@hasna/skills 0.10.76 → 0.10.78

package/dist/sdk/index.js

@@ -24586,7 +24586,7 @@ var require_httpAuthSchemes = __commonJS((exports) => {
 });
 
 // node_modules/@aws-sdk/credential-provider-env/dist-es/fromEnv.js
-var import_client8, import_config10, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET = "AWS_SECRET_ACCESS_KEY", ENV_SESSION = "AWS_SESSION_TOKEN", ENV_EXPIRATION = "AWS_CREDENTIAL_EXPIRATION", ENV_CREDENTIAL_SCOPE = "AWS_CREDENTIAL_SCOPE", ENV_ACCOUNT_ID = "AWS_ACCOUNT_ID", fromEnv = (init) => async () => {
+var import_client9, import_config10, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET = "AWS_SECRET_ACCESS_KEY", ENV_SESSION = "AWS_SESSION_TOKEN", ENV_EXPIRATION = "AWS_CREDENTIAL_EXPIRATION", ENV_CREDENTIAL_SCOPE = "AWS_CREDENTIAL_SCOPE", ENV_ACCOUNT_ID = "AWS_ACCOUNT_ID", fromEnv = (init) => async () => {
   init?.logger?.debug("@aws-sdk/credential-provider-env - fromEnv");
   const accessKeyId = process.env[ENV_KEY];
   const secretAccessKey = process.env[ENV_SECRET];
@@ -24603,13 +24603,13 @@ var import_client8, import_config10, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET =
       ...credentialScope && { credentialScope },
       ...accountId && { accountId }
     };
-    import_client8.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS", "g");
+    import_client9.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS", "g");
     return credentials;
   }
   throw new import_config10.CredentialsProviderError("Unable to find environment variable credentials.", { logger: init?.logger });
 };
 var init_fromEnv = __esm(() => {
-  import_client8 = __toESM(require_client2(), 1);
+  import_client9 = __toESM(require_client2(), 1);
   import_config10 = __toESM(require_config(), 1);
 });
 
@@ -25951,7 +25951,7 @@ var retryWrapper = (toRetry, maxRetries, delayMs) => {
 
 // node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/fromHttp.js
 import fs from "fs/promises";
-var import_client9, import_config18, import_node_http_handler, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2", AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromHttp = (options = {}) => {
+var import_client10, import_config18, import_node_http_handler, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2", AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromHttp = (options = {}) => {
   options.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");
   let host;
   const relative12 = options.awsContainerCredentialsRelativeUri ?? process.env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI];
@@ -25988,7 +25988,7 @@ Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
     }
     try {
       const result = await requestHandler.handle(request2, { requestTimeout });
-      return getCredentials(result.response).then((creds) => import_client9.setCredentialFeature(creds, "CREDENTIALS_HTTP", "z"));
+      return getCredentials(result.response).then((creds) => import_client10.setCredentialFeature(creds, "CREDENTIALS_HTTP", "z"));
     } catch (e3) {
       throw new import_config18.CredentialsProviderError(String(e3), { logger: options.logger });
     }
@@ -26010,7 +26010,7 @@ Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
 var init_fromHttp = __esm(() => {
   init_checkUrl();
   init_requestHelpers();
-  import_client9 = __toESM(require_client2(), 1);
+  import_client10 = __toESM(require_client2(), 1);
   import_config18 = __toESM(require_config(), 1);
   import_node_http_handler = __toESM(require_dist_cjs6(), 1);
 });
@@ -27394,7 +27394,7 @@ var init_loadSso = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-sso/dist-es/resolveSSOCredentials.js
-var import_client10, import_config24, SHOULD_FAIL_CREDENTIAL_CHAIN = false, resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger }) => {
+var import_client11, import_config24, SHOULD_FAIL_CREDENTIAL_CHAIN = false, resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger }) => {
   let token;
   const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
   if (ssoSession) {
@@ -27470,15 +27470,15 @@ var import_client10, import_config24, SHOULD_FAIL_CREDENTIAL_CHAIN = false, reso
     ...accountId && { accountId }
   };
   if (ssoSession) {
-    import_client10.setCredentialFeature(credentials, "CREDENTIALS_SSO", "s");
+    import_client11.setCredentialFeature(credentials, "CREDENTIALS_SSO", "s");
   } else {
-    import_client10.setCredentialFeature(credentials, "CREDENTIALS_SSO_LEGACY", "u");
+    import_client11.setCredentialFeature(credentials, "CREDENTIALS_SSO_LEGACY", "u");
   }
   return credentials;
 };
 var init_resolveSSOCredentials = __esm(() => {
   init_dist_es4();
-  import_client10 = __toESM(require_client2(), 1);
+  import_client11 = __toESM(require_client2(), 1);
   import_config24 = __toESM(require_config(), 1);
 });
 
@@ -27590,7 +27590,7 @@ var init_dist_es5 = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveCredentialSource.js
-var import_client11, import_config27, resolveCredentialSource = (credentialSource, profileName, logger) => {
+var import_client12, import_config27, resolveCredentialSource = (credentialSource, profileName, logger) => {
   const sourceProvidersMap = {
     EcsContainer: async (options) => {
       const { fromHttp: fromHttp2 } = await Promise.resolve().then(() => (init_dist_es3(), exports_dist_es3));
@@ -27614,9 +27614,9 @@ var import_client11, import_config27, resolveCredentialSource = (credentialSourc
   } else {
     throw new import_config27.CredentialsProviderError(`Unsupported credential source in profile ${profileName}. Got ${credentialSource}, expected EcsContainer or Ec2InstanceMetadata or Environment.`, { logger });
   }
-}, setNamedProvider = (creds) => import_client11.setCredentialFeature(creds, "CREDENTIALS_PROFILE_NAMED_PROVIDER", "p");
+}, setNamedProvider = (creds) => import_client12.setCredentialFeature(creds, "CREDENTIALS_PROFILE_NAMED_PROVIDER", "p");
 var init_resolveCredentialSource = __esm(() => {
-  import_client11 = __toESM(require_client2(), 1);
+  import_client12 = __toESM(require_client2(), 1);
   import_config27 = __toESM(require_config(), 1);
 });
 
@@ -28643,7 +28643,7 @@ var require_sts = __commonJS((exports) => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveAssumeRoleCredentials.js
-var import_client12, import_config28, isAssumeRoleProfile = (arg, { profile = "default", logger } = {}) => {
+var import_client13, import_config28, isAssumeRoleProfile = (arg, { profile = "default", logger } = {}) => {
   return Boolean(arg) && typeof arg === "object" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1 && ["undefined", "string"].indexOf(typeof arg.external_id) > -1 && ["undefined", "string"].indexOf(typeof arg.mfa_serial) > -1 && (isAssumeRoleWithSourceProfile(arg, { profile, logger }) || isCredentialSourceProfile(arg, { profile, logger }));
 }, isAssumeRoleWithSourceProfile = (arg, { profile, logger }) => {
   const withSourceProfile = typeof arg.source_profile === "string" && typeof arg.credential_source === "undefined";
@@ -28682,7 +28682,7 @@ var import_client12, import_config28, isAssumeRoleProfile = (arg, { profile = "d
     [source_profile]: true
   }, isCredentialSourceWithoutRoleArn(profiles[source_profile] ?? {})) : (await resolveCredentialSource(profileData.credential_source, profileName, options.logger)(options))();
   if (isCredentialSourceWithoutRoleArn(profileData)) {
-    return sourceCredsProvider.then((creds) => import_client12.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
+    return sourceCredsProvider.then((creds) => import_client13.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
   } else {
     const params = {
       RoleArn: profileData.role_arn,
@@ -28699,14 +28699,14 @@ var import_client12, import_config28, isAssumeRoleProfile = (arg, { profile = "d
       params.TokenCode = await options.mfaCodeProvider(mfa_serial);
     }
     const sourceCreds = await sourceCredsProvider;
-    return options.roleAssumer(sourceCreds, params).then((creds) => import_client12.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
+    return options.roleAssumer(sourceCreds, params).then((creds) => import_client13.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
   }
 }, isCredentialSourceWithoutRoleArn = (section) => {
   return !section.role_arn && !!section.credential_source;
 };
 var init_resolveAssumeRoleCredentials = __esm(() => {
   init_resolveCredentialSource();
-  import_client12 = __toESM(require_client2(), 1);
+  import_client13 = __toESM(require_client2(), 1);
   import_config28 = __toESM(require_config(), 1);
 });
 
