@hasna/skills 0.4.0 → 0.5.1

package/dist/sdk/index.js

@@ -17645,7 +17645,7 @@ var require_httpAuthSchemes = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-env@3.972.70/node_modules/@aws-sdk/credential-provider-env/dist-es/fromEnv.js
-var import_client7, import_config, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET = "AWS_SECRET_ACCESS_KEY", ENV_SESSION = "AWS_SESSION_TOKEN", ENV_EXPIRATION = "AWS_CREDENTIAL_EXPIRATION", ENV_CREDENTIAL_SCOPE = "AWS_CREDENTIAL_SCOPE", ENV_ACCOUNT_ID = "AWS_ACCOUNT_ID", fromEnv = (init) => async () => {
+var import_client8, import_config, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET = "AWS_SECRET_ACCESS_KEY", ENV_SESSION = "AWS_SESSION_TOKEN", ENV_EXPIRATION = "AWS_CREDENTIAL_EXPIRATION", ENV_CREDENTIAL_SCOPE = "AWS_CREDENTIAL_SCOPE", ENV_ACCOUNT_ID = "AWS_ACCOUNT_ID", fromEnv = (init) => async () => {
   init?.logger?.debug("@aws-sdk/credential-provider-env - fromEnv");
   const accessKeyId = process.env[ENV_KEY];
   const secretAccessKey = process.env[ENV_SECRET];
@@ -17662,13 +17662,13 @@ var import_client7, import_config, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET = "
       ...credentialScope && { credentialScope },
       ...accountId && { accountId }
     };
-    import_client7.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS", "g");
+    import_client8.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS", "g");
     return credentials;
   }
   throw new import_config.CredentialsProviderError("Unable to find environment variable credentials.", { logger: init?.logger });
 };
 var init_fromEnv = __esm(() => {
-  import_client7 = __toESM(require_client2(), 1);
+  import_client8 = __toESM(require_client2(), 1);
   import_config = __toESM(require_config(), 1);
 });
 
@@ -19010,7 +19010,7 @@ var retryWrapper = (toRetry, maxRetries, delayMs) => {
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-http@3.972.72/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/fromHttp.js
 import fs from "fs/promises";
-var import_client8, import_config9, import_node_http_handler, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2", AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromHttp = (options = {}) => {
+var import_client9, import_config9, import_node_http_handler, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2", AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromHttp = (options = {}) => {
   options.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");
   let host;
   const relative2 = options.awsContainerCredentialsRelativeUri ?? process.env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI];
@@ -19047,7 +19047,7 @@ Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
     }
     try {
       const result = await requestHandler.handle(request, { requestTimeout });
-      return getCredentials(result.response).then((creds) => import_client8.setCredentialFeature(creds, "CREDENTIALS_HTTP", "z"));
+      return getCredentials(result.response).then((creds) => import_client9.setCredentialFeature(creds, "CREDENTIALS_HTTP", "z"));
     } catch (e2) {
       throw new import_config9.CredentialsProviderError(String(e2), { logger: options.logger });
     }
@@ -19069,7 +19069,7 @@ Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
 var init_fromHttp = __esm(() => {
   init_checkUrl();
   init_requestHelpers();
-  import_client8 = __toESM(require_client2(), 1);
+  import_client9 = __toESM(require_client2(), 1);
   import_config9 = __toESM(require_config(), 1);
   import_node_http_handler = __toESM(require_dist_cjs6(), 1);
 });
@@ -20453,7 +20453,7 @@ var init_loadSso = __esm(() => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/resolveSSOCredentials.js
-var import_client9, import_config15, SHOULD_FAIL_CREDENTIAL_CHAIN = false, resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger }) => {
+var import_client10, import_config15, SHOULD_FAIL_CREDENTIAL_CHAIN = false, resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger }) => {
   let token;
   const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
   if (ssoSession) {
@@ -20529,15 +20529,15 @@ var import_client9, import_config15, SHOULD_FAIL_CREDENTIAL_CHAIN = false, resol
     ...accountId && { accountId }
   };
   if (ssoSession) {
-    import_client9.setCredentialFeature(credentials, "CREDENTIALS_SSO", "s");
+    import_client10.setCredentialFeature(credentials, "CREDENTIALS_SSO", "s");
   } else {
-    import_client9.setCredentialFeature(credentials, "CREDENTIALS_SSO_LEGACY", "u");
+    import_client10.setCredentialFeature(credentials, "CREDENTIALS_SSO_LEGACY", "u");
   }
   return credentials;
 };
 var init_resolveSSOCredentials = __esm(() => {
   init_dist_es4();
-  import_client9 = __toESM(require_client2(), 1);
+  import_client10 = __toESM(require_client2(), 1);
   import_config15 = __toESM(require_config(), 1);
 });
 
@@ -20649,7 +20649,7 @@ var init_dist_es5 = __esm(() => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveCredentialSource.js
-var import_client10, import_config18, resolveCredentialSource = (credentialSource, profileName, logger) => {
+var import_client11, import_config18, resolveCredentialSource = (credentialSource, profileName, logger) => {
   const sourceProvidersMap = {
     EcsContainer: async (options) => {
       const { fromHttp: fromHttp2 } = await Promise.resolve().then(() => (init_dist_es3(), exports_dist_es3));
@@ -20673,9 +20673,9 @@ var import_client10, import_config18, resolveCredentialSource = (credentialSourc
   } else {
     throw new import_config18.CredentialsProviderError(`Unsupported credential source in profile ${profileName}. Got ${credentialSource}, expected EcsContainer or Ec2InstanceMetadata or Environment.`, { logger });
   }
-}, setNamedProvider = (creds) => import_client10.setCredentialFeature(creds, "CREDENTIALS_PROFILE_NAMED_PROVIDER", "p");
+}, setNamedProvider = (creds) => import_client11.setCredentialFeature(creds, "CREDENTIALS_PROFILE_NAMED_PROVIDER", "p");
 var init_resolveCredentialSource = __esm(() => {
-  import_client10 = __toESM(require_client2(), 1);
+  import_client11 = __toESM(require_client2(), 1);
   import_config18 = __toESM(require_config(), 1);
 });
 
@@ -21702,7 +21702,7 @@ var require_sts = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveAssumeRoleCredentials.js
-var import_client11, import_config19, isAssumeRoleProfile = (arg, { profile = "default", logger } = {}) => {
+var import_client12, import_config19, isAssumeRoleProfile = (arg, { profile = "default", logger } = {}) => {
   return Boolean(arg) && typeof arg === "object" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1 && ["undefined", "string"].indexOf(typeof arg.external_id) > -1 && ["undefined", "string"].indexOf(typeof arg.mfa_serial) > -1 && (isAssumeRoleWithSourceProfile(arg, { profile, logger }) || isCredentialSourceProfile(arg, { profile, logger }));
 }, isAssumeRoleWithSourceProfile = (arg, { profile, logger }) => {
   const withSourceProfile = typeof arg.source_profile === "string" && typeof arg.credential_source === "undefined";
@@ -21741,7 +21741,7 @@ var import_client11, import_config19, isAssumeRoleProfile = (arg, { profile = "d
     [source_profile]: true
   }, isCredentialSourceWithoutRoleArn(profiles[source_profile] ?? {})) : (await resolveCredentialSource(profileData.credential_source, profileName, options.logger)(options))();
   if (isCredentialSourceWithoutRoleArn(profileData)) {
-    return sourceCredsProvider.then((creds) => import_client11.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
+    return sourceCredsProvider.then((creds) => import_client12.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
   } else {
     const params = {
       RoleArn: profileData.role_arn,
@@ -21758,14 +21758,14 @@ var import_client11, import_config19, isAssumeRoleProfile = (arg, { profile = "d
       params.TokenCode = await options.mfaCodeProvider(mfa_serial);
     }
     const sourceCreds = await sourceCredsProvider;
-    return options.roleAssumer(sourceCreds, params).then((creds) => import_client11.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
+    return options.roleAssumer(sourceCreds, params).then((creds) => import_client12.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
   }
 }, isCredentialSourceWithoutRoleArn = (section) => {
   return !section.role_arn && !!section.credential_source;
 };
 var init_resolveAssumeRoleCredentials = __esm(() => {
   init_resolveCredentialSource();
-  import_client11 = __toESM(require_client2(), 1);
+  import_client12 = __toESM(require_client2(), 1);
   import_config19 = __toESM(require_config(), 1);
 });
 
@@ -22766,7 +22766,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-login@3.972.77/node_modules/@aws-sdk/credential-provider-login/dist-es/fromLoginCredentials.js
-var import_client12, import_config21, fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
+var import_client13, import_config21, fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
   init?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");
   const profiles = await import_config21.parseKnownFiles(init || {});
   const profileName = import_config21.getProfileName({
@@ -22781,11 +22781,11 @@ var import_client12, import_config21, fromLoginCredentials = (init) => async ({
   }
   const fetcher = new LoginCredentialsFetcher(profile, init, callerClientConfig);
   const credentials = await fetcher.loadCredentials();
-  return import_client12.setCredentialFeature(credentials, "CREDENTIALS_LOGIN", "AD");
+  return import_client13.setCredentialFeature(credentials, "CREDENTIALS_LOGIN", "AD");
 };
 var init_fromLoginCredentials = __esm(() => {
   init_LoginCredentialsFetcher();
-  import_client12 = __toESM(require_client2(), 1);
+  import_client13 = __toESM(require_client2(), 1);
   import_config21 = __toESM(require_config(), 1);
 });
 
@@ -22799,7 +22799,7 @@ var init_dist_es6 = __esm(() => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveLoginCredentials.js
-var import_client13, isLoginProfile = (data) => {
+var import_client14, isLoginProfile = (data) => {
   return Boolean(data && data.login_session);
 }, resolveLoginCredentials = async (profileName, options, callerClientConfig) => {
   const { fromLoginCredentials: fromLoginCredentials2 } = await Promise.resolve().then(() => (init_dist_es6(), exports_dist_es5));
@@ -22807,14 +22807,14 @@ var import_client13, isLoginProfile = (data) => {
     ...options,
     profile: profileName
   })({ callerClientConfig });
-  return import_client13.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_LOGIN", "AC");
+  return import_client14.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_LOGIN", "AC");
 };
 var init_resolveLoginCredentials = __esm(() => {
-  import_client13 = __toESM(require_client2(), 1);
+  import_client14 = __toESM(require_client2(), 1);
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-process@3.972.70/node_modules/@aws-sdk/credential-provider-process/dist-es/getValidatedProcessCredentials.js
-var import_client14, getValidatedProcessCredentials = (profileName, data, profiles) => {
+var import_client15, getValidatedProcessCredentials = (profileName, data, profiles) => {
   if (data.Version !== 1) {
     throw Error(`Profile ${profileName} credential_process did not return Version 1.`);
   }
@@ -22840,11 +22840,11 @@ var import_client14, getValidatedProcessCredentials = (profileName, data, profil
     ...data.CredentialScope && { credentialScope: data.CredentialScope },
     ...accountId && { accountId }
   };
-  import_client14.setCredentialFeature(credentials, "CREDENTIALS_PROCESS", "w");
+  import_client15.setCredentialFeature(credentials, "CREDENTIALS_PROCESS", "w");
   return credentials;
 };
 var init_getValidatedProcessCredentials = __esm(() => {
-  import_client14 = __toESM(require_client2(), 1);
+  import_client15 = __toESM(require_client2(), 1);
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-process@3.972.70/node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js
@@ -22905,20 +22905,20 @@ var init_dist_es7 = __esm(() => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProcessCredentials.js
-var import_client15, isProcessProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.credential_process === "string", resolveProcessCredentials2 = async (options, profile) => {
+var import_client16, isProcessProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.credential_process === "string", resolveProcessCredentials2 = async (options, profile) => {
   const { fromProcess: fromProcess2 } = await Promise.resolve().then(() => (init_dist_es7(), exports_dist_es6));
   const credentials = await fromProcess2({
     ...options,
     profile
   })();
-  return import_client15.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_PROCESS", "v");
+  return import_client16.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_PROCESS", "v");
 };
 var init_resolveProcessCredentials2 = __esm(() => {
-  import_client15 = __toESM(require_client2(), 1);
+  import_client16 = __toESM(require_client2(), 1);
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveSsoCredentials.js
-var import_client16, resolveSsoCredentials = async (profile, profileData, options = {}, callerClientConfig) => {
+var import_client17, resolveSsoCredentials = async (profile, profileData, options = {}, callerClientConfig) => {
   const { fromSSO: fromSSO2 } = await Promise.resolve().then(() => (init_dist_es5(), exports_dist_es4));
   return fromSSO2({
     profile,
@@ -22929,18 +22929,18 @@ var import_client16, resolveSsoCredentials = async (profile, profileData, option
     callerClientConfig
   }).then((creds) => {
     if (profileData.sso_session) {
-      return import_client16.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO", "r");
+      return import_client17.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO", "r");
     } else {
-      return import_client16.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO_LEGACY", "t");
+      return import_client17.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO_LEGACY", "t");
     }
   });
 }, isSsoProfile2 = (arg) => arg && (typeof arg.sso_start_url === "string" || typeof arg.sso_account_id === "string" || typeof arg.sso_session === "string" || typeof arg.sso_region === "string" || typeof arg.sso_role_name === "string");
 var init_resolveSsoCredentials = __esm(() => {
-  import_client16 = __toESM(require_client2(), 1);
+  import_client17 = __toESM(require_client2(), 1);
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveStaticCredentials.js
-var import_client17, isStaticCredsProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.aws_access_key_id === "string" && typeof arg.aws_secret_access_key === "string" && ["undefined", "string"].indexOf(typeof arg.aws_session_token) > -1 && ["undefined", "string"].indexOf(typeof arg.aws_account_id) > -1, resolveStaticCredentials = async (profile, options) => {
+var import_client18, isStaticCredsProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.aws_access_key_id === "string" && typeof arg.aws_secret_access_key === "string" && ["undefined", "string"].indexOf(typeof arg.aws_session_token) > -1 && ["undefined", "string"].indexOf(typeof arg.aws_account_id) > -1, resolveStaticCredentials = async (profile, options) => {
   options?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");
   const credentials = {
     accessKeyId: profile.aws_access_key_id,
@@ -22949,10 +22949,10 @@ var import_client17, isStaticCredsProfile = (arg) => Boolean(arg) && typeof arg
     ...profile.aws_credential_scope && { credentialScope: profile.aws_credential_scope },
     ...profile.aws_account_id && { accountId: profile.aws_account_id }
   };
-  return import_client17.setCredentialFeature(credentials, "CREDENTIALS_PROFILE", "n");
+  return import_client18.setCredentialFeature(credentials, "CREDENTIALS_PROFILE", "n");
 };
 var init_resolveStaticCredentials = __esm(() => {
-  import_client17 = __toESM(require_client2(), 1);
+  import_client18 = __toESM(require_client2(), 1);
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-web-identity@3.972.76/node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromWebToken.js
@@ -22984,7 +22984,7 @@ var fromWebToken = (init) => async (awsIdentityProperties) => {
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-web-identity@3.972.76/node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromTokenFile.js
 import { readFileSync as readFileSync3 } from "fs";
-var import_client18, import_config24, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE", ENV_ROLE_ARN = "AWS_ROLE_ARN", ENV_ROLE_SESSION_NAME = "AWS_ROLE_SESSION_NAME", fromTokenFile = (init = {}) => async (awsIdentityProperties) => {
+var import_client19, import_config24, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE", ENV_ROLE_ARN = "AWS_ROLE_ARN", ENV_ROLE_SESSION_NAME = "AWS_ROLE_SESSION_NAME", fromTokenFile = (init = {}) => async (awsIdentityProperties) => {
   init.logger?.debug("@aws-sdk/credential-provider-web-identity - fromTokenFile");
   const webIdentityTokenFile = init?.webIdentityTokenFile ?? process.env[ENV_TOKEN_FILE];
   const roleArn = init?.roleArn ?? process.env[ENV_ROLE_ARN];
@@ -23001,12 +23001,12 @@ var import_client18, import_config24, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_F
     roleSessionName
   })(awsIdentityProperties);
   if (webIdentityTokenFile === process.env[ENV_TOKEN_FILE]) {
-    import_client18.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN", "h");
+    import_client19.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN", "h");
   }
   return credentials;
 };
 var init_fromTokenFile = __esm(() => {
-  import_client18 = __toESM(require_client2(), 1);
+  import_client19 = __toESM(require_client2(), 1);
   import_config24 = __toESM(require_config(), 1);
 });
 
