@hasna/skills 0.5.2 → 0.5.3

package/dist/sdk/index.js

@@ -25462,7 +25462,7 @@ class MissingSkillsFleetError extends Error {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.5.2",
+  version: "0.5.3",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -25635,6 +25635,41 @@ import { createHmac, timingSafeEqual } from "crypto";
 import { createHash } from "crypto";
 import { readFileSync as readFileSync2, readdirSync, statSync } from "fs";
 import { join as join2, relative } from "path";
+import { createGunzip } from "zlib";
+
+// src/lib/skill-entry-path.ts
+class SkillEntryPaths {
+  files = new Set;
+  directories = new Set;
+  add(path, maxBytes, invalid, limit) {
+    if (path.length > maxBytes)
+      limit();
+    const encoded = new TextEncoder().encode(path);
+    if (encoded.byteLength > maxBytes)
+      limit();
+    if (new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(encoded) !== path)
+      invalid("Invalid UTF-8 entry path");
+    if (!path || /[\\:\x00-\x1f\x7f]/u.test(path))
+      invalid("Unsafe entry path");
+    if (path.split("/").some((segment) => !segment || segment === "." || segment === ".."))
+      invalid("Unsafe entry path segment");
+    const key = path.normalize("NFC").toLowerCase().normalize("NFC");
+    if (this.files.has(key) || this.directories.has(key))
+      invalid("Duplicate or conflicting entry path");
+    const parents = key.split("/");
+    parents.pop();
+    while (parents.length) {
+      const parent = parents.join("/");
+      if (this.files.has(parent))
+        invalid("Conflicting entry file ancestor");
+      this.directories.add(parent);
+      parents.pop();
+    }
+    this.files.add(key);
+  }
+}
+
+// src/lib/skill-bundle.ts
 var BLOCK = 512;
 var ANY_SEGMENT_EXCLUDES = new Set([
   ".git",
@@ -25957,6 +25992,227 @@ function concat(chunks) {
   }
   return merged;
 }
+var SKILL_BUNDLE_INSPECTION_LIMITS = Object.freeze({
+  compressedBytes: 16 * 1024 * 1024,
+  decompressedBytes: 64 * 1024 * 1024,
+  entries: 1024,
+  fileBytes: 16 * 1024 * 1024,
+  pathBytes: 100,
+  timeoutMs: 5000
+});
+
+class SkillBundleInspectionError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SkillBundleInspectionError";
+  }
+}
+function invalidBundle(message) {
+  throw new SkillBundleInspectionError("BUNDLE_INVALID", message);
+}
+function inspectionLimits(options) {
+  const limits = { ...SKILL_BUNDLE_INSPECTION_LIMITS };
+  for (const key of Object.keys(options.limits ?? {})) {
+    if (!Object.hasOwn(limits, key))
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Unknown bundle limit");
+    const field = key;
+    const value = options.limits[field];
+    if (!Number.isSafeInteger(value) || value <= 0 || value > limits[field]) {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle limits must be positive integers within the hard ceilings");
+    }
+    limits[field] = value;
+  }
+  return limits;
+}
+async function inspectSkillBundle(bundle, options = {}) {
+  const signal = options.signal;
+  const limits = inspectionLimits(options);
+  const deadline = performance.now() + limits.timeoutMs;
+  const check = () => {
+    if (signal?.aborted)
+      throw new SkillBundleInspectionError("BUNDLE_ABORTED", "Bundle inspection aborted");
+    if (performance.now() >= deadline)
+      throw new SkillBundleInspectionError("BUNDLE_TIMEOUT", "Bundle inspection deadline exceeded");
+  };
+  check();
+  if (bundle.byteLength > limits.compressedBytes)
+    throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Compressed bundle exceeds byte limit");
+  const snapshot = ownBytes(bundle);
+  check();
+  const sha256 = sha256Hex(snapshot);
+  check();
+  const parser = new BoundedTarReader(limits, check);
+  const streamOptions = { chunkSize: 16 * 1024, highWaterMark: 16 * 1024 };
+  const decoder = createGunzip(streamOptions);