@@ -29707,7 +29707,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/credential-provider-login/dist-es/fromLoginCredentials.js
-var import_client13, import_config30, fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
+var import_client14, import_config30, fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
   init?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");
   const profiles = await import_config30.parseKnownFiles(init || {});
   const profileName = import_config30.getProfileName({
@@ -29722,11 +29722,11 @@ var import_client13, import_config30, fromLoginCredentials = (init) => async ({
   }
   const fetcher = new LoginCredentialsFetcher(profile, init, callerClientConfig);
   const credentials = await fetcher.loadCredentials();
-  return import_client13.setCredentialFeature(credentials, "CREDENTIALS_LOGIN", "AD");
+  return import_client14.setCredentialFeature(credentials, "CREDENTIALS_LOGIN", "AD");
 };
 var init_fromLoginCredentials = __esm(() => {
   init_LoginCredentialsFetcher();
-  import_client13 = __toESM(require_client2(), 1);
+  import_client14 = __toESM(require_client2(), 1);
   import_config30 = __toESM(require_config(), 1);
 });
 
@@ -29740,7 +29740,7 @@ var init_dist_es6 = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveLoginCredentials.js
-var import_client14, isLoginProfile = (data) => {
+var import_client15, isLoginProfile = (data) => {
   return Boolean(data && data.login_session);
 }, resolveLoginCredentials = async (profileName, options, callerClientConfig) => {
   const { fromLoginCredentials: fromLoginCredentials2 } = await Promise.resolve().then(() => (init_dist_es6(), exports_dist_es5));
@@ -29748,14 +29748,14 @@ var import_client14, isLoginProfile = (data) => {
     ...options,
     profile: profileName
   })({ callerClientConfig });
-  return import_client14.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_LOGIN", "AC");
+  return import_client15.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_LOGIN", "AC");
 };
 var init_resolveLoginCredentials = __esm(() => {
-  import_client14 = __toESM(require_client2(), 1);
+  import_client15 = __toESM(require_client2(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-process/dist-es/getValidatedProcessCredentials.js
-var import_client15, getValidatedProcessCredentials = (profileName, data, profiles) => {
+var import_client16, getValidatedProcessCredentials = (profileName, data, profiles) => {
   if (data.Version !== 1) {
     throw Error(`Profile ${profileName} credential_process did not return Version 1.`);
   }
@@ -29781,11 +29781,11 @@ var import_client15, getValidatedProcessCredentials = (profileName, data, profil
     ...data.CredentialScope && { credentialScope: data.CredentialScope },
     ...accountId && { accountId }
   };
-  import_client15.setCredentialFeature(credentials, "CREDENTIALS_PROCESS", "w");
+  import_client16.setCredentialFeature(credentials, "CREDENTIALS_PROCESS", "w");
   return credentials;
 };
 var init_getValidatedProcessCredentials = __esm(() => {
-  import_client15 = __toESM(require_client2(), 1);
+  import_client16 = __toESM(require_client2(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js
@@ -29846,20 +29846,20 @@ var init_dist_es7 = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProcessCredentials.js
-var import_client16, isProcessProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.credential_process === "string", resolveProcessCredentials2 = async (options, profile) => {
+var import_client17, isProcessProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.credential_process === "string", resolveProcessCredentials2 = async (options, profile) => {
   const { fromProcess: fromProcess2 } = await Promise.resolve().then(() => (init_dist_es7(), exports_dist_es6));
   const credentials = await fromProcess2({
     ...options,
     profile
   })();
-  return import_client16.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_PROCESS", "v");
+  return import_client17.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_PROCESS", "v");
 };
 var init_resolveProcessCredentials2 = __esm(() => {
-  import_client16 = __toESM(require_client2(), 1);
+  import_client17 = __toESM(require_client2(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveSsoCredentials.js
-var import_client17, resolveSsoCredentials = async (profile, profileData, options = {}, callerClientConfig) => {
+var import_client18, resolveSsoCredentials = async (profile, profileData, options = {}, callerClientConfig) => {
   const { fromSSO: fromSSO2 } = await Promise.resolve().then(() => (init_dist_es5(), exports_dist_es4));
   return fromSSO2({
     profile,
@@ -29870,18 +29870,18 @@ var import_client17, resolveSsoCredentials = async (profile, profileData, option
     callerClientConfig
   }).then((creds) => {
     if (profileData.sso_session) {
-      return import_client17.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO", "r");
+      return import_client18.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO", "r");
     } else {
-      return import_client17.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO_LEGACY", "t");
+      return import_client18.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO_LEGACY", "t");
     }
   });
 }, isSsoProfile2 = (arg) => arg && (typeof arg.sso_start_url === "string" || typeof arg.sso_account_id === "string" || typeof arg.sso_session === "string" || typeof arg.sso_region === "string" || typeof arg.sso_role_name === "string");
 var init_resolveSsoCredentials = __esm(() => {
-  import_client17 = __toESM(require_client2(), 1);
+  import_client18 = __toESM(require_client2(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveStaticCredentials.js
-var import_client18, isStaticCredsProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.aws_access_key_id === "string" && typeof arg.aws_secret_access_key === "string" && ["undefined", "string"].indexOf(typeof arg.aws_session_token) > -1 && ["undefined", "string"].indexOf(typeof arg.aws_account_id) > -1, resolveStaticCredentials = async (profile, options) => {
+var import_client19, isStaticCredsProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.aws_access_key_id === "string" && typeof arg.aws_secret_access_key === "string" && ["undefined", "string"].indexOf(typeof arg.aws_session_token) > -1 && ["undefined", "string"].indexOf(typeof arg.aws_account_id) > -1, resolveStaticCredentials = async (profile, options) => {
   options?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");
   const credentials = {
     accessKeyId: profile.aws_access_key_id,
@@ -29890,10 +29890,10 @@ var import_client18, isStaticCredsProfile = (arg) => Boolean(arg) && typeof arg
     ...profile.aws_credential_scope && { credentialScope: profile.aws_credential_scope },
     ...profile.aws_account_id && { accountId: profile.aws_account_id }
   };
-  return import_client18.setCredentialFeature(credentials, "CREDENTIALS_PROFILE", "n");
+  return import_client19.setCredentialFeature(credentials, "CREDENTIALS_PROFILE", "n");
 };
 var init_resolveStaticCredentials = __esm(() => {
-  import_client18 = __toESM(require_client2(), 1);
+  import_client19 = __toESM(require_client2(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-web-identity/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sts/index.js
@@ -30947,7 +30947,7 @@ var fromWebToken = (init) => async (awsIdentityProperties) => {
 
