, "CREDENTIALS_SSO", "s");
+    import_client11.setCredentialFeature(credentials, "CREDENTIALS_SSO", "s");
   } else {
-    import_client10.setCredentialFeature(credentials, "CREDENTIALS_SSO_LEGACY", "u");
+    import_client11.setCredentialFeature(credentials, "CREDENTIALS_SSO_LEGACY", "u");
   }
   return credentials;
 };
 var init_resolveSSOCredentials = __esm(() => {
   init_dist_es4();
-  import_client10 = __toESM(require_client2(), 1);
-  import_config23 = __toESM(require_config(), 1);
+  import_client11 = __toESM(require_client2(), 1);
+  import_config24 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-sso/dist-es/validateSsoProfile.js
-var import_config24, validateSsoProfile = (profile, logger) => {
+var import_config25, validateSsoProfile = (profile, logger) => {
   const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;
   if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {
-    throw new import_config24.CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", ` + `"sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(profile).join(", ")}
+    throw new import_config25.CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", ` + `"sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(profile).join(", ")}
 Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`, { tryNextLink: false, logger });
   }
   return profile;
 };
 var init_validateSsoProfile = __esm(() => {
-  import_config24 = __toESM(require_config(), 1);
+  import_config25 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-sso/dist-es/fromSSO.js
-var import_config25, fromSSO = (init = {}) => async ({ callerClientConfig } = {}) => {
+var import_config26, fromSSO = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");
   const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
   const { ssoClient } = init;
-  const profileName = import_config25.getProfileName({
+  const profileName = import_config26.getProfileName({
     profile: init.profile ?? callerClientConfig?.profile
   });
   if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
-    const profiles = await import_config25.parseKnownFiles(init);
+    const profiles = await import_config26.parseKnownFiles(init);
     const profile = profiles[profileName];
     if (!profile) {
-      throw new import_config25.CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });
+      throw new import_config26.CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });
     }
     if (!isSsoProfile(profile)) {
-      throw new import_config25.CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {
+      throw new import_config26.CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {
         logger: init.logger
       });
     }
     if (profile?.sso_session) {
-      const ssoSessions = await import_config25.loadSsoSessionData(init);
+      const ssoSessions = await import_config26.loadSsoSessionData(init);
       const session = ssoSessions[profile.sso_session];
       const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;
       if (ssoRegion && ssoRegion !== session.sso_region) {
-        throw new import_config25.CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {
+        throw new import_config26.CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {
           tryNextLink: false,
           logger: init.logger
         });
       }
       if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {
-        throw new import_config25.CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {
+        throw new import_config26.CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {
           tryNextLink: false,
           logger: init.logger
         });
@@ -27551,7 +27551,7 @@ var import_config25, fromSSO = (init = {}) => async ({ callerClientConfig } = {}
       logger: init.logger
     });
   } else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {
-    throw new import_config25.CredentialsProviderError("Incomplete configuration. The fromSSO() argument hash must include " + '"ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"', { tryNextLink: false, logger: init.logger });
+    throw new import_config26.CredentialsProviderError("Incomplete configuration. The fromSSO() argument hash must include " + '"ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"', { tryNextLink: false, logger: init.logger });
   } else {
     return resolveSSOCredentials({
       ssoStartUrl,
@@ -27574,7 +27574,7 @@ var import_config25, fromSSO = (init = {}) => async ({ callerClientConfig } = {}
 var init_fromSSO = __esm(() => {
   init_resolveSSOCredentials();
   init_validateSsoProfile();
-  import_config25 = __toESM(require_config(), 1);
+  import_config26 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-sso/dist-es/index.js
@@ -27590,13 +27590,13 @@ var init_dist_es5 = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveCredentialSource.js
-var import_client11, import_config26, resolveCredentialSource = (credentialSource, profileName, logger) => {
+var import_client12, import_config27, resolveCredentialSource = (credentialSource, profileName, logger) => {
   const sourceProvidersMap = {
     EcsContainer: async (options) => {
       const { fromHttp: fromHttp2 } = await Promise.resolve().then(() => (init_dist_es3(), exports_dist_es3));
       const { fromContainerMetadata: fromContainerMetadata2 } = await Promise.resolve().then(() => (init_dist_es2(), exports_dist_es2));
       logger?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer");
-      return async () => import_config26.chain(fromHttp2(options ?? {}), fromContainerMetadata2(options))().then(setNamedProvider);
+      return async () => import_config27.chain(fromHttp2(options ?? {}), fromContainerMetadata2(options))().then(setNamedProvider);
     },
     Ec2InstanceMetadata: async (options) => {
       logger?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");
@@ -27612,12 +27612,12 @@ var import_client11, import_config26, resolveCredentialSource = (credentialSourc
   if (credentialSource in sourceProvidersMap) {
     return sourceProvidersMap[credentialSource];
   } else {
-    throw new import_config26.CredentialsProviderError(`Unsupported credential source in profile ${profileName}. Got ${credentialSource}, expected EcsContainer or Ec2InstanceMetadata or Environment.`, { logger });
+    throw new import_config27.CredentialsProviderError(`Unsupported credential source in profile ${profileName}. Got ${credentialSource}, expected EcsContainer or Ec2InstanceMetadata or Environment.`, { logger });
   }
-}, setNamedProvider = (creds) => import_client11.setCredentialFeature(creds, "CREDENTIALS_PROFILE_NAMED_PROVIDER", "p");
+}, setNamedProvider = (creds) => import_client12.setCredentialFeature(creds, "CREDENTIALS_PROFILE_NAMED_PROVIDER", "p");
 var init_resolveCredentialSource = __esm(() => {
-  import_client11 = __toESM(require_client2(), 1);
-  import_config26 = __toESM(require_config(), 1);
+  import_client12 = __toESM(require_client2(), 1);
+  import_config27 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sts/index.js
@@ -28643,7 +28643,7 @@ var require_sts = __commonJS((exports) => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveAssumeRoleCredentials.js
-var import_client12, import_config27, isAssumeRoleProfile = (arg, { profile = "default", logger } = {}) => {
+var import_client13, import_config28, isAssumeRoleProfile = (arg, { profile = "default", logger } = {}) => {
   return Boolean(arg) && typeof arg === "object" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1 && ["undefined", "string"].indexOf(typeof arg.external_id) > -1 && ["undefined", "string"].indexOf(typeof arg.mfa_serial) > -1 && (isAssumeRoleWithSourceProfile(arg, { profile, logger }) || isCredentialSourceProfile(arg, { profile, logger }));
 }, isAssumeRoleWithSourceProfile = (arg, { profile, logger }) => {
   const withSourceProfile = typeof arg.source_profile === "string" && typeof arg.credential_source === "undefined";
@@ -28674,7 +28674,7 @@ var import_client12, import_config27, isAssumeRoleProfile = (arg, { profile = "d
     }, options.clientPlugins);
   }
   if (source_profile && source_profile in visitedProfiles) {
-    throw new import_config27.CredentialsProviderError(`Detected a cycle attempting to resolve credentials for profile ${import_config27.getProfileName(options)}. Profiles visited: ` + Object.keys(visitedProfiles).join(", "), { logger: options.logger });
+    throw new import_config28.CredentialsProviderError(`Detected a cycle attempting to resolve credentials for profile ${import_config28.getProfileName(options)}. Profiles visited: ` + Object.keys(visitedProfiles).join(", "), { logger: options.logger });
   }
   options.logger?.debug(`@aws-sdk/credential-provider-ini - finding credential resolver using ${source_profile ? `source_profile=[${source_profile}]` : `profile=[${profileName}]`}`);
   const sourceCredsProvider = source_profile ? resolveProfileData(source_profile, profiles, options, callerClientConfig, {
@@ -28682,7 +28682,7 @@ var import_client12, import_config27, isAssumeRoleProfile = (arg, { profile = "d
     [source_profile]: true
   }, isCredentialSourceWithoutRoleArn(profiles[source_profile] ?? {})) : (await resolveCredentialSource(profileData.credential_source, profileName, options.logger)(options))();
   if (isCredentialSourceWithoutRoleArn(profileData)) {
-    return sourceCredsProvider.then((creds) => import_client12.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
+    return sourceCredsProvider.then((creds) => import_client13.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
   } else {
     const params = {
       RoleArn: profileData.role_arn,
@@ -28693,21 +28693,21 @@ var import_client12, import_config27, isAssumeRoleProfile = (arg, { profile = "d
     const { mfa_serial } = profileData;
     if (mfa_serial) {
       if (!options.mfaCodeProvider) {
-        throw new import_config27.CredentialsProviderError(`Profile ${profileName} requires multi-factor authentication, but no MFA code callback was provided.`, { logger: options.logger, tryNextLink: false });
+        throw new import_config28.CredentialsProviderError(`Profile ${profileName} requires multi-factor authentication, but no MFA code callback was provided.`, { logger: options.logger, tryNextLink: false });
       }
       params.SerialNumber = mfa_serial;
       params.TokenCode = await options.mfaCodeProvider(mfa_serial);
     }
     const sourceCreds = await sourceCredsProvider;
-    return options.roleAssumer(sourceCreds, params).then((creds) => import_client12.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
+    return options.roleAssumer(sourceCreds, params).then((creds) => import_client13.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
   }
 }, isCredentialSourceWithoutRoleArn = (section) => {
   return !section.role_arn && !!section.credential_source;
 };
 var init_resolveAssumeRoleCredentials = __esm(() => {
   init_resolveCredentialSource();
-  import_client12 = __toESM(require_client2(), 1);
-  import_config27 = __toESM(require_config(), 1);
+  import_client13 = __toESM(require_client2(), 1);
+  import_config28 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/signin/index.js
@@ -29447,9 +29447,9 @@ import { createHash as createHash33, createPrivateKey, createPublicKey, sign } f
 import { promises as fs2 } from "fs";
 import { homedir as homedir7 } from "os";
 import { dirname as dirname30, join as join44 } from "path";
-var import_config28, import_protocols3, LoginCredentialsFetcher;
+var import_config29, import_protocols3, LoginCredentialsFetcher;
 var init_LoginCredentialsFetcher = __esm(() => {
-  import_config28 = __toESM(require_config(), 1);
+  import_config29 = __toESM(require_config(), 1);
   import_protocols3 = __toESM(require_protocols(), 1);
   LoginCredentialsFetcher = class LoginCredentialsFetcher {
     profileData;
@@ -29464,7 +29464,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
     async loadCredentials() {
       const token = await this.loadToken();
       if (!token) {
-        throw new import_config28.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`, { tryNextLink: false, logger: this.logger });
+        throw new import_config29.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`, { tryNextLink: false, logger: this.logger });
       }
       const accessToken = token.accessToken;
       const now = Date.now();
@@ -29531,7 +29531,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
         const { accessKeyId, secretAccessKey, sessionToken } = response.tokenOutput?.accessToken ?? {};
         const { refreshToken, expiresIn } = response.tokenOutput ?? {};
         if (!accessKeyId || !secretAccessKey || !sessionToken || !refreshToken) {
-          throw new import_config28.CredentialsProviderError("Token refresh response missing required fields", {
+          throw new import_config29.CredentialsProviderError("Token refresh response missing required fields", {
             logger: this.logger,
             tryNextLink: false
           });
@@ -29568,7 +29568,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
             default:
               message = `Failed to refresh token: ${String(error)}. Please re-authenticate using \`aws login\``;
           }
-          throw new import_config28.CredentialsProviderError(message, {
+          throw new import_config29.CredentialsProviderError(message, {
             logger: this.logger,
             tryNextLink: false
           });
@@ -29578,7 +29578,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
           this.logger?.warn?.(`Failed to refresh token: ${String(error)}. Using existing token until expiry.`);
           return this.toCredentials(freshToken.accessToken);
         }
-        throw new import_config28.CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });
+        throw new import_config29.CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });
       }
     }
     async loadToken() {
@@ -29591,14 +29591,14 @@ var init_LoginCredentialsFetcher = __esm(() => {
           missingFields.push("accountId");
         }
         if (missingFields.length > 0) {
-          throw new import_config28.CredentialsProviderError(`Token validation failed, missing fields: ${missingFields.join(", ")}`, {
+          throw new import_config29.CredentialsProviderError(`Token validation failed, missing fields: ${missingFields.join(", ")}`, {
             logger: this.logger,
             tryNextLink: false
           });
         }
         return token;
       } catch (error) {
-        throw new import_config28.CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error)}`, {
+        throw new import_config29.CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error)}`, {
           logger: this.logger,
           tryNextLink: false
         });
@@ -29700,34 +29700,34 @@ var init_LoginCredentialsFetcher = __esm(() => {
         const signatureB64 = rawSignature.toString("base64url");
         return `${message}.${signatureB64}`;
       } catch (error) {
-        throw new import_config28.CredentialsProviderError(`Failed to generate Dpop proof: ${error instanceof Error ? error.message : String(error)}`, { logger: this.logger, tryNextLink: false });
+        throw new import_config29.CredentialsProviderError(`Failed to generate Dpop proof: ${error instanceof Error ? error.message : String(error)}`, { logger: this.logger, tryNextLink: false });
       }
     }
   };
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/credential-provider-login/dist-es/fromLoginCredentials.js
-var import_client13, import_config29, fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
+var import_client14, import_config30, fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
   init?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");
-  const profiles = await import_config29.parseKnownFiles(init || {});
-  const profileName = import_config29.getProfileName({
+  const profiles = await import_config30.parseKnownFiles(init || {});
+  const profileName = import_config30.getProfileName({
     profile: init?.profile ?? callerClientConfig?.profile
   });
   const profile = profiles[profileName];
   if (!profile?.login_session) {
-    throw new import_config29.CredentialsProviderError(`Profile ${profileName} does not contain login_session.`, {
+    throw new import_config30.CredentialsProviderError(`Profile ${profileName} does not contain login_session.`, {
       tryNextLink: true,
       logger: init?.logger
     });
   }
   const fetcher = new LoginCredentialsFetcher(profile, init, callerClientConfig);
   const credentials = await fetcher.loadCredentials();
-  return import_client13.setCredentialFeature(credentials, "CREDENTIALS_LOGIN", "AD");
+  return import_client14.setCredentialFeature(credentials, "CREDENTIALS_LOGIN", "AD");
 };
 var init_fromLoginCredentials = __esm(() => {
   init_LoginCredentialsFetcher();
-  import_client13 = __toESM(require_client2(), 1);
-  import_config29 = __toESM(require_config(), 1);
+  import_client14 = __toESM(require_client2(), 1);
+  import_config30 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/credential-provider-login/dist-es/index.js
@@ -29740,7 +29740,7 @@ var init_dist_es6 = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveLoginCredentials.js
-var import_client14, isLoginProfile = (data) => {
+var import_client15, isLoginProfile = (data) => {
   return Boolean(data && data.login_session);
 }, resolveLoginCredentials = async (profileName, options, callerClientConfig) => {
   const { fromLoginCredentials: fromLoginCredentials2 } = await Promise.resolve().then(() => (init_dist_es6(), exports_dist_es5));
@@ -29748,14 +29748,14 @@ var import_client14, isLoginProfile = (data) => {
     ...options,
     profile: profileName
   })({ callerClientConfig });
-  return import_client14.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_LOGIN", "AC");
+  return import_client15.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_LOGIN", "AC");
 };
 var init_resolveLoginCredentials = __esm(() => {
-  import_client14 = __toESM(require_client2(), 1);
+  import_client15 = __toESM(require_client2(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-process/dist-es/getValidatedProcessCredentials.js
-var import_client15, getValidatedProcessCredentials = (profileName, data, profiles) => {
+var import_client16, getValidatedProcessCredentials = (profileName, data, profiles) => {
   if (data.Version !== 1) {
     throw Error(`Profile ${profileName} credential_process did not return Version 1.`);
   }
@@ -29781,22 +29781,22 @@ var import_client15, getValidatedProcessCredentials = (profileName, data, profil
     ...data.CredentialScope && { credentialScope: data.CredentialScope },
     ...accountId && { accountId }
   };
-  import_client15.setCredentialFeature(credentials, "CREDENTIALS_PROCESS", "w");
+  import_client16.setCredentialFeature(credentials, "CREDENTIALS_PROCESS", "w");
   return credentials;
 };
 var init_getValidatedProcessCredentials = __esm(() => {
-  import_client15 = __toESM(require_client2(), 1);
+  import_client16 = __toESM(require_client2(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js
 import { exec } from "child_process";
 import { promisify as promisify2 } from "util";
-var import_config30, resolveProcessCredentials = async (profileName, profiles, logger) => {
+var import_config31, resolveProcessCredentials = async (profileName, profiles, logger) => {
   const profile = profiles[profileName];
   if (profiles[profileName]) {
     const credentialProcess = profile["credential_process"];
     if (credentialProcess !== undefined) {
-      const execPromise = promisify2(import_config30.externalDataInterceptor?.getTokenRecord?.().exec ?? exec);
+      const execPromise = promisify2(import_config31.externalDataInterceptor?.getTokenRecord?.().exec ?? exec);
       try {
         const { stdout } = await execPromise(credentialProcess);
         let data;
@@ -29807,33 +29807,33 @@ var import_config30, resolveProcessCredentials = async (profileName, profiles, l
         }
         return getValidatedProcessCredentials(profileName, data, profiles);
       } catch (error) {
-        throw new import_config30.CredentialsProviderError(error.message, { logger });
+        throw new import_config31.CredentialsProviderError(error.message, { logger });
       }
     } else {
-      throw new import_config30.CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`, { logger });
+      throw new import_config31.CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`, { logger });
     }
   } else {
-    throw new import_config30.CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`, {
+    throw new import_config31.CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`, {
       logger
     });
   }
 };
 var init_resolveProcessCredentials = __esm(() => {
   init_getValidatedProcessCredentials();
-  import_config30 = __toESM(require_config(), 1);
+  import_config31 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-process/dist-es/fromProcess.js
-var import_config31, fromProcess = (init = {}) => async ({ callerClientConfig } = {}) => {
+var import_config32, fromProcess = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");
-  const profiles = await import_config31.parseKnownFiles(init);
-  return resolveProcessCredentials(import_config31.getProfileName({
+  const profiles = await import_config32.parseKnownFiles(init);
+  return resolveProcessCredentials(import_config32.getProfileName({
     profile: init.profile ?? callerClientConfig?.profile
   }), profiles, init.logger);
 };
 var init_fromProcess = __esm(() => {
   init_resolveProcessCredentials();
-  import_config31 = __toESM(require_config(), 1);
+  import_config32 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-process/dist-es/index.js
@@ -29846,20 +29846,20 @@ var init_dist_es7 = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProcessCredentials.js
-var import_client16, isProcessProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.credential_process === "string", resolveProcessCredentials2 = async (options, profile) => {
+var import_client17, isProcessProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.credential_process === "string", resolveProcessCredentials2 = async (options, profile) => {
   const { fromProcess: fromProcess2 } = await Promise.resolve().then(() => (init_dist_es7(), exports_dist_es6));
   const credentials = await fromProcess2({
     ...options,
     profile
   })();
-  return import_client16.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_PROCESS", "v");
+  return import_client17.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_PROCESS", "v");
 };
 var init_resolveProcessCredentials2 = __esm(() => {
-  import_client16 = __toESM(require_client2(), 1);
+  import_client17 = __toESM(require_client2(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveSsoCredentials.js
-var import_client17, resolveSsoCredentials = async (profile, profileData, options = {}, callerClientConfig) => {
+var import_client18, resolveSsoCredentials = async (profile, profileData, options = {}, callerClientConfig) => {
   const { fromSSO: fromSSO2 } = await Promise.resolve().then(() => (init_dist_es5(), exports_dist_es4));
   return fromSSO2({
     profile,
@@ -29870,18 +29870,18 @@ var import_client17, resolveSsoCredentials = async (profile, profileData, option
     callerClientConfig
   }).then((creds) => {
     if (profileData.sso_session) {
-      return import_client17.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO", "r");
+      return import_client18.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO", "r");
     } else {
-      return import_client17.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO_LEGACY", "t");
+      return import_client18.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO_LEGACY", "t");
     }
   });
 }, isSsoProfile2 = (arg) => arg && (typeof arg.sso_start_url === "string" || typeof arg.sso_account_id === "string" || typeof arg.sso_session === "string" || typeof arg.sso_region === "string" || typeof arg.sso_role_name === "string");
 var init_resolveSsoCredentials = __esm(() => {
-  import_client17 = __toESM(require_client2(), 1);
+  import_client18 = __toESM(require_client2(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveStaticCredentials.js
-var import_client18, isStaticCredsProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.aws_access_key_id === "string" && typeof arg.aws_secret_access_key === "string" && ["undefined", "string"].indexOf(typeof arg.aws_session_token) > -1 && ["undefined", "string"].indexOf(typeof arg.aws_account_id) > -1, resolveStaticCredentials = async (profile, options) => {
+var import_client19, isStaticCredsProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.aws_access_key_id === "string" && typeof arg.aws_secret_access_key === "string" && ["undefined", "string"].indexOf(typeof arg.aws_session_token) > -1 && ["undefined", "string"].indexOf(typeof arg.aws_account_id) > -1, resolveStaticCredentials = async (profile, options) => {
   options?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");
   const credentials = {
     accessKeyId: profile.aws_access_key_id,
@@ -29890,10 +29890,10 @@ var import_client18, isStaticCredsProfile = (arg) => Boolean(arg) && typeof arg
     ...profile.aws_credential_scope && { credentialScope: profile.aws_credential_scope },
     ...profile.aws_account_id && { accountId: profile.aws_account_id }
   };
-  return import_client18.setCredentialFeature(credentials, "CREDENTIALS_PROFILE", "n");
+  return import_client19.setCredentialFeature(credentials, "CREDENTIALS_PROFILE", "n");
 };
 var init_resolveStaticCredentials = __esm(() => {
-  import_client18 = __toESM(require_client2(), 1);
+  import_client19 = __toESM(require_client2(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-web-identity/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sts/index.js
@@ -30947,30 +30947,30 @@ var fromWebToken = (init) => async (awsIdentityProperties) => {
 