@@ -23021,7 +23021,7 @@ var init_dist_es8 = __esm(() => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveWebIdentityCredentials.js
-var import_client19, isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.web_identity_token_file === "string" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1, resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => {
+var import_client20, isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.web_identity_token_file === "string" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1, resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => {
   const { fromTokenFile: fromTokenFile2 } = await Promise.resolve().then(() => (init_dist_es8(), exports_dist_es7));
   const credentials = await fromTokenFile2({
     webIdentityTokenFile: profile.web_identity_token_file,
@@ -23033,10 +23033,10 @@ var import_client19, isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg
   })({
     callerClientConfig
   });
-  return import_client19.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN", "q");
+  return import_client20.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN", "q");
 };
 var init_resolveWebIdentityCredentials = __esm(() => {
-  import_client19 = __toESM(require_client2(), 1);
+  import_client20 = __toESM(require_client2(), 1);
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProfileData.js
@@ -23097,15 +23097,23 @@ var init_dist_es9 = __esm(() => {
   init_fromIni();
 });
 
-// ../../node_modules/.bun/@hasna+events@0.1.16/node_modules/@hasna/events/dist/index.js
+// ../events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile as writeFile2 } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
+import { existsSync as existsSync22 } from "fs";
+import { join as join22 } from "path";
 import { existsSync as existsSync16 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join20 } from "path";
+import { join as join20, resolve as resolve3 } from "path";
+import { homedir as pathsResolverHomedir2 } from "os";
+import { join as pathsResolverJoin2 } from "path";
 import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { lookup as dnsLookup } from "dns/promises";
+import { isIP as isIP2 } from "net";
 import { randomUUID as randomUUID5 } from "crypto";
 import { spawn } from "child_process";
+import { request as nodeHttpRequest } from "http";
+import { request as nodeHttpsRequest } from "https";
 import { randomUUID as randomUUID22 } from "crypto";
 function getPathValue(input, path) {
   return path.split(".").reduce((value, part) => {
@@ -23202,8 +23210,90 @@ function channelMatchesEvent(channel, event) {
     return true;
   return channel.filters.some((filter) => eventMatchesFilter(event, filter));
 }
+function pathsResolverAssertApp2(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!PATHS_RESOLVER_APP_SLUG_RE2.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
+}
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
+    return override;
+  const home = options.home ?? pathsResolverHomedir2();
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    switch (kind) {
+      case "config":
+      case "data":
+        return pathsResolverJoin2(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return pathsResolverJoin2(home, "Library", "Caches", "Hasna");
+      case "state":
+        return pathsResolverJoin2(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return pathsResolverJoin2(home, ".config", "hasna");
+    case "data":
+      return pathsResolverJoin2(home, ".local", "share", "hasna");
+    case "state":
+      return pathsResolverJoin2(home, ".local", "state", "hasna");
+    case "cache":
+      return pathsResolverJoin2(home, ".cache", "hasna");
+  }
+}
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp2(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin2("internal", options.app) : options.app;
+  return pathsResolverJoin2(pathsResolverBaseDir(kind, options), appSegment);
+}
+function dataDir2(options) {
+  return pathsResolverResolve("data", options);
+}
+function effectiveHome2() {
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir5();
+}
+function legacyHomeDir() {
+  return join20(effectiveHome2(), ".hasna", "events");
+}
+function resolverHome() {
+  return dataDir2({ app: "events", home: effectiveHome2() || undefined });
+}
+function adoptResolverHome(resolved, env = process.env) {
+  const dataOverride = env.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync16(join20(resolved, EVENTS_STORE_SENTINEL_FILE));
+}
+function exactEventsHome() {
+  const dir = process.env[HASNA_EVENTS_DIR_ENV];
+  if (dir && dir.trim())
+    return dir.trim();
+  const home = process.env[HASNA_EVENTS_HOME_ENV];
+  if (home && home.trim())
+    return home.trim();
+  return;
+}
+function getEventsHome() {
+  const exact = exactEventsHome();
+  if (exact)
+    return resolve3(exact);
+  const resolved = resolverHome();
+  return adoptResolverHome(resolved) ? resolve3(resolved) : resolve3(legacyHomeDir());
+}
 function getEventsDataDir(override) {
-  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join20(homedir5(), ".hasna", "events");
+  return override || getEventsHome();
 }
 
 class JsonEventsStore {
@@ -23212,12 +23302,12 @@ class JsonEventsStore {
   channelsPath;
   eventsPath;
   deliveriesPath;
-  constructor(dataDir2 = getEventsDataDir()) {
-    this.dataDir = dataDir2;
-    this.runtime = localJsonRuntime(dataDir2);
-    this.channelsPath = join20(dataDir2, "channels.json");
-    this.eventsPath = join20(dataDir2, "events.json");
-    this.deliveriesPath = join20(dataDir2, "deliveries.json");
+  constructor(dataDir22 = getEventsDataDir()) {
+    this.dataDir = dataDir22;
+    this.runtime = localJsonRuntime(dataDir22);
+    this.channelsPath = join22(dataDir22, "channels.json");
+    this.eventsPath = join22(dataDir22, "events.json");
+    this.deliveriesPath = join22(dataDir22, "deliveries.json");
   }
   async init() {
     await mkdir(this.dataDir, { recursive: true, mode: 448 });
@@ -23334,7 +23424,7 @@ class JsonEventsStore {
     };
   }
   async ensureArrayFile(path) {
-    if (!existsSync16(path)) {
+    if (!existsSync22(path)) {
       await writeFile2(path, `[]
 `, { encoding: "utf-8", mode: 384 });
     }
@@ -23364,7 +23454,7 @@ class JsonEventsStore {
     });
   }
 }
-function localJsonRuntime(dataDir2 = getEventsDataDir()) {
+function localJsonRuntime(dataDir22 = getEventsDataDir()) {
   return {
     mode: "local-files",
     name: "json-events-store",
@@ -23377,7 +23467,7 @@ function localJsonRuntime(dataDir2 = getEventsDataDir()) {
     durable: true,
     idempotency: "best-effort-local",
     replayCursors: true,
-    description: `Local JSON files in ${dataDir2}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+    description: `Local JSON files in ${dataDir22}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
   };
 }
 function encodeLocalJsonEventCursor(offset, options = {}) {
@@ -23448,6 +23538,177 @@ function signPayload(secret, timestamp, body) {
   const digest2 = createHmac3("sha256", secret).update(buildSignatureBase(timestamp, body)).digest("hex");
   return `sha256=${digest2}`;
 }
+function isPrivateAddress(address) {
+  const normalized = stripZoneId(address);
+  const version2 = isIP2(normalized);
+  if (version2 === 4) {
+    const integer = ipv4ToInt(normalized);
+    if (integer === undefined)
+      return true;
+    return IPV4_PRIVATE_RANGES.some(([low, high]) => integer >= low && integer <= high);
+  }
+  if (version2 === 6) {
+    const groups = ipv6Groups(normalized);
+    if (!groups)
+      return true;
+    for (const prefix of IPV6_SPECIAL_PREFIXES) {
+      if (!ipv6MatchesPrefix(groups, prefix.groups, prefix.bits))
+        continue;
+      if (prefix.bits === 96 && groups[5] === 65535) {
+        return isPrivateAddress(ipv4IntToString(groups[6] << 16 | groups[7]));
+      }
+      if (prefix.bits === 16 && groups[0] === 8194) {
+        return isPrivateAddress(ipv4IntToString(groups[1] << 16 | groups[2]));
+      }
+      return true;
+    }
+    return false;
+  }
+  return true;
+}
+async function resolveWebhookTarget(url, policy = {}) {
+  const hostname = normalizeHostname(url.hostname);
+  const allowlist = (policy.allowPrivateHosts ?? []).map((entry) => normalizeHostname(entry.toLowerCase()));
+  if (allowlist.includes(hostname)) {
+    const version22 = isIP2(hostname);
+    if (version22 === 4 || version22 === 6) {
+      return { hostname, addresses: [hostname] };
+    }
+    const lookup2 = policy.lookup ?? defaultTargetLookup;
+    let resolved2;
+    try {
+      resolved2 = await lookup2(hostname);
+    } catch {
+      throw new Error(`Webhook target ${hostname} could not be resolved`);
+    }
+    if (!Array.isArray(resolved2) || resolved2.length === 0) {
+      throw new Error(`Webhook target ${hostname} resolved to no addresses`);
+    }
+    const addresses = resolved2.map((entry) => normalizeHostname(entry.address));
+    return { hostname, addresses };
+  }
+  const version2 = isIP2(hostname);
+  if (version2 === 4 || version2 === 6) {
+    if (isPrivateAddress(hostname)) {
+      throw new Error(`Webhook target ${hostname} is a private or special-use address`);
+    }
+    return { hostname, addresses: [hostname] };
+  }
+  const lookup = policy.lookup ?? defaultTargetLookup;
+  let resolved;
+  try {
+    resolved = await lookup(hostname);
+  } catch {
+    throw new Error(`Webhook target ${hostname} could not be resolved`);
+  }
+  if (!Array.isArray(resolved) || resolved.length === 0) {
+    throw new Error(`Webhook target ${hostname} resolved to no addresses`);
+  }
+  const allowed = [];
+  for (const entry of resolved) {
+    const address = normalizeHostname(entry.address);
+    if (isPrivateAddress(address)) {
+      if (allowlist.includes(address)) {
+        allowed.push(address);
+        continue;
+      }
+      throw new Error(`Webhook target ${hostname} resolves to private or special-use address ${address}`);
+    }
+    allowed.push(address);
+  }
+  if (allowed.length === 0) {
+    throw new Error(`Webhook target ${hostname} resolved to no public addresses`);
+  }
+  return { hostname, addresses: allowed };
+}
+function normalizeMaxRedirects(value) {
+  if (value === undefined)
+    return DEFAULT_MAX_REDIRECTS;
+  if (!Number.isInteger(value) || value < 0)
+    throw new Error("webhookTargetPolicy.maxRedirects must be a non-negative integer");
+  return value;
+}
+function normalizeHostname(hostname) {
+  const lower = hostname.toLowerCase();
+  if (lower.startsWith("[") && lower.endsWith("]"))
+    return lower.slice(1, -1);
+  return lower;
+}
+function stripZoneId(address) {
+  const percent = address.indexOf("%");
+  return percent === -1 ? address : address.slice(0, percent);
+}
+function ipv4ToInt(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4)
+    return;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part))
+      return;
+    const octet = Number(part);
+    if (octet > 255)
+      return;
+    value = value << 8 | octet;
+  }
+  return value >>> 0;
+}
+function ipv4IntToString(integer) {
+  return [
+    integer >>> 24 & 255,
+    integer >>> 16 & 255,
+    integer >>> 8 & 255,
+    integer & 255
+  ].join(".");
+}
+function ipv6Groups(address) {
+  const raw = stripZoneId(address);
+  const doubleColon = raw.indexOf("::");
+  const headText = doubleColon === -1 ? raw : raw.slice(0, doubleColon);
+  const tailText = doubleColon === -1 ? "" : raw.slice(doubleColon + 2);
+  const parseGroups = (text) => {
+    if (text === "")
+      return [];
+    const out = [];
+    for (const part of text.split(":")) {
+      if (part.includes(".")) {
+        const v4 = ipv4ToInt(part);
+        if (v4 === undefined)
+          return;
+        out.push(v4 >>> 16 & 65535, v4 & 65535);
+      } else {
+        if (!/^[0-9a-fA-F]{1,4}$/.test(part))
+          return;
+        out.push(parseInt(part, 16));
+      }
+    }
+    return out;
+  };
+  const head = parseGroups(headText);
+  if (!head)
+    return;
+  const tail = parseGroups(tailText);
+  if (!tail)
+    return;
+  const total = head.length + tail.length;
+  if (doubleColon === -1) {
+    return total === 8 ? head : undefined;
+  }
+  if (total >= 8)
+    return;
+  return [...head, ...new Array(8 - total).fill(0), ...tail];
+}
+function ipv6MatchesPrefix(groups, prefixGroups, prefixBits) {
+  let remaining = prefixBits;
+  for (let index = 0;index < prefixGroups.length && remaining > 0; index += 1) {
+    const take = Math.min(16, remaining);
+    const mask = 65535 << 16 - take & 65535;
+    if ((groups[index] & mask) !== (prefixGroups[index] & mask))
+      return false;
+    remaining -= take;
+  }
+  return true;
+}
 function now() {
   return new Date().toISOString();
 }
@@ -23478,9 +23739,18 @@ function buildWebhookRequest(event, channel, options = {}) {
   }
   return { body, headers };
 }
+function normalizeWebhookUrl(raw) {
+  const url = new URL(raw);
+  if (url.username !== "" || url.password !== "") {
+    url.username = "";
+    url.password = "";
+  }
+  return url.toString();
+}
 async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
+  const webhookUrl = normalizeWebhookUrl(channel.webhook.url);
   const startedAt = now();
   let secret = channel.webhook.secret;
   if (channel.webhook.secretRef) {
@@ -23497,10 +23767,14 @@ async function dispatchWebhook(event, channel, options = {}) {
   }
   const timestamp = (options.now?.() ?? new Date).toISOString();
   const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp });
+  const validateTargets = options.webhookTargetPolicy !== undefined || options.fetchImpl === undefined;
+  if (validateTargets) {
+    return dispatchValidatedWebhook(event, channel, { body, headers, startedAt, options });
+  }
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
-    const response = await (options.fetchImpl ?? fetch)(channel.webhook.url, {
+    const response = await (options.fetchImpl ?? fetch)(webhookUrl, {
       method: "POST",
       headers,
       body,
@@ -23528,6 +23802,130 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
+function isRedirectStatus(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function redirectKeepsBody(status) {
+  return status === 307 || status === 308;
+}
+async function pinnedNativeRequest(target, addresses, method, headers, body, signal, tls) {
+  const isHttps = target.protocol === "https:";
+  if (!isHttps && target.protocol !== "http:") {
+    throw new Error(`Webhook target uses unsupported protocol ${target.protocol}`);
+  }
+  const defaultPort = isHttps ? 443 : 80;
+  const port = target.port ? Number(target.port) : defaultPort;
+  const requestOptions = {
+    hostname: target.hostname,
+    port,
+    path: `${target.pathname}${target.search}`,
+    method,
+    headers,
+    ...tls?.ca ? { ca: tls.ca } : {},
+    lookup: (hostname, _options, callback) => {
+      const entries = addresses.map((address) => ({
+        address,
+        family: address.includes(":") ? 6 : 4
+      }));
+      callback(null, entries);
+    }
+  };
+  return new Promise((resolve22, reject) => {
+    const request = isHttps ? nodeHttpsRequest(requestOptions, onResponse) : nodeHttpRequest(requestOptions, onResponse);
+    const onAbort = () => {
+      const error = new Error("The operation was aborted.");
+      error.name = "AbortError";
+      request.destroy(error);
+    };
+    if (signal.aborted)
+      onAbort();
+    else
+      signal.addEventListener("abort", onAbort, { once: true });
+    request.on("error", reject);
+    if (body !== undefined)
+      request.write(body);
+    request.end();
+    function onResponse(response) {
+      const chunks = [];
+      response.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+      response.on("error", reject);
+      response.on("end", () => {
+        const headersRecord = {};
+        for (const [name, value] of Object.entries(response.headers)) {
+          if (typeof value === "string")
+            headersRecord[name] = value;
+          else if (Array.isArray(value))
+            headersRecord[name] = value.join(", ");
+        }
+        resolve22(new Response(Buffer.concat(chunks), { status: response.statusCode ?? 200, headers: headersRecord }));
+      });
+    }
+  });
+}
+async function dispatchValidatedWebhook(event, channel, input) {
+  const { body, headers, startedAt, options } = input;
+  const webhook = channel.webhook;
+  if (!webhook)
+    throw new Error(`Channel ${channel.id} has no webhook config`);
+  const policy = options.webhookTargetPolicy ?? {};
+  const maxRedirects = normalizeMaxRedirects(policy.maxRedirects);
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), webhook.timeoutMs ?? 15000);
+  try {
+    let target = new URL(normalizeWebhookUrl(webhook.url));
+    let requestHeaders = headers;
+    let method = "POST";
+    let requestBody = body;
+    let redirectsFollowed = 0;
+    for (;; ) {
+      const resolved = await resolveWebhookTarget(target, policy).catch((error) => {
+        throw new Error(`Webhook target rejected by SSRF guard: ${error.message}`);
+      });
+      const response = options.fetchImpl ? await options.fetchImpl(target, {
+        method,
+        headers: requestHeaders,
+        body: requestBody,
+        signal: controller.signal,
+        redirect: "manual"
+      }) : await pinnedNativeRequest(target, resolved.addresses, method, requestHeaders, requestBody, controller.signal, options.tls);
+      const location = response.headers.get("location");
+      if (isRedirectStatus(response.status) && location) {
+        if (redirectsFollowed >= maxRedirects) {
+          return failedAttempt(startedAt, `Webhook target exceeded ${maxRedirects} redirects`);
+        }
+        redirectsFollowed += 1;
+        const next = new URL(location, target);
+        target = next;
+        if (!redirectKeepsBody(response.status)) {
+          method = "GET";
+          requestBody = undefined;
+          requestHeaders = Object.fromEntries(Object.entries(requestHeaders).filter(([name]) => name.toLowerCase() !== "content-type" && name.toLowerCase() !== "content-length"));
+        }
+        continue;
+      }
+      const responseBody = truncate(await response.text());
+      return {
+        attempt: 1,
+        status: response.ok ? "success" : "failed",
+        startedAt,
+        completedAt: now(),
+        responseStatus: response.status,
+        responseBody,
+        error: response.ok ? undefined : `Webhook returned HTTP ${response.status}`
+      };
+    }
+  } catch (error) {
+    return {
+      attempt: 1,
+      status: "failed",
+      startedAt,
+      completedAt: now(),
+      error: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 function failedAttempt(startedAt, error) {
   return {
     attempt: 1,
@@ -23556,7 +23954,7 @@ async function dispatchCommand(event, channel) {
     HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
     HASNA_EVENT_JSON: eventJson
   };
-  return new Promise((resolve3) => {
+  return new Promise((resolve22) => {
     const child = spawn(channel.command.command, channel.command.args ?? [], {
       cwd: channel.command.cwd,
       env,
@@ -23574,7 +23972,7 @@ async function dispatchCommand(event, channel) {
     });
     child.on("error", (error) => {
       clearTimeout(timeout);
-      resolve3({
+      resolve22({
         attempt: 1,
         status: "failed",
         startedAt,
@@ -23587,7 +23985,7 @@ async function dispatchCommand(event, channel) {
     child.on("close", (code, signal) => {
       clearTimeout(timeout);
       const success = code === 0;
-      resolve3({
+      resolve22({
         attempt: 1,
         status: success ? "success" : "failed",
         startedAt,
@@ -23723,7 +24121,9 @@ class EventsClient {
     this.transportOptions = {
       fetchImpl: options.fetchImpl,
       secretResolver: options.secretResolver,
-      now: options.now
+      now: options.now,
+      tls: options.tls,
+      webhookTargetPolicy: options.webhookTargetPolicy
     };
     this.catalog = options.catalog ?? defaultEventTypeCatalog;
     this.validateCatalogTypes = options.validateCatalogTypes ?? false;
@@ -23928,9 +24328,51 @@ function normalizeRetryPolicy(policy) {
     multiplier: Math.max(1, policy?.multiplier ?? 2)
   };
 }
-var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:", DEFAULT_EVENT_PAGE_LIMIT = 100, MAX_EVENT_PAGE_LIMIT = 1000, DEFAULT_SIGNATURE_TOLERANCE_MS, EventValidationError, defaultEventTypeCatalog, APP_EVENT_V1_MAX_DATA_BYTES;
+var PATHS_RESOLVER_KIND_ENV, PATHS_RESOLVER_APP_SLUG_RE2, HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", EVENTS_STORE_SENTINEL_FILE = "events.json", LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:", DEFAULT_EVENT_PAGE_LIMIT = 100, MAX_EVENT_PAGE_LIMIT = 1000, DEFAULT_SIGNATURE_TOLERANCE_MS, DEFAULT_MAX_REDIRECTS = 5, IPV4_PRIVATE_RANGES, IPV6_SPECIAL_PREFIXES, defaultTargetLookup = async (hostname) => {
+  return dnsLookup(hostname, { all: true, verbatim: false });
+}, EventValidationError, defaultEventTypeCatalog, APP_EVENT_V1_MAX_DATA_BYTES;
 var init_dist = __esm(() => {
+  PATHS_RESOLVER_KIND_ENV = {
+    config: "HASNA_CONFIG_HOME",
+    data: "HASNA_DATA_HOME",
+    state: "HASNA_STATE_HOME",
+    cache: "HASNA_CACHE_HOME"
+  };
+  PATHS_RESOLVER_APP_SLUG_RE2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
   DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
+  IPV4_PRIVATE_RANGES = [
+    [0, 16777215],
+    [167772160, 184549375],
+    [1681915904, 1686110207],
+    [2130706432, 2147483647],
+    [2851995648, 2852061183],
+    [2886729728, 2887778303],
+    [3221225472, 3221225727],
+    [3221225984, 3221226239],
+    [3227017984, 3227018239],
+    [3232235520, 3232301055],
+    [3323068416, 3323199487],
+    [3325256704, 3325256959],
+    [3405803776, 3405804031],
+    [3758096384, 4294967295]
+  ];
+  IPV6_SPECIAL_PREFIXES = [
+    { groups: [0, 0, 0, 0, 0, 0, 0, 0], bits: 128 },
+    { groups: [0, 0, 0, 0, 0, 0, 0, 1], bits: 128 },
+    { groups: [0, 0, 0, 0, 0, 65535, 0, 0], bits: 96 },
+    { groups: [100, 65435, 0, 0, 0, 0, 0, 0], bits: 96 },
+    { groups: [256, 0, 0, 0, 0, 0, 0, 0], bits: 64 },
+    { groups: [8193, 0, 0, 0, 0, 0, 0, 0], bits: 32 },
+    { groups: [8193, 2, 0, 0, 0, 0, 0, 0], bits: 48 },
+    { groups: [8193, 16, 0, 0, 0, 0, 0, 0], bits: 28 },
+    { groups: [8193, 3512, 0, 0, 0, 0, 0, 0], bits: 32 },
+    { groups: [8194, 0, 0, 0, 0, 0, 0, 0], bits: 16 },
+    { groups: [16383, 0, 0, 0, 0, 0, 0, 0], bits: 20 },
+    { groups: [64512, 0, 0, 0, 0, 0, 0, 0], bits: 7 },
+    { groups: [65152, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
+    { groups: [65216, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
+    { groups: [65280, 0, 0, 0, 0, 0, 0, 0], bits: 8 }
+  ];
   EventValidationError = class EventValidationError extends Error {
     eventType;
     issues;
@@ -24740,6 +25182,28 @@ function readSkillsInstanceMetadata(file) {
   return { apiUrl: urls[0], binding: values.get(SKILLS_BOUND_API_URL) };
 }
 