 // node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromTokenFile.js
 import { readFileSync as readFileSync29 } from "fs";
-var import_client19, import_config33, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE", ENV_ROLE_ARN = "AWS_ROLE_ARN", ENV_ROLE_SESSION_NAME = "AWS_ROLE_SESSION_NAME", fromTokenFile = (init = {}) => async (awsIdentityProperties) => {
+var import_client20, import_config33, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE", ENV_ROLE_ARN = "AWS_ROLE_ARN", ENV_ROLE_SESSION_NAME = "AWS_ROLE_SESSION_NAME", fromTokenFile = (init = {}) => async (awsIdentityProperties) => {
   init.logger?.debug("@aws-sdk/credential-provider-web-identity - fromTokenFile");
   const webIdentityTokenFile = init?.webIdentityTokenFile ?? process.env[ENV_TOKEN_FILE];
   const roleArn = init?.roleArn ?? process.env[ENV_ROLE_ARN];
@@ -30964,12 +30964,12 @@ var import_client19, import_config33, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_F
     roleSessionName
   })(awsIdentityProperties);
   if (webIdentityTokenFile === process.env[ENV_TOKEN_FILE]) {
-    import_client19.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN", "h");
+    import_client20.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN", "h");
   }
   return credentials;
 };
 var init_fromTokenFile = __esm(() => {
-  import_client19 = __toESM(require_client2(), 1);
+  import_client20 = __toESM(require_client2(), 1);
   import_config33 = __toESM(require_config(), 1);
 });
 
@@ -30984,7 +30984,7 @@ var init_dist_es8 = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveWebIdentityCredentials.js
-var import_client20, isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.web_identity_token_file === "string" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1, resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => {
+var import_client21, isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.web_identity_token_file === "string" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1, resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => {
   const { fromTokenFile: fromTokenFile2 } = await Promise.resolve().then(() => (init_dist_es8(), exports_dist_es7));
   const credentials = await fromTokenFile2({
     webIdentityTokenFile: profile.web_identity_token_file,
@@ -30996,10 +30996,10 @@ var import_client20, isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg
   })({
     callerClientConfig
   });
-  return import_client20.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN", "q");
+  return import_client21.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN", "q");
 };
 var init_resolveWebIdentityCredentials = __esm(() => {
-  import_client20 = __toESM(require_client2(), 1);
+  import_client21 = __toESM(require_client2(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProfileData.js
@@ -32371,7 +32371,7 @@ var init_event_sink = __esm(() => {
   init_dist();
 });
 // package.json
-var version = "0.10.76";
+var version = "0.10.78";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -33526,6 +33526,9 @@ function selectsSkillsLocalMode(env = process.env) {
   return !hasSkillsEnvAuthorityIntent(env) && isSkillsLocalOptIn(env);
 }
 
+// src/lib/credential-profile-command.ts
+var urlKeys = clientTransportEnvKeys("skills").apiUrlKeys;
+
 // src/lib/fleet-credentials.ts
 var SKILLS_APP = "skills";
 var ENV_KEYS = clientTransportEnvKeys(SKILLS_APP);
@@ -39100,7 +39103,8 @@ var MEASURED_CODEX_CAPABILITIES = {
   "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
   "codex-cli 0.161.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
   "codex-cli 0.162.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
-  "codex-cli 0.162.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
+  "codex-cli 0.162.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
+  "codex-cli 0.163.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
 };
 function supportsCodexNativeCapability(version2, capability) {
   return typeof version2 === "string" && Object.hasOwn(MEASURED_CODEX_CAPABILITIES, version2) && MEASURED_CODEX_CAPABILITIES[version2].includes(capability);
@@ -41361,6 +41365,37 @@ function hashRawDiscoveryFile(path, budget2, changes) {
   }
 }
 