 // node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromTokenFile.js
 import { readFileSync as readFileSync29 } from "fs";
-var import_client19, import_config32, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE", ENV_ROLE_ARN = "AWS_ROLE_ARN", ENV_ROLE_SESSION_NAME = "AWS_ROLE_SESSION_NAME", fromTokenFile = (init = {}) => async (awsIdentityProperties) => {
+var import_client20, import_config33, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE", ENV_ROLE_ARN = "AWS_ROLE_ARN", ENV_ROLE_SESSION_NAME = "AWS_ROLE_SESSION_NAME", fromTokenFile = (init = {}) => async (awsIdentityProperties) => {
   init.logger?.debug("@aws-sdk/credential-provider-web-identity - fromTokenFile");
   const webIdentityTokenFile = init?.webIdentityTokenFile ?? process.env[ENV_TOKEN_FILE];
   const roleArn = init?.roleArn ?? process.env[ENV_ROLE_ARN];
   const roleSessionName = init?.roleSessionName ?? process.env[ENV_ROLE_SESSION_NAME];
   if (!webIdentityTokenFile || !roleArn) {
-    throw new import_config32.CredentialsProviderError("Web identity configuration not specified", {
+    throw new import_config33.CredentialsProviderError("Web identity configuration not specified", {
       logger: init.logger
     });
   }
   const credentials = await fromWebToken({
     ...init,
-    webIdentityToken: import_config32.externalDataInterceptor?.getTokenRecord?.()[webIdentityTokenFile] ?? readFileSync29(webIdentityTokenFile, { encoding: "ascii" }),
+    webIdentityToken: import_config33.externalDataInterceptor?.getTokenRecord?.()[webIdentityTokenFile] ?? readFileSync29(webIdentityTokenFile, { encoding: "ascii" }),
     roleArn,
     roleSessionName
   })(awsIdentityProperties);
   if (webIdentityTokenFile === process.env[ENV_TOKEN_FILE]) {
-    import_client19.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN", "h");
+    import_client20.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN", "h");
   }
   return credentials;
 };
 var init_fromTokenFile = __esm(() => {
-  import_client19 = __toESM(require_client2(), 1);
-  import_config32 = __toESM(require_config(), 1);
+  import_client20 = __toESM(require_client2(), 1);
+  import_config33 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-web-identity/dist-es/index.js
@@ -30984,7 +30984,7 @@ var init_dist_es8 = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveWebIdentityCredentials.js
-var import_client20, isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.web_identity_token_file === "string" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1, resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => {
+var import_client21, isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.web_identity_token_file === "string" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1, resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => {
   const { fromTokenFile: fromTokenFile2 } = await Promise.resolve().then(() => (init_dist_es8(), exports_dist_es7));
   const credentials = await fromTokenFile2({
     webIdentityTokenFile: profile.web_identity_token_file,
@@ -30996,14 +30996,14 @@ var import_client20, isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg
   })({
     callerClientConfig
   });
-  return import_client20.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN", "q");
+  return import_client21.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN", "q");
 };
 var init_resolveWebIdentityCredentials = __esm(() => {
-  import_client20 = __toESM(require_client2(), 1);
+  import_client21 = __toESM(require_client2(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProfileData.js
-var import_config33, resolveProfileData = async (profileName, profiles, options, callerClientConfig, visitedProfiles = {}, isAssumeRoleRecursiveCall = false) => {
+var import_config34, resolveProfileData = async (profileName, profiles, options, callerClientConfig, visitedProfiles = {}, isAssumeRoleRecursiveCall = false) => {
   const data = profiles[profileName];
   if (Object.keys(visitedProfiles).length > 0 && isStaticCredsProfile(data)) {
     return resolveStaticCredentials(data, options);
@@ -31026,7 +31026,7 @@ var import_config33, resolveProfileData = async (profileName, profiles, options,
   if (isLoginProfile(data)) {
     return resolveLoginCredentials(profileName, options, callerClientConfig);
   }
-  throw new import_config33.CredentialsProviderError(`Could not resolve credentials using profile: [${profileName}] in configuration/credentials file(s).`, { logger: options.logger });
+  throw new import_config34.CredentialsProviderError(`Could not resolve credentials using profile: [${profileName}] in configuration/credentials file(s).`, { logger: options.logger });
 };
 var init_resolveProfileData = __esm(() => {
   init_resolveAssumeRoleCredentials();
@@ -31035,20 +31035,20 @@ var init_resolveProfileData = __esm(() => {
   init_resolveSsoCredentials();
   init_resolveStaticCredentials();
   init_resolveWebIdentityCredentials();
-  import_config33 = __toESM(require_config(), 1);
+  import_config34 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/fromIni.js
-var import_config34, fromIni = (init = {}) => async ({ callerClientConfig } = {}) => {
+var import_config35, fromIni = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/credential-provider-ini - fromIni");
-  const profiles = await import_config34.parseKnownFiles(init);
-  return resolveProfileData(import_config34.getProfileName({
+  const profiles = await import_config35.parseKnownFiles(init);
+  return resolveProfileData(import_config35.getProfileName({
     profile: init.profile ?? callerClientConfig?.profile
   }), profiles, init, callerClientConfig);
 };
 var init_fromIni = __esm(() => {
   init_resolveProfileData();
-  import_config34 = __toESM(require_config(), 1);
+  import_config35 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/index.js
@@ -32371,7 +32371,7 @@ var init_event_sink = __esm(() => {
   init_dist();
 });
 // package.json
-var version = "0.10.75";
+var version = "0.10.77";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -33526,6 +33526,9 @@ function selectsSkillsLocalMode(env = process.env) {
   return !hasSkillsEnvAuthorityIntent(env) && isSkillsLocalOptIn(env);
 }
 
+// src/lib/credential-profile-command.ts
+var urlKeys = clientTransportEnvKeys("skills").apiUrlKeys;
+
 // src/lib/fleet-credentials.ts
 var SKILLS_APP = "skills";
 var ENV_KEYS = clientTransportEnvKeys(SKILLS_APP);
@@ -37622,7 +37625,7 @@ function applySessionReconciliation(snapshot, target, planned, record2, verified
 // src/lib/selected-run.ts
 import { createHash as createHash32 } from "crypto";
 import { spawn as spawn3 } from "child_process";
-import { mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync10, realpathSync as realpathSync17 } from "fs";
+import { mkdirSync as mkdirSync13, mkdtempSync as mkdtempSync4, writeFileSync as writeFileSync10, realpathSync as realpathSync17 } from "fs";
 import { dirname as dirname29, join as join43, resolve as resolve30 } from "path";
 import { tmpdir, hostname as stationHostname2 } from "os";
 