+// src/lib/local-opt-in.ts
+var SKILLS_LOCAL_OPT_IN_ENV_KEYS = ["HASNA_SKILLS_LOCAL", "SKILLS_LOCAL"];
+function isSkillsLocalOptIn(env = process.env) {
+  return SKILLS_LOCAL_OPT_IN_ENV_KEYS.some((key) => (env[key] ?? "").trim() !== "");
+}
+function skillsAuthorityEnvKeys() {
+  const keys = clientTransportEnvKeys("skills");
+  return [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey("skills"),
+    credentialPointerEnvKey("skills"),
+    CREDENTIAL_PROFILE_ENV_KEY
+  ];
+}
+function hasSkillsEnvAuthorityIntent(env = process.env) {
+  return skillsAuthorityEnvKeys().some((key) => (env[key] ?? "").trim() !== "");
+}
+function selectsSkillsLocalMode(env = process.env) {
+  return !hasSkillsEnvAuthorityIntent(env) && isSkillsLocalOptIn(env);
+}
+
 // src/lib/fleet-credentials.ts
 var SKILLS_APP = "skills";
 var ENV_KEYS = clientTransportEnvKeys(SKILLS_APP);
@@ -24759,6 +25223,9 @@ class SkillsFleetCredentialError extends Error {
 function isCredentialResolutionError(error) {
   return error instanceof CredentialResolutionError || typeof error === "object" && error !== null && error.name === "CredentialResolutionError";
 }
+function isSkillsFleetCredentialError(error) {
+  return error instanceof SkillsFleetCredentialError || typeof error === "object" && error !== null && error.name === "SkillsFleetCredentialError";
+}
 function asSkillsFleetCredentialError(error) {
   if (!isCredentialResolutionError(error))
     return null;
@@ -24825,7 +25292,7 @@ function noticeLocalSkillsMode(write = (line) => console.error(line)) {
   if (localNoticePrinted)
     return;
   localNoticePrinted = true;
-  write(`skills: local mode \u2014 no ${SKILLS_API_KEY_ENV} and no ${SKILLS_API_URL_ENV} resolved, ` + `so this runs on this machine against the bundled corpus. ` + `Sign in with: skills auth login`);
+  write(`skills: local mode (${SKILLS_LOCAL_OPT_IN_ENV_KEYS[0]}=1) \u2014 running on this machine against the bundled corpus.`);
 }
 function resolveSkillsFleet(env = process.env, options = {}) {
   try {
@@ -24862,13 +25329,16 @@ function snapshotSkillsOptions(env, options) {
   } } };
 }
 function resolveSkillsFleetOrThrow(env, options) {
+  if (selectsSkillsLocalMode(env))
+    return { mode: "local", apiOrigin: null, apiKey: null };
   const assertFilesUnchanged = captureSkillsCredentialFiles(skillsProfileCredentialFiles(env, options.credentials?.profile));
   const configured = configuredSkillsApiUrl(env, options.credentials?.keychain, options.credentials?.profile);
   const credential = resolveCredential(SKILLS_APP, env, options.credentials);
   if (!credential) {
-    if (!configured)
-      return { mode: "local", apiOrigin: null, apiKey: null };
-    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in hasna.credentials.skills.api-key, ${skillsCredentialFiles(env).join(" or ") || "no credentials file"}, and ${SKILLS_API_KEY_ENV}. Sign in with: skills auth login`);
+    if (!configured) {
+      throw new SkillsFleetCredentialError(`No API key resolved and no Skills API URL is configured \u2014 failing closed ` + `(local mode is opt-in only: set ${SKILLS_LOCAL_OPT_IN_ENV_KEYS[0]}=1 to run on this machine). ` + `Looked in ${credentialLocations(env)}. Sign in with: skills auth login`);
+    }
+    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in ${credentialLocations(env)}. Sign in with: skills auth login`);
   }
   const apiOrigin = normalizeSkillsApiOrigin(configured?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP));
   toV1BaseUrl(apiOrigin);
@@ -24890,6 +25360,10 @@ function resolveSkillsFleetOrThrow(env, options) {
   }
   return { ...base, apiKey: credential.apiKey, apiKeyPointer: null };
 }
+function credentialLocations(env) {
+  const files = skillsCredentialFiles(env).join(" or ") || "no credentials file (HOME is unset)";
+  return `hasna.credentials.${SKILLS_APP}.api-key (macOS Keychain, account HASNA_STATION or the host name), ${files}, and ${SKILLS_API_KEY_ENV}`;
+}
 function assertCredentialInstance(credential, apiOrigin, env, options) {
   let bound;
   if (credential.tier === "disk" || credential.tier === "profile") {
@@ -24943,7 +25417,7 @@ async function skillsCredentialOrReason(env = process.env, options = {}) {
     const connection = await resolveSkillsConnection(env, options);
     return connection ? { apiKey: connection.apiKey, apiOrigin: connection.apiOrigin, reason: null } : { apiKey: null, apiOrigin: null, reason: null };
   } catch (error) {
-    if (error instanceof SkillsFleetCredentialError || error?.name === "SkillsFleetCredentialError") {
+    if (isSkillsFleetCredentialError(error)) {
       return { apiKey: null, apiOrigin: null, reason: error.message };
     }
     throw error;
@@ -24955,7 +25429,14 @@ function resolveSkillsApiOrigin(env = process.env, options = {}) {
     toV1BaseUrl(configured.value);
     return { origin: normalizeSkillsApiOrigin(configured.value), source: configured.source };
   }
-  const fleet = resolveSkillsFleet(env, options);
+  let fleet;
+  try {
+    fleet = resolveSkillsFleet(env, options);
+  } catch (error) {
+    if (isSkillsFleetCredentialError(error))
+      return null;
+    throw error;
+  }
   return fleet.mode === "hosted" ? { origin: fleet.apiOrigin, source: fleet.apiUrlSource } : null;
 }
 function requireSkillsApiOrigin(action = "This command", env = process.env, options = {}) {
@@ -24981,7 +25462,7 @@ class MissingSkillsFleetError extends Error {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.4.0",
+  version: "0.5.1",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -25013,6 +25494,7 @@ var package_default = {
   files: [
     "dist/",
     "!dist/**/*.test.d.ts",
+    "!dist/**/*.fixture.d.ts",
     "!dist/test-preload.d.ts",
     "!dist/platform",
     "bin/",
@@ -25038,8 +25520,9 @@ var package_default = {
     migrate: "bun run ./src/server/migrate.ts",
     typecheck: "tsc --noEmit",
     "verify:release": "bun run scripts/release-guard.ts",
+    "verify:consumer-types": "bun run scripts/consumer-types.ts",
     prepare: "bun run build:js",
-    prepack: "bun run build && bun run verify:release",
+    prepack: "bun run build && bun run verify:release && bun run verify:consumer-types",
     prepublishOnly: "bun run typecheck && bun run test"
   },
   keywords: [
@@ -25061,6 +25544,7 @@ var package_default = {
   author: "Hasna",
   license: "Apache-2.0",
   devDependencies: {
+    "@hasna/contracts": "1.0.2",
     "@types/bun": "1.3.14",
     "@types/node": "25.2.3",
     "@types/react": "^18.2.0",
@@ -25072,8 +25556,7 @@ var package_default = {
   dependencies: {
     "@aws-sdk/client-ecs": "^3.1079.0",
     "@aws-sdk/client-s3": "^3.1079.0",
-    "@hasna/contracts": "1.0.1",
-    "@hasna/events": "0.1.16",
+    "@hasna/events": "0.1.18",
     "@modelcontextprotocol/sdk": "^1.26.0",
     chalk: "^5.3.0",
     commander: "^12.1.0",
@@ -25889,8 +26372,8 @@ var $NODE_RESPONSE_CHECKSUM_VALIDATION_CONFIG_OPTIONS = NODE_RESPONSE_CHECKSUM_V
 var $getFlexibleChecksumsPlugin = getFlexibleChecksumsPlugin;
 var $resolveFlexibleChecksumsConfig = resolveFlexibleChecksumsConfig;
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
-var import_client25 = __toESM(require_client2(), 1);
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
+var import_client26 = __toESM(require_client2(), 1);
 