+// src/lib/codex-plugin-capability-paths.ts
+var CODEX_PLUGIN_MANIFEST_LOCATIONS = Object.freeze([
+  "plugin.json",
+  ".codex-plugin/plugin.json",
+  ".claude-plugin/plugin.json",
+  ".cursor-plugin/plugin.json"
+]);
+var CODEX_PLUGIN_MANIFEST_DIRECTORIES = Object.freeze([".codex-plugin", ".claude-plugin", ".cursor-plugin"]);
+var CODEX_PLUGIN_ROOT_CAPABILITY_ENTRIES = Object.freeze([
+  "plugin.json",
+  ".codex-plugin",
+  ".claude-plugin",
+  ".cursor-plugin",
+  "hooks",
+  "hooks.json",
+  ".mcp.json",
+  ".app.json",
+  "commands",
+  "agents"
+]);
+function foldCodexPluginEntryName(name) {
+  return name.toUpperCase().toLowerCase();
+}
+function codexPluginRootCapabilityEntry(name) {
+  const folded = foldCodexPluginEntryName(name);
+  return CODEX_PLUGIN_ROOT_CAPABILITY_ENTRIES.includes(folded) ? folded : null;
+}
+function isCodexSkillDocumentName(name) {
+  return foldCodexPluginEntryName(name) === "skill.md";
+}
+
 // src/lib/codex-hook-mcp-dependencies.ts
 var need5 = (value) => {
   if (!value)
@@ -41510,15 +41545,13 @@ function captureCodexHookMcpDependencies(configPath, reviewed, configText, chang
       }
     };
     const root = join17(cacheRoot, identity3, selectCodexPluginVersion(versions, selectionBudget));
-    const agent = read(join17(root, "plugin.json"));
+    const [agentPluginManifest, ...legacyManifests] = CODEX_PLUGIN_MANIFEST_LOCATIONS;
+    const agent = read(join17(root, agentPluginManifest));
     if (agent !== null) {
       const schema = JSON.parse(agent).$schema;
       need5(typeof schema !== "string" || !schema.startsWith("https://agent-plugins.org/schemas/"));
     }
-    const codex = read(join17(root, ".codex-plugin/plugin.json"));
-    const claude = read(join17(root, ".claude-plugin/plugin.json"));
-    const cursor = read(join17(root, ".cursor-plugin/plugin.json"));
-    const text2 = codex ?? claude ?? cursor;
+    const text2 = legacyManifests.map((location) => read(join17(root, location))).find((value) => value !== null) ?? null;
     if (text2 === null)
       continue;
     const manifest = JSON.parse(text2);
@@ -42215,6 +42248,7 @@ import { createHash as createHash18 } from "crypto";
 import { constants as constants12, closeSync as closeSync15, fstatSync as fstatSync15, lstatSync as lstatSync14, openSync as openSync15, readSync as readSync8, readdirSync as readdirSync5, realpathSync as realpathSync9 } from "fs";
 import { basename as basename9, dirname as dirname14, isAbsolute as isAbsolute15, join as join18, relative as relative6, resolve as resolve14, sep as sep8 } from "path";
 var CODEX_SEMANTIC_CACHE_WITNESS_SCHEMA = "hasna.codex-semantic-cache-witness.v1";
+var SEMANTIC_BOUND_ROOT_ENTRIES = Object.freeze([".codex-plugin", ".app.json", ".mcp.json", "hooks"]);
 var identifier5 = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(value);
 var digest2 = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
 var refuse5 = () => {
@@ -42724,14 +42758,23 @@ function assertParents(cacheRoot, controls, appOnlyParents, hookParents, files,
       continue;
     const parent = join18(cacheRoot, parts[0], parts[1]);
     const root = join18(parent, parts[2]);
-    const base = parts[parts.length - 1];
-    if (parts.includes(".codex-plugin") && (parts.length < 4 || parts[3] !== ".codex-plugin" || (parts.length === 4 ? base !== ".codex-plugin" : parts.length !== 5 || base !== "plugin.json")))
+    const base = parts[parts.length - 1], folded = foldCodexPluginEntryName(base);
+    if (parts.length === 3 && (codexPluginRootCapabilityEntry(base) !== null || isCodexSkillDocumentName(base)))
+      refuse5();
+    const rootEntry = parts.length >= 4 ? codexPluginRootCapabilityEntry(parts[3]) : null;
+    if (rootEntry !== null && rootEntry !== parts[3])
+      refuse5();
+    if (rootEntry !== null && !SEMANTIC_BOUND_ROOT_ENTRIES.includes(rootEntry))
+      refuse5();
+    if (isCodexSkillDocumentName(base) && base !== "SKILL.md")
       refuse5();
-    if ([".app.json", ".mcp.json"].includes(base) && (parts.length !== 4 || dirname14(member) !== root))
+    if (parts.some((part) => CODEX_PLUGIN_MANIFEST_DIRECTORIES.includes(foldCodexPluginEntryName(part))) && (parts.length < 4 || parts[3] !== ".codex-plugin" || (parts.length === 4 ? base !== ".codex-plugin" : parts.length !== 5 || base !== "plugin.json")))
       refuse5();
-    if ([".app.json", ".mcp.json"].includes(base) && hookParents.some((reviewed) => reviewed.pluginParent === parent))
+    if ([".app.json", ".mcp.json"].includes(folded) && (parts.length !== 4 || dirname14(member) !== root))
       refuse5();
-    if ((parts[3] === "hooks" || base === "hooks.json") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base !== "hooks" : base !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join18(cacheRoot, parts[0], parts[1]))))
+    if ([".app.json", ".mcp.json"].includes(folded) && hookParents.some((reviewed) => reviewed.pluginParent === parent))
+      refuse5();
+    if ((rootEntry === "hooks" || folded === "hooks.json") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base !== "hooks" : base !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join18(cacheRoot, parts[0], parts[1]))))
       refuse5();
   }
 }
@@ -42998,16 +43041,16 @@ function codexVendorMarketplace(cache, path) {
     return null;
   return CODEX_VENDOR_MARKETPLACES.includes(parts[0]) ? parts[0] : null;
 }
-var OTHER_PLUGIN_CONTROLS = Object.freeze(["plugin.json", ".claude-plugin", ".cursor-plugin", "hooks", "hooks.json", ".mcp.json", "commands", "agents"]);
+var OTHER_PLUGIN_CONTROLS = Object.freeze(CODEX_PLUGIN_ROOT_CAPABILITY_ENTRIES.filter((entry) => entry !== ".codex-plugin" && entry !== ".app.json"));
 var VENDOR_MANIFEST_KEYS = Object.freeze(["name", "version", "description", "author", "homepage", "repository", "license", "keywords", "interface", "skills", "apps"]);
 var DEFAULT_SKILLS_PATHS = Object.freeze(["./skills", "./skills/"]);
 var VENDOR_APP_DECLARATION = "./.app.json";
 var MAX_SUBTREE_ENTRIES = 20000;
 var MAX_SUBTREE_DEPTH = 32;
 var hiddenName = (name) => name.startsWith(".") || name === "node_modules";
-var isSkillDocument = (name) => name.toLowerCase() === "skill.md";
+var isSkillDocument = isCodexSkillDocumentName;
 var present = (path) => lstatSync15(path, { throwIfNoEntry: false }) !== undefined;
-var holdsOtherControl = (path) => readdirSync6(path).some((name) => OTHER_PLUGIN_CONTROLS.includes(name.toLowerCase()));
+var holdsOtherControl = (path) => readdirSync6(path).some((name) => OTHER_PLUGIN_CONTROLS.includes(codexPluginRootCapabilityEntry(name) ?? ""));
 function pluginTreeVisible(path, hidden, insideSkill, depth, budget2) {
   if (depth > MAX_SUBTREE_DEPTH)
     return false;
@@ -53953,7 +53996,7 @@ var $getFlexibleChecksumsPlugin = getFlexibleChecksumsPlugin;
 var $resolveFlexibleChecksumsConfig = resolveFlexibleChecksumsConfig;
 
 // node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
-var import_client26 = __toESM(require_client2(), 1);
+var import_client27 = __toESM(require_client2(), 1);
 
 // node_modules/@aws-sdk/middleware-sdk-s3/dist-cjs/submodules/s3/index.js
 var { NoOpLogger, getSmithyContext } = require_client();
@@ -54562,7 +54605,7 @@ var $resolveS3Config = resolveS3Config;
 
 // node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
 var import_core = __toESM(require_dist_cjs2(), 1);
-var import_client27 = __toESM(require_client(), 1);
+var import_client28 = __toESM(require_client(), 1);
 var import_config38 = __toESM(require_config(), 1);
 var import_endpoints5 = __toESM(require_endpoints(), 1);
 var import_event_streams2 = __toESM(require_event_streams(), 1);
@@ -54573,11 +54616,11 @@ var import_schema2 = __toESM(require_schema4(), 1);
 // node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
 var import_httpAuthSchemes = __toESM(require_httpAuthSchemes(), 1);
 var import_signature_v4_multi_region = __toESM(require_dist_cjs4(), 1);
-var import_client5 = __toESM(require_client(), 1);
+var import_client6 = __toESM(require_client(), 1);
 var import_endpoints3 = __toESM(require_endpoints(), 1);
 
 // node_modules/@aws-sdk/client-s3/dist-es/endpoint/endpointResolver.js
-var import_client4 = __toESM(require_client2(), 1);
+var import_client5 = __toESM(require_client2(), 1);
 var import_endpoints2 = __toESM(require_endpoints(), 1);
 
 // node_modules/@aws-sdk/client-s3/dist-es/endpoint/bdd.js
@@ -56550,7 +56593,7 @@ var defaultEndpointResolver = (endpointParams, context = {}) => {
     logger: context.logger
   }));
 };
-import_endpoints2.customEndpointFunctions.aws = import_client4.awsEndpointFunctions;
+import_endpoints2.customEndpointFunctions.aws = import_client5.awsEndpointFunctions;
 