+  let terminalError;
+  const stop = (code) => {
+    terminalError ??= new SkillBundleInspectionError(code, code === "BUNDLE_ABORTED" ? "Bundle inspection aborted" : "Bundle inspection deadline exceeded");
+    decoder.destroy(terminalError);
+  };
+  const onAbort = () => stop("BUNDLE_ABORTED");
+  const timer = setTimeout(() => stop("BUNDLE_TIMEOUT"), Math.max(1, deadline - performance.now()));
+  signal?.addEventListener("abort", onAbort, { once: true });
+  let decompressedByteSize = 0;
+  let bytesSinceYield = 0;
+  try {
+    check();
+    decoder.end(snapshot);
+    for await (const chunk of decoder) {
+      check();
+      decompressedByteSize += chunk.byteLength;
+      if (decompressedByteSize > limits.decompressedBytes)
+        throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Decompressed bundle exceeds byte limit");
+      parser.push(chunk);
+      bytesSinceYield += chunk.byteLength;
+      if (bytesSinceYield >= 256 * 1024) {
+        await new Promise((resolve) => setTimeout(resolve, 0));
+        bytesSinceYield = 0;
+        check();
+      }
+    }
+    check();
+    const entries = parser.finish();
+    return {
+      entries,
+      sha256,
+      compressedByteSize: snapshot.byteLength,
+      decompressedByteSize,
+      unpackedByteSize: parser.fileBytes,
+      fileCount: entries.length
+    };
+  } catch (error) {
+    if (terminalError)
+      throw terminalError;
+    if (error instanceof SkillBundleInspectionError)
+      throw error;
+    throw new SkillBundleInspectionError("BUNDLE_INVALID", "Invalid or truncated gzip bundle");
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", onAbort);
+    decoder.destroy();
+  }
+}
+
+class BoundedTarReader {
+  limits;
+  check;
+  header = new Uint8Array(BLOCK);
+  headerOffset = 0;
+  pending;
+  bodyOffset = 0;
+  padding = 0;
+  zeroBlocks = 0;
+  entries = [];
+  paths = new SkillEntryPaths;
+  fileBytes = 0;
+  constructor(limits, check) {
+    this.limits = limits;
+    this.check = check;
+  }
+  push(chunk) {
+    let offset = 0;
+    while (offset < chunk.byteLength) {
+      this.check();
+      if (this.pending) {
+        const count = Math.min(this.pending.bytes.byteLength - this.bodyOffset, chunk.byteLength - offset);
+        this.pending.bytes.set(chunk.subarray(offset, offset + count), this.bodyOffset);
+        offset += count;
+        this.bodyOffset += count;
+        if (this.bodyOffset === this.pending.bytes.byteLength) {
+          this.entries.push(this.pending);
+          this.pending = undefined;
+        }
+      } else if (this.padding) {
+        const count = Math.min(this.padding, chunk.byteLength - offset);
+        if (chunk.subarray(offset, offset + count).some((byte) => byte !== 0))
+          invalidBundle("Nonzero tar body padding");
+        offset += count;
+        this.padding -= count;
+      } else {
+        const count = Math.min(BLOCK - this.headerOffset, chunk.byteLength - offset);
+        this.header.set(chunk.subarray(offset, offset + count), this.headerOffset);
+        offset += count;
+        this.headerOffset += count;
+        if (this.headerOffset === BLOCK) {
+          this.readHeader();
+          this.headerOffset = 0;
+        }
+      }
+    }
+  }
+  finish() {
+    this.check();
+    if (this.pending || this.padding || this.headerOffset || this.zeroBlocks < 2)
+      invalidBundle("Truncated tar bundle");
+    return this.entries;
+  }
+  readHeader() {
+    this.check();
+    const h = this.header;
+    if (h.every((byte) => byte === 0)) {
+      this.zeroBlocks++;
+      return;
+    }
+    if (this.zeroBlocks)
+      invalidBundle("Nonzero tar data after terminator");
+    if (this.entries.length >= this.limits.entries)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle entry limit exceeded");
+    let checksum = 0;