 // ../../node_modules/.bun/@aws-sdk+middleware-sdk-s3@3.972.75/node_modules/@aws-sdk/middleware-sdk-s3/dist-cjs/submodules/s3/index.js
 var { NoOpLogger, getSmithyContext } = require_client();
@@ -26497,9 +26980,9 @@ var $getThrow200ExceptionsPlugin = getThrow200ExceptionsPlugin;
 var $getValidateBucketNamePlugin = getValidateBucketNamePlugin;
 var $resolveS3Config = resolveS3Config;
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
 var import_core = __toESM(require_dist_cjs2(), 1);
-var import_client26 = __toESM(require_client(), 1);
+var import_client27 = __toESM(require_client(), 1);
 var import_config29 = __toESM(require_config(), 1);
 var import_endpoints5 = __toESM(require_endpoints(), 1);
 var import_event_streams2 = __toESM(require_event_streams(), 1);
@@ -26507,17 +26990,17 @@ var import_protocols6 = __toESM(require_protocols(), 1);
 var import_retry4 = __toESM(require_retry(), 1);
 var import_schema2 = __toESM(require_schema(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
 var import_httpAuthSchemes = __toESM(require_httpAuthSchemes(), 1);
 var import_signature_v4_multi_region = __toESM(require_dist_cjs4(), 1);
-var import_client4 = __toESM(require_client(), 1);
+var import_client5 = __toESM(require_client(), 1);
 var import_endpoints3 = __toESM(require_endpoints(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/endpointResolver.js
-var import_client3 = __toESM(require_client2(), 1);
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/endpointResolver.js
+var import_client4 = __toESM(require_client2(), 1);
 var import_endpoints2 = __toESM(require_endpoints(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/bdd.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/bdd.js
 var import_endpoints = __toESM(require_endpoints(), 1);
 var aw = "ref";
 var ax = "argv";
@@ -28461,7 +28944,7 @@ var nodes = new Int32Array([
 ]);
 var bdd = import_endpoints.BinaryDecisionDiagram.from(nodes, root, _data.conditions, _data.results);
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/endpointResolver.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/endpointResolver.js
 var cache = new import_endpoints2.EndpointCache({
   size: 50,
   params: [
@@ -28487,15 +28970,15 @@ var defaultEndpointResolver = (endpointParams, context = {}) => {
     logger: context.logger
   }));
 };
-import_endpoints2.customEndpointFunctions.aws = import_client3.awsEndpointFunctions;
+import_endpoints2.customEndpointFunctions.aws = import_client4.awsEndpointFunctions;
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
 var createEndpointRuleSetHttpAuthSchemeParametersProvider = (defaultHttpAuthSchemeParametersProvider) => async (config, context, input) => {
   if (!input) {
     throw new Error("Could not find `input` for `defaultEndpointRuleSetHttpAuthSchemeParametersProvider`");
   }
   const defaultParameters = await defaultHttpAuthSchemeParametersProvider(config, context, input);
-  const instructionsFn = import_client4.getSmithyContext(context)?.commandInstance?.constructor?.getEndpointParameterInstructions;
+  const instructionsFn = import_client5.getSmithyContext(context)?.commandInstance?.constructor?.getEndpointParameterInstructions;
   if (!instructionsFn) {
     throw new Error(`getEndpointParameterInstructions() is not defined on '${context.commandName}'`);
   }
@@ -28504,8 +28987,8 @@ var createEndpointRuleSetHttpAuthSchemeParametersProvider = (defaultHttpAuthSche
 };
 var _defaultS3HttpAuthSchemeParametersProvider = async (config, context, input) => {
   return {
-    operation: import_client4.getSmithyContext(context).operation,
-    region: await import_client4.normalizeProvider(config.region)() || (() => {
+    operation: import_client5.getSmithyContext(context).operation,
+    region: await import_client5.normalizeProvider(config.region)() || (() => {
       throw new Error("expected `region` to be configured for `aws.auth#sigv4`");
     })()
   };
@@ -28601,15 +29084,15 @@ var resolveHttpAuthSchemeConfig = (config) => {
   const config_0 = import_httpAuthSchemes.resolveAwsSdkSigV4Config(config);
   const config_1 = import_httpAuthSchemes.resolveAwsSdkSigV4AConfig(config_0);
   return Object.assign(config_1, {
-    authSchemePreference: import_client4.normalizeProvider(config.authSchemePreference ?? [])
+    authSchemePreference: import_client5.normalizeProvider(config.authSchemePreference ?? [])
   });
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
-var import_client5 = __toESM(require_client(), 1);
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
+var import_client6 = __toESM(require_client(), 1);
 var import_endpoints4 = __toESM(require_endpoints(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/EndpointParameters.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/EndpointParameters.js
 var resolveClientEndpointParameters = (options) => {
   return Object.assign(options, {
     useFipsEndpoint: options.useFipsEndpoint ?? false,
@@ -28635,8 +29118,8 @@ var commonParams = {
   UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
-var command = import_client5.makeBuilder(commonParams, "AmazonS3", "S3Client", import_endpoints4.getEndpointPlugin);
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
+var command = import_client6.makeBuilder(commonParams, "AmazonS3", "S3Client", import_endpoints4.getEndpointPlugin);
 var _ep0 = {
   Bucket: { type: "contextParams", name: "Bucket" },
   Key: { type: "contextParams", name: "Key" }
@@ -28667,19 +29150,19 @@ var _mw11 = (Command, cs, config, o2) => [
   $getSsecPlugin(config)
 ];
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/schemas/schemas_0.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/schemas/schemas_0.js
 var import_schema = __toESM(require_schema(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/models/S3ServiceException.js
-var import_client6 = __toESM(require_client(), 1);
-class S3ServiceException extends import_client6.ServiceException {
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/models/S3ServiceException.js
+var import_client7 = __toESM(require_client(), 1);
+class S3ServiceException extends import_client7.ServiceException {
   constructor(options) {
     super(options);
     Object.setPrototypeOf(this, S3ServiceException.prototype);
   }
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/models/errors.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/models/errors.js
 class NoSuchUpload extends S3ServiceException {
   name = "NoSuchUpload";
   $fault = "client";
@@ -28957,7 +29440,7 @@ class ObjectAlreadyInActiveTierError extends S3ServiceException {
   }
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/schemas/schemas_0.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/schemas/schemas_0.js
 var _A = "Account";
 var _AAO = "AnalyticsAndOperator";
 var _AC = "AccelerateConfiguration";
@@ -34409,13 +34892,13 @@ var WriteGetObjectResponse$ = [
   () => __Unit
 ];
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/commands/CreateSessionCommand.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/CreateSessionCommand.js
 class CreateSessionCommand extends command(_ep4, _mw0, "CreateSession", CreateSession$) {
 }
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/package.json
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/package.json
 var package_default2 = {
   name: "@aws-sdk/client-s3",
-  version: "3.1126.0",
+  version: "3.1127.0",
   description: "AWS SDK for JavaScript S3 Client for Node.js, Browser and React Native",
   homepage: "https://github.com/aws/aws-sdk-js-v3/tree/main/clients/client-s3",
   license: "Apache-2.0",
@@ -34482,7 +34965,7 @@ var package_default2 = {
     tslib: "^2.6.2"
   },
   devDependencies: {
-    "@aws-sdk/signature-v4-crt": "3.1126.0",
+    "@aws-sdk/signature-v4-crt": "3.1127.0",
     "@smithy/snapshot-testing": "^2.3.2",
     "@tsconfig/node20": "20.1.8",
     "@types/node": "^20.14.8",
@@ -34497,8 +34980,8 @@ var package_default2 = {
   }
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
-var import_client21 = __toESM(require_client2(), 1);
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
+var import_client22 = __toESM(require_client2(), 1);
 var import_httpAuthSchemes3 = __toESM(require_httpAuthSchemes(), 1);
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-node@3.972.82/node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.js
@@ -34654,9 +35137,9 @@ var defaultProvider = (init = {}) => memoizeChain([
   }
 ], credentialsTreatedAsExpired);
 var credentialsTreatedAsExpired = (credentials) => credentials?.expiration !== undefined && credentials.expiration.getTime() - Date.now() < 300000;
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var import_checksum2 = __toESM(require_checksum(), 1);
-var import_client22 = __toESM(require_client(), 1);
+var import_client23 = __toESM(require_client(), 1);
 var import_config28 = __toESM(require_config(), 1);
 var import_event_streams = __toESM(require_event_streams(), 1);
 var import_retry3 = __toESM(require_retry(), 1);
@@ -34892,11 +35375,11 @@ var subtle = typeof digest === "function" && typeof sign2 === "function" && type
 var MAX_PENDING_BYTES = 8 * 1024 * 1024;
 var $Sha1 = Sha1Node;
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.shared.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.shared.js
 var import_httpAuthSchemes2 = __toESM(require_httpAuthSchemes(), 1);
 var import_signature_v4_multi_region2 = __toESM(require_dist_cjs4(), 1);
 var import_checksum = __toESM(require_checksum(), 1);
-var import_client20 = __toESM(require_client(), 1);
+var import_client21 = __toESM(require_client(), 1);
 var import_protocols4 = __toESM(require_protocols(), 1);
 var import_serde3 = __toESM(require_serde(), 1);
 var getRuntimeConfig2 = (config) => {
@@ -34921,7 +35404,7 @@ var getRuntimeConfig2 = (config) => {
         signer: new import_httpAuthSchemes2.AwsSdkSigV4ASigner
       }
     ],
-    logger: config?.logger ?? new import_client20.NoOpLogger,
+    logger: config?.logger ?? new import_client21.NoOpLogger,
     md5: config?.md5 ?? import_checksum.Md5,
     protocol: config?.protocol ?? $S3RestXmlProtocol,
     protocolSettings: config?.protocolSettings ?? {
@@ -34944,13 +35427,13 @@ var getRuntimeConfig2 = (config) => {
   };
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var getRuntimeConfig3 = (config) => {
-  import_client22.emitWarningIfUnsupportedVersion(process.version);
+  import_client23.emitWarningIfUnsupportedVersion(process.version);
   const defaultsMode = import_config28.resolveDefaultsModeConfig(config);
-  const defaultConfigProvider = () => defaultsMode().then(import_client22.loadConfigsForDefaultMode);
+  const defaultConfigProvider = () => defaultsMode().then(import_client23.loadConfigsForDefaultMode);
   const clientSharedValues = getRuntimeConfig2(config);
-  import_client21.emitWarningIfUnsupportedVersion(process.version);
+  import_client22.emitWarningIfUnsupportedVersion(process.version);
   const loaderConfig = {
     profile: config?.profile,
     logger: clientSharedValues.logger
@@ -34963,7 +35446,7 @@ var getRuntimeConfig3 = (config) => {
     authSchemePreference: config?.authSchemePreference ?? import_config28.loadConfig(import_httpAuthSchemes3.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde4.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
-    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client21.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default2.version }),
+    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client22.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default2.version }),
     disableS3ExpressSessionAuth: config?.disableS3ExpressSessionAuth ?? import_config28.loadConfig($NODE_DISABLE_S3_EXPRESS_SESSION_AUTH_OPTIONS, loaderConfig),
     eventStreamSerdeProvider: config?.eventStreamSerdeProvider ?? import_event_streams.eventStreamSerdeProvider,
     maxAttempts: config?.maxAttempts ?? import_config28.loadConfig(import_retry3.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
@@ -34981,16 +35464,16 @@ var getRuntimeConfig3 = (config) => {
     useArnRegion: config?.useArnRegion ?? import_config28.loadConfig($NODE_USE_ARN_REGION_CONFIG_OPTIONS, loaderConfig),
     useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config28.loadConfig(import_config28.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
     useFipsEndpoint: config?.useFipsEndpoint ?? import_config28.loadConfig(import_config28.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    userAgentAppId: config?.userAgentAppId ?? import_config28.loadConfig(import_client21.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    userAgentAppId: config?.userAgentAppId ?? import_config28.loadConfig(import_client22.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
   };
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
-var import_client23 = __toESM(require_client2(), 1);
-var import_client24 = __toESM(require_client(), 1);
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
+var import_client24 = __toESM(require_client2(), 1);
+var import_client25 = __toESM(require_client(), 1);
 var import_protocols5 = __toESM(require_protocols(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthExtensionConfiguration.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthExtensionConfiguration.js
 var getHttpAuthExtensionConfiguration2 = (runtimeConfig) => {
   const _httpAuthSchemes = runtimeConfig.httpAuthSchemes;
   let _httpAuthSchemeProvider = runtimeConfig.httpAuthSchemeProvider;
@@ -35029,26 +35512,26 @@ var resolveHttpAuthRuntimeConfig2 = (config) => {
   };
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
 var resolveRuntimeExtensions2 = (runtimeConfig, extensions) => {
-  const extensionConfiguration = Object.assign(import_client23.getAwsRegionExtensionConfiguration(runtimeConfig), import_client24.getDefaultExtensionConfiguration(runtimeConfig), import_protocols5.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration2(runtimeConfig));
+  const extensionConfiguration = Object.assign(import_client24.getAwsRegionExtensionConfiguration(runtimeConfig), import_client25.getDefaultExtensionConfiguration(runtimeConfig), import_protocols5.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration2(runtimeConfig));
   extensions.forEach((extension) => extension.configure(extensionConfiguration));
-  return Object.assign(runtimeConfig, import_client23.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client24.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols5.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig2(extensionConfiguration));
+  return Object.assign(runtimeConfig, import_client24.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client25.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols5.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig2(extensionConfiguration));
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
-class S3Client extends import_client26.Client {
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
+class S3Client extends import_client27.Client {
   config;
   constructor(...[configuration]) {
     const _config_0 = getRuntimeConfig3(configuration || {});
     super(_config_0);
     this.initConfig = _config_0;
     const _config_1 = resolveClientEndpointParameters(_config_0);
-    const _config_2 = import_client25.resolveUserAgentConfig(_config_1);
+    const _config_2 = import_client26.resolveUserAgentConfig(_config_1);
     const _config_3 = $resolveFlexibleChecksumsConfig(_config_2);
     const _config_4 = import_retry4.resolveRetryConfig(_config_3);
     const _config_5 = import_config29.resolveRegionConfig(_config_4);
-    const _config_6 = import_client25.resolveHostHeaderConfig(_config_5);
+    const _config_6 = import_client26.resolveHostHeaderConfig(_config_5);
     const _config_7 = import_endpoints5.resolveEndpointConfig(_config_6);
     const _config_8 = import_event_streams2.resolveEventStreamSerdeConfig(_config_7);
     const _config_9 = resolveHttpAuthSchemeConfig(_config_8);
@@ -35056,12 +35539,12 @@ class S3Client extends import_client26.Client {
     const _config_11 = resolveRuntimeExtensions2(_config_10, configuration?.extensions || []);
     this.config = _config_11;
     this.middlewareStack.use(import_schema2.getSchemaSerdePlugin(this.config));
-    this.middlewareStack.use(import_client25.getUserAgentPlugin(this.config));
+    this.middlewareStack.use(import_client26.getUserAgentPlugin(this.config));
     this.middlewareStack.use(import_retry4.getRetryPlugin(this.config));
     this.middlewareStack.use(import_protocols6.getContentLengthPlugin(this.config));
-    this.middlewareStack.use(import_client25.getHostHeaderPlugin(this.config));
-    this.middlewareStack.use(import_client25.getLoggerPlugin(this.config));
-    this.middlewareStack.use(import_client25.getRecursionDetectionPlugin(this.config));
+    this.middlewareStack.use(import_client26.getHostHeaderPlugin(this.config));
+    this.middlewareStack.use(import_client26.getLoggerPlugin(this.config));
+    this.middlewareStack.use(import_client26.getRecursionDetectionPlugin(this.config));
     this.middlewareStack.use(import_core.getHttpAuthSchemeEndpointRuleSetPlugin(this.config, {
       httpAuthSchemeParametersProvider: defaultS3HttpAuthSchemeParametersProvider,
       identityProviderConfigProvider: async (config) => new import_core.DefaultIdentityProviderConfig({
@@ -35081,15 +35564,15 @@ class S3Client extends import_client26.Client {
   }
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/commands/DeleteObjectCommand.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/DeleteObjectCommand.js
 class DeleteObjectCommand extends command(_ep0, _mw0, "DeleteObject", DeleteObject$) {
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/commands/GetObjectCommand.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/GetObjectCommand.js
 class GetObjectCommand extends command(_ep0, _mw7, "GetObject", GetObject$) {
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/commands/PutObjectCommand.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/PutObjectCommand.js
 class PutObjectCommand extends command(_ep0, _mw11, "PutObject", PutObject$) {
 }
 