 // node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
 var createEndpointRuleSetHttpAuthSchemeParametersProvider = (defaultHttpAuthSchemeParametersProvider) => async (config, context, input) => {
@@ -56558,7 +56601,7 @@ var createEndpointRuleSetHttpAuthSchemeParametersProvider = (defaultHttpAuthSche
     throw new Error("Could not find `input` for `defaultEndpointRuleSetHttpAuthSchemeParametersProvider`");
   }
   const defaultParameters = await defaultHttpAuthSchemeParametersProvider(config, context, input);
-  const instructionsFn = import_client5.getSmithyContext(context)?.commandInstance?.constructor?.getEndpointParameterInstructions;
+  const instructionsFn = import_client6.getSmithyContext(context)?.commandInstance?.constructor?.getEndpointParameterInstructions;
   if (!instructionsFn) {
     throw new Error(`getEndpointParameterInstructions() is not defined on '${context.commandName}'`);
   }
@@ -56567,8 +56610,8 @@ var createEndpointRuleSetHttpAuthSchemeParametersProvider = (defaultHttpAuthSche
 };
 var _defaultS3HttpAuthSchemeParametersProvider = async (config, context, input) => {
   return {
-    operation: import_client5.getSmithyContext(context).operation,
-    region: await import_client5.normalizeProvider(config.region)() || (() => {
+    operation: import_client6.getSmithyContext(context).operation,
+    region: await import_client6.normalizeProvider(config.region)() || (() => {
       throw new Error("expected `region` to be configured for `aws.auth#sigv4`");
     })()
   };
@@ -56664,12 +56707,12 @@ var resolveHttpAuthSchemeConfig = (config) => {
   const config_0 = import_httpAuthSchemes.resolveAwsSdkSigV4Config(config);
   const config_1 = import_httpAuthSchemes.resolveAwsSdkSigV4AConfig(config_0);
   return Object.assign(config_1, {
-    authSchemePreference: import_client5.normalizeProvider(config.authSchemePreference ?? [])
+    authSchemePreference: import_client6.normalizeProvider(config.authSchemePreference ?? [])
   });
 };
 
 // node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
-var import_client6 = __toESM(require_client(), 1);
+var import_client7 = __toESM(require_client(), 1);
 var import_endpoints4 = __toESM(require_endpoints(), 1);
 
 // node_modules/@aws-sdk/client-s3/dist-es/endpoint/EndpointParameters.js
@@ -56699,7 +56742,7 @@ var commonParams = {
 };
 
 // node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
-var command = import_client6.makeBuilder(commonParams, "AmazonS3", "S3Client", import_endpoints4.getEndpointPlugin);
+var command = import_client7.makeBuilder(commonParams, "AmazonS3", "S3Client", import_endpoints4.getEndpointPlugin);
 var _ep0 = {
   Bucket: { type: "contextParams", name: "Bucket" },
   Key: { type: "contextParams", name: "Key" }
@@ -56734,8 +56777,8 @@ var _mw11 = (Command, cs, config, o3) => [
 var import_schema = __toESM(require_schema4(), 1);
 
 // node_modules/@aws-sdk/client-s3/dist-es/models/S3ServiceException.js
-var import_client7 = __toESM(require_client(), 1);
-class S3ServiceException extends import_client7.ServiceException {
+var import_client8 = __toESM(require_client(), 1);
+class S3ServiceException extends import_client8.ServiceException {
   constructor(options) {
     super(options);
     Object.setPrototypeOf(this, S3ServiceException.prototype);
@@ -62561,7 +62604,7 @@ var package_default2 = {
 };
 
 // node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
-var import_client22 = __toESM(require_client2(), 1);
+var import_client23 = __toESM(require_client2(), 1);
 var import_httpAuthSchemes3 = __toESM(require_httpAuthSchemes(), 1);
 
 // node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.js
@@ -62719,7 +62762,7 @@ var defaultProvider = (init = {}) => memoizeChain([
 var credentialsTreatedAsExpired = (credentials) => credentials?.expiration !== undefined && credentials.expiration.getTime() - Date.now() < 300000;
 // node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var import_checksum2 = __toESM(require_checksum(), 1);
-var import_client23 = __toESM(require_client(), 1);
+var import_client24 = __toESM(require_client(), 1);
 var import_config37 = __toESM(require_config(), 1);
 var import_event_streams = __toESM(require_event_streams(), 1);
 var import_retry3 = __toESM(require_retry(), 1);
@@ -62959,7 +63002,7 @@ var $Sha1 = Sha1Node;
 var import_httpAuthSchemes2 = __toESM(require_httpAuthSchemes(), 1);
 var import_signature_v4_multi_region2 = __toESM(require_dist_cjs4(), 1);
 var import_checksum = __toESM(require_checksum(), 1);
-var import_client21 = __toESM(require_client(), 1);
+var import_client22 = __toESM(require_client(), 1);
 var import_protocols4 = __toESM(require_protocols(), 1);
 var import_serde3 = __toESM(require_serde(), 1);
 var getRuntimeConfig2 = (config) => {
@@ -62984,7 +63027,7 @@ var getRuntimeConfig2 = (config) => {
         signer: new import_httpAuthSchemes2.AwsSdkSigV4ASigner
       }
     ],
-    logger: config?.logger ?? new import_client21.NoOpLogger,
+    logger: config?.logger ?? new import_client22.NoOpLogger,
     md5: config?.md5 ?? import_checksum.Md5,
     protocol: config?.protocol ?? $S3RestXmlProtocol,
     protocolSettings: config?.protocolSettings ?? {
@@ -63009,11 +63052,11 @@ var getRuntimeConfig2 = (config) => {
 
 // node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var getRuntimeConfig3 = (config) => {
-  import_client23.emitWarningIfUnsupportedVersion(process.version);
+  import_client24.emitWarningIfUnsupportedVersion(process.version);
   const defaultsMode = import_config37.resolveDefaultsModeConfig(config);
-  const defaultConfigProvider = () => defaultsMode().then(import_client23.loadConfigsForDefaultMode);
+  const defaultConfigProvider = () => defaultsMode().then(import_client24.loadConfigsForDefaultMode);
   const clientSharedValues = getRuntimeConfig2(config);
-  import_client22.emitWarningIfUnsupportedVersion(process.version);
+  import_client23.emitWarningIfUnsupportedVersion(process.version);
   const loaderConfig = {
     profile: config?.profile,
     logger: clientSharedValues.logger
@@ -63026,7 +63069,7 @@ var getRuntimeConfig3 = (config) => {
     authSchemePreference: config?.authSchemePreference ?? import_config37.loadConfig(import_httpAuthSchemes3.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde4.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
-    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client22.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default2.version }),
+    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client23.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default2.version }),
     disableS3ExpressSessionAuth: config?.disableS3ExpressSessionAuth ?? import_config37.loadConfig($NODE_DISABLE_S3_EXPRESS_SESSION_AUTH_OPTIONS, loaderConfig),
     eventStreamSerdeProvider: config?.eventStreamSerdeProvider ?? import_event_streams.eventStreamSerdeProvider,
     maxAttempts: config?.maxAttempts ?? import_config37.loadConfig(import_retry3.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
@@ -63044,13 +63087,13 @@ var getRuntimeConfig3 = (config) => {
     useArnRegion: config?.useArnRegion ?? import_config37.loadConfig($NODE_USE_ARN_REGION_CONFIG_OPTIONS, loaderConfig),
     useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config37.loadConfig(import_config37.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
     useFipsEndpoint: config?.useFipsEndpoint ?? import_config37.loadConfig(import_config37.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    userAgentAppId: config?.userAgentAppId ?? import_config37.loadConfig(import_client22.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    userAgentAppId: config?.userAgentAppId ?? import_config37.loadConfig(import_client23.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
   };
 };
 
 // node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
-var import_client24 = __toESM(require_client2(), 1);
-var import_client25 = __toESM(require_client(), 1);
+var import_client25 = __toESM(require_client2(), 1);
+var import_client26 = __toESM(require_client(), 1);
 var import_protocols5 = __toESM(require_protocols(), 1);
 
 // node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthExtensionConfiguration.js
@@ -63094,24 +63137,24 @@ var resolveHttpAuthRuntimeConfig2 = (config) => {
 