@@ -38169,14 +38172,35 @@ class KernelLock {
 }
 
 // src/lib/codex-corpus-write.ts
-import { execFileSync } from "child_process";
+import { AsyncLocalStorage } from "async_hooks";
+import { execFileSync, spawnSync as spawnSync5 } from "child_process";
 import { createHash as createHash6 } from "crypto";
-import { accessSync, constants as constants7, lstatSync as lstatSync7, readFileSync as readFileSync10, realpathSync as realpathSync4, statSync as statSync4 } from "fs";
+import { accessSync, constants as constants7, lstatSync as lstatSync7, mkdirSync as mkdirSync4, mkdtempSync, readdirSync as readdirSync3, readFileSync as readFileSync10, realpathSync as realpathSync4, rmSync, statSync as statSync4 } from "fs";
 import { basename as basename2, delimiter, dirname as dirname5, isAbsolute as isAbsolute4, join as join11, relative as relative4, resolve as resolve4, sep as sep3 } from "path";
 var KEY = ".native-corpus-admission";
-var fail = () => {
-  throw new Error("CODEX_CORPUS_ADMISSION_REQUIRED: verified native admission and its existing shared lock are required");
+var fail = (reason) => {
+  throw new Error(`CODEX_CORPUS_ADMISSION_REQUIRED: verified native admission and its existing shared lock are required${reason ? ` (${reason})` : ""}`);
 };
+function codexAdmissionRecord(options) {
+  const record2 = options.onCodexAdmission;
+  const invalid3 = () => {
+    throw new Error("CODEX_CORPUS_ADMISSION_RECORD_INVALID: onCodexAdmission must be a synchronous function");
+  };
+  if (record2 !== undefined && typeof record2 !== "function")
+    invalid3();
+  return { policy: { fallback: typeof record2 === "function" }, deliver(admission) {
+    if (!admission || typeof record2 !== "function")
+      return;
+    const result = record2(admission);
+    if (result !== null && (typeof result === "object" || typeof result === "function") && typeof result.then === "function") {
+      Promise.resolve(result).catch(() => {});
+      invalid3();
+    }
+  } };
+}
+function codexAdmissionReceipt(admission) {
+  return admission?.nativeAdmission === "unavailable" && admission.probe ? { nativeAdmission: "unavailable", nativeAdmissionProbe: { ...admission.probe } } : {};
+}
 function physicalTarget(path) {
   const suffix = [];
   for (let cursor = path;; cursor = dirname5(cursor)) {
@@ -38258,13 +38282,246 @@ function executable(options) {
   const digest2 = hash2();
   if (options.codexSha256 && digest2 !== options.codexSha256)
     return fail();
-  return { path, assertCurrent() {
+  return { path, sha256: digest2, size: Number(initial.size), assertCurrent() {
     const current = statSync4(path, { bigint: true });
     if (realpathSync4(found) !== path || ["dev", "ino", "size", "mtimeNs", "ctimeNs", "mode"].some((key) => initial[key] !== current[key]) || hash2() !== digest2)
       fail();
   } };
 }
-function acquireCodexCorpusWrite(roots, options) {
+var PROBE = { timeout: 5000, maxBuffer: 4096, killSignal: "SIGKILL", encoding: "utf8" };
+var UNRECOGNIZED = /^error: unrecognized subcommand 'corpus-admission-inspect'(?:\r?\n|$)/;
+var VERSION = /^codex-cli (?:0|[1-9][0-9]{0,5})\.(?:0|[1-9][0-9]{0,5})\.(?:0|[1-9][0-9]{0,5})(?:-[0-9A-Za-z-]{1,32}(?:\.[0-9A-Za-z-]{1,32}){0,7})?$/;
+var LOCK_DIRECTORY = "codex-corpus-locks";
+var PROBE_PARENT = "codex-probe-homes";
+var retain = (hold) => {
+  hold.refs++;
+  return { hold, released: false };
+};
+var release = (ref) => {
+  if (ref.released)
+    return;
+  ref.released = true;
+  if (--ref.hold.refs === 0)
+    ref.hold.lock.close();
+};
+var enclosing = new AsyncLocalStorage;
+var leaseHolds = new WeakMap;
+var contains = (base, path) => {
+  const distance = relative4(base, path);
+  return distance === "" || !distance.startsWith(`..${sep3}`) && distance !== ".." && !isAbsolute4(distance);
+};
+function nativeLockAbsent(root) {
+  for (const name of [`${KEY}.flock-v1`, `${KEY}.lock`]) {
+    try {
+      lstatSync7(join11(root, name));
+      return false;
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
+  }
+  return true;
+}
+function skillsState(root, leaf, roots) {
+  const chain = [realpathSync4(dirname5(root))];
+  for (const part of [".hasna", "skills", leaf])
+    chain.push(join11(chain.at(-1), part));
+  const path = chain.at(-1);
+  const uid = process.getuid();
+  const verify = () => {
+    if (roots.some((item) => contains(item, path)) || codexCorpusRootForPath(path) !== undefined)
+      fail();
+    for (let ancestor = dirname5(chain[0]);; ancestor = dirname5(ancestor)) {
+      const stat = lstatSync7(ancestor), sticky = stat.uid === 0 && (stat.mode & 512) !== 0;
+      if (!stat.isDirectory() || stat.uid !== uid && stat.uid !== 0 || (stat.mode & 18) !== 0 && !sticky)
+        fail();
+      if (dirname5(ancestor) === ancestor)
+        break;
+    }
+    for (const component of chain) {
+      const stat = lstatSync7(component, { throwIfNoEntry: false });
+      if (!stat)
+        return;
+      if (!stat.isDirectory() || stat.uid !== uid && stat.uid !== 0 || (stat.mode & 18) !== 0 || component === path && stat.uid !== uid)
+        fail();
+    }
+  };
+  verify();
+  return { path, ensure() {
+    verify();
+    for (const component of chain.slice(1)) {
+      try {
+        mkdirSync4(component, { mode: 448 });
+      } catch (error) {
+        if (error.code !== "EEXIST")
+          throw error;
+      }
+    }
+    verify();
+    if (realpathSync4(path) !== path)
+      fail();
+    return path;
+  } };
+}
+function probeParent(roots) {
+  const dataRoot = resolve4(getDataDirReadOnly()), path = join11(dataRoot, PROBE_PARENT), uid = process.getuid();
+  const chain = [];
+  for (let component = path;; component = dirname5(component)) {
+    chain.unshift(component);
+    if (dirname5(component) === component)
+      break;
+  }
+  const verify = () => {
+    if (roots.some((item) => contains(item, path)) || codexCorpusRootForPath(path) !== undefined)
+      fail();
+    for (const component of chain) {
+      const stat = lstatSync7(component, { throwIfNoEntry: false });
+      if (!stat)
+        return;
+      const skills = contains(dataRoot, component), sticky = !skills && stat.uid === 0 && (stat.mode & 512) !== 0;
+      if (!stat.isDirectory() || stat.uid !== uid && (skills || stat.uid !== 0) || (stat.mode & 18) !== 0 && !sticky)
+        fail();
+    }
+  };
+  verify();
+  for (const component of chain) {
+    if (lstatSync7(component, { throwIfNoEntry: false }))
+      continue;
+    try {
+      mkdirSync4(component, { mode: 448 });
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+    }
+  }
+  verify();
+  if (realpathSync4(path) !== path)
+    fail();
+  return path;
+}
+function probeHomeIntact(home, empty) {
+  const stat = lstatSync7(home.path, { bigint: true, throwIfNoEntry: false });
+  return !!stat && stat.isDirectory() && stat.dev === home.dev && stat.ino === home.ino && stat.uid === BigInt(process.getuid()) && (stat.mode & 0o777n) === 0o700n && realpathSync4(home.path) === home.path && (!empty || readdirSync3(home.path).length === 0);
+}
+function removeProbeHome(home) {
+  try {
+    const stat = lstatSync7(home.path, { bigint: true });
+    if (stat.isDirectory() && stat.dev === home.dev && stat.ino === home.ino)
+      rmSync(home.path, { recursive: true, force: true });
+  } catch {}
+}
+function probe(path, args, parent, stdio) {
+  const created = mkdtempSync(join11(parent, "probe-")), stat = lstatSync7(created, { bigint: true });
+  const home = { path: created, dev: stat.dev, ino: stat.ino };
+  try {
+    if (!probeHomeIntact(home, true))
+      return;
+    const env = { CODEX_HOME: home.path };
+    for (const key of ["PATH", "HOME"])
+      if (process.env[key] !== undefined)
+        env[key] = process.env[key];
+    const result = spawnSync5(path, args, { ...PROBE, cwd: home.path, env, stdio: ["ignore", stdio, stdio] });
+    return probeHomeIntact(home, false) ? result : undefined;
+  } finally {
+    removeProbeHome(home);
+  }
+}
+function probeAdmissionCommand(path, parent) {
+  const help = probe(path, ["help", "corpus-admission-inspect"], parent, "pipe");
+  if (!help || help.error || help.signal !== null)
+    return "inconclusive";
+  if (help.status === 0)
+    return "present";
+  if (help.status !== 2 || help.stdout !== "" || typeof help.stderr !== "string" || !UNRECOGNIZED.test(help.stderr))
+    return "inconclusive";
+  const control = probe(path, ["help", "exec"], parent, "ignore");
+  return control && !control.error && control.signal === null && control.status === 0 ? "absent" : "inconclusive";
+}
+function strictVersion(path, parent) {
+  const result = probe(path, ["--version"], parent, "pipe");
+  if (!result || result.error || result.signal !== null || result.status !== 0 || typeof result.stdout !== "string")
+    return;
+  const line = result.stdout.replace(/\r?\n$/, "");
+  return VERSION.test(line) ? line : undefined;
+}
+function rootLockKey(root, id2) {
+  return `codex-corpus-${createHash6("sha256").update(`${root}\x00${id2.device}\x00${id2.inode}`).digest("hex")}`;
+}
+function acquireFallback(inputs, options) {
+  let reason = "executable-unverified";
+  const refs = new Map, held = [];
+  const close = () => {
+    for (const ref of [...refs.values()].reverse())
+      release(ref);
+  };
+  try {
+    const native = executable(options);
+    reason = "skills-lock-unavailable";
+    const roots = inputs.map((item) => item.root);
+    const locks = new Map(roots.map((root) => [root, skillsState(root, LOCK_DIRECTORY, roots)]));
+    const parent = probeParent(roots);
+    reason = "probe-inconclusive";
+    const state = probeAdmissionCommand(native.path, parent);
+    if (state === "present")
+      reason = "command-present";
+    if (state !== "absent")
+      fail();
+    const version2 = strictVersion(native.path, parent);
+    if (version2 === undefined)
+      fail();
+    reason = "executable-unverified";
+    native.assertCurrent();
+    reason = "skills-lock-unavailable";
+    for (const { input, root } of inputs) {
+      const id2 = identity(root), key = rootLockKey(root, id2);
+      if (!refs.has(key)) {
+        const owner = enclosing.getStore()?.get(key);
+        if (owner && !owner.released)
+          refs.set(key, retain(owner.hold));
+        else {
+          const lock = new KernelLock(locks.get(root).ensure(), key, { mode: "exclusive" });
+          refs.set(key, retain({ lock, refs: 0 }));
+          if (!lock.trySync(1000)) {
+            reason = "writer-busy";
+            fail();
+          }
+        }
+      }
+      held.push({ input, root, id: id2, ref: refs.get(key) });
+    }
+    const assertCurrent = () => {
+      try {
+        for (const item of held) {
+          if (item.ref.released)
+            fail();
+          item.ref.hold.lock.assertUnchanged();
+          if (realpathSync4(item.input) !== item.root || !sameIdentity(identity(item.root), item.id) || !nativeLockAbsent(item.root))
+            fail();
+        }
+        native.assertCurrent();
+      } catch {
+        fail("lease-changed");
+      }
+    };
+    reason = "lease-changed";
+    assertCurrent();
+    const lease = { assertCurrent, close, admission: { nativeAdmission: "unavailable", probe: {
+      kind: "help-unrecognized-subcommand",
+      executable: native.path,
+      sha256: native.sha256,
+      size: native.size,
+      version: version2,
+      probeExitCode: 2,
+      controlExitCode: 0
+    } } };
+    leaseHolds.set(lease, refs);
+    return lease;
+  } catch {
+    close();
+    return fail(reason);
+  }
+}
+function acquireCodexCorpusWrite(roots, options, policy = {}) {
   const held = [];
   const close = () => {
     for (const item of held.reverse())
@@ -38277,10 +38534,20 @@ function acquireCodexCorpusWrite(roots, options) {
         fail();
     }
   };
+  let fallback = false, refusal;
   try {
     if (roots.some((root) => typeof root !== "string" || !isAbsolute4(root) || root.includes("\x00")))
       fail();
     const inputs = [...new Set(roots)].map((input) => ({ input, root: realpathSync4(input) })).sort((a, b) => a.root.localeCompare(b.root));
+    const absent = inputs.filter(({ root }) => nativeLockAbsent(root));
+    if (absent.length && absent.length !== inputs.length) {
+      refusal = "native-lock-present";
+      fail();
+    }
+    if (absent.length && policy.fallback !== false) {
+      fallback = true;
+      return acquireFallback(inputs, options);
+    }
     for (const { input, root } of inputs) {
       const lock = new KernelLock(root, KEY, { mode: "shared", existingOnly: true });
       held.push({ input, root, lock });
@@ -38308,19 +38575,25 @@ function acquireCodexCorpusWrite(roots, options) {
       if (Object.keys(row).sort().join(",") !== "lock,root,schema,state" || row.schema !== "codex-corpus-admission-status/v1" || row.state !== "committed-v1" && row.state !== "committed-v2" || !sameIdentity(row.root, rootIdentity) || !sameIdentity(row.lock, lockIdentity))
         fail();
     }
-    return { assertCurrent, close };
-  } catch {
+    return { assertCurrent, close, admission: { nativeAdmission: "verified" } };
+  } catch (error) {
+    if (fallback)
+      throw error;
     close();
-    return fail();
+    return fail(refusal);
   }
 }
-function withCodexCorpusWrite(roots, run, options = {}) {
+function scoped(lease, run) {
+  const holds = leaseHolds.get(lease);
+  return holds?.size ? enclosing.run(new Map([...enclosing.getStore() ?? [], ...holds]), run) : run();
+}
+function withCodexCorpusWrite(roots, run, options = {}, policy = {}) {
   if (!roots.length)
     return run(() => {});
-  const lease = acquireCodexCorpusWrite(roots, options);
+  const lease = acquireCodexCorpusWrite(roots, options, policy);
   try {
     lease.assertCurrent();
-    const result = run(lease.assertCurrent);
+    const result = scoped(lease, () => run(lease.assertCurrent, lease.admission));
     lease.assertCurrent();
     return result;
   } finally {
@@ -38329,7 +38602,7 @@ function withCodexCorpusWrite(roots, run, options = {}) {
 }
 
 // src/lib/installer.ts
-import { existsSync as existsSync14, readFileSync as readFileSync27, rmSync as rmSync4 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync27, rmSync as rmSync5 } from "fs";
 import { join as join41 } from "path";
 import { homedir as homedir6 } from "os";
 
@@ -38338,12 +38611,12 @@ import {
   cpSync as cpSync2,
   existsSync as existsSync11,
   lstatSync as lstatSync33,
-  mkdirSync as mkdirSync10,
-  mkdtempSync as mkdtempSync2,
+  mkdirSync as mkdirSync11,
+  mkdtempSync as mkdtempSync3,
   readFileSync as readFileSync24,
-  readdirSync as readdirSync13,
+  readdirSync as readdirSync14,
   renameSync as renameSync6,
-  rmSync as rmSync3,
+  rmSync as rmSync4,
   statSync as statSync13,
   writeFileSync as writeFileSync8
 } from "fs";
@@ -38812,7 +39085,7 @@ function isCodexLocalStdioMcpServer(name, server) {
 
 // src/lib/codex-plugin-skill-controls.ts
 import { basename as basename4, dirname as dirname7, join as join13, relative as relative5, resolve as resolve6, sep as sep4 } from "path";
-import { lstatSync as lstatSync9, readdirSync as readdirSync3, readFileSync as readFileSync11, readlinkSync as readlinkSync2, realpathSync as realpathSync7 } from "fs";
+import { lstatSync as lstatSync9, readdirSync as readdirSync4, readFileSync as readFileSync11, readlinkSync as readlinkSync2, realpathSync as realpathSync7 } from "fs";
 
 // src/lib/codex-native-compatibility.ts
 var MEASURED_CODEX_CAPABILITIES = {
@@ -38954,6 +39227,7 @@ async function connectCodexHookRpc(options) {
   const rpc = {
     version: version2,
     processId: child.pid,
+    admission: corpusLease.admission,
     request(method, params) {
       if (stopped)
         return Promise.reject(new Error(configInvalid ? CODEX_CONFIG_INVALID : "CODEX_HOOK_TRUST_NATIVE_RPC_CLOSED"));
@@ -39407,7 +39681,7 @@ function reviewedRetiredCodexRoot(cache, root, controls, rules, read, allowAbsen
     if (!enrolled.some((control) => control.namespace === parsed.namespace && control.manifestSha256 === parsed.manifestSha256 && !parsed.appSha256 && !parsed.mcpSha256))
       return false;
     let entries = 0;
-    const emptySkills = (directory, depth) => depth <= 64 && readdirSync3(directory).every((name) => {
+    const emptySkills = (directory, depth) => depth <= 64 && readdirSync4(directory).every((name) => {
       if (++entries > 4096 || name === "SKILL.md")
         return false;
       const path = join13(directory, name), stat = lstatSync9(path);
@@ -39432,7 +39706,7 @@ function reviewedCodexPluginCapabilitiesUnchanged(cache, controls, read, rules)
         if (control.remotePluginId !== undefined && !remoteInstallationMatches(parent, control.remotePluginId, read))
           return false;
       }
-      const names = readdirSync3(parent);
+      const names = readdirSync4(parent);
       entries += names.length;
       if (entries > 4096)
         return false;
@@ -39622,7 +39896,7 @@ enabled = false
 
 // src/lib/codex-native-skill-policy.ts
 import { createHash as createHash10, randomUUID as randomUUID2 } from "crypto";
-import { closeSync as closeSync12, constants as constants9, fstatSync as fstatSync12, fsyncSync as fsyncSync2, lstatSync as lstatSync10, mkdirSync as mkdirSync4, openSync as openSync12, readFileSync as readFileSync12, readSync as readSync5, readlinkSync as readlinkSync3, realpathSync as realpathSync8, renameSync as renameSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "fs";
+import { closeSync as closeSync12, constants as constants9, fstatSync as fstatSync12, fsyncSync as fsyncSync2, lstatSync as lstatSync10, mkdirSync as mkdirSync5, openSync as openSync12, readFileSync as readFileSync12, readSync as readSync5, readlinkSync as readlinkSync3, realpathSync as realpathSync8, renameSync as renameSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname8, isAbsolute as isAbsolute8, join as join14, resolve as resolve7 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 var CODEX_NATIVE_POLICY_CAPABILITY = "host-path-allowlist-v1";
@@ -39891,7 +40165,7 @@ function writeExecutableCache(dataDir2, entries) {
       return;
     const existing = lstatSync10(directory, { throwIfNoEntry: false });
     if (!existing)
-      mkdirSync4(directory, { mode: 448 });
+      mkdirSync5(directory, { mode: 448 });
     else if (existing.isSymbolicLink() || !existing.isDirectory())
       return;
     const holder = lstatSync10(directory, { throwIfNoEntry: false, bigint: true });
@@ -40186,7 +40460,7 @@ function recordCodexNativePolicyAcceptance(dataDir2, verification, accepted) {
     ...verification.attestation ? { attestation: { schema: verification.attestation.schema, peerProcessId: verification.attestation.peerProcessId } } : {}
   };
   try {
-    mkdirSync4(directory, { recursive: true, mode: 448 });
+    mkdirSync5(directory, { recursive: true, mode: 448 });
     const stat = lstatSync10(directory);
     if (stat.isSymbolicLink() || !stat.isDirectory())
       throw new Error(`the receipt directory is not a real directory: ${directory}`);
@@ -41090,6 +41364,37 @@ function hashRawDiscoveryFile(path, budget2, changes) {
   }
 }
 
+// src/lib/codex-plugin-capability-paths.ts
+var CODEX_PLUGIN_MANIFEST_LOCATIONS = Object.freeze([
+  "plugin.json",
+  ".codex-plugin/plugin.json",
+  ".claude-plugin/plugin.json",
+  ".cursor-plugin/plugin.json"
+]);
+var CODEX_PLUGIN_MANIFEST_DIRECTORIES = Object.freeze([".codex-plugin", ".claude-plugin", ".cursor-plugin"]);
+var CODEX_PLUGIN_ROOT_CAPABILITY_ENTRIES = Object.freeze([
+  "plugin.json",
+  ".codex-plugin",
+  ".claude-plugin",
+  ".cursor-plugin",
+  "hooks",
+  "hooks.json",
+  ".mcp.json",
+  ".app.json",
+  "commands",
+  "agents"
+]);
+function foldCodexPluginEntryName(name) {
+  return name.toUpperCase().toLowerCase();
+}
+function codexPluginRootCapabilityEntry(name) {
+  const folded = foldCodexPluginEntryName(name);
+  return CODEX_PLUGIN_ROOT_CAPABILITY_ENTRIES.includes(folded) ? folded : null;
+}
+function isCodexSkillDocumentName(name) {
+  return foldCodexPluginEntryName(name) === "skill.md";
+}
+
 // src/lib/codex-hook-mcp-dependencies.ts
 var need5 = (value) => {
   if (!value)
@@ -41239,15 +41544,13 @@ function captureCodexHookMcpDependencies(configPath, reviewed, configText, chang
       }
     };
     const root = join17(cacheRoot, identity3, selectCodexPluginVersion(versions, selectionBudget));
-    const agent = read(join17(root, "plugin.json"));
+    const [agentPluginManifest, ...legacyManifests] = CODEX_PLUGIN_MANIFEST_LOCATIONS;
+    const agent = read(join17(root, agentPluginManifest));
     if (agent !== null) {
       const schema = JSON.parse(agent).$schema;
       need5(typeof schema !== "string" || !schema.startsWith("https://agent-plugins.org/schemas/"));
     }
-    const codex = read(join17(root, ".codex-plugin/plugin.json"));
-    const claude = read(join17(root, ".claude-plugin/plugin.json"));
-    const cursor = read(join17(root, ".cursor-plugin/plugin.json"));
-    const text2 = codex ?? claude ?? cursor;
+    const text2 = legacyManifests.map((location) => read(join17(root, location))).find((value) => value !== null) ?? null;
     if (text2 === null)
       continue;
     const manifest = JSON.parse(text2);
@@ -41941,9 +42244,10 @@ function captureCodexSettingsV6(path, reviewedSources, budget2 = { remaining: 25
 