+    for (let i = 0;i < BLOCK; i++)
+      checksum += i >= 148 && i < 156 ? 32 : h[i];
+    if (tarOctal(h.subarray(148, 156)) !== checksum)
+      invalidBundle("Invalid tar header checksum");
+    if (new TextDecoder().decode(h.subarray(257, 265)) !== "ustar\x00" + "00")
+      invalidBundle("Unsupported tar format");
+    if (h[156] !== 48 && h[156] !== 0 || h.subarray(157, 257).some((b) => b !== 0) || h.subarray(345).some((b) => b !== 0))
+      invalidBundle("Unsupported tar entry or path prefix");
+    const mode = tarOctal(h.subarray(100, 108));
+    if (mode > 511)
+      invalidBundle("Unsupported tar permission bits");
+    tarOctal(h.subarray(108, 116));
+    tarOctal(h.subarray(116, 124));
+    tarOctal(h.subarray(136, 148));
+    const size = tarOctal(h.subarray(124, 136));
+    if (size > this.limits.fileBytes || this.fileBytes + size > this.limits.decompressedBytes) {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle file byte limit exceeded");
+    }
+    const name = h.subarray(0, 100);
+    const end = name.indexOf(0);
+    if (end !== -1 && name.subarray(end).some((b) => b !== 0))
+      invalidBundle("Invalid tar path padding");
+    const raw = end === -1 ? name : name.subarray(0, end);
+    if (raw.byteLength > this.limits.pathBytes)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    let path;
+    try {
+      path = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw);
+    } catch {
+      return invalidBundle("Invalid UTF-8 bundle path");
+    }
+    this.paths.add(path, this.limits.pathBytes, invalidBundle, () => {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    });
+    this.fileBytes += size;
+    this.pending = { path, mode, bytes: new Uint8Array(new ArrayBuffer(size)) };
+    this.bodyOffset = 0;
+    this.padding = (BLOCK - size % BLOCK) % BLOCK;
+    if (!size) {
+      this.entries.push(this.pending);
+      this.pending = undefined;
+    }
+  }
+}
+function tarOctal(field) {
+  const text = new TextDecoder().decode(field);
+  if (!/^[0-7]+[\0 ]*$/.test(text))
+    invalidBundle("Invalid tar octal field");
+  const value = Number.parseInt(text, 8);
+  if (!Number.isSafeInteger(value))
+    invalidBundle("Tar integer is out of range");
+  return value;
+}
 
 // src/lib/skill-bundles.ts
 var SKILLS_SIGNING_KEY_ENV = "SKILLS_SIGNING_KEY";
@@ -38659,6 +38915,9 @@ import { existsSync as existsSync6, readdirSync as readdirSync6, readFileSync as
 import { join as join11, sep } from "path";
 var CONTENT_HASH_ALGORITHM = "sha256";
 var HASH_EXCLUDE_DIRS = new Set([".git", "node_modules", "dist", "build", ".turbo"]);
+function excludedHashEntry(name, directory) {
+  return name.startsWith(".") || directory && HASH_EXCLUDE_DIRS.has(name);
+}
 var HASH_COVERAGE = [
   "SKILL.md",
   "skill.json",
@@ -38740,7 +38999,7 @@ function collectDirectory(files, dir, rel) {
     if (stats.isSymbolicLink())
       continue;
     if (stats.isDirectory()) {
-      if (HASH_EXCLUDE_DIRS.has(entry))
+      if (excludedHashEntry(entry, true))
         continue;
       collectDirectory(files, absolute, childRel);
     } else if (stats.isFile()) {
@@ -38750,28 +39009,242 @@ function collectDirectory(files, dir, rel) {
 }
 function collectFile(files, absolute, rel) {
   const buffer = readFileSync8(absolute);
+  files.push(normalizeBundleFile(rel.split(sep).join("/"), buffer));
+}
+function normalizeBundleFile(rel, buffer) {
   if (rel === "skill.json") {
-    files.push({ rel: rel.split(sep).join("/"), content: new TextEncoder().encode(canonicalizeManifest(new TextDecoder().decode(buffer))) });
-    return;
+    return { rel, content: new TextEncoder().encode(canonicalizeManifest(new TextDecoder().decode(buffer))) };
   }
   if (looksLikeText(buffer)) {
     const normalized = normalizeLineEndings(new TextDecoder().decode(buffer));