@@ -35495,12 +35978,7 @@ import { homedir as homedir2 } from "os";
 import { join as join4, resolve } from "path";
 import { homedir as pathsResolverHomedir } from "os";
 import { join as pathsResolverJoin } from "path";
-var PATHS_RESOLVER_KIND_ENV = {
-  config: "HASNA_CONFIG_HOME",
-  data: "HASNA_DATA_HOME",
-  state: "HASNA_STATE_HOME",
-  cache: "HASNA_CACHE_HOME"
-};
+var PATHS_RESOLVER_DATA_ENV = "HASNA_DATA_HOME";
 var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 function pathsResolverAssertApp(app) {
   if (typeof app !== "string" || app.length === 0) {
@@ -35510,48 +35988,19 @@ function pathsResolverAssertApp(app) {
     throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
   }
 }
-function pathsResolverAssertKind(kind) {
-  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
-    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
-  }
-}
-function pathsResolverBaseDir(kind, options) {
-  pathsResolverAssertKind(kind);
+function pathsResolverDataBaseDir(options) {
   const env = options.env ?? process.env;
-  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  const override = env[PATHS_RESOLVER_DATA_ENV];
   if (typeof override === "string" && override.length > 0)
     return override;
   const home = options.home ?? pathsResolverHomedir();
   const platform = options.platform ?? process.platform;
-  if (platform === "darwin") {
-    switch (kind) {
-      case "config":
-      case "data":
-        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
-      case "cache":
-        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
-      case "state":
-        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
-    }
-  }
-  switch (kind) {
-    case "config":
-      return pathsResolverJoin(home, ".config", "hasna");
-    case "data":
-      return pathsResolverJoin(home, ".local", "share", "hasna");
-    case "state":
-      return pathsResolverJoin(home, ".local", "state", "hasna");
-    case "cache":
-      return pathsResolverJoin(home, ".cache", "hasna");
-  }
+  return platform === "darwin" ? pathsResolverJoin(home, "Library", "Application Support", "Hasna") : pathsResolverJoin(home, ".local", "share", "hasna");
 }
-function pathsResolverResolve(kind, options) {
+function dataDir(options) {
   pathsResolverAssertApp(options.app);
   const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
-  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
-}
-function dataDir(options) {
-  return pathsResolverResolve("data", options);
+  return pathsResolverJoin(pathsResolverDataBaseDir(options), appSegment);
 }
 var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
 var HASNA_SKILLS_HOME_ENV = "HASNA_SKILLS_HOME";
@@ -36882,13 +37331,12 @@ class SqliteGovernanceStore {
     return rows.map((row) => this.reservationFrom(row));
   }
   async reconcileReservation(reservationId2, actualCents, status) {
-    const row = this.db.query("SELECT * FROM skills_credit_reservations WHERE id = ? LIMIT 1").get(reservationId2);
-    if (!row || String(row.status) !== "reserved")
-      return row ? this.reservationFrom(row) : null;
-    const reconciledAt = nowIso();
-    this.db.run("UPDATE skills_credit_reservations SET actual_cents = ?, status = ?, reconciled_at = ? WHERE id = ?", [actualCents, status, reconciledAt, reservationId2]);
-    const updated = this.db.query("SELECT * FROM skills_credit_reservations WHERE id = ? LIMIT 1").get(reservationId2);
-    return this.reservationFrom(updated);
+    const updated = this.db.query(`UPDATE skills_credit_reservations SET actual_cents = ?, status = ?, reconciled_at = ?
+       WHERE id = ? AND status = 'reserved' RETURNING *`).get(actualCents, status, nowIso(), reservationId2);
+    if (updated)
+      return this.reservationFrom(updated);
+    const existing = this.db.query("SELECT * FROM skills_credit_reservations WHERE id = ? LIMIT 1").get(reservationId2);
+    return existing ? this.reservationFrom(existing) : null;
   }
   async monthlySpendCents(orgId, monthPrefix) {
     const from = `${monthPrefix}-01T00:00:00.000Z`;
@@ -37076,6 +37524,7 @@ import { fileURLToPath as fileURLToPath2 } from "url";
 import {
   cpSync as cpSync3,
   existsSync as existsSync9,
+  lstatSync as lstatSync4,
   mkdirSync as mkdirSync6,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync10,
@@ -38549,14 +38998,27 @@ function normalizePortableSkillName(name) {
   }
   return normalized;
 }
+function normalizeNewPortableSkillName(name) {
+  normalizePortableSkillName(name);
+  const normalized = name.trim().replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (!normalized)
+    throw new Error(`Invalid skill name '${name}'. Include letters or numbers.`);
+  return normalized;
+}
 function readPortableSkillManifest(skillPath, fallbackName = basename(skillPath)) {
+  return readManifest(skillPath, fallbackName, normalizePortableSkillName);
+}
+function readPortableSkillManifestForImport(skillPath) {
+  return readManifest(skillPath, basename(skillPath), normalizeNewPortableSkillName);
+}
+function readManifest(skillPath, fallbackName, normalizeName) {
   const skillJsonPath = join12(skillPath, "skill.json");
   const skillMdPath = join12(skillPath, "SKILL.md");
   const pkgPath = join12(skillPath, "package.json");
   const jsonManifest = existsSync7(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
   const frontmatter = existsSync7(skillMdPath) ? parseSkillFrontmatter(readFileSync9(skillMdPath, "utf-8")) ?? undefined : undefined;
   const pkg = existsSync7(pkgPath) ? readJsonObject(pkgPath) : undefined;
-  const name = normalizePortableSkillName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
+  const name = normalizeName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
   const description = stringField(jsonManifest, "description") ?? frontmatter?.description ?? stringValue(pkg?.description) ?? `${name} skill`;
   const version2 = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
   const kind = parseSkillKind(stringField(jsonManifest, "kind") ?? frontmatter?.kind);
@@ -38804,10 +39266,45 @@ function ensureInstructionSkillFiles(skillPath, manifest) {
   };
   if (!existsSync7(join12(skillPath, "SKILL.md"))) {
     writeFileSync2(join12(skillPath, "SKILL.md"), renderSkillMd(next));
+  } else {
+    const path = join12(skillPath, "SKILL.md");
+    const content = readFileSync9(path, "utf8");
+    const declaredName = parseSkillFrontmatter(content)?.name;
+    if (declaredName && declaredName !== next.name) {
+      writeFileSync2(path, renameInstructionFrontmatter(content, next.name));
+    }
+  }
+  const packagePath = join12(skillPath, "package.json");
+  if (existsSync7(packagePath)) {
+    const pkg = readJsonObject(packagePath);
+    if (typeof pkg.name === "string" && pkg.name !== next.name) {
+      writeFileSync2(packagePath, `${JSON.stringify({ ...pkg, name: next.name }, null, 2)}
+`);
+    }
   }
   writeSkillJsonWithHash(skillPath, next);
   return readPortableSkillManifest(skillPath, next.name);
 }
+function renameInstructionFrontmatter(content, name) {
+  const frontmatter = content.match(/^---\r?\n([\s\S]*?)\r?\n---(?=\r?\n|$)/);
+  const names = frontmatter?.[1]?.match(/^[ \t]*name[ \t]*:[^\r\n]*/gm) ?? [];
+  const declaration = names.length === 1 ? names[0].match(/^(name[ \t]*:[ \t]*)(.*?)([ \t]*)$/) : null;
+  const scalar = declaration?.[2] ?? "";
+  let simple = /^[a-zA-Z0-9_.@/ -]+$/.test(scalar);
+  if (scalar.startsWith('"')) {
+    try {
+      simple = typeof JSON.parse(scalar) === "string";
+    } catch {
+      simple = false;
+    }
+  } else if (scalar.startsWith("'"))
+    simple = /^'[^'\r\n]*'$/.test(scalar);
+  if (!frontmatter || !declaration || !simple) {
+    throw new Error("Cannot rename instruction SKILL.md: use one unambiguous top-level name scalar in frontmatter.");
+  }
+  const renamed = frontmatter[0].replace(/^name[ \t]*:[^\r\n]*/m, () => `${declaration[1]}${name}${declaration[3]}`);
+  return renamed + content.slice(frontmatter[0].length);
+}
 function copySkillDirectory(source, destination) {
   const resolvedSource = lstatSync3(source).isSymbolicLink() ? realpathSync(source) : source;
   mkdirSync4(destination, { recursive: true });
@@ -39215,7 +39712,7 @@ function isOfficialSkillName(name) {
   return OFFICIAL_SKILL_NAMES.has(name);
 }
 function scaffoldPortableSkill(name, options = {}) {
-  const skillName = normalizePortableSkillName(name);
+  const skillName = normalizeNewPortableSkillName(name);
   const root3 = getPortableSkillsRoot(options);
   const skillPath = join13(root3, skillName);
   if (existsSync8(skillPath)) {
@@ -39285,9 +39782,9 @@ function portPortableSkill(sourcePath, options = {}) {
   if (!existsSync8(absoluteSource) || !statSync7(absoluteSource).isDirectory()) {
     throw new Error(`Skill source directory not found: ${sourcePath}`);
   }
-  const inferred = readPortableSkillManifest(absoluteSource, basename2(absoluteSource));
+  const inferred = readPortableSkillManifestForImport(absoluteSource);
   const explicitName = options.name != null;
-  const skillName = normalizePortableSkillName(options.name ?? inferred.name);
+  const skillName = normalizeNewPortableSkillName(options.name ?? inferred.name);
   if (isOfficialSkillName(skillName) && !options.allowShadow) {
     const sourceSlug = safeNormalizeName(basename2(absoluteSource));
     const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename2(absoluteSource)}')` : ""} matches a bundled official skill.`;
@@ -39561,6 +40058,20 @@ var SYNC_AGENTS = ["claude", "codewith", "codex", "opencode", "cursor"];
 var SKILLS_SOURCE_ENV = "SKILLS_SOURCE";
 var SYNC_MARKER_FILE = ".hasna-skills.json";
 var SYNC_MARKER_MANAGED_BY = "@hasna/skills";
+function isSkillsOwnershipMarker(marker) {
+  return typeof marker === "object" && marker !== null && Object.hasOwn(marker, "managedBy") && marker.managedBy === SYNC_MARKER_MANAGED_BY;
+}
+function hasSkillsOwnershipMarker(dir) {
+  const path = join14(dir, SYNC_MARKER_FILE);
+  try {
+    if (!lstatSync4(path).isFile())
+      return false;
+    const marker = JSON.parse(readFileSync10(path, "utf8"));
+    return isSkillsOwnershipMarker(marker);
+  } catch {
+    return false;
+  }
+}
 function isSyncAgent(value) {
   return SYNC_AGENTS.includes(value);
 }
@@ -39744,7 +40255,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
   const skillMdPath = join14(dir, "SKILL.md");
   const markerPath = join14(dir, SYNC_MARKER_FILE);
   const dirExists = existsSync9(dir);
-  const managed = existsSync9(markerPath);
+  const managed = hasSkillsOwnershipMarker(dir);
   const hasSkillMd = existsSync9(skillMdPath);
   if (dirExists && !managed && !hasSkillMd) {
     return {
@@ -39757,7 +40268,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
     return {
       action: "skip",
       path: skillMdPath,
-      reason: "an unmanaged SKILL.md already exists here (hand-authored); pass --force to overwrite"
+      reason: existsSync9(markerPath) ? "an unmanaged SKILL.md already exists here (invalid or foreign ownership marker); pass --force to overwrite" : "an unmanaged SKILL.md already exists here (hand-authored); pass --force to overwrite"
     };
   }
   if (dirExists && managed && hasSkillMd && !options.force && isPointerSkillMd(skillMd)) {
@@ -39834,7 +40345,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
 }
 function removeManagedAgentSkill(skill, agent, homeDir2 = homedir3()) {
   const dir = join14(agentGlobalSkillsDir(agent, homeDir2), skill);
-  if (!existsSync9(join14(dir, SYNC_MARKER_FILE)))
+  if (!hasSkillsOwnershipMarker(dir))
     return false;
   rmSync2(dir, { recursive: true, force: true });
   return true;
@@ -40555,7 +41066,7 @@ function removeSkillForAgent(name, options) {
   const canonicalName = getCanonicalSkillName(name);
   const scope = options.scope ?? "global";
   const dir = getAgentSkillPath(canonicalName, options.agent, scope, options.projectDir);
-  if (!existsSync12(join17(dir, SYNC_MARKER_FILE)))
+  if (!hasSkillsOwnershipMarker(dir))
     return false;
   rmSync3(dir, { recursive: true, force: true });
   return true;
@@ -40799,7 +41310,7 @@ async function runSkill(name, args, options = {}) {
   }
   const proc = Bun.spawn(["bun", "run", entryPath, ...args], {
     cwd: skillPath,
-    stdout: options.stdio === "pipe" ? "pipe" : "inherit",
+    stdout: options.stdio === "pipe" ? "pipe" : options.stdio === "stderr" ? 2 : "inherit",
     stderr: options.stdio === "pipe" ? "pipe" : "inherit",
     stdin: "inherit",
     env: { ...process.env, ...options.env }
@@ -41169,7 +41680,7 @@ async function getMergedSkill(store, artifactStorage, principal, slug) {
   if (resolved.kind === "published")
     return publishedPayload(resolved.record);
   const bundled = getServerSkill(slug);
-  return bundled ? bundled : null;
+  return bundled ? { ...bundled, publicationState: "catalogue-only", revisionId: null } : null;
 }
 async function getMergedSkillMd(store, artifactStorage, principal, slug) {
   const resolved = await resolvePublishedSkill(store, artifactStorage, principal, slug);
@@ -47133,7 +47644,7 @@ function sortKeys(value) {
     return value.map(sortKeys);
   if (value !== null && typeof value === "object") {
     const record = value;
-    const sorted = {};
+    const sorted = Object.create(null);
     for (const key of Object.keys(record).sort()) {
       sorted[key] = sortKeys(record[key]);
     }
@@ -47886,23 +48397,23 @@ function createReceiptService(store) {
 // src/sdk/execution/dispatchers/ecs.ts
 import { createHash as createHash11 } from "crypto";
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
-var import_client35 = __toESM(require_client2(), 1);
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
+var import_client36 = __toESM(require_client2(), 1);
 var import_core2 = __toESM(require_dist_cjs2(), 1);
-var import_client36 = __toESM(require_client(), 1);
+var import_client37 = __toESM(require_client(), 1);
 var import_config39 = __toESM(require_config(), 1);
 var import_endpoints8 = __toESM(require_endpoints(), 1);
 var import_protocols10 = __toESM(require_protocols(), 1);
 var import_retry6 = __toESM(require_retry(), 1);
 var import_schema4 = __toESM(require_schema(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/auth/httpAuthSchemeProvider.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/auth/httpAuthSchemeProvider.js
 var import_httpAuthSchemes4 = __toESM(require_httpAuthSchemes(), 1);
-var import_client27 = __toESM(require_client(), 1);
+var import_client28 = __toESM(require_client(), 1);
 var defaultECSHttpAuthSchemeParametersProvider = async (config, context, input) => {
   return {
-    operation: import_client27.getSmithyContext(context).operation,
-    region: await import_client27.normalizeProvider(config.region)() || (() => {
+    operation: import_client28.getSmithyContext(context).operation,
+    region: await import_client28.normalizeProvider(config.region)() || (() => {
       throw new Error("expected `region` to be configured for `aws.auth#sigv4`");
     })()
   };
@@ -47934,11 +48445,11 @@ var defaultECSHttpAuthSchemeProvider = (authParameters) => {
 var resolveHttpAuthSchemeConfig3 = (config) => {
   const config_0 = import_httpAuthSchemes4.resolveAwsSdkSigV4Config(config);
   return Object.assign(config_0, {
-    authSchemePreference: import_client27.normalizeProvider(config.authSchemePreference ?? [])
+    authSchemePreference: import_client28.normalizeProvider(config.authSchemePreference ?? [])
   });
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/EndpointParameters.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/EndpointParameters.js
 var resolveClientEndpointParameters3 = (options) => {
   return Object.assign(options, {
     useDualstackEndpoint: options.useDualstackEndpoint ?? false,
@@ -47952,10 +48463,10 @@ var commonParams3 = {
   Region: { type: "builtInParams", name: "region" },
   UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
 };
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/package.json
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/package.json
 var package_default3 = {
   name: "@aws-sdk/client-ecs",
-  version: "3.1126.0",
+  version: "3.1127.0",
   description: "AWS SDK for JavaScript Ecs Client for Node.js, Browser and React Native",
   homepage: "https://github.com/aws/aws-sdk-js-v3/tree/main/clients/client-ecs",
   license: "Apache-2.0",
@@ -48025,28 +48536,28 @@ var package_default3 = {
   }
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
-var import_client31 = __toESM(require_client2(), 1);
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
+var import_client32 = __toESM(require_client2(), 1);
 var import_httpAuthSchemes6 = __toESM(require_httpAuthSchemes(), 1);
-var import_client32 = __toESM(require_client(), 1);
+var import_client33 = __toESM(require_client(), 1);
 var import_config38 = __toESM(require_config(), 1);
 var import_retry5 = __toESM(require_retry(), 1);
 var import_serde6 = __toESM(require_serde(), 1);
 var import_node_http_handler3 = __toESM(require_dist_cjs6(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.shared.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.shared.js
 var import_httpAuthSchemes5 = __toESM(require_httpAuthSchemes(), 1);
 var import_protocols7 = __toESM(require_protocols2(), 1);
 var import_checksum3 = __toESM(require_checksum(), 1);
-var import_client30 = __toESM(require_client(), 1);
+var import_client31 = __toESM(require_client(), 1);
 var import_protocols8 = __toESM(require_protocols(), 1);
 var import_serde5 = __toESM(require_serde(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/endpointResolver.js
-var import_client28 = __toESM(require_client2(), 1);
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/endpointResolver.js
+var import_client29 = __toESM(require_client2(), 1);
 var import_endpoints7 = __toESM(require_endpoints(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/bdd.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/bdd.js
 var import_endpoints6 = __toESM(require_endpoints(), 1);
 var k3 = "ref";
 var a3 = -1;
@@ -48129,7 +48640,7 @@ var nodes3 = new Int32Array([
 ]);
 var bdd3 = import_endpoints6.BinaryDecisionDiagram.from(nodes3, root3, _data3.conditions, _data3.results);
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/endpointResolver.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/endpointResolver.js
 var cache3 = new import_endpoints7.EndpointCache({
   size: 50,
   params: ["Endpoint", "Region", "UseDualStack", "UseFIPS"]
@@ -48140,21 +48651,21 @@ var defaultEndpointResolver3 = (endpointParams, context = {}) => {
     logger: context.logger
   }));
 };
-import_endpoints7.customEndpointFunctions.aws = import_client28.awsEndpointFunctions;
+import_endpoints7.customEndpointFunctions.aws = import_client29.awsEndpointFunctions;
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/schemas/schemas_0.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/schemas/schemas_0.js
 var import_schema3 = __toESM(require_schema(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/models/ECSServiceException.js
-var import_client29 = __toESM(require_client(), 1);
-class ECSServiceException extends import_client29.ServiceException {
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/models/ECSServiceException.js
+var import_client30 = __toESM(require_client(), 1);
+class ECSServiceException extends import_client30.ServiceException {
   constructor(options) {
     super(options);
     Object.setPrototypeOf(this, ECSServiceException.prototype);
   }
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/models/errors.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/models/errors.js
 class AccessDeniedException extends ECSServiceException {
   name = "AccessDeniedException";
   $fault = "client";
@@ -48547,7 +49058,7 @@ class BlockedException extends ECSServiceException {
   }
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/schemas/schemas_0.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/schemas/schemas_0.js
 var _A2 = "Attachment";
 var _ACR = "AcceleratorCountRequest";
 var _AD2 = "AttachmentDetails";
@@ -50934,7 +51445,7 @@ var StopTask$ = [
   () => StopTaskResponse$
 ];
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.shared.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.shared.js
 var getRuntimeConfig4 = (config) => {
   return {
     apiVersion: "2014-11-13",
@@ -50951,7 +51462,7 @@ var getRuntimeConfig4 = (config) => {
         signer: new import_httpAuthSchemes5.AwsSdkSigV4Signer
       }
     ],
-    logger: config?.logger ?? new import_client30.NoOpLogger,
+    logger: config?.logger ?? new import_client31.NoOpLogger,
     protocol: config?.protocol ?? import_protocols7.AwsJson1_1Protocol,
     protocolSettings: config?.protocolSettings ?? {
       defaultNamespace: "com.amazonaws.ecs",
@@ -50968,13 +51479,13 @@ var getRuntimeConfig4 = (config) => {
   };
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
 var getRuntimeConfig5 = (config) => {
-  import_client32.emitWarningIfUnsupportedVersion(process.version);
+  import_client33.emitWarningIfUnsupportedVersion(process.version);
   const defaultsMode = import_config38.resolveDefaultsModeConfig(config);
-  const defaultConfigProvider = () => defaultsMode().then(import_client32.loadConfigsForDefaultMode);
+  const defaultConfigProvider = () => defaultsMode().then(import_client33.loadConfigsForDefaultMode);
   const clientSharedValues = getRuntimeConfig4(config);
-  import_client31.emitWarningIfUnsupportedVersion(process.version);
+  import_client32.emitWarningIfUnsupportedVersion(process.version);
   const loaderConfig = {
     profile: config?.profile,
     logger: clientSharedValues.logger
@@ -50987,7 +51498,7 @@ var getRuntimeConfig5 = (config) => {
     authSchemePreference: config?.authSchemePreference ?? import_config38.loadConfig(import_httpAuthSchemes6.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde6.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
-    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client31.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default3.version }),
+    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client32.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default3.version }),
     maxAttempts: config?.maxAttempts ?? import_config38.loadConfig(import_retry5.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
     region: config?.region ?? import_config38.loadConfig(import_config38.NODE_REGION_CONFIG_OPTIONS, { ...import_config38.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
     requestHandler: import_node_http_handler3.NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
@@ -50998,16 +51509,16 @@ var getRuntimeConfig5 = (config) => {
     streamCollector: config?.streamCollector ?? import_node_http_handler3.streamCollector,
     useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config38.loadConfig(import_config38.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
     useFipsEndpoint: config?.useFipsEndpoint ?? import_config38.loadConfig(import_config38.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    userAgentAppId: config?.userAgentAppId ?? import_config38.loadConfig(import_client31.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    userAgentAppId: config?.userAgentAppId ?? import_config38.loadConfig(import_client32.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
   };
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeExtensions.js
-var import_client33 = __toESM(require_client2(), 1);
-var import_client34 = __toESM(require_client(), 1);
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeExtensions.js
+var import_client34 = __toESM(require_client2(), 1);
+var import_client35 = __toESM(require_client(), 1);
 var import_protocols9 = __toESM(require_protocols(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/auth/httpAuthExtensionConfiguration.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/auth/httpAuthExtensionConfiguration.js
 var getHttpAuthExtensionConfiguration3 = (runtimeConfig) => {
   const _httpAuthSchemes = runtimeConfig.httpAuthSchemes;
   let _httpAuthSchemeProvider = runtimeConfig.httpAuthSchemeProvider;
@@ -51046,36 +51557,36 @@ var resolveHttpAuthRuntimeConfig3 = (config) => {
   };
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeExtensions.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeExtensions.js
 var resolveRuntimeExtensions3 = (runtimeConfig, extensions) => {
-  const extensionConfiguration = Object.assign(import_client33.getAwsRegionExtensionConfiguration(runtimeConfig), import_client34.getDefaultExtensionConfiguration(runtimeConfig), import_protocols9.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration3(runtimeConfig));
+  const extensionConfiguration = Object.assign(import_client34.getAwsRegionExtensionConfiguration(runtimeConfig), import_client35.getDefaultExtensionConfiguration(runtimeConfig), import_protocols9.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration3(runtimeConfig));
   extensions.forEach((extension) => extension.configure(extensionConfiguration));
-  return Object.assign(runtimeConfig, import_client33.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client34.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols9.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig3(extensionConfiguration));
+  return Object.assign(runtimeConfig, import_client34.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client35.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols9.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig3(extensionConfiguration));
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
-class ECSClient extends import_client36.Client {
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
+class ECSClient extends import_client37.Client {
   config;
   constructor(...[configuration]) {
     const _config_0 = getRuntimeConfig5(configuration || {});
     super(_config_0);
     this.initConfig = _config_0;
     const _config_1 = resolveClientEndpointParameters3(_config_0);
-    const _config_2 = import_client35.resolveUserAgentConfig(_config_1);
+    const _config_2 = import_client36.resolveUserAgentConfig(_config_1);
     const _config_3 = import_retry6.resolveRetryConfig(_config_2);
     const _config_4 = import_config39.resolveRegionConfig(_config_3);
-    const _config_5 = import_client35.resolveHostHeaderConfig(_config_4);
+    const _config_5 = import_client36.resolveHostHeaderConfig(_config_4);
     const _config_6 = import_endpoints8.resolveEndpointConfig(_config_5);
     const _config_7 = resolveHttpAuthSchemeConfig3(_config_6);
     const _config_8 = resolveRuntimeExtensions3(_config_7, configuration?.extensions || []);
     this.config = _config_8;
     this.middlewareStack.use(import_schema4.getSchemaSerdePlugin(this.config));
-    this.middlewareStack.use(import_client35.getUserAgentPlugin(this.config));
+    this.middlewareStack.use(import_client36.getUserAgentPlugin(this.config));
     this.middlewareStack.use(import_retry6.getRetryPlugin(this.config));
     this.middlewareStack.use(import_protocols10.getContentLengthPlugin(this.config));
-    this.middlewareStack.use(import_client35.getHostHeaderPlugin(this.config));
-    this.middlewareStack.use(import_client35.getLoggerPlugin(this.config));
-    this.middlewareStack.use(import_client35.getRecursionDetectionPlugin(this.config));
+    this.middlewareStack.use(import_client36.getHostHeaderPlugin(this.config));
+    this.middlewareStack.use(import_client36.getLoggerPlugin(this.config));
+    this.middlewareStack.use(import_client36.getRecursionDetectionPlugin(this.config));
     this.middlewareStack.use(import_core2.getHttpAuthSchemeEndpointRuleSetPlugin(this.config, {
       httpAuthSchemeParametersProvider: defaultECSHttpAuthSchemeParametersProvider,
       identityProviderConfigProvider: async (config) => new import_core2.DefaultIdentityProviderConfig({
@@ -51089,26 +51600,26 @@ class ECSClient extends import_client36.Client {
   }
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/commandBuilder.js
-var import_client37 = __toESM(require_client(), 1);
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/commandBuilder.js
+var import_client38 = __toESM(require_client(), 1);
 var import_endpoints9 = __toESM(require_endpoints(), 1);
-var command3 = import_client37.makeBuilder(commonParams3, "AmazonEC2ContainerServiceV20141113", "ECSClient", import_endpoints9.getEndpointPlugin);
+var command3 = import_client38.makeBuilder(commonParams3, "AmazonEC2ContainerServiceV20141113", "ECSClient", import_endpoints9.getEndpointPlugin);
 var _ep03 = {};
 var _mw03 = (Command, cs, config, o2) => [];
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/DescribeTasksCommand.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/DescribeTasksCommand.js
 class DescribeTasksCommand extends command3(_ep03, _mw03, "DescribeTasks", DescribeTasks$) {
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/ListTasksCommand.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/ListTasksCommand.js
 class ListTasksCommand extends command3(_ep03, _mw03, "ListTasks", ListTasks$) {
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/RunTaskCommand.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/RunTaskCommand.js
 class RunTaskCommand extends command3(_ep03, _mw03, "RunTask", RunTask$) {
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/StopTaskCommand.js
+// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/StopTaskCommand.js
 class StopTaskCommand extends command3(_ep03, _mw03, "StopTask", StopTask$) {
 }
 