 // src/lib/codex-semantic-cache-witness.ts
 import { createHash as createHash18 } from "crypto";
-import { constants as constants12, closeSync as closeSync15, fstatSync as fstatSync15, lstatSync as lstatSync14, openSync as openSync15, readSync as readSync8, readdirSync as readdirSync4, realpathSync as realpathSync9 } from "fs";
+import { constants as constants12, closeSync as closeSync15, fstatSync as fstatSync15, lstatSync as lstatSync14, openSync as openSync15, readSync as readSync8, readdirSync as readdirSync5, realpathSync as realpathSync9 } from "fs";
 import { basename as basename9, dirname as dirname14, isAbsolute as isAbsolute15, join as join18, relative as relative6, resolve as resolve14, sep as sep8 } from "path";
 var CODEX_SEMANTIC_CACHE_WITNESS_SCHEMA = "hasna.codex-semantic-cache-witness.v1";
+var SEMANTIC_BOUND_ROOT_ENTRIES = Object.freeze([".codex-plugin", ".app.json", ".mcp.json", "hooks"]);
 var identifier5 = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(value);
 var digest2 = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
 var refuse5 = () => {
@@ -42106,7 +42410,7 @@ function assertCanonicalDirectory(path) {
 function walkSafeTree(path, state, depth = 0, root = path) {
   if (depth > 64 || ++state.entries > 16384)
     refuse5();
-  const names = readdirSync4(path).sort();
+  const names = readdirSync5(path).sort();
   const files = [];
   for (const name of names) {
     if (!name || name === "." || name === ".." || name.includes(sep8) || ++state.entries > 16384)
@@ -42252,7 +42556,7 @@ function appOnlyParentProjection(cacheRoot, parents2, read) {
     } catch {
       refuse5();
     }
-    const versions = readdirSync4(parent.pluginParent).filter((name) => name !== ".codex-remote-plugin-install.json");
+    const versions = readdirSync5(parent.pluginParent).filter((name) => name !== ".codex-remote-plugin-install.json");
     if (!versions.length || versions.length > 4096)
       refuse5();
     const materializations = versions.map((version2) => {
@@ -42397,7 +42701,7 @@ function reviewedHookParentProjection(cacheRoot, parents2, read) {
       if (createHash18("sha256").update(marketplaceText).digest("hex") !== parent.marketplaceSha256 || !codexLocalMarketplaceMapsPlugin(marketplaceText, parts[0], parent.namespace))
         refuse5();
     }
-    const materializations = readdirSync4(parent.pluginParent).filter((name) => name !== ".codex-remote-plugin-install.json").map((version2) => {
+    const materializations = readdirSync5(parent.pluginParent).filter((name) => name !== ".codex-remote-plugin-install.json").map((version2) => {
       if (!/^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/.test(version2))
         refuse5();
       const root = join18(parent.pluginParent, version2), stat = lstatSync14(root, { throwIfNoEntry: false });
@@ -42431,14 +42735,14 @@ function assertParents(cacheRoot, controls, appOnlyParents, hookParents, files,
       refuse5();
     actual.add(join18(cacheRoot, parts[0], parts[1]));
   }
-  const actualMarkets = readdirSync4(cacheRoot);
+  const actualMarkets = readdirSync5(cacheRoot);
   if (actualMarkets.length !== expectedMarkets.size || actualMarkets.some((market) => !expectedMarkets.has(market)))
     refuse5();
   for (const market of actualMarkets) {
     const marketPath = join18(cacheRoot, market), marketStat = lstatSync14(marketPath);
     if (!identifier5(market) || !marketStat.isDirectory() || marketStat.isSymbolicLink())
       refuse5();
-    for (const plugin of readdirSync4(marketPath)) {
+    for (const plugin of readdirSync5(marketPath)) {
       const parent = join18(marketPath, plugin), stat = lstatSync14(parent);
       if (!identifier5(plugin) || !stat.isDirectory() || stat.isSymbolicLink())
         refuse5();
@@ -42453,14 +42757,23 @@ function assertParents(cacheRoot, controls, appOnlyParents, hookParents, files,
       continue;
     const parent = join18(cacheRoot, parts[0], parts[1]);
     const root = join18(parent, parts[2]);
-    const base = parts[parts.length - 1];
-    if (parts.includes(".codex-plugin") && (parts.length < 4 || parts[3] !== ".codex-plugin" || (parts.length === 4 ? base !== ".codex-plugin" : parts.length !== 5 || base !== "plugin.json")))
+    const base = parts[parts.length - 1], folded = foldCodexPluginEntryName(base);
+    if (parts.length === 3 && (codexPluginRootCapabilityEntry(base) !== null || isCodexSkillDocumentName(base)))
+      refuse5();
+    const rootEntry = parts.length >= 4 ? codexPluginRootCapabilityEntry(parts[3]) : null;
+    if (rootEntry !== null && rootEntry !== parts[3])
+      refuse5();
+    if (rootEntry !== null && !SEMANTIC_BOUND_ROOT_ENTRIES.includes(rootEntry))
+      refuse5();
+    if (isCodexSkillDocumentName(base) && base !== "SKILL.md")
       refuse5();
-    if ([".app.json", ".mcp.json"].includes(base) && (parts.length !== 4 || dirname14(member) !== root))
+    if (parts.some((part) => CODEX_PLUGIN_MANIFEST_DIRECTORIES.includes(foldCodexPluginEntryName(part))) && (parts.length < 4 || parts[3] !== ".codex-plugin" || (parts.length === 4 ? base !== ".codex-plugin" : parts.length !== 5 || base !== "plugin.json")))
       refuse5();
-    if ([".app.json", ".mcp.json"].includes(base) && hookParents.some((reviewed) => reviewed.pluginParent === parent))
+    if ([".app.json", ".mcp.json"].includes(folded) && (parts.length !== 4 || dirname14(member) !== root))
       refuse5();
-    if ((parts[3] === "hooks" || base === "hooks.json") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base !== "hooks" : base !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join18(cacheRoot, parts[0], parts[1]))))
+    if ([".app.json", ".mcp.json"].includes(folded) && hookParents.some((reviewed) => reviewed.pluginParent === parent))
+      refuse5();
+    if ((rootEntry === "hooks" || folded === "hooks.json") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base !== "hooks" : base !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join18(cacheRoot, parts[0], parts[1]))))
       refuse5();
   }
 }
@@ -42490,7 +42803,7 @@ function assertSkillMaterializations(cacheRoot, controls, files, read) {
     const expectedNames = new Set(rows.map((row) => row.name));
     if (expectedNames.size !== rows.length)
       refuse5();
-    const entries = readdirSync4(parent);
+    const entries = readdirSync5(parent);
     let roots = 0;
     for (const entry of entries) {
       if (entry === ".codex-remote-plugin-install.json")
@@ -42705,7 +43018,7 @@ var NATIVE_SKILL_ROOTS = [
 ];
 
 // src/lib/codex-vendor-refresh.ts
-import { lstatSync as lstatSync15, readdirSync as readdirSync5, readFileSync as readFileSync13 } from "fs";
+import { lstatSync as lstatSync15, readdirSync as readdirSync6, readFileSync as readFileSync13 } from "fs";
 import { isAbsolute as isAbsolute16, join as join19, relative as relative7, resolve as resolve15, sep as sep9 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual7 } from "util";
 var CODEX_VENDOR_MARKETPLACES = Object.freeze(["openai-bundled", "openai-curated", "openai-curated-remote"]);
@@ -42727,20 +43040,20 @@ function codexVendorMarketplace(cache, path) {
     return null;
   return CODEX_VENDOR_MARKETPLACES.includes(parts[0]) ? parts[0] : null;
 }
-var OTHER_PLUGIN_CONTROLS = Object.freeze(["plugin.json", ".claude-plugin", ".cursor-plugin", "hooks", "hooks.json", ".mcp.json", "commands", "agents"]);
+var OTHER_PLUGIN_CONTROLS = Object.freeze(CODEX_PLUGIN_ROOT_CAPABILITY_ENTRIES.filter((entry) => entry !== ".codex-plugin" && entry !== ".app.json"));
 var VENDOR_MANIFEST_KEYS = Object.freeze(["name", "version", "description", "author", "homepage", "repository", "license", "keywords", "interface", "skills", "apps"]);
 var DEFAULT_SKILLS_PATHS = Object.freeze(["./skills", "./skills/"]);
 var VENDOR_APP_DECLARATION = "./.app.json";
 var MAX_SUBTREE_ENTRIES = 20000;
 var MAX_SUBTREE_DEPTH = 32;
 var hiddenName = (name) => name.startsWith(".") || name === "node_modules";
-var isSkillDocument = (name) => name.toLowerCase() === "skill.md";
+var isSkillDocument = isCodexSkillDocumentName;
 var present = (path) => lstatSync15(path, { throwIfNoEntry: false }) !== undefined;
-var holdsOtherControl = (path) => readdirSync5(path).some((name) => OTHER_PLUGIN_CONTROLS.includes(name.toLowerCase()));
+var holdsOtherControl = (path) => readdirSync6(path).some((name) => OTHER_PLUGIN_CONTROLS.includes(codexPluginRootCapabilityEntry(name) ?? ""));
 function pluginTreeVisible(path, hidden, insideSkill, depth, budget2) {
   if (depth > MAX_SUBTREE_DEPTH)
     return false;
-  const names = readdirSync5(path);
+  const names = readdirSync6(path);
   const skill = names.some(isSkillDocument);
   if (skill && (hidden || insideSkill))
     return false;
@@ -42764,7 +43077,7 @@ function codexVendorPluginRootRefreshSafe(root, budget2 = { remaining: MAX_SUBTR
       return false;
     if (!directory(join19(root, ".codex-plugin")))
       return false;
-    const controls = readdirSync5(join19(root, ".codex-plugin"));
+    const controls = readdirSync6(join19(root, ".codex-plugin"));
     if (controls.length !== 1 || controls[0] !== "plugin.json")
       return false;
     const manifest = join19(root, ".codex-plugin", "plugin.json"), stat = lstatSync15(manifest, { throwIfNoEntry: false });
@@ -42787,7 +43100,7 @@ function codexVendorPluginRootRefreshSafe(root, budget2 = { remaining: MAX_SUBTR
 }
 function vendorMembers(path, budget2) {
   const directories = [];
-  for (const name of readdirSync5(path)) {
+  for (const name of readdirSync6(path)) {
     if (--budget2.remaining < 0)
       return null;
     const stat = lstatSync15(join19(path, name));
@@ -42980,7 +43293,7 @@ function codexPluginCacheSkillTree(path, depth) {
 // src/lib/agent-integration.ts
 import { createHash as createHash30, randomUUID as randomUUID4 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual10 } from "util";
-import { existsSync as existsSync7, lstatSync as lstatSync30, statSync as statSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync21, readdirSync as readdirSync10, opendirSync as opendirSync5, readlinkSync as readlinkSync7, realpathSync as realpathSync13, renameSync as renameSync4, rmdirSync as rmdirSync3, writeFileSync as writeFileSync5, unlinkSync as unlinkSync5, chmodSync, openSync as openSync23, closeSync as closeSync23, fsyncSync as fsyncSync7, fstatSync as fstatSync23, readSync as readSync15, constants as constants21, linkSync as linkSync3 } from "fs";
+import { existsSync as existsSync7, lstatSync as lstatSync30, statSync as statSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync21, readdirSync as readdirSync11, opendirSync as opendirSync5, readlinkSync as readlinkSync7, realpathSync as realpathSync13, renameSync as renameSync4, rmdirSync as rmdirSync3, writeFileSync as writeFileSync5, unlinkSync as unlinkSync5, chmodSync, openSync as openSync23, closeSync as closeSync23, fsyncSync as fsyncSync7, fstatSync as fstatSync23, readSync as readSync15, constants as constants21, linkSync as linkSync3 } from "fs";
 import { basename as basename13, dirname as dirname24, join as join33, resolve as resolve27, relative as relative9, isAbsolute as isAbsolute29, sep as sep14 } from "path";
 import { homedir as homedir3 } from "os";
 
@@ -43066,7 +43379,7 @@ function requiresCliSkillLoading(dataDir2 = getDataDirReadOnly()) {
 
 // src/lib/agent-bridge.ts
 import { createHash as createHash19 } from "crypto";
-import { lstatSync as lstatSync18, readFileSync as readFileSync15, readdirSync as readdirSync6 } from "fs";
+import { lstatSync as lstatSync18, readFileSync as readFileSync15, readdirSync as readdirSync7 } from "fs";
 import { join as join22 } from "path";
 var CLI_BRIDGE_NAME = "skills-cli";
 var CLI_BRIDGE_VERSION = 1;
@@ -43096,7 +43409,7 @@ function isOwnedCliBridge(path, expectedPaths) {
   try {
     if (!lstatSync18(path).isDirectory())
       return false;
-    if (JSON.stringify(readdirSync6(path).sort()) !== JSON.stringify(Object.keys(CLI_BRIDGE_FILES).sort()))
+    if (JSON.stringify(readdirSync7(path).sort()) !== JSON.stringify(Object.keys(CLI_BRIDGE_FILES).sort()))
       return false;
     return Object.entries(CLI_BRIDGE_FILES).every(([name, content]) => {
       const file = join22(path, name), stat = lstatSync18(file);
@@ -43109,7 +43422,7 @@ function isOwnedCliBridge(path, expectedPaths) {
 
 // src/lib/agent-discovery.ts
 import { createHash as createHash28 } from "crypto";
-import { lstatSync as lstatSync28, readFileSync as readFileSync19, readdirSync as readdirSync9, realpathSync as realpathSync11 } from "fs";
+import { lstatSync as lstatSync28, readFileSync as readFileSync19, readdirSync as readdirSync10, realpathSync as realpathSync11 } from "fs";
 import { basename as basename12, dirname as dirname23, isAbsolute as isAbsolute27, join as join32, relative as relative8, resolve as resolve26, sep as sep13 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual8 } from "util";
 
@@ -43368,7 +43681,7 @@ if (failed) process.exitCode = 2;
 
 // src/lib/plugin-projection-store.ts
 import { createHash as createHash21, randomUUID as randomUUID3 } from "crypto";
-import { constants as constants14, closeSync as closeSync17, fchmodSync, fstatSync as fstatSync17, fsyncSync as fsyncSync3, linkSync as linkSync2, lstatSync as lstatSync20, mkdirSync as mkdirSync5, openSync as openSync17, opendirSync as opendirSync3, readSync as readSync10, renameSync as renameSync3, rmdirSync as rmdirSync2, rmSync, unlinkSync as unlinkSync4, writeSync as writeSync2 } from "fs";
+import { constants as constants14, closeSync as closeSync17, fchmodSync, fstatSync as fstatSync17, fsyncSync as fsyncSync3, linkSync as linkSync2, lstatSync as lstatSync20, mkdirSync as mkdirSync6, openSync as openSync17, opendirSync as opendirSync3, readSync as readSync10, renameSync as renameSync3, rmdirSync as rmdirSync2, rmSync as rmSync2, unlinkSync as unlinkSync4, writeSync as writeSync2 } from "fs";
 import { dirname as dirname17, isAbsolute as isAbsolute18, join as join24, parse as parse5, resolve as resolve18 } from "path";
 
 // src/lib/plugin-projection.ts
@@ -43604,7 +43917,7 @@ function ancestors(path, create = false) {
     let currentStat = stat(current);
     if (!currentStat && create) {
       try {
-        mkdirSync5(current, { mode: 448 });
+        mkdirSync6(current, { mode: 448 });
       } catch (error) {
         if (!(error && typeof error === "object" && ("code" in error) && error.code === "EEXIST"))
           pluginRefusal("Cannot create private plugin storage directory");
@@ -43817,7 +44130,7 @@ function materializePluginTree(root, entries) {
   let locked, staged;
   try {
     try {
-      mkdirSync5(lock, { mode: 448 });
+      mkdirSync6(lock, { mode: 448 });
       locked = stat(lock);
     } catch {
       pluginRefusal("Plugin projection publication is already locked");
@@ -43827,7 +44140,7 @@ function materializePluginTree(root, entries) {
       verifyPluginTree(root, witnesses);
       return;
     }
-    mkdirSync5(staging, { mode: 448 });
+    mkdirSync6(staging, { mode: 448 });
     staged = stat(staging);
     for (const entry of entries) {
       const path = join24(staging, entry.path);
@@ -43846,7 +44159,7 @@ function materializePluginTree(root, entries) {
   } finally {
     if (staged) {
       same4(staged, stat(staging), true);
-      rmSync(staging, { recursive: true });
+      rmSync2(staging, { recursive: true });
     }
     if (locked) {
       same4(locked, stat(lock), true);
@@ -44191,11 +44504,11 @@ import { homedir as homedir2 } from "os";
 import { isAbsolute as isAbsolute21, join as join28, resolve as resolve20 } from "path";
 
 // src/lib/skill-validation.ts
-import { existsSync as existsSync5, lstatSync as lstatSync22, readFileSync as readFileSync18, readdirSync as readdirSync8, statSync as statSync7 } from "fs";
+import { existsSync as existsSync5, lstatSync as lstatSync22, readFileSync as readFileSync18, readdirSync as readdirSync9, statSync as statSync7 } from "fs";
 import { isAbsolute as isAbsolute20, join as join27, normalize as normalize3 } from "path";
 
 // src/lib/hosted-skill-set.ts
-import { existsSync as existsSync4, readFileSync as readFileSync17, readdirSync as readdirSync7, statSync as statSync6 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync17, readdirSync as readdirSync8, statSync as statSync6 } from "fs";
 import { join as join26 } from "path";
 var HOSTED_RUNTIMES = new Set(["hosted"]);
 var HOSTED_SOURCES = new Set(["remote", "private-hosted"]);
@@ -44424,7 +44737,7 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
   if (!VALID_BIN_COMMAND.test(bareName)) {
     add(issues, "skill.name_invalid", `Skill name '${bareName}' must use lowercase letters, numbers, dots, underscores, or hyphens`);
   }
-  for (const entry of readdirSync8(skillPath).sort()) {
+  for (const entry of readdirSync9(skillPath).sort()) {
     const entryPath = join27(skillPath, entry);
     if (RESERVED_SKILL_ENTRIES.has(entry)) {
       add(issues, "skill.reserved_file", `Reserved file '${entry}' is not allowed in skill packages`);
@@ -44610,7 +44923,7 @@ function validateRegistryConsistency(registry, skillsDir) {
     seen.add(name);
     return false;
   })));
-  const skillDirs = existsSync5(skillsDir) ? readdirSync8(skillsDir).filter((entry) => {
+  const skillDirs = existsSync5(skillsDir) ? readdirSync9(skillsDir).filter((entry) => {
     const fullPath = join27(skillsDir, entry);
     return !entry.startsWith(".") && entry !== "_common" && statSync7(fullPath).isDirectory();
   }) : [];
@@ -45442,7 +45755,7 @@ function verifiesCodexHookDiscoverySource(binding, source, currentDigest, witnes
 }
 
 // src/lib/agent-sumi.ts
-import { spawnSync as spawnSync5 } from "child_process";
+import { spawnSync as spawnSync6 } from "child_process";
 import { accessSync as accessSync2, constants as constants18, existsSync as existsSync6, lstatSync as lstatSync26, realpathSync as realpathSync10, statSync as statSync8 } from "fs";
 import { delimiter as delimiter2, isAbsolute as isAbsolute25, join as join30, resolve as resolve24 } from "path";
 
@@ -45600,7 +45913,7 @@ function sumiPathPlan(home, cwd = process.cwd(), env = process.env) {
       childEnv[key2] = env[key2];
   let child2;
   try {
-    child2 = spawnSync5(executable2, ["--json", "--home", resolve24(home), "--cwd", resolve24(cwd)], {
+    child2 = spawnSync6(executable2, ["--json", "--home", resolve24(home), "--cwd", resolve24(cwd)], {
       cwd: resolve24(cwd),
       env: childEnv,
       encoding: "buffer",
@@ -45761,7 +46074,7 @@ var SUMI_SKILL_PERMISSIONS = [
 