-    files.push({ rel: rel.split(sep).join("/"), content: new TextEncoder().encode(normalized) });
-    return;
+    return { rel, content: new TextEncoder().encode(normalized) };
   }
-  files.push({ rel: rel.split(sep).join("/"), content: buffer });
+  return { rel, content: buffer };
 }
 function computeContentHash(skillPath) {
+  return hashBundleFiles(collectBundleFiles(skillPath));
+}
+function* bundleHashParts(files) {
+  for (const file of files) {
+    yield new TextEncoder().encode(file.rel);
+    yield new TextEncoder().encode(`\x00${file.content.length}\x00`);
+    yield file.content;
+    yield new TextEncoder().encode("\x00");
+  }
+  yield new TextEncoder().encode("\x00");
+}
+function hashBundleFiles(files) {
+  const hash = createHash6(CONTENT_HASH_ALGORITHM);
+  for (const part of bundleHashParts(files))
+    hash.update(part);
+  return hash.digest("hex");
+}
+async function hashBundleFilesCooperatively(files, check) {
   const hash = createHash6(CONTENT_HASH_ALGORITHM);
-  for (const file of collectBundleFiles(skillPath)) {
-    hash.update(new TextEncoder().encode(file.rel));
-    hash.update(new TextEncoder().encode(`\x00${file.content.length}\x00`));
-    hash.update(file.content);
-    hash.update(new TextEncoder().encode("\x00"));
+  let bytesSinceYield = 0;
+  for (const part of bundleHashParts(files)) {
+    for (let offset = 0;offset < part.byteLength; offset += 64 * 1024) {
+      check();
+      const chunk = part.subarray(offset, offset + 64 * 1024);
+      hash.update(chunk);
+      bytesSinceYield += chunk.byteLength;
+      if (bytesSinceYield >= 256 * 1024) {
+        await new Promise((resolve2) => setImmediate(resolve2));
+        bytesSinceYield = 0;
+      }
+    }
   }
-  hash.update(new TextEncoder().encode("\x00"));
+  check();
   return hash.digest("hex");
 }
+var CONTENT_HASH_LIMITS = Object.freeze({
+  entries: 1024,
+  rawBytes: 64 * 1024 * 1024,
+  normalizedBytes: 64 * 1024 * 1024,
+  fileBytes: 16 * 1024 * 1024,
+  normalizedFileBytes: 16 * 1024 * 1024,
+  pathBytes: 100,
+  manifestBytes: 16 * 1024,
+  manifestDepth: 64,
+  timeoutMs: 5000
+});
+
+class ContentHashInputError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "ContentHashInputError";
+  }
+}
+function invalidContent(message = "Invalid content hash input") {
+  throw new ContentHashInputError("CONTENT_HASH_INVALID", message);
+}
+function contentLimit(message) {
+  throw new ContentHashInputError("CONTENT_HASH_LIMIT", message);
+}
+function contentRecord(value, allowed) {
+  if (!value || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    invalidContent();
+  const result = Object.create(null);
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string" || !allowed.includes(key))
+      invalidContent();
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !("value" in descriptor))
+      invalidContent("Accessor content hash input is unsupported");
+    result[key] = descriptor.value;
+  }
+  return result;
+}
+function contentOptions(options) {
+  const record = contentRecord(options, ["limits", "signal"]);
+  const limits = { ...CONTENT_HASH_LIMITS };
+  if (record.limits !== undefined) {
+    const supplied = contentRecord(record.limits, Object.keys(limits));
+    for (const key of Object.keys(supplied)) {
+      const value = supplied[key];
+      if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0 || value > limits[key])
+        contentLimit("Invalid content hash limit");
+      limits[key] = value;
+    }
+  }
+  if (record.signal !== undefined && !(record.signal instanceof AbortSignal))
+    invalidContent("Invalid content hash signal");
+  return { limits, signal: record.signal };
+}
+var typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
+var byteLengthOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteLength").get;
+var bufferOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer").get;