@@ -51434,6 +51945,7 @@ var localRunExecutor = {
 // src/sdk/storage.ts
 var artifactStorageSeam = ArtifactStorage;
 // src/sdk/outputs.ts
+import { createHash as createHash12 } from "crypto";
 class DatabaseOnlyObjectStore {
   usesS3 = false;
   async materialize(run, artifact, body) {
@@ -51461,9 +51973,13 @@ function createGovernedArtifactWriter(options) {
   const storage2 = options.storage ?? new DatabaseOnlyObjectStore;
   return {
     async write(run, meta, body) {
+      if (typeof body?.bodyText !== "string") {
+        throw new TypeError("Governed artifacts require a text body before persistence");
+      }
       const redacted = redactRunOutput(body.bodyText, config.redactPatterns);
       const redactedBody = { ...body, bodyText: redacted };
-      const outputBytes = new TextEncoder().encode(redacted).byteLength;
+      const persistedBytes = new TextEncoder().encode(redacted);
+      const outputBytes = persistedBytes.byteLength;
       if (outputBytes > config.perOutputBytes) {
         throw new GovernanceError(GOVERNANCE_ERROR_CODES.ARTIFACT_LIMIT_EXCEEDED, `output ${meta.relativePath} for run ${run.id} is ${outputBytes} bytes; the per-output limit is ${config.perOutputBytes}`, { gate: "perOutputBytes" });
       }
@@ -51475,6 +51991,8 @@ function createGovernedArtifactWriter(options) {
       const createdAt = new Date().toISOString();
       const stamped = {
         ...meta,
+        byteSize: outputBytes,
+        sha256: createHash12("sha256").update(persistedBytes).digest("hex"),
         visibility: options.visibility ?? config.defaultVisibility,
         ...config.artifactTtlSeconds !== undefined ? { expiresAt: expiresAtFor(createdAt, config.artifactTtlSeconds) } : {}
       };
@@ -51646,6 +52164,202 @@ function createOfflineGate(options) {
     }
   };
 }
+// src/lib/remote-workspace-selection.ts
+var record = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
+var uuid = (v2) => typeof v2 === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v2);
+var text = (v2, max = 1024) => typeof v2 === "string" && !!v2.trim() && v2.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v2);
+var role = (v2) => typeof v2 === "string" && ["owner", "admin", "member", "viewer"].includes(v2);
+var invalidWorkspaceResult = "The server returned an invalid workspace selection result.";
+
+class WorkspaceContextInputError extends Error {
+  constructor() {
+    super("Provide the observed user ID and exact lowercase membership ID.");
+    this.name = "WorkspaceContextInputError";
+  }
+}
+
+class WorkspaceIdentityMismatchError extends Error {
+  constructor() {
+    super("The verified account does not match the requested workspace context.");
+    this.name = "WorkspaceIdentityMismatchError";
+  }
+}
+function workspaceExpectedUserId(value) {
+  if (!uuid(value))
+    throw new WorkspaceContextInputError;
+  return value;
+}
+function workspaceContext(value) {
+  if (!record(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid(value.userId) || !uuid(value.membershipId))
+    throw new WorkspaceContextInputError;
+  return { userId: value.userId, membershipId: value.membershipId };
+}
+function invalid() {
+  throw new Error(invalidWorkspaceResult);
+}
+function organization(v2) {
+  if (!record(v2) || !uuid(v2.id) || !text(v2.slug) || !text(v2.name))
+    return invalid();
+  return { id: v2.id, slug: v2.slug, name: v2.name };
+}
+function parseAccountWorkspaces(value) {
+  if (!record(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
+    return invalid();
+  const workspaces = value.workspaces.map((v2) => {
+    if (!record(v2) || !uuid(v2.membershipId) || !role(v2.role) || typeof v2.current !== "boolean")
+      return invalid();
+    return { membershipId: v2.membershipId, organization: organization(v2.organization), role: v2.role, current: v2.current };
+  });
+  if (workspaces.filter((w2) => w2.current).length !== 1 || new Set(workspaces.map((w2) => w2.membershipId)).size !== workspaces.length || new Set(workspaces.map((w2) => w2.organization.id)).size !== workspaces.length)
+    return invalid();
+  return { workspaces };
+}
+function parseWorkspaceIdentity(value, expectedUserId) {
+  if (!record(value))
+    return invalid();
+  const user = value.user;
+  if (!record(user) || !uuid(user.id) || !uuid(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role(user.role))
+    return invalid();
+  if (user.id !== expectedUserId)
+    throw new WorkspaceIdentityMismatchError;
+  return { user: { id: user.id, membershipId: user.membershipId, email: user.email, displayName: user.displayName, role: user.role }, organization: organization(value.organization) };
+}
+function sessionToken(value) {
+  if (typeof value !== "string" || !value || value.length > 8192 || /[^\x21-\x7e]/.test(value) || value.startsWith("sk_"))
+    return invalid();
+  return value;
+}
+function parseWorkspaceSession(value, expected) {
+  const identity = parseWorkspaceIdentity(value, expected.userId);
+  if (identity.user.membershipId !== expected.membershipId)
+    throw new WorkspaceIdentityMismatchError;
+  return { token: sessionToken(value.token), ...identity };
+}
+function parseWorkspaceLogin(value, expectedUserId) {
+  const user = record(value) && value.user;
+  if (!record(value) || !record(user) || !uuid(user.id))
+    return invalid();
+  if (expectedUserId !== undefined && user.id !== expectedUserId)
+    throw new WorkspaceIdentityMismatchError;
+  return { token: sessionToken(value.token), userId: user.id };
+}
+var workspaceSelectionFailures = {
+  INVALID_WORKSPACE_SELECTION: [400, "Provide only the exact membership ID from your workspace list."],
+  SESSION_EXPIRED: [401, "Sign in again before selecting a workspace."],
+  ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+  INTERACTIVE_SESSION_REQUIRED: [403, "Interactive sign-in is required to select a workspace."],
+  WORKSPACE_UNAVAILABLE: [404, "Workspace is unavailable. Refresh your workspace list."],
+  WORKSPACE_BUSY: [503, "Workspace is busy. Refresh before retrying."]
+};
+function workspaceSelectionFailure(value, status) {
+  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
+    return null;
+  const code = value.code;
+  return workspaceSelectionFailures[code][0] === status ? code : null;
+}
+
+// src/lib/remote-workspace.ts
+var record2 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+var cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value);
+var uuid2 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value);
+function workspaceMembersQuery(options = {}) {
+  if (!record2(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+    throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
+  const query = new URLSearchParams;
+  if (options.limit !== undefined)
+    query.set("limit", String(options.limit));
+  if (options.cursor !== undefined)
+    query.set("cursor", options.cursor);
+  return query.size ? `?${query}` : "";
+}
+function timestamp(value) {
+  if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}Z$/.test(value))
+    return false;
+  const time = Date.parse(value);
+  return Number.isFinite(time) && new Date(time).toISOString().slice(0, 23) === value.slice(0, 23);
+}
+function parseMember(row, fail) {
+  if (!record2(row) || !uuid2(row.membershipId) || !uuid2(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp(row.createdAt))
+    return fail();
+  return {
+    membershipId: row.membershipId,
+    userId: row.userId,
+    email: row.email,
+    displayName: row.displayName,
+    role: row.role,
+    createdAt: row.createdAt
+  };
+}
+var isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value);
+
+class WorkspaceMemberInputError extends Error {
+  constructor() {
+    super("Use an unchanged lowercase membership ID and the exact role and expected-role parameters from the roster.");
+    this.name = "WorkspaceMemberInputError";
+  }
+}
+function mutationInput(membershipId, input, roleChange) {
+  if (typeof membershipId !== "string" || !uuid2(membershipId) || membershipId !== membershipId.toLowerCase() || !record2(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+    throw new WorkspaceMemberInputError;
+  const expectedRole = input.expectedRole, role2 = roleChange ? input.role : undefined;
+  if (!isRole(expectedRole) || roleChange && !isRole(role2))
+    throw new WorkspaceMemberInputError;
+  return { membershipId, role: role2, expectedRole };
+}
+function workspaceMemberRoleInput(membershipId, input) {
+  const value = mutationInput(membershipId, input, true);
+  return { membershipId: value.membershipId, body: { role: value.role, expectedRole: value.expectedRole } };
+}
+function workspaceMemberRemovalInput(membershipId, input) {
+  const value = mutationInput(membershipId, input, false);
+  return { membershipId: value.membershipId, body: { expectedRole: value.expectedRole } };
+}
+var invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.";
+function parseWorkspaceMemberRoleResult(value, membershipId, role2) {
+  const fail = () => {
+    throw new Error(invalidMemberResult);
+  };
+  if (!record2(value) || !uuid2(value.organizationId) || typeof value.changed !== "boolean")
+    return fail();
+  const member = parseMember(value.member, fail);
+  if (member.membershipId !== membershipId || member.role !== role2)
+    return fail();
+  return { organizationId: value.organizationId, member, changed: value.changed };
+}
+function parseWorkspaceMemberRemovalResult(value, membershipId) {
+  if (!record2(value) || !uuid2(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+    throw new Error(invalidMemberResult);
+  return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
+}
+var workspaceMemberFailures = {
+  INVALID_REQUEST: [400, "Provide the exact membership role parameters."],
+  ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+  INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required."],
+  WORKSPACE_ADMIN_REQUIRED: [403, "A current workspace owner or admin is required."],
+  MEMBERSHIP_ACTION_FORBIDDEN: [403, "Your current workspace role cannot perform this membership action."],
+  MEMBERSHIP_NOT_FOUND: [404, "Membership was not found in the current workspace."],
+  SELF_REMOVAL_UNAVAILABLE: [409, "Leaving your own workspace is not available through member removal."],
+  MEMBERSHIP_ROLE_CHANGED: [409, "The member role changed. Refresh the roster before another action."],
+  LAST_OWNER_REQUIRED: [409, "The workspace must retain at least one active owner."],
+  MEMBERSHIP_BUSY: [503, "Membership is busy. Refresh the roster before another action."]
+};
+function workspaceMemberFailure(value, status) {
+  if (!record2(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+    return null;
+  const code = value.code;
+  return workspaceMemberFailures[code][0] === status ? code : null;
+}
+function parseWorkspaceMembersPage(value) {
+  const fail = () => {
+    throw new Error("The server returned an invalid workspace roster.");
+  };
+  if (!record2(value) || !uuid2(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+    return fail();
+  const members = value.members.map((row) => parseMember(row, fail));
+  if (new Set(members.map((row) => row.membershipId)).size !== members.length)
+    return fail();
+  return { organizationId: value.organizationId, members, nextCursor: value.nextCursor };
+}
 // src/lib/auth-store.ts
 function getApiUrl(action, env = process.env, options = {}) {
   return requireSkillsApiOrigin(action, env, options);
@@ -51728,7 +52442,7 @@ function object(value) {
 }
 