 // src/lib/retained-review-artifacts.ts
 import { createHash as createHash27 } from "crypto";
-import { constants as constants19, closeSync as closeSync21, fstatSync as fstatSync21, fsyncSync as fsyncSync5, lstatSync as lstatSync27, mkdirSync as mkdirSync6, openSync as openSync21, readSync as readSync14, writeSync as writeSync3 } from "fs";
+import { constants as constants19, closeSync as closeSync21, fstatSync as fstatSync21, fsyncSync as fsyncSync5, lstatSync as lstatSync27, mkdirSync as mkdirSync7, openSync as openSync21, readSync as readSync14, writeSync as writeSync3 } from "fs";
 import { dirname as dirname22, isAbsolute as isAbsolute26, join as join31, resolve as resolve25, sep as sep12 } from "path";
 var sha4 = (bytes) => createHash27("sha256").update(bytes).digest("hex");
 var hex = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
@@ -45891,7 +46204,7 @@ function writeReviewArtifactExclusive(change) {
   for (let parent = dirname22(change.path);!lstatSync27(parent, { throwIfNoEntry: false }); parent = dirname22(parent))
     missing2.push(parent);
   for (const parent of missing2.reverse())
-    mkdirSync6(parent, { mode: 448 });
+    mkdirSync7(parent, { mode: 448 });
   safe5(change.path);
   privateStore(change.artifact.storeRoot);
   for (let parent = dirname22(change.path);parent !== change.artifact.storeRoot; parent = dirname22(parent)) {
@@ -46656,13 +46969,13 @@ function assertProjectDiscovery(agent, directories, home, canonical9 = resolve26
       for (const name of ["plugin", "plugins"]) {
         const path = canonical9(join32(directory2, ".sumi", name));
         safe6(path);
-        if (lstatSync28(path, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(path).length)
+        if (lstatSync28(path, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(path).length)
           throw new Error(`NATIVE_SKILL_DRIFT: project Sumi plugins require a dedicated discovery review: ${path}`);
       }
     if (agent === "claude") {
       const commands = canonical9(join32(directory2, ".claude/commands"));
       safe6(commands);
-      if (lstatSync28(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length)
+      if (lstatSync28(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(commands).length)
         throw new Error("NATIVE_SKILL_DRIFT: legacy project command discovery requires a dedicated format adapter");
     }
   }
@@ -46811,7 +47124,7 @@ function resolveAgentDiscovery(options) {
     for (const path of plugins) {
       safe6(path);
       if (lstatSync28(path, { throwIfNoEntry: false })?.isDirectory())
-        for (const name of readdirSync9(path).sort()) {
+        for (const name of readdirSync10(path).sort()) {
           if (name === "skills-cli.js" && path === plugins[1])
             continue;
           const target = join32(path, name);
@@ -46822,7 +47135,7 @@ function resolveAgentDiscovery(options) {
     }
     for (const root2 of roots) {
       safe6(root2);
-      if (lstatSync28(root2, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(root2).some((name) => name.endsWith(".md")))
+      if (lstatSync28(root2, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(root2).some((name) => name.endsWith(".md")))
         unresolved("flat markdown skills require a dedicated native migration adapter");
     }
   }
@@ -46866,7 +47179,7 @@ function resolveAgentDiscovery(options) {
       safe6(builtinRoot);
       if (!lstatSync28(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
         unresolved("installed Gemini builtin root is missing");
-      for (const name of readdirSync9(builtinRoot).sort()) {
+      for (const name of readdirSync10(builtinRoot).sort()) {
         const text2 = witness(join32(builtinRoot, name, "SKILL.md"));
         const match = text2?.match(/^---\r?\n[\s\S]*?^name:\s*([a-z0-9][a-z0-9-]*)\s*$/m);
         if (!match?.[1] || builtinNames.includes(match[1]))
@@ -46964,7 +47277,7 @@ function resolveAgentDiscovery(options) {
       unresolved("plugin hooks require a separate no-skill-injection review");
     const commands = join32(root2, "commands");
     safe6(commands);
-    if (agent === "claude" && (manifest.commands !== undefined || lstatSync28(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length))
+    if (agent === "claude" && (manifest.commands !== undefined || lstatSync28(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(commands).length))
       unresolved("legacy command discovery requires retirement or a dedicated format adapter");
     const rootSkill = witness(join32(root2, "SKILL.md"));
     if (rootSkill !== null)
@@ -46986,7 +47299,7 @@ function resolveAgentDiscovery(options) {
     const installed = registrations === null ? {} : parseConfig(registrations, join32(home, ".claude/plugins/installed_plugins.json")).plugins;
     const commands = canonical9(join32(home, ".claude/commands"));
     safe6(commands);
-    if (lstatSync28(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length)
+    if (lstatSync28(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(commands).length)
       unresolved("legacy home command discovery requires a dedicated format adapter");
     for (const [id2, enabled] of Object.entries(config.enabledPlugins ?? {})) {
       if (enabled === false)
@@ -47028,7 +47341,7 @@ function resolveAgentDiscovery(options) {
     }
     const localPlugins = join32(home, ".config/opencode/plugins");
     safe6(localPlugins);
-    if (lstatSync28(localPlugins, { throwIfNoEntry: false }) && readdirSync9(localPlugins).some((name) => name !== "skills-cli.js"))
+    if (lstatSync28(localPlugins, { throwIfNoEntry: false }) && readdirSync10(localPlugins).some((name) => name !== "skills-cli.js"))
       unresolved("additional local plugin hooks require review");
   } else if (agent === "sumi") {
     if ((config.plugin?.length ?? 0) > 0 || (config.plugins?.length ?? 0) > 0 || sources.some((source) => source.path !== canonical9(configPath) && source.path !== canonical9(join32(sumiConfigDirectory(home), "sumi.jsonc")) && source.sha256 !== null))
@@ -47047,7 +47360,7 @@ function resolveAgentDiscovery(options) {
     const directory2 = join32(home, ".gemini/extensions");
     safe6(directory2);
     if (lstatSync28(directory2, { throwIfNoEntry: false }))
-      for (const name of readdirSync9(directory2)) {
+      for (const name of readdirSync10(directory2)) {
         const root2 = join32(directory2, name);
         safe6(root2);
         if (!lstatSync28(root2)?.isDirectory())
@@ -47861,7 +48174,7 @@ function treeHash(root2) {
     const rel = relative9(root2, path);
     if (stat2.isDirectory()) {
       hash3.update(`d\x00${rel}\x00`);
-      for (const name of readdirSync10(path).sort())
+      for (const name of readdirSync11(path).sort())
         visit2(join33(path, name));
       return;
     }
@@ -48756,7 +49069,7 @@ function planClaudeHookEventsUpdate(options) {
 }
 function atomicWrite2(path, content) {
   assertSafePath(path);
-  mkdirSync7(dirname24(path), { recursive: true, mode: 448 });
+  mkdirSync8(dirname24(path), { recursive: true, mode: 448 });
   const temporary = `${path}.skills-${randomUUID4()}`;
   try {
     writeFileSync5(temporary, content, { mode: 384, flag: "wx" });
@@ -48924,7 +49237,7 @@ function planCodexSemanticCacheWitnessUpgrade(options) {
         throw new Error("Local marketplace hook parent is not enabled in the unchanged Codex settings");
       identity5 = { role: "reviewed-hook", pluginId: pluginId2, namespace: parts[1], pluginParent: parent, installation: "local-marketplace", marketplaceSourcePath: source.path, marketplaceSha256: source.sha256 };
     }
-    const versions = readdirSync10(parent).filter((name) => name !== ".codex-remote-plugin-install.json");
+    const versions = readdirSync11(parent).filter((name) => name !== ".codex-remote-plugin-install.json");
     if (!versions.length || versions.length > 4096)
       throw new Error("Reviewed native-hook parent has no bounded materializations");
     for (const version2 of versions) {
@@ -49018,9 +49331,10 @@ function applyAgentIntegration(plan, options = {}) {
     const alias = plan.rootAliases?.find((item) => item.agent === "codex" && (change.path === item.target || change.path.startsWith(item.target + "/")));
     return lexical ? [lexical] : alias ? [alias.alias] : [];
   });
-  return withCodexCorpusWrite(roots, (assertCurrent) => applyAgentIntegrationUnlocked(plan, options, assertCurrent), options);
+  return withCodexCorpusWrite(roots, (assertCurrent, admission) => applyAgentIntegrationUnlocked(plan, options, assertCurrent, admission), options);
 }
-function applyAgentIntegrationUnlocked(plan, options = {}, assertCurrent) {
+function applyAgentIntegrationUnlocked(plan, options = {}, assertCurrent, admission) {
+  const fallback = codexAdmissionReceipt(admission);
   for (const source of plan.reviewArtifactSources ?? [])
     verifyReviewArtifactOriginal(source.path, source.sha256);
   for (const source of plan.observedNativeSources ?? [])
@@ -49084,10 +49398,10 @@ function applyAgentIntegrationUnlocked(plan, options = {}, assertCurrent) {
     recheckRootAliases(aliases);
     for (const agent of plan.retainedReviewChecks?.agents ?? [])
       assertManagedAgentBridge(agent, { ...plan.retainedReviewChecks, dataDir: plan.dataDir });
-    return { changed: [], backups, ...aliases.length ? { rootAliases: aliases } : {} };
+    return { changed: [], backups, ...aliases.length ? { rootAliases: aliases } : {}, ...fallback };
   }
   assertSafePath(backupRoot);
-  mkdirSync7(backupRoot, { recursive: true, mode: 448 });
+  mkdirSync8(backupRoot, { recursive: true, mode: 448 });
   chmodSync(backupRoot, 448);
   for (const [index, change] of plan.changes.entries())
     if (change.before !== null) {
@@ -49135,7 +49449,7 @@ function applyAgentIntegrationUnlocked(plan, options = {}, assertCurrent) {
       assertManagedAgentBridge(agent, { home: plan.managedAgentChecks.home, dataDir: plan.dataDir, projectDir: plan.managedAgentChecks.projectDir ?? plan.managedAgentChecks.home });
     for (const agent of plan.retainedReviewChecks?.agents ?? [])
       assertManagedAgentBridge(agent, { ...plan.retainedReviewChecks, dataDir: plan.dataDir });
-    atomicWrite2(join33(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha5(change.before), afterHash: sha5(change.after) })), backups, ...plan.cacheWitnessUpgrade ? { cacheWitnessUpgrade: plan.cacheWitnessUpgrade } : {}, ...plan.retainedReviewArtifacts?.length ? { retainedReviewArtifacts: plan.retainedReviewArtifacts.map((item) => ({ path: item.path, ...item.artifact })) } : {}, ...aliases.length ? { rootAliases: aliases } : {} }) + `
+    atomicWrite2(join33(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha5(change.before), afterHash: sha5(change.after) })), backups, ...plan.cacheWitnessUpgrade ? { cacheWitnessUpgrade: plan.cacheWitnessUpgrade } : {}, ...plan.retainedReviewArtifacts?.length ? { retainedReviewArtifacts: plan.retainedReviewArtifacts.map((item) => ({ path: item.path, ...item.artifact })) } : {}, ...aliases.length ? { rootAliases: aliases } : {}, ...fallback }) + `
 `);
   } catch (error) {
     assertCurrent();
@@ -49163,7 +49477,7 @@ function applyAgentIntegrationUnlocked(plan, options = {}, assertCurrent) {
     }
     throw error;
   }
-  return { changed: plan.changes.map((change) => change.path), backups, ...aliases.length ? { rootAliases: aliases } : {} };
+  return { changed: plan.changes.map((change) => change.path), backups, ...aliases.length ? { rootAliases: aliases } : {}, ...fallback };
 }
 function syncArchiveDirectory(path) {
   assertSafePath(path);
@@ -49203,9 +49517,10 @@ function archiveNativeSkills(inventory, options) {
       throw new Error("CODEX_CORPUS_ROOT_UNVERIFIED");
     return [...new Set([root2, owner2].filter((value) => value !== undefined))];
   });
-  return withCodexCorpusWrite(roots, (assertCurrent) => archiveNativeSkillsUnlocked(inventory, options, assertCurrent), options);
+  return withCodexCorpusWrite(roots, (assertCurrent, admission) => archiveNativeSkillsUnlocked(inventory, options, assertCurrent, admission), options);
 }
-function archiveNativeSkillsUnlocked(inventory, options, assertCurrent) {
+function archiveNativeSkillsUnlocked(inventory, options, assertCurrent, admission) {
+  const fallback = codexAdmissionReceipt(admission);
   const aliases = [...new Map(inventory.filter((entry) => entry.rootAlias).map((entry) => [entry.rootAlias.alias, entry.rootAlias])).values()];
   if (aliases.length && !options.allowRootAliases)
     throw new Error("Native migration requires explicit allowRootAliases for agent root aliases");
@@ -49223,7 +49538,7 @@ function archiveNativeSkillsUnlocked(inventory, options, assertCurrent) {
       throw new Error(`Native skill changed after planning: ${entry.path}`);
   const targetManifest = options.targetManifest ? { schema: options.targetManifest.schema, digest: options.targetManifest.digest, targetCount: options.targetManifest.targets.length } : undefined;
   if (!selected.length)
-    return { entries: [], ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
+    return { entries: [], ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {}, ...fallback };
   const operationId = randomUUID4(), archiveRoot = join33(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join33(archiveRoot, "receipt.json");
   const entries = selected.map((entry, index) => ({
     source: entry.vendor ? join33(entry.path, "SKILL.md") : entry.path,
@@ -49232,7 +49547,7 @@ function archiveNativeSkillsUnlocked(inventory, options, assertCurrent) {
     ...entry.vendor ? { discoveryOnly: true } : {},
     status: "planned"
   }));
-  const journal = { version: 2, operationId, status: "planned", entries, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
+  const journal = { version: 2, operationId, status: "planned", entries, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {}, ...fallback };
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
@@ -49246,7 +49561,7 @@ function archiveNativeSkillsUnlocked(inventory, options, assertCurrent) {
   const created = [];
   for (let path = archiveRoot;!existsSync7(path); path = dirname24(path))
     created.push(path);
-  mkdirSync7(archiveRoot, { recursive: true, mode: 448 });
+  mkdirSync8(archiveRoot, { recursive: true, mode: 448 });
   try {
     for (const directory2 of created)
       syncArchiveDirectory(directory2);
@@ -49329,7 +49644,7 @@ function archiveNativeSkillsUnlocked(inventory, options, assertCurrent) {
     } catch {}
     throw new Error(`Native archive failed; inspect the recovery journal at ${receiptPath} before retrying.`, { cause: error });
   }
-  return { entries: entries.map(({ status, conflict, ...entry }) => entry), receiptPath, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
+  return { entries: entries.map(({ status, conflict, ...entry }) => entry), receiptPath, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {}, ...fallback };
 }
 function classifiedCodexPluginCacheCopy(entry, cache, read3, admit) {
   try {
@@ -49671,12 +49986,12 @@ function assertNativeExportAllowed(dataDir2 = getDataDirReadOnly()) {
 // src/lib/portable-skills.ts
 import {
   existsSync as existsSync10,
-  mkdirSync as mkdirSync9,
-  mkdtempSync,
-  readdirSync as readdirSync12,
+  mkdirSync as mkdirSync10,
+  mkdtempSync as mkdtempSync2,
+  readdirSync as readdirSync13,
   realpathSync as realpathSync16,
   renameSync as renameSync5,
-  rmSync as rmSync2,
+  rmSync as rmSync3,
   statSync as statSync12,
   writeFileSync as writeFileSync7
 } from "fs";
@@ -49687,7 +50002,7 @@ var SKILLS = [];
 