+function snapshotContentEntries(entries, limits, check) {
+  if (!Array.isArray(entries))
+    invalidContent("Content hash entries must be an array");
+  if (entries.length > limits.entries)
+    contentLimit("Content hash entry limit exceeded");
+  if (Reflect.ownKeys(entries).length !== entries.length + 1)
+    invalidContent("Invalid content hash entry array");
+  const snapshot = [];
+  const paths = new SkillEntryPaths;
+  let rawBytes = 0;
+  for (let index = 0;index < entries.length; index++) {
+    check();
+    const descriptor = Object.getOwnPropertyDescriptor(entries, String(index));
+    if (!descriptor || !("value" in descriptor))
+      invalidContent("Invalid content hash entry array");
+    const entry = contentRecord(descriptor.value, ["path", "bytes", "mode"]);
+    if (typeof entry.path !== "string" || typeof entry.mode !== "number" || !Number.isInteger(entry.mode) || entry.mode < 0 || entry.mode > 511)
+      invalidContent("Invalid regular-file content hash entry");
+    paths.add(entry.path, limits.pathBytes, invalidContent, () => contentLimit("Content hash path limit exceeded"));
+    if (!(entry.bytes instanceof Uint8Array) || !ArrayBuffer.isView(entry.bytes))
+      invalidContent("Content hash entry requires bytes");
+    const size = byteLengthOf.call(entry.bytes);
+    if (!(bufferOf.call(entry.bytes) instanceof ArrayBuffer))
+      invalidContent("Shared content hash bytes are unsupported");
+    if (size > limits.fileBytes || rawBytes + size > limits.rawBytes)
+      contentLimit("Content hash raw byte limit exceeded");
+    if (entry.path === "skill.json" && size > limits.manifestBytes)
+      contentLimit("Content hash manifest byte limit exceeded");
+    rawBytes += size;
+    const bytes = new Uint8Array(new ArrayBuffer(size));
+    bytes.set(entry.bytes);
+    snapshot.push({ path: entry.path, bytes, mode: entry.mode });
+  }
+  check();
+  return snapshot;
+}
+function coveredContentPath(path) {
+  const segments = path.split("/");
+  if (!HASH_COVERAGE.includes(segments[0]))
+    return false;
+  return !segments.slice(1).some((segment, index) => excludedHashEntry(segment, index < segments.length - 2));
+}
+function boundedManifest(raw, maxDepth) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return;
+  }
+  const pending = [{ value: parsed, depth: 1 }];
+  while (pending.length) {
+    const { value, depth } = pending.pop();
+    if (!value || typeof value !== "object")
+      continue;
+    if (depth > maxDepth)
+      contentLimit("Content hash manifest depth limit exceeded");
+    for (const child of Object.values(value))
+      pending.push({ value: child, depth: depth + 1 });
+  }
+  return parsed;
+}
+async function hashContentEntries(entries, options) {
+  const { limits, signal } = contentOptions(options);
+  const deadline = performance.now() + limits.timeoutMs;
+  let terminal;
+  const abort = () => {
+    terminal ??= new ContentHashInputError("CONTENT_HASH_ABORTED", "Content hashing aborted");
+  };
+  const timer = setTimeout(() => {
+    terminal ??= new ContentHashInputError("CONTENT_HASH_TIMEOUT", "Content hashing deadline exceeded");
+  }, limits.timeoutMs);
+  const check = () => {
+    if (signal?.aborted)
+      abort();
+    if (terminal)
+      throw terminal;
+    if (performance.now() >= deadline)
+      throw new ContentHashInputError("CONTENT_HASH_TIMEOUT", "Content hashing deadline exceeded");
+  };
+  try {
+    signal?.addEventListener("abort", abort, { once: true });
+    check();
+    const snapshot = snapshotContentEntries(entries, limits, check);
+    const normalized = [];
+    let normalizedBytes = 0;
+    let manifest;
+    await new Promise((resolve2) => setImmediate(resolve2));
+    for (const entry of snapshot) {
+      check();
+      if (!coveredContentPath(entry.path))