 // src/lib/remote-files.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 var MAX_REMOTE_FILE_BYTES = 64 * 1024 * 1024;
 function describeRemoteFiles(files) {
   if (files.length > 10)
@@ -51746,7 +52460,7 @@ function describeRemoteFiles(files) {
   });
 }
 function sha256(bytes) {
-  return createHash12("sha256").update(bytes).digest("hex");
+  return createHash13("sha256").update(bytes).digest("hex");
 }
 async function readBoundedResponse(response, maximum) {
   if (!Number.isSafeInteger(maximum) || maximum < 0 || maximum > MAX_REMOTE_FILE_BYTES)
@@ -51786,6 +52500,37 @@ async function readBoundedResponse(response, maximum) {
   return bytes;
 }
 
+// src/lib/remote-profile.ts
+function customerNamePatch(input, field) {
+  if (!isRecord5(input) || Object.keys(input).length !== 1 || !Object.hasOwn(input, field))
+    throw new Error("Provide only the requested name field.");
+  const value = input[field];
+  if (typeof value !== "string" || /[\p{Cc}\p{Cs}\u2028\u2029]/u.test(value) || !value.trim() || [...value.trim()].length > 100) {
+    throw new Error("Use a name of 1\u2013100 characters without control characters or newlines.");
+  }
+  return { [field]: value.trim() };
+}
+function isRecord5(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function string(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function parseUpdatedProfile(value) {
+  const user = isRecord5(value) && value.user;
+  if (!isRecord5(user) || !string(user.id) || !string(user.email) || !(user.displayName === null || typeof user.displayName === "string") || typeof user.role !== "string" || !["owner", "admin", "member", "viewer"].includes(user.role)) {
+    throw new Error("The server returned an invalid account profile.");
+  }
+  return { user: { id: user.id, email: user.email, displayName: user.displayName, role: user.role } };
+}
+function parseUpdatedWorkspace(value) {
+  const organization2 = isRecord5(value) && value.organization;
+  if (!isRecord5(organization2) || !string(organization2.id) || !string(organization2.slug) || !string(organization2.name)) {
+    throw new Error("The server returned an invalid workspace.");
+  }
+  return { organization: { id: organization2.id, slug: organization2.slug, name: organization2.name } };
+}
+
 // src/lib/remote-client.ts
 class RemoteRouteUnsupportedError extends Error {
   path;
@@ -51803,14 +52548,43 @@ class RemoteRouteUnsupportedError extends Error {
 class RemoteRequestError extends Error {
   path;
   status;
-  constructor(path, status, statusText) {
-    super(`Remote request to ${path} failed: HTTP ${status}${statusText ? ` ${statusText}` : ""}`);
+  constructor(path, status, _statusText) {
+    super(`Remote request to ${path} failed: HTTP ${status}`);
     this.path = path;
     this.status = status;
     this.name = "RemoteRequestError";
   }
 }
 