 // src/lib/skill-hash.ts
 import { createHash as createHash31 } from "crypto";
-import { existsSync as existsSync8, readdirSync as readdirSync11, readFileSync as readFileSync22, statSync as statSync10 } from "fs";
+import { existsSync as existsSync8, readdirSync as readdirSync12, readFileSync as readFileSync22, statSync as statSync10 } from "fs";
 import { join as join34, sep as sep15 } from "path";
 var CONTENT_HASH_ALGORITHM = "sha256";
 var HASH_EXCLUDE_DIRS = new Set([".git", "node_modules", "dist", "build", ".turbo"]);
@@ -49761,7 +50076,7 @@ function collectBundleFiles(skillPath) {
   return files.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
 }
 function collectDirectory(files, dir, rel) {
-  for (const entry of readdirSync11(dir).sort()) {
+  for (const entry of readdirSync12(dir).sort()) {
     if (entry.startsWith("."))
       continue;
     const absolute = join34(dir, entry);
@@ -50200,7 +50515,7 @@ import {
   cpSync,
   existsSync as existsSync9,
   lstatSync as lstatSync31,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   readFileSync as readFileSync23,
   realpathSync as realpathSync14,
   writeFileSync as writeFileSync6
@@ -50321,7 +50636,7 @@ function createInstructionManifest(name, options) {
   };
 }
 function writeInstructionSkillTemplate(skillPath, manifest) {
-  mkdirSync8(skillPath, { recursive: true });
+  mkdirSync9(skillPath, { recursive: true });
   writeFileSync6(join35(skillPath, "SKILL.md"), renderInstructionSkillMd(manifest));
   writeSkillJsonWithHash(skillPath, manifest);
 }
@@ -50372,7 +50687,7 @@ function createPortableManifest(name, options) {
   };
 }
 function writePortableSkillTemplate(skillPath, manifest) {
-  mkdirSync8(join35(skillPath, "src"), { recursive: true });
+  mkdirSync9(join35(skillPath, "src"), { recursive: true });
   writeFileSync6(join35(skillPath, "SKILL.md"), renderSkillMd(manifest));
   writeFileSync6(join35(skillPath, "AGENTS.md"), renderAgentsMd(manifest));
   writeFileSync6(join35(skillPath, "package.json"), renderPackageJson(manifest));
@@ -50452,7 +50767,7 @@ function ensurePortableSkillFiles(skillPath, manifest) {
   };
   const entry = next.commands[0]?.entry ?? "src/index.ts";
   if (entry && !existsSync9(join35(skillPath, entry))) {
-    mkdirSync8(dirname25(join35(skillPath, entry)), { recursive: true });
+    mkdirSync9(dirname25(join35(skillPath, entry)), { recursive: true });
     writeFileSync6(join35(skillPath, entry), renderEntrypoint(next));
   }
   if (!existsSync9(join35(skillPath, "SKILL.md")))
@@ -50558,7 +50873,7 @@ function renameInstructionFrontmatter(content, name) {
 }
 function copySkillDirectory(source, destination) {
   const resolvedSource = lstatSync31(source).isSymbolicLink() ? realpathSync14(source) : source;
-  mkdirSync8(destination, { recursive: true });
+  mkdirSync9(destination, { recursive: true });
   cpSync(resolvedSource, destination, {
     recursive: true,
     filter: (src) => {
@@ -50879,7 +51194,7 @@ function physicalPath(path) {
   }
   return resolve28(realpathSync15(cursor), ...suffix);
 }
-function contains(root2, path) {
+function contains2(root2, path) {
   return path === root2 || path.startsWith(root2 + sep16);
 }
 function configuredRoots(home, explicitHome) {
@@ -50932,14 +51247,14 @@ function assertPortableAuthoringPath(path, options = {}) {
   const defaults = NATIVE_DISCOVERY_ROOTS.map((parts) => join36(home, ...parts));
   defaults.push(join36(home, ".codex/plugins/cache"), join36(home, ".claude/plugins/cache"), join36(home, ".claude/plugins/synced"), join36(home, ".gemini/extensions"));
   for (const root2 of defaults) {
-    if (candidates.some((candidate2) => contains(resolve28(root2), candidate2) || contains(physicalPath(root2), candidate2)))
+    if (candidates.some((candidate2) => contains2(resolve28(root2), candidate2) || contains2(physicalPath(root2), candidate2)))
       native ??= root2;
   }
   if (native) {
     throw new Error(`Refusing portable Skills authoring below native discovery root '${native}': ${lexical}. Set HASNA_SKILLS_DIR to a private authoring corpus outside native roots.`);
   }
   for (const root2 of configuredRoots(home, options.homeDir !== undefined)) {
-    if (candidates.some((candidate2) => contains(resolve28(root2), candidate2) || contains(physicalPath(root2), candidate2))) {
+    if (candidates.some((candidate2) => contains2(resolve28(root2), candidate2) || contains2(physicalPath(root2), candidate2))) {
       throw new Error(`Refusing portable Skills authoring below configured native discovery root: ${lexical}`);
     }
   }
@@ -50982,7 +51297,7 @@ function listPortableSkills(options = {}) {
   if (!safeIsDirectory(root2))
     return [];
   const skills = [];
-  for (const entry of readdirSync12(root2).sort()) {
+  for (const entry of readdirSync13(root2).sort()) {
     if (entry.startsWith("."))
       continue;
     const path = join37(root2, entry);
@@ -51026,7 +51341,7 @@ function scaffoldPortableSkill(name, options = {}) {
   if (existsSync10(skillPath)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${skillPath}`);
-    rmSync2(skillPath, { recursive: true, force: true });
+    rmSync3(skillPath, { recursive: true, force: true });
   }
   const kind = options.kind ?? "executable";
   const description = options.description ?? `${displayName(skillName)} skill`;
@@ -51053,7 +51368,7 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   };
   const imported = [];
   const skipped = [];
-  const entries = readdirSync12(absoluteSource, { withFileTypes: true }).map((entry) => entry.name).filter((entryName) => !entryName.startsWith(".")).sort();
+  const entries = readdirSync13(absoluteSource, { withFileTypes: true }).map((entry) => entry.name).filter((entryName) => !entryName.startsWith(".")).sort();
   for (const entryName of entries) {
     const childPath = join37(absoluteSource, entryName);
     if (!safeIsDirectory(childPath))
@@ -51098,11 +51413,11 @@ function physicalImportPath(path) {
 function assertDisjointImportPaths(source, destination) {
   const sourcePath = realpathSync16(source);
   const destinationPath = physicalImportPath(destination);
-  const contains2 = (parent, child2) => {
+  const contains3 = (parent, child2) => {
     const path = relative11(parent, child2);
     return path === "" || !isAbsolute30(path) && path !== ".." && !path.startsWith(`..${sep17}`);
   };
-  if (contains2(sourcePath, destinationPath) || contains2(destinationPath, sourcePath)) {
+  if (contains3(sourcePath, destinationPath) || contains3(destinationPath, sourcePath)) {
     throw new Error("Source and destination skill directories must not overlap");
   }
 }
@@ -51129,9 +51444,9 @@ function portPortableSkill(sourcePath, options = {}) {
   if (existsSync10(destination)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${destination}`);
-    rmSync2(destination, { recursive: true, force: true });
+    rmSync3(destination, { recursive: true, force: true });
   }
-  mkdirSync9(dirname27(destination), { recursive: true });
+  mkdirSync10(dirname27(destination), { recursive: true });
   copySkillDirectory(absoluteSource, destination);
   const base = {
     ...inferred,
@@ -51173,7 +51488,7 @@ function writeCorpusSkill(input, options = {}) {
   const skillPath = join37(root2, name);
   assertPortableAuthoringPath(skillPath, options);
   const created = !existsSync10(skillPath);
-  mkdirSync9(skillPath, { recursive: true });
+  mkdirSync10(skillPath, { recursive: true });
   writeFileSync7(join37(skillPath, "SKILL.md"), input.skillMd);
   const manifest = buildCorpusManifest(input, name);
   writeSkillJsonWithHash(skillPath, manifest);
@@ -51187,8 +51502,8 @@ function installCorpusSkillAtomically(input, options = {}) {
   const target = join37(root2, name);
   assertPortableAuthoringPath(target, options);
   const created = !existsSync10(target);
-  mkdirSync9(root2, { recursive: true });
-  const staging = mkdtempSync(join37(root2, `.pull-${name}-`));
+  mkdirSync10(root2, { recursive: true });
+  const staging = mkdtempSync2(join37(root2, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
@@ -51196,16 +51511,16 @@ function installCorpusSkillAtomically(input, options = {}) {
     const manifest = buildCorpusManifest(input, name);
     writeSkillJsonWithHash(staging, manifest);
     if (existsSync10(target)) {
-      backup = mkdtempSync(join37(root2, `.pull-backup-${name}-`));
+      backup = mkdtempSync2(join37(root2, `.pull-backup-${name}-`));
       renameSync5(target, join37(backup, name));
       moved = true;
     }
     renameSync5(staging, target);
     if (moved && backup)
-      rmSync2(backup, { recursive: true, force: true });
+      rmSync3(backup, { recursive: true, force: true });
     return { name, path: target, manifest, created };
   } catch (error) {
-    rmSync2(staging, { recursive: true, force: true });
+    rmSync3(staging, { recursive: true, force: true });
     if (moved && backup && existsSync10(join37(backup, name))) {
       try {
         renameSync5(join37(backup, name), target);
@@ -51502,7 +51817,7 @@ function packageSourceRoots(source) {
 function containsSkillDirectories(path) {
   let entries;
   try {
-    entries = readdirSync13(path);
+    entries = readdirSync14(path);
   } catch {
     return false;
   }
@@ -51597,12 +51912,16 @@ function writeManagedAgentSkill(params) {
     agent: params.agent,
     path: result.path,
     action: result.action,
-    ...result.reason ? { reason: result.reason } : {}
+    ...result.reason ? { reason: result.reason } : {},
+    ...result.nativeAdmission ? { nativeAdmission: result.nativeAdmission, nativeAdmissionProbe: result.nativeAdmissionProbe } : {}
   };
 }
 function writeManagedSkillDir(dir, skillMd, options) {
   const root2 = options.dryRun ? undefined : codexCorpusRootForPath(dir);
-  return withCodexCorpusWrite(root2 ? [root2] : [], (assertCurrent) => writeManagedSkillDirUnlocked(dir, skillMd, options, assertCurrent), options);
+  return withCodexCorpusWrite(root2 ? [root2] : [], (assertCurrent, admission) => {
+    const result = writeManagedSkillDirUnlocked(dir, skillMd, options, assertCurrent);
+    return { ...result, ...codexAdmissionReceipt(admission) };
+  }, options);
 }
 function writeManagedSkillDirUnlocked(dir, skillMd, options, assertCurrent) {
   const skillMdPath = join38(dir, "SKILL.md");
@@ -51643,8 +51962,8 @@ function writeManagedSkillDirUnlocked(dir, skillMd, options, assertCurrent) {
   if (options.dryRun)
     return { action, path: skillMdPath };
   const parentDir = dirname28(dir);
-  mkdirSync10(parentDir, { recursive: true });
-  const transactionDir = mkdtempSync2(join38(parentDir, `.hasna-skills-write-${basename17(dir)}-`));
+  mkdirSync11(parentDir, { recursive: true });
+  const transactionDir = mkdtempSync3(join38(parentDir, `.hasna-skills-write-${basename17(dir)}-`));
   const candidateDir = join38(transactionDir, "candidate");
   const backupDir = join38(transactionDir, "backup");
   const candidateSkillMdPath = join38(candidateDir, "SKILL.md");
@@ -51662,7 +51981,7 @@ function writeManagedSkillDirUnlocked(dir, skillMd, options, assertCurrent) {
     if (options.resourceDir) {
       cpSync2(options.resourceDir, candidateDir, { recursive: true, force: true });
     } else {
-      mkdirSync10(candidateDir, { recursive: true });
+      mkdirSync11(candidateDir, { recursive: true });
     }
     writeFileSync8(candidateSkillMdPath, skillMd.endsWith(`
 `) ? skillMd : `${skillMd}
@@ -51686,7 +52005,7 @@ function writeManagedSkillDirUnlocked(dir, skillMd, options, assertCurrent) {
       try {
         assertCurrent();
         if (existsSync11(dir))
-          rmSync3(dir, { recursive: true, force: true });
+          rmSync4(dir, { recursive: true, force: true });
         renameDirectory(backupDir, dir);
         originalMoved = false;
       } catch (rollbackError) {
@@ -51699,22 +52018,26 @@ function writeManagedSkillDirUnlocked(dir, skillMd, options, assertCurrent) {
     if (!preserveTransaction) {
       try {
         assertCurrent();
-        rmSync3(transactionDir, { recursive: true, force: true });
+        rmSync4(transactionDir, { recursive: true, force: true });
       } catch {}
     }
   }
   return { action, path: skillMdPath };
 }
 function removeManagedAgentSkill(skill, agent, homeDir3 = homedir5(), options = {}) {
+  const record6 = codexAdmissionRecord(options);
   const dir = join38(agentGlobalSkillsDir(agent, homeDir3), skill);
   const root2 = codexCorpusRootForPath(dir);
-  return withCodexCorpusWrite(root2 ? [root2] : [], () => removeManagedAgentSkillUnlocked(skill, agent, homeDir3, options), options);
+  return withCodexCorpusWrite(root2 ? [root2] : [], (_assertCurrent, admission) => {
+    record6.deliver(admission);
+    return removeManagedAgentSkillUnlocked(skill, agent, homeDir3, options);
+  }, options, record6.policy);
 }
 function removeManagedAgentSkillUnlocked(skill, agent, homeDir3 = homedir5(), options = {}) {
   const dir = join38(agentGlobalSkillsDir(agent, homeDir3), skill);
   if (!hasSkillsOwnershipMarker(dir))
     return false;
-  rmSync3(dir, { recursive: true, force: true });
+  rmSync4(dir, { recursive: true, force: true });
   return true;
 }
 function sourceSkillMd(skillPath, name, description, kind, preferBundledDocs = false) {
@@ -51751,7 +52074,7 @@ function normalizeSkillName(name) {
 }
 
 // src/lib/registry.ts
-import { existsSync as existsSync12, readFileSync as readFileSync25, readdirSync as readdirSync14 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync25, readdirSync as readdirSync15 } from "fs";
 import { join as join39 } from "path";
 
 // src/lib/registry-merge.ts
@@ -51981,7 +52304,7 @@ function discoverSkillsInDir(dir, source = "custom") {
     return [];
   const result = [];
   try {
-    const entries = readdirSync14(dir, { withFileTypes: true });
+    const entries = readdirSync15(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
@@ -52017,7 +52340,7 @@ function findExtensionSkillPath(name) {
   if (!config.extensionsDir || !existsSync12(config.extensionsDir))
     return null;
   try {
-    const entries = readdirSync14(config.extensionsDir, { withFileTypes: true });
+    const entries = readdirSync15(config.extensionsDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
@@ -52092,7 +52415,7 @@ function getAllTags(catalog) {
 }
 
 // src/lib/project-state.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync11, readFileSync as readFileSync26, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync12, readFileSync as readFileSync26, writeFileSync as writeFileSync9 } from "fs";
 import { join as join40 } from "path";
 var VALID_PIN_SOURCES = [
   "official",
@@ -52139,7 +52462,7 @@ function ensureProjectConfig(targetDir = process.cwd()) {
 }
 function saveProjectConfig(config, targetDir = process.cwd()) {
   const dir = getProjectStateDir(targetDir);
-  mkdirSync11(dir, { recursive: true });
+  mkdirSync12(dir, { recursive: true });
   const normalized2 = normalizeProjectConfig({ ...config, updatedAt: new Date().toISOString() });
   writeFileSync9(getProjectConfigPath(targetDir), JSON.stringify(normalized2, null, 2) + `
 `);
@@ -52408,15 +52731,20 @@ function installSkillForAgent(name, options, generateSkillMd) {
     codexCommand: options.codexCommand,
     codexSha256: options.codexSha256
   });
+  const fallback = result.nativeAdmission ? { nativeAdmission: result.nativeAdmission, nativeAdmissionProbe: result.nativeAdmissionProbe } : {};
   if (result.action === "skip") {
-    return { skill: canonicalName, success: false, error: result.reason ?? "skipped", path: result.path };
+    return { skill: canonicalName, success: false, error: result.reason ?? "skipped", path: result.path, ...fallback };
   }
-  return { skill: canonicalName, success: true, path: result.path };
+  return { skill: canonicalName, success: true, path: result.path, ...fallback };
 }
 function removeSkillForAgent(name, options) {
+  const record6 = codexAdmissionRecord(options);
   const dir = getAgentSkillPath(name, options.agent, options.scope ?? "global", options.projectDir);
   const root2 = codexCorpusRootForPath(dir);
-  return withCodexCorpusWrite(root2 ? [root2] : [], () => removeSkillForAgentUnlocked(name, options), options);
+  return withCodexCorpusWrite(root2 ? [root2] : [], (_assertCurrent, admission) => {
+    record6.deliver(admission);
+    return removeSkillForAgentUnlocked(name, options);
+  }, options, record6.policy);
 }
 function removeSkillForAgentUnlocked(name, options) {
   const canonicalName = getCanonicalSkillName(name);
@@ -52424,7 +52752,7 @@ function removeSkillForAgentUnlocked(name, options) {
   const dir = getAgentSkillPath(canonicalName, options.agent, scope, options.projectDir);
   if (!hasSkillsOwnershipMarker(dir))
     return false;
-  rmSync4(dir, { recursive: true, force: true });
+  rmSync5(dir, { recursive: true, force: true });
   return true;
 }
 function resolveAgentSkillMd(name, generateSkillMd) {
@@ -53108,7 +53436,7 @@ async function executeSelectedLocal(selected, options = {}) {
         throw new SkillSelectionError("INVALID_SECRET_BINDINGS", "Explicit environment values must be bounded strings without NUL bytes.");
       secretEnv[name] = value;
     }
-  const runDirectory = mkdtempSync3(join43(tmpdir(), "skills-execution-"));
+  const runDirectory = mkdtempSync4(join43(tmpdir(), "skills-execution-"));
   const paths = new SkillEntryPaths;
   for (const entry of entries) {
     paths.add(entry.path, 100, () => {
@@ -53117,7 +53445,7 @@ async function executeSelectedLocal(selected, options = {}) {
       throw new SkillSelectionError("INVALID_BUNDLE_PATH", "The execution bundle path exceeds its limit.");
     });
     const destination = join43(runDirectory, entry.path);
-    mkdirSync12(dirname29(destination), { recursive: true, mode: 448 });
+    mkdirSync13(dirname29(destination), { recursive: true, mode: 448 });
     writeFileSync10(destination, entry.bytes, { flag: "wx", mode: entry.mode & 511 });
   }
   env.SKILLS_INPUT_JSON = input;
@@ -53667,7 +53995,7 @@ var $getFlexibleChecksumsPlugin = getFlexibleChecksumsPlugin;
 var $resolveFlexibleChecksumsConfig = resolveFlexibleChecksumsConfig;
 
 // node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
-var import_client26 = __toESM(require_client2(), 1);
+var import_client27 = __toESM(require_client2(), 1);
 
 // node_modules/@aws-sdk/middleware-sdk-s3/dist-cjs/submodules/s3/index.js
 var { NoOpLogger, getSmithyContext } = require_client();
@@ -54276,8 +54604,8 @@ var $resolveS3Config = resolveS3Config;
 
 // node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
 var import_core = __toESM(require_dist_cjs2(), 1);
-var import_client27 = __toESM(require_client(), 1);
-var import_config37 = __toESM(require_config(), 1);
+var import_client28 = __toESM(require_client(), 1);
+var import_config38 = __toESM(require_config(), 1);
 var import_endpoints5 = __toESM(require_endpoints(), 1);
 var import_event_streams2 = __toESM(require_event_streams(), 1);
 var import_protocols6 = __toESM(require_protocols(), 1);
@@ -54287,11 +54615,11 @@ var import_schema2 = __toESM(require_schema4(), 1);
 // node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
 var import_httpAuthSchemes = __toESM(require_httpAuthSchemes(), 1);
 var import_signature_v4_multi_region = __toESM(require_dist_cjs4(), 1);
-var import_client5 = __toESM(require_client(), 1);
+var import_client6 = __toESM(require_client(), 1);
 var import_endpoints3 = __toESM(require_endpoints(), 1);
 
 // node_modules/@aws-sdk/client-s3/dist-es/endpoint/endpointResolver.js
-var import_client4 = __toESM(require_client2(), 1);
+var import_client5 = __toESM(require_client2(), 1);
 var import_endpoints2 = __toESM(require_endpoints(), 1);
 
 // node_modules/@aws-sdk/client-s3/dist-es/endpoint/bdd.js
@@ -56264,7 +56592,7 @@ var defaultEndpointResolver = (endpointParams, context = {}) => {
     logger: context.logger
   }));
 };
-import_endpoints2.customEndpointFunctions.aws = import_client4.awsEndpointFunctions;
+import_endpoints2.customEndpointFunctions.aws = import_client5.awsEndpointFunctions;
 