 // node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
 var resolveRuntimeExtensions2 = (runtimeConfig, extensions) => {
-  const extensionConfiguration = Object.assign(import_client24.getAwsRegionExtensionConfiguration(runtimeConfig), import_client25.getDefaultExtensionConfiguration(runtimeConfig), import_protocols5.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration2(runtimeConfig));
+  const extensionConfiguration = Object.assign(import_client25.getAwsRegionExtensionConfiguration(runtimeConfig), import_client26.getDefaultExtensionConfiguration(runtimeConfig), import_protocols5.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration2(runtimeConfig));
   extensions.forEach((extension) => extension.configure(extensionConfiguration));
-  return Object.assign(runtimeConfig, import_client24.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client25.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols5.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig2(extensionConfiguration));
+  return Object.assign(runtimeConfig, import_client25.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client26.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols5.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig2(extensionConfiguration));
 };
 
 // node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
-class S3Client extends import_client27.Client {
+class S3Client extends import_client28.Client {
   config;
   constructor(...[configuration]) {
     const _config_0 = getRuntimeConfig3(configuration || {});
     super(_config_0);
     this.initConfig = _config_0;
     const _config_1 = resolveClientEndpointParameters(_config_0);
-    const _config_2 = import_client26.resolveUserAgentConfig(_config_1);
+    const _config_2 = import_client27.resolveUserAgentConfig(_config_1);
     const _config_3 = $resolveFlexibleChecksumsConfig(_config_2);
     const _config_4 = import_retry4.resolveRetryConfig(_config_3);
     const _config_5 = import_config38.resolveRegionConfig(_config_4);
-    const _config_6 = import_client26.resolveHostHeaderConfig(_config_5);
+    const _config_6 = import_client27.resolveHostHeaderConfig(_config_5);
     const _config_7 = import_endpoints5.resolveEndpointConfig(_config_6);
     const _config_8 = import_event_streams2.resolveEventStreamSerdeConfig(_config_7);
     const _config_9 = resolveHttpAuthSchemeConfig(_config_8);
@@ -63119,12 +63162,12 @@ class S3Client extends import_client27.Client {
     const _config_11 = resolveRuntimeExtensions2(_config_10, configuration?.extensions || []);
     this.config = _config_11;
     this.middlewareStack.use(import_schema2.getSchemaSerdePlugin(this.config));
-    this.middlewareStack.use(import_client26.getUserAgentPlugin(this.config));
+    this.middlewareStack.use(import_client27.getUserAgentPlugin(this.config));
     this.middlewareStack.use(import_retry4.getRetryPlugin(this.config));
     this.middlewareStack.use(import_protocols6.getContentLengthPlugin(this.config));
-    this.middlewareStack.use(import_client26.getHostHeaderPlugin(this.config));
-    this.middlewareStack.use(import_client26.getLoggerPlugin(this.config));
-    this.middlewareStack.use(import_client26.getRecursionDetectionPlugin(this.config));
+    this.middlewareStack.use(import_client27.getHostHeaderPlugin(this.config));
+    this.middlewareStack.use(import_client27.getLoggerPlugin(this.config));
+    this.middlewareStack.use(import_client27.getRecursionDetectionPlugin(this.config));
     this.middlewareStack.use(import_core.getHttpAuthSchemeEndpointRuleSetPlugin(this.config, {
       httpAuthSchemeParametersProvider: defaultS3HttpAuthSchemeParametersProvider,
       identityProviderConfigProvider: async (config) => new import_core.DefaultIdentityProviderConfig({
@@ -67187,9 +67230,9 @@ function createReceiptService(store) {
 }
 
 // node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
-var import_client36 = __toESM(require_client2(), 1);
+var import_client37 = __toESM(require_client2(), 1);
 var import_core2 = __toESM(require_dist_cjs2(), 1);
-var import_client37 = __toESM(require_client(), 1);
+var import_client38 = __toESM(require_client(), 1);
 var import_config41 = __toESM(require_config(), 1);
 var import_endpoints8 = __toESM(require_endpoints(), 1);
 var import_protocols10 = __toESM(require_protocols(), 1);
@@ -67198,11 +67241,11 @@ var import_schema4 = __toESM(require_schema4(), 1);
 
 // node_modules/@aws-sdk/client-ecs/dist-es/auth/httpAuthSchemeProvider.js
 var import_httpAuthSchemes4 = __toESM(require_httpAuthSchemes(), 1);
-var import_client28 = __toESM(require_client(), 1);
+var import_client29 = __toESM(require_client(), 1);
 var defaultECSHttpAuthSchemeParametersProvider = async (config, context, input) => {
   return {
-    operation: import_client28.getSmithyContext(context).operation,
-    region: await import_client28.normalizeProvider(config.region)() || (() => {
+    operation: import_client29.getSmithyContext(context).operation,
+    region: await import_client29.normalizeProvider(config.region)() || (() => {
       throw new Error("expected `region` to be configured for `aws.auth#sigv4`");
     })()
   };
@@ -67234,7 +67277,7 @@ var defaultECSHttpAuthSchemeProvider = (authParameters) => {
 var resolveHttpAuthSchemeConfig3 = (config) => {
   const config_0 = import_httpAuthSchemes4.resolveAwsSdkSigV4Config(config);
   return Object.assign(config_0, {
-    authSchemePreference: import_client28.normalizeProvider(config.authSchemePreference ?? [])
+    authSchemePreference: import_client29.normalizeProvider(config.authSchemePreference ?? [])
   });
 };
 
@@ -67326,9 +67369,9 @@ var package_default3 = {
 };
 
 // node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
-var import_client32 = __toESM(require_client2(), 1);
+var import_client33 = __toESM(require_client2(), 1);
 var import_httpAuthSchemes6 = __toESM(require_httpAuthSchemes(), 1);
-var import_client33 = __toESM(require_client(), 1);
+var import_client34 = __toESM(require_client(), 1);
 var import_config40 = __toESM(require_config(), 1);
 var import_retry5 = __toESM(require_retry(), 1);
 var import_serde6 = __toESM(require_serde(), 1);
@@ -67338,12 +67381,12 @@ var import_node_http_handler3 = __toESM(require_dist_cjs6(), 1);
 var import_httpAuthSchemes5 = __toESM(require_httpAuthSchemes(), 1);
 var import_protocols7 = __toESM(require_protocols2(), 1);
 var import_checksum3 = __toESM(require_checksum(), 1);
-var import_client31 = __toESM(require_client(), 1);
+var import_client32 = __toESM(require_client(), 1);
 var import_protocols8 = __toESM(require_protocols(), 1);
 var import_serde5 = __toESM(require_serde(), 1);
 
 // node_modules/@aws-sdk/client-ecs/dist-es/endpoint/endpointResolver.js
-var import_client29 = __toESM(require_client2(), 1);
+var import_client30 = __toESM(require_client2(), 1);
 var import_endpoints7 = __toESM(require_endpoints(), 1);
 
 // node_modules/@aws-sdk/client-ecs/dist-es/endpoint/bdd.js
@@ -67440,14 +67483,14 @@ var defaultEndpointResolver3 = (endpointParams, context = {}) => {
     logger: context.logger
   }));
 };
-import_endpoints7.customEndpointFunctions.aws = import_client29.awsEndpointFunctions;
+import_endpoints7.customEndpointFunctions.aws = import_client30.awsEndpointFunctions;
 