+class RemoteWorkspaceMemberError extends RemoteRequestError {
+  code;
+  constructor(path, code) {
+    super(path, workspaceMemberFailures[code][0]);
+    this.code = code;
+    this.name = "RemoteWorkspaceMemberError";
+    this.message = workspaceMemberFailures[code][1];
+  }
+}
+
+class RemoteWorkspaceSelectionError extends RemoteRequestError {
+  code;
+  constructor(path, code) {
+    super(path, workspaceSelectionFailures[code][0]);
+    this.code = code;
+    this.name = "RemoteWorkspaceSelectionError";
+    this.message = workspaceSelectionFailures[code][1];
+  }
+}
+
+class RemoteCapabilityUnavailableError extends RemoteRequestError {
+  code = "SUBSCRIPTION_CHECKOUT_UNAVAILABLE";
+  constructor() {
+    super("/api/v1/billing/checkout", 503);
+    this.name = "RemoteCapabilityUnavailableError";
+    this.message = "Subscription checkout is unavailable on the configured Skills server. " + "Use skills credits packs to view credit packs, or skills billing portal to manage an existing subscription.";
+  }
+}
+
 class RemoteSkillsClient {
   apiUrl;
   apiKey;
@@ -51823,6 +52597,7 @@ class RemoteSkillsClient {
     return fetch(`${this.apiUrl}${path}`, {
       ...options,
       redirect: "error",
+      credentials: "omit",
       signal: options?.signal ?? AbortSignal.timeout(15000),
       headers: {
         Authorization: `Bearer ${this.apiKey}`,
@@ -51838,9 +52613,14 @@ class RemoteSkillsClient {
       if (response.status === 404 && opts.domainNotFoundCodes?.length && await responseBodyCarriesCode(response, opts.domainNotFoundCodes)) {
         return response;
       }
+      response.body?.cancel().catch(() => {});
       throw new RemoteRouteUnsupportedError(routePath, response.status, this.apiUrl);
     }
     if (!response.ok) {
+      if (path === "/api/v1/billing/checkout" && options?.method === "POST" && response.status === 503 && await responseBodyCarriesCode(response, ["SUBSCRIPTION_CHECKOUT_UNAVAILABLE"])) {
+        throw new RemoteCapabilityUnavailableError;
+      }
+      response.body?.cancel().catch(() => {});
       throw new RemoteRequestError(routePath, response.status, response.statusText);
     }
     return response;
@@ -51924,6 +52704,117 @@ class RemoteSkillsClient {
   async getIdentity() {
     return (await this.requestNewRoute("/api/auth/whoami")).json();
   }
+  async listAccountWorkspaces(expectedUserId) {
+    const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    let identity;
+    if (expected !== undefined) {
+      const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+      if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+        throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces", "INTERACTIVE_SESSION_REQUIRED");
+      identity = parseWorkspaceIdentity(value, expected);
+    }
+    const result = parseAccountWorkspaces(await connection.requestWorkspaceSelection("/api/v1/account/workspaces"));
+    const current = result.workspaces.find((workspace) => workspace.current);
+    if (identity && (current.membershipId !== identity.user.membershipId || current.organization.id !== identity.organization.id))
+      throw new WorkspaceIdentityMismatchError;
+    return result;
+  }
+  async switchWorkspace(context) {
+    const target = workspaceContext(context);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+      throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces/switch", "INTERACTIVE_SESSION_REQUIRED");
+    parseWorkspaceIdentity(value, target.userId);
+    const selected = parseWorkspaceSession(await connection.requestWorkspaceSelection("/api/v1/account/workspaces/switch", {
+      method: "POST",
+      body: JSON.stringify({ membershipId: target.membershipId })
+    }), target);
+    const verified = await new RemoteSkillsClient(selected.token, connection.apiUrl).requestWorkspaceSelection("/api/auth/whoami");
+    if (!verified || typeof verified !== "object" || verified.authMethod !== "jwt")
+      throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces/switch", "INTERACTIVE_SESSION_REQUIRED");
+    const identity = parseWorkspaceIdentity(verified, target.userId);
+    if (identity.user.membershipId !== target.membershipId || identity.organization.id !== selected.organization.id)
+      throw new WorkspaceIdentityMismatchError;
+    return { token: selected.token, ...identity };
+  }
+  async requestWorkspaceSelection(path, options) {
+    let response;
+    try {
+      response = await this.request(path, { ...options, credentials: "omit" });
+    } catch {
+      throw new Error("Unable to reach the Skills workspace API.");
+    }
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 1024 * 1024 : 4096)));
+    } catch {
+      if (response.ok)
+        throw new Error(invalidWorkspaceResult);
+    }
+    if (!response.ok) {
+      const code = workspaceSelectionFailure(value, response.status);
+      if (code)
+        throw new RemoteWorkspaceSelectionError(path, code);
+      if (response.status === 404 || response.status === 405)
+        throw new RemoteRouteUnsupportedError(path, response.status, this.apiUrl);
+      throw new RemoteRequestError(path, response.status);
+    }
+    return value;
+  }
+  async updateProfile(input) {
+    const body = customerNamePatch(input, "displayName");
+    return parseUpdatedProfile(await (await this.requestNewRoute("/api/v1/account/profile", { method: "PATCH", body: JSON.stringify(body) })).json());
+  }
+  async updateCurrentWorkspace(input) {
+    const body = customerNamePatch(input, "name");
+    return parseUpdatedWorkspace(await (await this.requestNewRoute("/api/v1/workspaces/current", { method: "PATCH", body: JSON.stringify(body) })).json());
+  }
+  async listWorkspaceMembers(options = {}) {
+    const query = workspaceMembersQuery(options);
+    const requestedCursor = options.cursor;
+    const response = await this.requestNewRoute(`/api/v1/workspace/members${query}`);
+    let value;
+    try {
+      value = await response.json();
+    } catch {
+      throw new Error("The server returned an invalid workspace roster.");
+    }
+    const page = parseWorkspaceMembersPage(value);
+    if (requestedCursor !== undefined && page.nextCursor === requestedCursor)
+      throw new Error("The server returned an invalid workspace roster.");
+    return page;
+  }
+  async setWorkspaceMemberRole(membershipId, input) {
+    const captured = workspaceMemberRoleInput(membershipId, input);
+    const value = await this.requestWorkspaceMember(captured.membershipId, "PATCH", captured.body);
+    return parseWorkspaceMemberRoleResult(value, captured.membershipId, captured.body.role);
+  }
+  async removeWorkspaceMember(membershipId, input) {
+    const captured = workspaceMemberRemovalInput(membershipId, input);
+    return parseWorkspaceMemberRemovalResult(await this.requestWorkspaceMember(captured.membershipId, "DELETE", captured.body), captured.membershipId);
+  }
+  async requestWorkspaceMember(membershipId, method, body) {
+    const path = `/api/v1/workspace/members/${membershipId}`;
+    const response = await this.request(path, { method, body: JSON.stringify(body) });
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 64 * 1024 : 4096)));
+    } catch {
+      if (response.ok)
+        throw new Error(invalidMemberResult);
+    }
+    if (!response.ok) {
+      const code = workspaceMemberFailure(value, response.status);
+      if (code)
+        throw new RemoteWorkspaceMemberError(path, code);
+      if (response.status === 404 || response.status === 405)
+        throw new RemoteRouteUnsupportedError(path, response.status, this.apiUrl);
+      throw new RemoteRequestError(path, response.status);
+    }
+    return value;
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -52115,8 +53006,10 @@ class RemoteSkillsClient {
       return [];
     if (!response.ok)
       throw new Error(`versions request failed: ${response.status}`);
-    const body = await response.json();
-    return Array.isArray(body.versions) ? body.versions : [];
+    const body = await readSkillVersionPayload(response);
+    if (!isVersionRecord(body) || !Array.isArray(body.versions) || body.slug !== undefined && body.slug !== slug)
+      throw new Error(INVALID_SKILL_VERSION_RESPONSE);
+    return body.versions.map((entry) => normalizeSkillVersion(entry, slug));
   }
   async getSkillVersion(slug, version2) {
     const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version2)}`, undefined, { domainNotFoundCodes: ["SKILL_NOT_FOUND", "SKILL_VERSION_NOT_FOUND"] });
@@ -52124,7 +53017,7 @@ class RemoteSkillsClient {
       return null;
     if (!response.ok)
       throw new Error(`version request failed: ${response.status}`);
-    return await response.json();
+    return normalizeSkillVersion(await readSkillVersionPayload(response), slug, version2);
   }
   async listPins() {
     const response = await this.requestNewRoute("/api/v1/pins");
@@ -52172,31 +53065,48 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record, field) {
-  if (record[field] === undefined)
+function requireOptionalString(record3, field) {
+  if (record3[field] === undefined)
     return;
-  if (typeof record[field] !== "string") {
+  if (typeof record3[field] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field} must be a string when present)`);
   }
-  return record[field];
+  return record3[field];
+}
+var INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
+function isVersionRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+async function readSkillVersionPayload(response) {
+  try {
+    return await response.json();
+  } catch {
+    throw new Error(INVALID_SKILL_VERSION_RESPONSE);
+  }
+}
+function normalizeSkillVersion(entry, slug, version2) {
+  if (!isVersionRecord(entry) || typeof entry.slug !== "string" || !entry.slug.trim() || entry.slug !== slug || typeof entry.version !== "string" || !entry.version.trim() || version2 !== undefined && entry.version !== version2 || typeof entry.bundleSha256 !== "string" || !/^[a-f0-9]{64}$/i.test(entry.bundleSha256) || typeof entry.bundleByteSize !== "number" || !Number.isSafeInteger(entry.bundleByteSize) || entry.bundleByteSize < 0 || typeof entry.createdAt !== "string" || !entry.createdAt.trim() || entry.current !== undefined && typeof entry.current !== "boolean" || entry.storageKind !== undefined && typeof entry.storageKind !== "string" || entry.manifest !== undefined && !isVersionRecord(entry.manifest)) {
+    throw new Error(INVALID_SKILL_VERSION_RESPONSE);
+  }
+  return entry;
 }
 function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record = entry;
-  const slug = typeof record.slug === "string" && record.slug.trim() ? record.slug.trim() : undefined;
+  const record3 = entry;
+  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record.metadata !== undefined) {
-    if (!record.metadata || typeof record.metadata !== "object" || Array.isArray(record.metadata)) {
+  if (record3.metadata !== undefined) {
+    if (!record3.metadata || typeof record3.metadata !== "object" || Array.isArray(record3.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record.metadata;
+    metadata = record3.metadata;
   }
-  const pinnedAt = requireOptionalString(record, "pinnedAt");
+  const pinnedAt = requireOptionalString(record3, "pinnedAt");
   return {
     slug,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -52213,16 +53123,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record = entry;
-  const slug = typeof record.slug === "string" && record.slug.trim() ? record.slug.trim() : undefined;
+  const record3 = entry;
+  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug,
-    ...requireOptionalString(record, "name") !== undefined ? { name: requireOptionalString(record, "name") } : {},
-    ...requireOptionalString(record, "version") !== undefined ? { version: requireOptionalString(record, "version") } : {},
-    ...requireOptionalString(record, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record, "updatedAt") } : {}
+    ...requireOptionalString(record3, "name") !== undefined ? { name: requireOptionalString(record3, "name") } : {},
+    ...requireOptionalString(record3, "version") !== undefined ? { version: requireOptionalString(record3, "version") } : {},
+    ...requireOptionalString(record3, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record3, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -52232,26 +53142,55 @@ function normalizeSkillSummaryList(payload) {
   return payload.map(normalizeSkillSummary);
 }
 async function responseBodyCarriesCode(response, codes) {
+  const reader = response.body?.getReader();
+  if (!reader)
+    return false;
+  const maximum = 8 * 1024;
+  let deadline;
+  const expired = new Promise((_, reject) => {
+    deadline = setTimeout(() => reject(new Error("Error response read deadline exceeded")), 1000);
+  });
   try {
-    const payload = await response.clone().json();
-    if (!payload || typeof payload !== "object")
+    const chunks = [];
+    let size = 0;
+    while (true) {
+      const next = await Promise.race([reader.read(), expired]);
+      if (next.done)
+        break;
+      size += next.value.byteLength;
+      if (size > maximum)
+        return false;
+      chunks.push(next.value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    if (!payload || typeof payload !== "object" || Array.isArray(payload) || !Object.hasOwn(payload, "code"))
       return false;
     const code = payload.code;
     return typeof code === "string" && codes.includes(code);
   } catch {
     return false;
+  } finally {
+    clearTimeout(deadline);
+    reader.cancel().catch(() => {});
+    reader.releaseLock();
   }
 }
 function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record = payload;
-  if (!Array.isArray(record.skills)) {
+  const record3 = payload;
+  if (!Array.isArray(record3.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record.skills.map(normalizeSkillSummary);
-  const nextCursor = record.nextCursor === undefined || record.nextCursor === null ? null : record.nextCursor;
+  const skills = record3.skills.map(normalizeSkillSummary);
+  const nextCursor = record3.nextCursor === undefined || record3.nextCursor === null ? null : record3.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -52298,13 +53237,13 @@ async function requestAuthApi(instance, path, options) {
       apiUrl: safeUrl
     });
   }
-  const text = await res.text();
-  const body = text ? parseJsonBody(text) : {};
+  const text2 = await res.text();
+  const body = text2 ? parseJsonBody(text2) : {};
   if (!res.ok) {
-    const record = isRecord5(body) ? body : {};
-    const detail = typeof record.detail === "string" ? record.detail : undefined;
-    const error = typeof record.error === "string" ? record.error : undefined;
-    const code = typeof record.code === "string" ? record.code : undefined;
+    const record3 = isRecord6(body) ? body : {};
+    const detail = typeof record3.detail === "string" ? record3.detail : undefined;
+    const error = typeof record3.error === "string" ? record3.error : undefined;
+    const code = typeof record3.code === "string" ? record3.code : undefined;
     throw new HostedApiError(detail || error || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -52315,21 +53254,21 @@ async function requestAuthApi(instance, path, options) {
   }
   return body;
 }
-function parseJsonBody(text) {
+function parseJsonBody(text2) {
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { detail: condenseErrorBody(text) };
+    return { detail: condenseErrorBody(text2) };
   }
 }
-function condenseErrorBody(text) {
-  const stripped = /<[a-z!/]/i.test(text) ? text.replace(/<(script|style)[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]*>/g, " ") : text;
+function condenseErrorBody(text2) {
+  const stripped = /<[a-z!/]/i.test(text2) ? text2.replace(/<(script|style)[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]*>/g, " ") : text2;
   const collapsed = stripped.replace(/\s+/g, " ").trim();
   if (collapsed.length <= MAX_ERROR_DETAIL_LENGTH)
     return collapsed;
   return `${collapsed.slice(0, MAX_ERROR_DETAIL_LENGTH - 1).trimEnd()}\u2026`;
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 
@@ -52350,22 +53289,90 @@ class RemoteSkillsAuthClient {
   pollDevice(deviceCode) {
     return this.request("/api/auth/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) });
   }
-  async sessionClient(email, code) {
+  async sessionClient(email, code, context) {
+    if (context !== undefined) {
+      const target = workspaceContext(context), apiOrigin2 = this.apiOrigin;
+      const session = await this.switchWorkspace(email, code, target);
+      return new RemoteSkillsClient(session.token, apiOrigin2);
+    }
+    const apiOrigin = this.apiOrigin;
     if (!email.includes("@") || !/^\d{6}$/.test(code))
-      throw new Error("Fresh email and six-digit verification code are required to manage API keys");
+      throw new Error("Fresh email and six-digit verification code are required to manage this account");
     const login = await this.verifyCode(email, code);
     if (!login || typeof login.token !== "string" || !login.token)
       throw new Error("The server did not return an authorized account session");
-    return new RemoteSkillsClient(login.token, this.apiOrigin);
+    return new RemoteSkillsClient(login.token, apiOrigin);
+  }
+  async listAccountWorkspaces(email, code, expectedUserId) {
+    const login = await this.workspaceLogin(email, code, expectedUserId);
+    const result = await new RemoteSkillsClient(login.token, login.apiOrigin).listAccountWorkspaces(login.userId);
+    return { userId: login.userId, ...result };
+  }
+  async switchWorkspace(email, code, context) {
+    const target = workspaceContext(context);
+    const login = await this.workspaceLogin(email, code, target.userId);
+    return new RemoteSkillsClient(login.token, login.apiOrigin).switchWorkspace(target);
+  }
+  async workspaceLogin(email, code, expectedUserId) {
+    const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
+    const apiOrigin = this.apiOrigin;
+    if (typeof email !== "string" || !email.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
+      throw new Error("Fresh email and six-digit verification code are required to manage this account");
+    let response;
+    try {
+      response = await fetch(`${apiOrigin}/api/auth/verify`, {
+        method: "POST",
+        redirect: "error",
+        credentials: "omit",
+        signal: AbortSignal.timeout(15000),
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email, code })
+      });
+    } catch {
+      throw new HostedApiError("Unable to verify the Skills account.");
+    }
+    if (!response.ok) {
+      response.body?.cancel().catch(() => {});
+      throw new HostedApiError("Unable to verify the Skills account.", { status: response.status });
+    }
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, 64 * 1024)));
+    } catch {
+      throw new HostedApiError("The server returned an invalid account verification result.");
+    }
+    return { ...parseWorkspaceLogin(value, expected), apiOrigin };
+  }
+  async createApiKey(email, code, name, scopes, context) {
+    const capturedScopes = scopes === undefined ? undefined : [...scopes];
+    return (await this.sessionClient(email, code, context)).createApiKey(name, capturedScopes);
+  }
+  async listApiKeys(email, code, context) {
+    return (await this.sessionClient(email, code, context)).listApiKeys();
+  }
+  async revokeApiKey(email, code, keyId, context) {
+    return (await this.sessionClient(email, code, context)).revokeApiKey(keyId);
+  }
+  async updateProfile(email, code, input, context) {
+    const body = customerNamePatch(input, "displayName");
+    return (await this.sessionClient(email, code, context)).updateProfile({ displayName: body.displayName });
+  }
+  async updateCurrentWorkspace(email, code, input, context) {
+    const body = customerNamePatch(input, "name");
+    return (await this.sessionClient(email, code, context)).updateCurrentWorkspace({ name: body.name });
   }
-  async createApiKey(email, code, name, scopes) {
-    return (await this.sessionClient(email, code)).createApiKey(name, scopes);
+  async listWorkspaceMembers(email, code, options = {}, context) {
+    workspaceMembersQuery(options);
+    const captured = { ...options };
+    return (await this.sessionClient(email, code, context)).listWorkspaceMembers(captured);
   }
-  async listApiKeys(email, code) {
-    return (await this.sessionClient(email, code)).listApiKeys();
+  async setWorkspaceMemberRole(email, code, membershipId, input, context) {
+    const captured = workspaceMemberRoleInput(membershipId, input);
+    return (await this.sessionClient(email, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
   }
-  async revokeApiKey(email, code, keyId) {
-    return (await this.sessionClient(email, code)).revokeApiKey(keyId);
+  async removeWorkspaceMember(email, code, membershipId, input, context) {
+    const captured = workspaceMemberRemovalInput(membershipId, input);
+    return (await this.sessionClient(email, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
   }
   request(path, options) {
     if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
@@ -52382,6 +53389,7 @@ export {
   skillsCredentialFiles,
   skillsCredentialFilePath,
   settleRun,
+  selectsSkillsLocalMode,
   runTerminalSchema,
   runProtocolSchema,
   runPointersOf,
@@ -52409,6 +53417,7 @@ export {
   leaseGenerationOf,
   isValidSkillSlug,
   isTerminalStatus,
+  isSkillsLocalOptIn,
   isActiveStatus,
   getServerSkillMd,
   getServerSkill,
@@ -52444,18 +53453,24 @@ export {
   assertDurableTarget,
   assertDurableStore,
   artifactStorageSeam,
+  WorkspaceIdentityMismatchError,
+  WorkspaceContextInputError,
   SqliteSkillsStore,
   SqliteRunExecutionStore,
   SqliteGovernanceStore,
   SkillsFleetCredentialError,
+  SKILLS_LOCAL_OPT_IN_ENV_KEYS,
   SKILLS_APP,
   SKILLS_API_URL_ENV,
   SKILLS_API_KEY_ENV,
+  RemoteWorkspaceSelectionError,
+  RemoteWorkspaceMemberError,
   RemoteSkillsClient,
   RemoteSkillsAuthClient,
   RemoteRouteUnsupportedError,
   RemoteRequestError,
   RemoteCreditApprovalError,
+  RemoteCapabilityUnavailableError,
   RUN_PROTOCOL_VERSION,
   RUN_PROTOCOL_STATES,
   RUN_LIFECYCLE_EVENT_TYPES,