 // node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
 var createEndpointRuleSetHttpAuthSchemeParametersProvider = (defaultHttpAuthSchemeParametersProvider) => async (config, context, input) => {
@@ -56272,7 +56600,7 @@ var createEndpointRuleSetHttpAuthSchemeParametersProvider = (defaultHttpAuthSche
     throw new Error("Could not find `input` for `defaultEndpointRuleSetHttpAuthSchemeParametersProvider`");
   }
   const defaultParameters = await defaultHttpAuthSchemeParametersProvider(config, context, input);
-  const instructionsFn = import_client5.getSmithyContext(context)?.commandInstance?.constructor?.getEndpointParameterInstructions;
+  const instructionsFn = import_client6.getSmithyContext(context)?.commandInstance?.constructor?.getEndpointParameterInstructions;
   if (!instructionsFn) {
     throw new Error(`getEndpointParameterInstructions() is not defined on '${context.commandName}'`);
   }
@@ -56281,8 +56609,8 @@ var createEndpointRuleSetHttpAuthSchemeParametersProvider = (defaultHttpAuthSche
 };
 var _defaultS3HttpAuthSchemeParametersProvider = async (config, context, input) => {
   return {
-    operation: import_client5.getSmithyContext(context).operation,
-    region: await import_client5.normalizeProvider(config.region)() || (() => {
+    operation: import_client6.getSmithyContext(context).operation,
+    region: await import_client6.normalizeProvider(config.region)() || (() => {
       throw new Error("expected `region` to be configured for `aws.auth#sigv4`");
     })()
   };
@@ -56378,12 +56706,12 @@ var resolveHttpAuthSchemeConfig = (config) => {
   const config_0 = import_httpAuthSchemes.resolveAwsSdkSigV4Config(config);
   const config_1 = import_httpAuthSchemes.resolveAwsSdkSigV4AConfig(config_0);
   return Object.assign(config_1, {
-    authSchemePreference: import_client5.normalizeProvider(config.authSchemePreference ?? [])
+    authSchemePreference: import_client6.normalizeProvider(config.authSchemePreference ?? [])
   });
 };
 
 // node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
-var import_client6 = __toESM(require_client(), 1);
+var import_client7 = __toESM(require_client(), 1);
 var import_endpoints4 = __toESM(require_endpoints(), 1);
 
 // node_modules/@aws-sdk/client-s3/dist-es/endpoint/EndpointParameters.js
@@ -56413,7 +56741,7 @@ var commonParams = {
 };
 
 // node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
-var command = import_client6.makeBuilder(commonParams, "AmazonS3", "S3Client", import_endpoints4.getEndpointPlugin);
+var command = import_client7.makeBuilder(commonParams, "AmazonS3", "S3Client", import_endpoints4.getEndpointPlugin);
 var _ep0 = {
   Bucket: { type: "contextParams", name: "Bucket" },
   Key: { type: "contextParams", name: "Key" }
@@ -56448,8 +56776,8 @@ var _mw11 = (Command, cs, config, o3) => [
 var import_schema = __toESM(require_schema4(), 1);
 
 // node_modules/@aws-sdk/client-s3/dist-es/models/S3ServiceException.js
-var import_client7 = __toESM(require_client(), 1);
-class S3ServiceException extends import_client7.ServiceException {
+var import_client8 = __toESM(require_client(), 1);
+class S3ServiceException extends import_client8.ServiceException {
   constructor(options) {
     super(options);
     Object.setPrototypeOf(this, S3ServiceException.prototype);
@@ -62275,26 +62603,26 @@ var package_default2 = {
 };
 
 // node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
-var import_client22 = __toESM(require_client2(), 1);
+var import_client23 = __toESM(require_client2(), 1);
 var import_httpAuthSchemes3 = __toESM(require_httpAuthSchemes(), 1);
 
 // node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.js
 init_dist_es();
-var import_config35 = __toESM(require_config(), 1);
+var import_config36 = __toESM(require_config(), 1);
 
 // node_modules/@aws-sdk/credential-provider-node/dist-es/remoteProvider.js
-var import_config18 = __toESM(require_config(), 1);
+var import_config19 = __toESM(require_config(), 1);
 var ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
 var remoteProvider = async (init) => {
   const { ENV_CMDS_FULL_URI: ENV_CMDS_FULL_URI2, ENV_CMDS_RELATIVE_URI: ENV_CMDS_RELATIVE_URI2, fromContainerMetadata: fromContainerMetadata2, fromInstanceMetadata: fromInstanceMetadata2 } = await Promise.resolve().then(() => (init_dist_es2(), exports_dist_es2));
   if (process.env[ENV_CMDS_RELATIVE_URI2] || process.env[ENV_CMDS_FULL_URI2]) {
     init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromHttp/fromContainerMetadata");
     const { fromHttp: fromHttp2 } = await Promise.resolve().then(() => (init_dist_es3(), exports_dist_es3));
-    return import_config18.chain(fromHttp2(init), fromContainerMetadata2(init));
+    return import_config19.chain(fromHttp2(init), fromContainerMetadata2(init));
   }
   if (process.env[ENV_IMDS_DISABLED] && process.env[ENV_IMDS_DISABLED] !== "false") {
     return async () => {
-      throw new import_config18.CredentialsProviderError("EC2 Instance Metadata Service access disabled", { logger: init.logger });
+      throw new import_config19.CredentialsProviderError("EC2 Instance Metadata Service access disabled", { logger: init.logger });
     };
   }
   init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromInstanceMetadata");
@@ -62369,7 +62697,7 @@ var internalCreateChain = (providers) => async (awsIdentityProperties) => {
 var multipleCredentialSourceWarningEmitted = false;
 var defaultProvider = (init = {}) => memoizeChain([
   async () => {
-    const profile = init.profile ?? process.env[import_config35.ENV_PROFILE];
+    const profile = init.profile ?? process.env[import_config36.ENV_PROFILE];
     if (profile) {
       const envStaticCredentialsAreSet = process.env[ENV_KEY] && process.env[ENV_SECRET];
       if (envStaticCredentialsAreSet) {
@@ -62387,7 +62715,7 @@ var defaultProvider = (init = {}) => memoizeChain([
           multipleCredentialSourceWarningEmitted = true;
         }
       }
-      throw new import_config35.CredentialsProviderError("AWS_PROFILE is set, skipping fromEnv provider.", {
+      throw new import_config36.CredentialsProviderError("AWS_PROFILE is set, skipping fromEnv provider.", {
         logger: init.logger,
         tryNextLink: true
       });
@@ -62399,7 +62727,7 @@ var defaultProvider = (init = {}) => memoizeChain([
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromSSO");
     const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
     if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
-      throw new import_config35.CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).", { logger: init.logger });
+      throw new import_config36.CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).", { logger: init.logger });
     }
     const { fromSSO: fromSSO2 } = await Promise.resolve().then(() => (init_dist_es5(), exports_dist_es4));
     return fromSSO2(init)(awsIdentityProperties);
@@ -62424,7 +62752,7 @@ var defaultProvider = (init = {}) => memoizeChain([
     return (await remoteProvider(init))();
   },
   async () => {
-    throw new import_config35.CredentialsProviderError("Could not load credentials from any providers", {
+    throw new import_config36.CredentialsProviderError("Could not load credentials from any providers", {
       tryNextLink: false,
       logger: init.logger
     });
@@ -62433,8 +62761,8 @@ var defaultProvider = (init = {}) => memoizeChain([
 var credentialsTreatedAsExpired = (credentials) => credentials?.expiration !== undefined && credentials.expiration.getTime() - Date.now() < 300000;
 // node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var import_checksum2 = __toESM(require_checksum(), 1);
-var import_client23 = __toESM(require_client(), 1);
-var import_config36 = __toESM(require_config(), 1);
+var import_client24 = __toESM(require_client(), 1);
+var import_config37 = __toESM(require_config(), 1);
 var import_event_streams = __toESM(require_event_streams(), 1);
 var import_retry3 = __toESM(require_retry(), 1);
 var import_serde4 = __toESM(require_serde(), 1);
@@ -62673,7 +63001,7 @@ var $Sha1 = Sha1Node;
 var import_httpAuthSchemes2 = __toESM(require_httpAuthSchemes(), 1);
 var import_signature_v4_multi_region2 = __toESM(require_dist_cjs4(), 1);
 var import_checksum = __toESM(require_checksum(), 1);
-var import_client21 = __toESM(require_client(), 1);
+var import_client22 = __toESM(require_client(), 1);
 var import_protocols4 = __toESM(require_protocols(), 1);
 var import_serde3 = __toESM(require_serde(), 1);
 var getRuntimeConfig2 = (config) => {
@@ -62698,7 +63026,7 @@ var getRuntimeConfig2 = (config) => {
         signer: new import_httpAuthSchemes2.AwsSdkSigV4ASigner
       }
     ],
-    logger: config?.logger ?? new import_client21.NoOpLogger,
+    logger: config?.logger ?? new import_client22.NoOpLogger,
     md5: config?.md5 ?? import_checksum.Md5,
     protocol: config?.protocol ?? $S3RestXmlProtocol,
     protocolSettings: config?.protocolSettings ?? {
@@ -62723,11 +63051,11 @@ var getRuntimeConfig2 = (config) => {
 
 // node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var getRuntimeConfig3 = (config) => {
-  import_client23.emitWarningIfUnsupportedVersion(process.version);
-  const defaultsMode = import_config36.resolveDefaultsModeConfig(config);
-  const defaultConfigProvider = () => defaultsMode().then(import_client23.loadConfigsForDefaultMode);
+  import_client24.emitWarningIfUnsupportedVersion(process.version);
+  const defaultsMode = import_config37.resolveDefaultsModeConfig(config);
+  const defaultConfigProvider = () => defaultsMode().then(import_client24.loadConfigsForDefaultMode);
   const clientSharedValues = getRuntimeConfig2(config);
-  import_client22.emitWarningIfUnsupportedVersion(process.version);
+  import_client23.emitWarningIfUnsupportedVersion(process.version);
   const loaderConfig = {
     profile: config?.profile,
     logger: clientSharedValues.logger
@@ -62737,34 +63065,34 @@ var getRuntimeConfig3 = (config) => {
     ...config,
     runtime: "node",
     defaultsMode,
-    authSchemePreference: config?.authSchemePreference ?? import_config36.loadConfig(import_httpAuthSchemes3.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
+    authSchemePreference: config?.authSchemePreference ?? import_config37.loadConfig(import_httpAuthSchemes3.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde4.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
-    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client22.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default2.version }),
-    disableS3ExpressSessionAuth: config?.disableS3ExpressSessionAuth ?? import_config36.loadConfig($NODE_DISABLE_S3_EXPRESS_SESSION_AUTH_OPTIONS, loaderConfig),
+    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client23.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default2.version }),
+    disableS3ExpressSessionAuth: config?.disableS3ExpressSessionAuth ?? import_config37.loadConfig($NODE_DISABLE_S3_EXPRESS_SESSION_AUTH_OPTIONS, loaderConfig),
     eventStreamSerdeProvider: config?.eventStreamSerdeProvider ?? import_event_streams.eventStreamSerdeProvider,
-    maxAttempts: config?.maxAttempts ?? import_config36.loadConfig(import_retry3.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
-    region: config?.region ?? import_config36.loadConfig(import_config36.NODE_REGION_CONFIG_OPTIONS, { ...import_config36.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
-    requestChecksumCalculation: config?.requestChecksumCalculation ?? import_config36.loadConfig($NODE_REQUEST_CHECKSUM_CALCULATION_CONFIG_OPTIONS, loaderConfig),
+    maxAttempts: config?.maxAttempts ?? import_config37.loadConfig(import_retry3.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
+    region: config?.region ?? import_config37.loadConfig(import_config37.NODE_REGION_CONFIG_OPTIONS, { ...import_config37.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
+    requestChecksumCalculation: config?.requestChecksumCalculation ?? import_config37.loadConfig($NODE_REQUEST_CHECKSUM_CALCULATION_CONFIG_OPTIONS, loaderConfig),
     requestHandler: import_node_http_handler2.NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
-    responseChecksumValidation: config?.responseChecksumValidation ?? import_config36.loadConfig($NODE_RESPONSE_CHECKSUM_VALIDATION_CONFIG_OPTIONS, loaderConfig),
-    retryMode: config?.retryMode ?? import_config36.loadConfig({
+    responseChecksumValidation: config?.responseChecksumValidation ?? import_config37.loadConfig($NODE_RESPONSE_CHECKSUM_VALIDATION_CONFIG_OPTIONS, loaderConfig),
+    retryMode: config?.retryMode ?? import_config37.loadConfig({
       ...import_retry3.NODE_RETRY_MODE_CONFIG_OPTIONS,
       default: async () => (await defaultConfigProvider()).retryMode || import_retry3.DEFAULT_RETRY_MODE
     }, config),
-    sigv4aSigningRegionSet: config?.sigv4aSigningRegionSet ?? import_config36.loadConfig(import_httpAuthSchemes3.NODE_SIGV4A_CONFIG_OPTIONS, loaderConfig),
+    sigv4aSigningRegionSet: config?.sigv4aSigningRegionSet ?? import_config37.loadConfig(import_httpAuthSchemes3.NODE_SIGV4A_CONFIG_OPTIONS, loaderConfig),
     streamCollector: config?.streamCollector ?? import_node_http_handler2.streamCollector,
     streamHasher: config?.streamHasher ?? import_checksum2.readableStreamHasher,
-    useArnRegion: config?.useArnRegion ?? import_config36.loadConfig($NODE_USE_ARN_REGION_CONFIG_OPTIONS, loaderConfig),
-    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config36.loadConfig(import_config36.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    useFipsEndpoint: config?.useFipsEndpoint ?? import_config36.loadConfig(import_config36.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    userAgentAppId: config?.userAgentAppId ?? import_config36.loadConfig(import_client22.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    useArnRegion: config?.useArnRegion ?? import_config37.loadConfig($NODE_USE_ARN_REGION_CONFIG_OPTIONS, loaderConfig),
+    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config37.loadConfig(import_config37.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    useFipsEndpoint: config?.useFipsEndpoint ?? import_config37.loadConfig(import_config37.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    userAgentAppId: config?.userAgentAppId ?? import_config37.loadConfig(import_client23.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
   };
 };
 
 // node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
-var import_client24 = __toESM(require_client2(), 1);
-var import_client25 = __toESM(require_client(), 1);
+var import_client25 = __toESM(require_client2(), 1);
+var import_client26 = __toESM(require_client(), 1);
 var import_protocols5 = __toESM(require_protocols(), 1);
 
 // node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthExtensionConfiguration.js
@@ -62808,24 +63136,24 @@ var resolveHttpAuthRuntimeConfig2 = (config) => {
 
 // node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
 var resolveRuntimeExtensions2 = (runtimeConfig, extensions) => {
-  const extensionConfiguration = Object.assign(import_client24.getAwsRegionExtensionConfiguration(runtimeConfig), import_client25.getDefaultExtensionConfiguration(runtimeConfig), import_protocols5.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration2(runtimeConfig));
+  const extensionConfiguration = Object.assign(import_client25.getAwsRegionExtensionConfiguration(runtimeConfig), import_client26.getDefaultExtensionConfiguration(runtimeConfig), import_protocols5.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration2(runtimeConfig));
   extensions.forEach((extension) => extension.configure(extensionConfiguration));
-  return Object.assign(runtimeConfig, import_client24.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client25.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols5.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig2(extensionConfiguration));
+  return Object.assign(runtimeConfig, import_client25.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client26.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols5.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig2(extensionConfiguration));
 };
 
 // node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
-class S3Client extends import_client27.Client {
+class S3Client extends import_client28.Client {
   config;
   constructor(...[configuration]) {
     const _config_0 = getRuntimeConfig3(configuration || {});
     super(_config_0);
     this.initConfig = _config_0;
     const _config_1 = resolveClientEndpointParameters(_config_0);
-    const _config_2 = import_client26.resolveUserAgentConfig(_config_1);
+    const _config_2 = import_client27.resolveUserAgentConfig(_config_1);
     const _config_3 = $resolveFlexibleChecksumsConfig(_config_2);
     const _config_4 = import_retry4.resolveRetryConfig(_config_3);
-    const _config_5 = import_config37.resolveRegionConfig(_config_4);
-    const _config_6 = import_client26.resolveHostHeaderConfig(_config_5);
+    const _config_5 = import_config38.resolveRegionConfig(_config_4);
+    const _config_6 = import_client27.resolveHostHeaderConfig(_config_5);
     const _config_7 = import_endpoints5.resolveEndpointConfig(_config_6);
     const _config_8 = import_event_streams2.resolveEventStreamSerdeConfig(_config_7);
     const _config_9 = resolveHttpAuthSchemeConfig(_config_8);
@@ -62833,12 +63161,12 @@ class S3Client extends import_client27.Client {
     const _config_11 = resolveRuntimeExtensions2(_config_10, configuration?.extensions || []);
     this.config = _config_11;
     this.middlewareStack.use(import_schema2.getSchemaSerdePlugin(this.config));
-    this.middlewareStack.use(import_client26.getUserAgentPlugin(this.config));
+    this.middlewareStack.use(import_client27.getUserAgentPlugin(this.config));
     this.middlewareStack.use(import_retry4.getRetryPlugin(this.config));
     this.middlewareStack.use(import_protocols6.getContentLengthPlugin(this.config));
-    this.middlewareStack.use(import_client26.getHostHeaderPlugin(this.config));
-    this.middlewareStack.use(import_client26.getLoggerPlugin(this.config));
-    this.middlewareStack.use(import_client26.getRecursionDetectionPlugin(this.config));
+    this.middlewareStack.use(import_client27.getHostHeaderPlugin(this.config));
+    this.middlewareStack.use(import_client27.getLoggerPlugin(this.config));
+    this.middlewareStack.use(import_client27.getRecursionDetectionPlugin(this.config));
     this.middlewareStack.use(import_core.getHttpAuthSchemeEndpointRuleSetPlugin(this.config, {
       httpAuthSchemeParametersProvider: defaultS3HttpAuthSchemeParametersProvider,
       identityProviderConfigProvider: async (config) => new import_core.DefaultIdentityProviderConfig({
@@ -63219,7 +63547,7 @@ function assertReservationCents(value, field3) {
 // src/sdk/governance-store.ts
 import { Database as Database2 } from "bun:sqlite";
 import { randomUUID as randomUUID9 } from "crypto";
-import { mkdirSync as mkdirSync14 } from "fs";
+import { mkdirSync as mkdirSync15 } from "fs";
 import { dirname as dirname33 } from "path";
 