+        continue;
+      if (entry.path === "skill.json")
+        manifest = boundedManifest(new TextDecoder().decode(entry.bytes), limits.manifestDepth);
+      const file = normalizeBundleFile(entry.path, entry.bytes);
+      check();
+      if (file.content.byteLength > limits.normalizedFileBytes || normalizedBytes + file.content.byteLength > limits.normalizedBytes)
+        contentLimit("Content hash normalized byte limit exceeded");
+      normalizedBytes += file.content.byteLength;
+      normalized.push(file);
+      await new Promise((resolve2) => setImmediate(resolve2));
+    }
+    normalized.sort((a3, b3) => a3.rel < b3.rel ? -1 : a3.rel > b3.rel ? 1 : 0);
+    check();
+    return { hash: await hashBundleFilesCooperatively(normalized, check), manifest };
+  } catch (error) {
+    if (error instanceof ContentHashInputError)
+      throw error;
+    throw new ContentHashInputError("CONTENT_HASH_INVALID", "Invalid content hash input");
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", abort);
+  }
+}
+async function computeContentHashFromEntries(entries, options = {}) {
+  return (await hashContentEntries(entries, options)).hash;
+}
+async function verifyContentHashFromEntries(entries, options = {}) {
+  const { hash, manifest } = await hashContentEntries(entries, options);
+  const provenance = manifest && typeof manifest === "object" && !Array.isArray(manifest) ? manifest.provenance : undefined;
+  const value = provenance && typeof provenance === "object" && !Array.isArray(provenance) ? provenance.content_hash : undefined;
+  if (value !== undefined && typeof value !== "string")
+    invalidContent("Invalid content hash declaration");
+  const declaredHash = value?.trim() || undefined;
+  if (!declaredHash)
+    return { declared: false, valid: false };
+  if (!/^[a-f0-9]{64}$/.test(declaredHash))
+    return { declared: true, valid: false, declaredHash };
+  return { declared: true, valid: hash === declaredHash, declaredHash, computedHash: hash };
+}
 function verifyContentHash(skillPath, manifest) {
   const declaredHash = manifest?.provenance?.content_hash?.trim() || undefined;
   if (!declaredHash)
@@ -52164,11 +52637,174 @@ function createOfflineGate(options) {
     }
   };
 }
-// src/lib/remote-workspace-selection.ts
+// src/lib/remote-invitations.ts
+class WorkspaceInvitationInputError extends Error {
+  code = "INVITATION_INPUT_INVALID";
+  constructor() {
+    super("Provide only the documented invitation fields, exact lowercase IDs, expected generation and explicit confirmation. Issue and resend require your stable idempotency key.");
+    this.name = "WorkspaceInvitationInputError";
+  }
+}
+var invitationFailures = {
+  INVALID_REQUEST: [400, "Invitation parameters were refused."],
+  ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+  INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required."],
+  WORKSPACE_ADMIN_REQUIRED: [403, "A current workspace owner or admin is required."],
+  INVITATION_FORBIDDEN: [403, "Your current role cannot manage this invitation."],
+  INVITATION_UNAVAILABLE: [404, "Invitation is unavailable for this account."],
+  INVITATION_CHANGED: [409, "Invitation changed. Read its current generation before another action."],
+  INVITATION_EXISTS: [409, "A pending invitation already exists. Read current invitations."],
+  ALREADY_MEMBER: [409, "An active membership already exists. An invitation cannot change its role."],
+  IDEMPOTENCY_CONFLICT: [409, "This request key was used for different invitation parameters. Reconcile the original request."],
+  INVITATION_LIMIT: [429, "Invitation limit reached. Wait before issuing or resending."],
+  INVITATION_BUSY: [503, "Invitation is busy. Read its state before another action."],
+  INVITATION_DELIVERY_UNAVAILABLE: [503, "Invitation email delivery is unavailable."]