 // node_modules/@aws-sdk/client-ecs/dist-es/schemas/schemas_0.js
 var import_schema3 = __toESM(require_schema4(), 1);
 
 // node_modules/@aws-sdk/client-ecs/dist-es/models/ECSServiceException.js
-var import_client30 = __toESM(require_client(), 1);
-class ECSServiceException extends import_client30.ServiceException {
+var import_client31 = __toESM(require_client(), 1);
+class ECSServiceException extends import_client31.ServiceException {
   constructor(options) {
     super(options);
     Object.setPrototypeOf(this, ECSServiceException.prototype);
@@ -70251,7 +70294,7 @@ var getRuntimeConfig4 = (config) => {
         signer: new import_httpAuthSchemes5.AwsSdkSigV4Signer
       }
     ],
-    logger: config?.logger ?? new import_client31.NoOpLogger,
+    logger: config?.logger ?? new import_client32.NoOpLogger,
     protocol: config?.protocol ?? import_protocols7.AwsJson1_1Protocol,
     protocolSettings: config?.protocolSettings ?? {
       defaultNamespace: "com.amazonaws.ecs",
@@ -70270,11 +70313,11 @@ var getRuntimeConfig4 = (config) => {
 
 // node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
 var getRuntimeConfig5 = (config) => {
-  import_client33.emitWarningIfUnsupportedVersion(process.version);
+  import_client34.emitWarningIfUnsupportedVersion(process.version);
   const defaultsMode = import_config40.resolveDefaultsModeConfig(config);
-  const defaultConfigProvider = () => defaultsMode().then(import_client33.loadConfigsForDefaultMode);
+  const defaultConfigProvider = () => defaultsMode().then(import_client34.loadConfigsForDefaultMode);
   const clientSharedValues = getRuntimeConfig4(config);
-  import_client32.emitWarningIfUnsupportedVersion(process.version);
+  import_client33.emitWarningIfUnsupportedVersion(process.version);
   const loaderConfig = {
     profile: config?.profile,
     logger: clientSharedValues.logger
@@ -70287,7 +70330,7 @@ var getRuntimeConfig5 = (config) => {
     authSchemePreference: config?.authSchemePreference ?? import_config40.loadConfig(import_httpAuthSchemes6.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde6.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
-    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client32.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default3.version }),
+    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client33.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default3.version }),
     maxAttempts: config?.maxAttempts ?? import_config40.loadConfig(import_retry5.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
     region: config?.region ?? import_config40.loadConfig(import_config40.NODE_REGION_CONFIG_OPTIONS, { ...import_config40.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
     requestHandler: import_node_http_handler3.NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
@@ -70298,13 +70341,13 @@ var getRuntimeConfig5 = (config) => {
     streamCollector: config?.streamCollector ?? import_node_http_handler3.streamCollector,
     useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config40.loadConfig(import_config40.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
     useFipsEndpoint: config?.useFipsEndpoint ?? import_config40.loadConfig(import_config40.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    userAgentAppId: config?.userAgentAppId ?? import_config40.loadConfig(import_client32.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    userAgentAppId: config?.userAgentAppId ?? import_config40.loadConfig(import_client33.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
   };
 };
 
 // node_modules/@aws-sdk/client-ecs/dist-es/runtimeExtensions.js
-var import_client34 = __toESM(require_client2(), 1);
-var import_client35 = __toESM(require_client(), 1);
+var import_client35 = __toESM(require_client2(), 1);
+var import_client36 = __toESM(require_client(), 1);
 var import_protocols9 = __toESM(require_protocols(), 1);
 
 // node_modules/@aws-sdk/client-ecs/dist-es/auth/httpAuthExtensionConfiguration.js
@@ -70348,34 +70391,34 @@ var resolveHttpAuthRuntimeConfig3 = (config) => {
 
 // node_modules/@aws-sdk/client-ecs/dist-es/runtimeExtensions.js
 var resolveRuntimeExtensions3 = (runtimeConfig, extensions) => {
-  const extensionConfiguration = Object.assign(import_client34.getAwsRegionExtensionConfiguration(runtimeConfig), import_client35.getDefaultExtensionConfiguration(runtimeConfig), import_protocols9.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration3(runtimeConfig));
+  const extensionConfiguration = Object.assign(import_client35.getAwsRegionExtensionConfiguration(runtimeConfig), import_client36.getDefaultExtensionConfiguration(runtimeConfig), import_protocols9.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration3(runtimeConfig));
   extensions.forEach((extension) => extension.configure(extensionConfiguration));
-  return Object.assign(runtimeConfig, import_client34.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client35.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols9.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig3(extensionConfiguration));
+  return Object.assign(runtimeConfig, import_client35.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client36.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols9.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig3(extensionConfiguration));
 };
 
 // node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
-class ECSClient extends import_client37.Client {
+class ECSClient extends import_client38.Client {
   config;
   constructor(...[configuration]) {
     const _config_0 = getRuntimeConfig5(configuration || {});
     super(_config_0);
     this.initConfig = _config_0;
     const _config_1 = resolveClientEndpointParameters3(_config_0);
-    const _config_2 = import_client36.resolveUserAgentConfig(_config_1);
+    const _config_2 = import_client37.resolveUserAgentConfig(_config_1);
     const _config_3 = import_retry6.resolveRetryConfig(_config_2);
     const _config_4 = import_config41.resolveRegionConfig(_config_3);
-    const _config_5 = import_client36.resolveHostHeaderConfig(_config_4);
+    const _config_5 = import_client37.resolveHostHeaderConfig(_config_4);
     const _config_6 = import_endpoints8.resolveEndpointConfig(_config_5);
     const _config_7 = resolveHttpAuthSchemeConfig3(_config_6);
     const _config_8 = resolveRuntimeExtensions3(_config_7, configuration?.extensions || []);
     this.config = _config_8;
     this.middlewareStack.use(import_schema4.getSchemaSerdePlugin(this.config));
-    this.middlewareStack.use(import_client36.getUserAgentPlugin(this.config));
+    this.middlewareStack.use(import_client37.getUserAgentPlugin(this.config));
     this.middlewareStack.use(import_retry6.getRetryPlugin(this.config));
     this.middlewareStack.use(import_protocols10.getContentLengthPlugin(this.config));
-    this.middlewareStack.use(import_client36.getHostHeaderPlugin(this.config));
-    this.middlewareStack.use(import_client36.getLoggerPlugin(this.config));
-    this.middlewareStack.use(import_client36.getRecursionDetectionPlugin(this.config));
+    this.middlewareStack.use(import_client37.getHostHeaderPlugin(this.config));
+    this.middlewareStack.use(import_client37.getLoggerPlugin(this.config));
+    this.middlewareStack.use(import_client37.getRecursionDetectionPlugin(this.config));
     this.middlewareStack.use(import_core2.getHttpAuthSchemeEndpointRuleSetPlugin(this.config, {
       httpAuthSchemeParametersProvider: defaultECSHttpAuthSchemeParametersProvider,
       identityProviderConfigProvider: async (config) => new import_core2.DefaultIdentityProviderConfig({
@@ -70390,9 +70433,9 @@ class ECSClient extends import_client37.Client {
 }
 