 // src/server/database-url.ts
@@ -63515,7 +63843,7 @@ class PostgresSkillSelectionStore {
 
 // src/server/sqlite-store.ts
 import { randomUUID as randomUUID8 } from "crypto";
-import { mkdirSync as mkdirSync13, readFileSync as readFileSync30, readdirSync as readdirSync15 } from "fs";
+import { mkdirSync as mkdirSync14, readFileSync as readFileSync30, readdirSync as readdirSync16 } from "fs";
 import { dirname as dirname32, join as join47 } from "path";
 
 // src/server/auth.ts
@@ -63892,7 +64220,7 @@ class SqliteSkillsStore {
   constructor(path = SQLITE_MEMORY_PATH, options = {}) {
     const inMemory = path === SQLITE_MEMORY_PATH;
     if (!inMemory)
-      mkdirSync13(dirname32(path), { recursive: true });
+      mkdirSync14(dirname32(path), { recursive: true });
     this.db = openDatabase(path);
     this.db.exec(`PRAGMA busy_timeout = ${Math.max(0, options.busyTimeoutMs ?? 5000)}`);
     if (!inMemory)
@@ -64564,7 +64892,7 @@ function applySqliteMigrations(db, migrationsDir = resolveMigrationsDir("sqlite"
        version text PRIMARY KEY,
        applied_at text NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
      )`);
-  const files = readdirSync15(migrationsDir).filter((name) => name.endsWith(".sql")).sort();
+  const files = readdirSync16(migrationsDir).filter((name) => name.endsWith(".sql")).sort();
   if (files.length === 0) {
     throw new Error(`no .sql migrations found in ${migrationsDir}`);
   }
@@ -64718,7 +65046,7 @@ class SqliteGovernanceStore {
   closed = false;
   constructor(path = SQLITE_MEMORY_PATH, options = {}) {
     if (path !== SQLITE_MEMORY_PATH)
-      mkdirSync14(dirname33(path), { recursive: true });
+      mkdirSync15(dirname33(path), { recursive: true });
     this.db = new Database2(path, { create: true, readwrite: true });
     this.db.exec("PRAGMA busy_timeout = 5000");
     this.db.exec("PRAGMA foreign_keys = ON");
@@ -65823,7 +66151,7 @@ async function handleProfileApi(store, principal, request2, parts, config) {
 
 // src/server/runtime-store.ts
 import { Database as Database3 } from "bun:sqlite";
-import { mkdirSync as mkdirSync15 } from "fs";
+import { mkdirSync as mkdirSync16 } from "fs";
 import { dirname as dirname34 } from "path";
 
 // src/sdk/execution/types.ts
@@ -65880,7 +66208,7 @@ class RuntimeExecutionStore {
     }
     const path = target.kind === "sqlite" ? target.path : ":memory:";
     if (path !== ":memory:")
-      mkdirSync15(dirname34(path), { recursive: true });
+      mkdirSync16(dirname34(path), { recursive: true });
     const db = new Database3(path);
     db.run("PRAGMA busy_timeout=5000");
     db.run("PRAGMA journal_mode=WAL");
@@ -66901,10 +67229,10 @@ function createReceiptService(store) {
 }
 
 // node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
-var import_client36 = __toESM(require_client2(), 1);
+var import_client37 = __toESM(require_client2(), 1);
 var import_core2 = __toESM(require_dist_cjs2(), 1);
-var import_client37 = __toESM(require_client(), 1);
-var import_config40 = __toESM(require_config(), 1);
+var import_client38 = __toESM(require_client(), 1);
+var import_config41 = __toESM(require_config(), 1);
 var import_endpoints8 = __toESM(require_endpoints(), 1);
 var import_protocols10 = __toESM(require_protocols(), 1);
 var import_retry6 = __toESM(require_retry(), 1);
@@ -66912,11 +67240,11 @@ var import_schema4 = __toESM(require_schema4(), 1);
 
 // node_modules/@aws-sdk/client-ecs/dist-es/auth/httpAuthSchemeProvider.js
 var import_httpAuthSchemes4 = __toESM(require_httpAuthSchemes(), 1);
-var import_client28 = __toESM(require_client(), 1);
+var import_client29 = __toESM(require_client(), 1);
 var defaultECSHttpAuthSchemeParametersProvider = async (config, context, input) => {
   return {
-    operation: import_client28.getSmithyContext(context).operation,
-    region: await import_client28.normalizeProvider(config.region)() || (() => {
+    operation: import_client29.getSmithyContext(context).operation,
+    region: await import_client29.normalizeProvider(config.region)() || (() => {
       throw new Error("expected `region` to be configured for `aws.auth#sigv4`");
     })()
   };
@@ -66948,7 +67276,7 @@ var defaultECSHttpAuthSchemeProvider = (authParameters) => {
 var resolveHttpAuthSchemeConfig3 = (config) => {
   const config_0 = import_httpAuthSchemes4.resolveAwsSdkSigV4Config(config);
   return Object.assign(config_0, {
-    authSchemePreference: import_client28.normalizeProvider(config.authSchemePreference ?? [])
+    authSchemePreference: import_client29.normalizeProvider(config.authSchemePreference ?? [])
   });
 };
 
@@ -67040,10 +67368,10 @@ var package_default3 = {
 };
 
 // node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
-var import_client32 = __toESM(require_client2(), 1);
+var import_client33 = __toESM(require_client2(), 1);
 var import_httpAuthSchemes6 = __toESM(require_httpAuthSchemes(), 1);
-var import_client33 = __toESM(require_client(), 1);
-var import_config39 = __toESM(require_config(), 1);
+var import_client34 = __toESM(require_client(), 1);
+var import_config40 = __toESM(require_config(), 1);
 var import_retry5 = __toESM(require_retry(), 1);
 var import_serde6 = __toESM(require_serde(), 1);
 var import_node_http_handler3 = __toESM(require_dist_cjs6(), 1);
@@ -67052,12 +67380,12 @@ var import_node_http_handler3 = __toESM(require_dist_cjs6(), 1);
 var import_httpAuthSchemes5 = __toESM(require_httpAuthSchemes(), 1);
 var import_protocols7 = __toESM(require_protocols2(), 1);
 var import_checksum3 = __toESM(require_checksum(), 1);
-var import_client31 = __toESM(require_client(), 1);
+var import_client32 = __toESM(require_client(), 1);
 var import_protocols8 = __toESM(require_protocols(), 1);
 var import_serde5 = __toESM(require_serde(), 1);
 
 // node_modules/@aws-sdk/client-ecs/dist-es/endpoint/endpointResolver.js
-var import_client29 = __toESM(require_client2(), 1);
+var import_client30 = __toESM(require_client2(), 1);
 var import_endpoints7 = __toESM(require_endpoints(), 1);
 
 // node_modules/@aws-sdk/client-ecs/dist-es/endpoint/bdd.js
@@ -67154,14 +67482,14 @@ var defaultEndpointResolver3 = (endpointParams, context = {}) => {
     logger: context.logger
   }));
 };
-import_endpoints7.customEndpointFunctions.aws = import_client29.awsEndpointFunctions;
+import_endpoints7.customEndpointFunctions.aws = import_client30.awsEndpointFunctions;
 
 // node_modules/@aws-sdk/client-ecs/dist-es/schemas/schemas_0.js
 var import_schema3 = __toESM(require_schema4(), 1);
 
 // node_modules/@aws-sdk/client-ecs/dist-es/models/ECSServiceException.js
-var import_client30 = __toESM(require_client(), 1);
-class ECSServiceException extends import_client30.ServiceException {
+var import_client31 = __toESM(require_client(), 1);
+class ECSServiceException extends import_client31.ServiceException {
   constructor(options) {
     super(options);
     Object.setPrototypeOf(this, ECSServiceException.prototype);
@@ -69965,7 +70293,7 @@ var getRuntimeConfig4 = (config) => {
         signer: new import_httpAuthSchemes5.AwsSdkSigV4Signer
       }
     ],
-    logger: config?.logger ?? new import_client31.NoOpLogger,
+    logger: config?.logger ?? new import_client32.NoOpLogger,
     protocol: config?.protocol ?? import_protocols7.AwsJson1_1Protocol,
     protocolSettings: config?.protocolSettings ?? {
       defaultNamespace: "com.amazonaws.ecs",
@@ -69984,11 +70312,11 @@ var getRuntimeConfig4 = (config) => {
 
 // node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
 var getRuntimeConfig5 = (config) => {
-  import_client33.emitWarningIfUnsupportedVersion(process.version);
-  const defaultsMode = import_config39.resolveDefaultsModeConfig(config);
-  const defaultConfigProvider = () => defaultsMode().then(import_client33.loadConfigsForDefaultMode);
+  import_client34.emitWarningIfUnsupportedVersion(process.version);
+  const defaultsMode = import_config40.resolveDefaultsModeConfig(config);
+  const defaultConfigProvider = () => defaultsMode().then(import_client34.loadConfigsForDefaultMode);
   const clientSharedValues = getRuntimeConfig4(config);
-  import_client32.emitWarningIfUnsupportedVersion(process.version);
+  import_client33.emitWarningIfUnsupportedVersion(process.version);
   const loaderConfig = {
     profile: config?.profile,
     logger: clientSharedValues.logger
@@ -69998,27 +70326,27 @@ var getRuntimeConfig5 = (config) => {
     ...config,
     runtime: "node",
     defaultsMode,
-    authSchemePreference: config?.authSchemePreference ?? import_config39.loadConfig(import_httpAuthSchemes6.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
+    authSchemePreference: config?.authSchemePreference ?? import_config40.loadConfig(import_httpAuthSchemes6.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde6.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
-    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client32.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default3.version }),
-    maxAttempts: config?.maxAttempts ?? import_config39.loadConfig(import_retry5.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
-    region: config?.region ?? import_config39.loadConfig(import_config39.NODE_REGION_CONFIG_OPTIONS, { ...import_config39.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
+    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client33.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default3.version }),
+    maxAttempts: config?.maxAttempts ?? import_config40.loadConfig(import_retry5.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
+    region: config?.region ?? import_config40.loadConfig(import_config40.NODE_REGION_CONFIG_OPTIONS, { ...import_config40.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
     requestHandler: import_node_http_handler3.NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
-    retryMode: config?.retryMode ?? import_config39.loadConfig({
+    retryMode: config?.retryMode ?? import_config40.loadConfig({
       ...import_retry5.NODE_RETRY_MODE_CONFIG_OPTIONS,
       default: async () => (await defaultConfigProvider()).retryMode || import_retry5.DEFAULT_RETRY_MODE
     }, config),
     streamCollector: config?.streamCollector ?? import_node_http_handler3.streamCollector,
-    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config39.loadConfig(import_config39.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    useFipsEndpoint: config?.useFipsEndpoint ?? import_config39.loadConfig(import_config39.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    userAgentAppId: config?.userAgentAppId ?? import_config39.loadConfig(import_client32.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config40.loadConfig(import_config40.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    useFipsEndpoint: config?.useFipsEndpoint ?? import_config40.loadConfig(import_config40.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    userAgentAppId: config?.userAgentAppId ?? import_config40.loadConfig(import_client33.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
   };
 };
 
 // node_modules/@aws-sdk/client-ecs/dist-es/runtimeExtensions.js
-var import_client34 = __toESM(require_client2(), 1);
-var import_client35 = __toESM(require_client(), 1);
+var import_client35 = __toESM(require_client2(), 1);
+var import_client36 = __toESM(require_client(), 1);
 var import_protocols9 = __toESM(require_protocols(), 1);
 
 // node_modules/@aws-sdk/client-ecs/dist-es/auth/httpAuthExtensionConfiguration.js
@@ -70062,34 +70390,34 @@ var resolveHttpAuthRuntimeConfig3 = (config) => {
 
 // node_modules/@aws-sdk/client-ecs/dist-es/runtimeExtensions.js
 var resolveRuntimeExtensions3 = (runtimeConfig, extensions) => {
-  const extensionConfiguration = Object.assign(import_client34.getAwsRegionExtensionConfiguration(runtimeConfig), import_client35.getDefaultExtensionConfiguration(runtimeConfig), import_protocols9.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration3(runtimeConfig));
+  const extensionConfiguration = Object.assign(import_client35.getAwsRegionExtensionConfiguration(runtimeConfig), import_client36.getDefaultExtensionConfiguration(runtimeConfig), import_protocols9.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration3(runtimeConfig));
   extensions.forEach((extension) => extension.configure(extensionConfiguration));
-  return Object.assign(runtimeConfig, import_client34.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client35.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols9.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig3(extensionConfiguration));
+  return Object.assign(runtimeConfig, import_client35.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client36.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols9.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig3(extensionConfiguration));
 };
 
 // node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
-class ECSClient extends import_client37.Client {
+class ECSClient extends import_client38.Client {
   config;
   constructor(...[configuration]) {
     const _config_0 = getRuntimeConfig5(configuration || {});
     super(_config_0);
     this.initConfig = _config_0;
     const _config_1 = resolveClientEndpointParameters3(_config_0);
-    const _config_2 = import_client36.resolveUserAgentConfig(_config_1);
+    const _config_2 = import_client37.resolveUserAgentConfig(_config_1);
     const _config_3 = import_retry6.resolveRetryConfig(_config_2);
-    const _config_4 = import_config40.resolveRegionConfig(_config_3);
-    const _config_5 = import_client36.resolveHostHeaderConfig(_config_4);
+    const _config_4 = import_config41.resolveRegionConfig(_config_3);
+    const _config_5 = import_client37.resolveHostHeaderConfig(_config_4);
     const _config_6 = import_endpoints8.resolveEndpointConfig(_config_5);
     const _config_7 = resolveHttpAuthSchemeConfig3(_config_6);
     const _config_8 = resolveRuntimeExtensions3(_config_7, configuration?.extensions || []);
     this.config = _config_8;
     this.middlewareStack.use(import_schema4.getSchemaSerdePlugin(this.config));
-    this.middlewareStack.use(import_client36.getUserAgentPlugin(this.config));
+    this.middlewareStack.use(import_client37.getUserAgentPlugin(this.config));
     this.middlewareStack.use(import_retry6.getRetryPlugin(this.config));
     this.middlewareStack.use(import_protocols10.getContentLengthPlugin(this.config));
-    this.middlewareStack.use(import_client36.getHostHeaderPlugin(this.config));
-    this.middlewareStack.use(import_client36.getLoggerPlugin(this.config));
-    this.middlewareStack.use(import_client36.getRecursionDetectionPlugin(this.config));
+    this.middlewareStack.use(import_client37.getHostHeaderPlugin(this.config));
+    this.middlewareStack.use(import_client37.getLoggerPlugin(this.config));
+    this.middlewareStack.use(import_client37.getRecursionDetectionPlugin(this.config));
     this.middlewareStack.use(import_core2.getHttpAuthSchemeEndpointRuleSetPlugin(this.config, {
       httpAuthSchemeParametersProvider: defaultECSHttpAuthSchemeParametersProvider,
       identityProviderConfigProvider: async (config) => new import_core2.DefaultIdentityProviderConfig({
@@ -70104,9 +70432,9 @@ class ECSClient extends import_client37.Client {
 }
 
 // node_modules/@aws-sdk/client-ecs/dist-es/commandBuilder.js
-var import_client38 = __toESM(require_client(), 1);
+var import_client39 = __toESM(require_client(), 1);
 var import_endpoints9 = __toESM(require_endpoints(), 1);
-var command3 = import_client38.makeBuilder(commonParams3, "AmazonEC2ContainerServiceV20141113", "ECSClient", import_endpoints9.getEndpointPlugin);
+var command3 = import_client39.makeBuilder(commonParams3, "AmazonEC2ContainerServiceV20141113", "ECSClient", import_endpoints9.getEndpointPlugin);
 var _ep03 = {};
 var _mw03 = (Command, cs, config, o3) => [];
 
@@ -98571,7 +98899,7 @@ class RemoteSkillsAuthClient {
   }
 }
 // src/lib/private-publication-recovery.ts
-import { constants as constants22, closeSync as closeSync24, fsyncSync as fsyncSync8, fstatSync as fstatSync24, lstatSync as lstatSync34, mkdirSync as mkdirSync16, openSync as openSync24, readSync as readSync16, realpathSync as realpathSync18, renameSync as renameSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync11 } from "fs";
+import { constants as constants22, closeSync as closeSync24, fsyncSync as fsyncSync8, fstatSync as fstatSync24, lstatSync as lstatSync34, mkdirSync as mkdirSync17, openSync as openSync24, readSync as readSync16, realpathSync as realpathSync18, renameSync as renameSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync11 } from "fs";
 import { dirname as dirname35, isAbsolute as isAbsolute32, join as join49, resolve as resolve32 } from "path";
 import { randomUUID as randomUUID12 } from "crypto";
 var fail2 = () => {
@@ -98718,7 +99046,7 @@ async function preparePrivatePublication(client2, sourceDirectory, recoveryDirec
   };
   if (!isAbsolute32(recoveryDirectory) || resolve32(recoveryDirectory) !== recoveryDirectory || realpathSync18(dirname35(recoveryDirectory)) !== dirname35(recoveryDirectory))
     return fail2();
-  mkdirSync16(recoveryDirectory, { mode: 448 });
+  mkdirSync17(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
   const parent = openSync24(dirname35(recoveryDirectory), constants22.O_RDONLY | constants22.O_NOFOLLOW);
   try {