 // node_modules/@aws-sdk/client-ecs/dist-es/commandBuilder.js
-var import_client38 = __toESM(require_client(), 1);
+var import_client39 = __toESM(require_client(), 1);
 var import_endpoints9 = __toESM(require_endpoints(), 1);
-var command3 = import_client38.makeBuilder(commonParams3, "AmazonEC2ContainerServiceV20141113", "ECSClient", import_endpoints9.getEndpointPlugin);
+var command3 = import_client39.makeBuilder(commonParams3, "AmazonEC2ContainerServiceV20141113", "ECSClient", import_endpoints9.getEndpointPlugin);
 var _ep03 = {};
 var _mw03 = (Command, cs, config, o3) => [];
 
@@ -98330,6 +98373,16 @@ async function requestInvitationEmail(origin, action, input2) {
 // src/lib/remote-private-publications.ts
 import { createHash as createHash45 } from "crypto";
 var PRIVATE_PUBLICATION_MAX_BYTES = 16 * 1024 * 1024;
+var skillCreateFailures = {
+  INVALID_SLUG: [400, "Provide a lowercase kebab-case skill slug."],
+  INVALID_DISPLAY_NAME: [400, "Provide a nonempty skill display name."],
+  INVALID_VISIBILITY: [400, "Use private or team visibility for source publication."],
+  SESSION_EXPIRED: [401, "Sign in again before creating a private skill."],
+  INTERACTIVE_SESSION_REQUIRED: [403, "An interactive account session is required to create a private skill."],
+  ACCOUNT_UNAVAILABLE: [403, "The current account membership cannot create a private skill."],
+  PLAN_REQUIRED: [403, "Private and team skills require the Pro plan."],
+  SLUG_CONFLICT: [409, "This skill slug already exists. Inspect the existing skill before publishing."]
+};
 var failures2 = {
   INVALID_REQUEST: [400, "The publication request is invalid."],
   SESSION_EXPIRED: [401, "Sign in again to manage this publication."],
@@ -98376,6 +98429,24 @@ var record12 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
 var exact = (v2, keys4) => record12(v2) && Object.keys(v2).sort().join(",") === keys4.sort().join(",");
 var date5 = (v2) => typeof v2 === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v2) && Number.isFinite(Date.parse(v2));
 var publicationSha256 = (bytes) => createHash45("sha256").update(bytes).digest("hex");
+function checkedPrivateSkillCreate(value) {
+  const refuse8 = (field3, accepted) => {
+    throw new PrivatePublicationError("INVALID_SKILL_CREATE_INPUT", `Invalid ${field3}. ${accepted}`);
+  };
+  if (!record12(value) || !Object.keys(value).every((key2) => ["slug", "displayName", "description", "visibility", "confirm"].includes(key2)))
+    return refuse8("create input", "Provide only slug, displayName, description, visibility and confirm.");
+  if (value.confirm !== true)
+    throw new PrivatePublicationError("SKILL_CREATE_CONFIRM_REQUIRED", "Explicit confirmation is required to create this skill.");
+  if (typeof value.slug !== "string" || value.slug.length > 128 || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(value.slug))
+    return refuse8("slug", "Use lowercase kebab-case, at most 128 characters.");
+  if (typeof value.displayName !== "string" || !value.displayName.trim() || value.displayName.length > 256 || /[\p{Cc}\p{Cs}\u2028\u2029]/u.test(value.displayName))
+    return refuse8("displayName", "Use nonempty text, at most 256 characters, without control characters.");
+  if (value.description !== undefined && (typeof value.description !== "string" || Buffer.byteLength(value.description) > 8192 || /[\p{Cc}\p{Cs}]/u.test(value.description.replace(/[\r\n\t]/g, ""))))
+    return refuse8("description", "Use text of at most 8192 UTF-8 bytes, without control characters other than tabs and newlines.");
+  if (value.visibility !== undefined && value.visibility !== "private" && value.visibility !== "team")
+    return refuse8("visibility", "Use private or team.");
+  return Object.freeze({ slug: value.slug, displayName: value.displayName.trim(), description: value.description ?? "", visibility: value.visibility ?? "private" });
+}
 function checkedPublicationDeclaration(value) {
   if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash5(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
     return bad();
@@ -98395,11 +98466,11 @@ function checkedPublicationView(value, skillId, intentId, declaration) {
     return invalid7();
   return Object.freeze({ ...value });
 }
-async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal) {
+async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal, create = false) {
   const controller = new AbortController;
   let reader;
   let response;
-  const timeout2 = new PrivatePublicationError("PUBLICATION_UNCONFIRMED", "No confirmed publication result. Inspect the saved intent before retrying.", mutation);
+  const timeout2 = new PrivatePublicationError(create ? "SKILL_CREATE_UNCONFIRMED" : "PUBLICATION_UNCONFIRMED", create ? "Skill creation could not be confirmed. Inspect the workspace for this slug before another create; do not retry automatically." : "No confirmed publication result. Inspect the saved intent before retrying.", mutation);
   let timer;
   let abort;
   try {
@@ -98439,11 +98510,19 @@ async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal)
         return invalid7();
       }
       if (!response.ok) {
-        const code = record12(body4) && typeof body4.code === "string" && Object.hasOwn(failures2, body4.code) ? body4.code : null;
-        if (code && failures2[code][0] === response.status)
-          throw new PrivatePublicationError(code, failures2[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
+        const known = create ? skillCreateFailures : failures2;
+        const code = record12(body4) && typeof body4.code === "string" && Object.hasOwn(known, body4.code) ? body4.code : null;
+        if (code && known[code][0] === response.status)
+          throw new PrivatePublicationError(code, known[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
+        if (create) {
+          if (response.status >= 500)
+            throw timeout2;
+          throw new PrivatePublicationError("SKILL_CREATE_REQUEST_FAILED", "The server refused skill creation.", false, response.status);
+        }
         throw new PrivatePublicationError("PUBLICATION_REQUEST_FAILED", "The publication request was refused. Inspect its status before retrying.", mutation && response.status >= 500, response.status);
       }
+      if (create && response.status !== 201)
+        return invalid7();
       return body4;
     })(), new Promise((_, reject) => {
       abort = () => {
@@ -98490,6 +98569,15 @@ class RemotePrivatePublicationsClient {
     this.membershipId = checked.user.membershipId;
     Object.freeze(this);
   }
+  async createSkill(input2, options = {}) {
+    const body4 = checkedPrivateSkillCreate(input2);
+    if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
+      throw new PrivatePublicationError("INVALID_SKILL_CREATE_INPUT", "Invalid timeoutMs. Use an integer from 1 to 15000.");
+    const value = await boundedJson(skillsApiRequestUrl(this.apiOrigin, "/api/v1/skills"), { method: "POST", body: JSON.stringify(body4) }, this.#token, true, options.timeoutMs, options.signal, true);
+    if (!record12(value) || !publicationUuid(value.id) || value.slug !== body4.slug || value.displayName !== body4.displayName || value.description !== body4.description || value.visibility !== body4.visibility || value.sourceType !== "private_hosted" || !record12(value.metadata) || value.metadata.ownerOrganizationId !== this.organizationId)
+      throw new PrivatePublicationError("SKILL_CREATE_UNCONFIRMED", "Skill creation returned an unbound result. Inspect the workspace for this slug before another create; do not retry automatically.", true);
+    return Object.freeze({ id: value.id, slug: body4.slug, visibility: body4.visibility, sourceType: "private_hosted", ownerOrganizationId: this.organizationId });
+  }
   async getCapability(options = {}) {
     if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
       return bad();