+};
+
+class RemoteWorkspaceInvitationError extends Error {
+  code;
+  status;
+  constructor(code) {
+    super(invitationFailures[code][1]);
+    this.code = code;
+    this.name = "RemoteWorkspaceInvitationError";
+    this.status = invitationFailures[code][0];
+  }
+}
+
+class RemoteWorkspaceInvitationUnconfirmedError extends Error {
+  code = "INVITATION_UNCONFIRMED";
+  constructor() {
+    super("The invitation outcome is unconfirmed. Read current invitations or memberships. Reconcile issue/resend only with the same request key, parameters, server and membership; never generate a new key or retry automatically. Saved credentials are unchanged.");
+    this.name = "RemoteWorkspaceInvitationUnconfirmedError";
+  }
+}
+
+class RemoteWorkspaceInvitationReadError extends Error {
+  code = "INVITATION_READ_FAILED";
+  constructor() {
+    super("Unable to read a valid invitation result. Check the selected server, account, current membership and permissions.");
+    this.name = "RemoteWorkspaceInvitationReadError";
+  }
+}
+function invitationFailure(value, status) {
+  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(invitationFailures, value.code))
+    return null;
+  const code = value.code;
+  return invitationFailures[code][0] === status ? code : null;
+}
 var record = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
 var uuid = (v2) => typeof v2 === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v2);
-var text = (v2, max = 1024) => typeof v2 === "string" && !!v2.trim() && v2.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v2);
 var role = (v2) => typeof v2 === "string" && ["owner", "admin", "member", "viewer"].includes(v2);
+var email = (v2) => typeof v2 === "string" && v2.length <= 254 && !/[\p{Cc}\p{Cs}\u2028\u2029\s]/u.test(v2) && /^[^@]+@[^@]+\.[^@]+$/.test(v2);
+var timestamp = (v2) => typeof v2 === "string" && v2.length <= 40 && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d{1,6})?(?:Z|[+-]\d\d:\d\d)$/.test(v2) && Number.isFinite(Date.parse(v2));
+var inputFailure = () => {
+  throw new WorkspaceInvitationInputError;
+};
+function invitationInput(action, input) {
+  if (!record(input))
+    return inputFailure();
+  const keys = {
+    list: ["after"],
+    get: ["invitationId"],
+    issue: ["email", "role", "idempotencyKey", "confirm"],
+    resend: ["invitationId", "expectedGeneration", "idempotencyKey", "confirm"],
+    revoke: ["invitationId", "expectedGeneration", "confirm"],
+    accept: ["invitationId", "token", "confirm"]
+  };
+  if (Object.keys(input).some((key) => !keys[action].includes(key)) || action !== "list" && keys[action].some((key) => !Object.hasOwn(input, key)))
+    return inputFailure();
+  const value = { ...input };
+  if (action === "list") {
+    if (value.after !== undefined && !uuid(value.after))
+      return inputFailure();
+  }
+  if (["get", "resend", "revoke", "accept"].includes(action) && !uuid(value.invitationId))
+    return inputFailure();
+  if (!["list", "get"].includes(action) && value.confirm !== true)
+    return inputFailure();
+  if (["issue", "resend"].includes(action) && !uuid(value.idempotencyKey))
+    return inputFailure();
+  if (action === "issue") {
+    if (typeof value.email !== "string")
+      return inputFailure();
+    value.email = value.email.trim().toLowerCase();
+    if (!email(value.email) || !role(value.role))
+      return inputFailure();
+  }
+  if (["resend", "revoke"].includes(action) && (!Number.isInteger(value.expectedGeneration) || Number(value.expectedGeneration) < 1 || Number(value.expectedGeneration) > 10))
+    return inputFailure();
+  if (action === "accept" && (typeof value.token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value.token)))
+    return inputFailure();
+  return value;
+}
+function invitationRequest(action, input) {
+  const base = "/api/v1/workspace/invitations", value = input;
+  const { confirm: _confirm, invitationId: id, ...body } = value;
+  if (action === "list")
+    return { path: base + (value.after ? `?after=${value.after}` : ""), method: "GET" };
+  if (action === "get")
+    return { path: `${base}/${id}`, method: "GET" };
+  if (action === "accept")
+    return { path: "/api/v1/account/invitations/accept", method: "POST", body: JSON.stringify({ invitationId: id, token: value.token }) };
+  return { path: action === "issue" ? base : `${base}/${id}${action === "resend" ? "/resend" : ""}`, method: action === "revoke" ? "DELETE" : "POST", body: JSON.stringify(body) };
+}
+function invalid() {
+  throw new RemoteWorkspaceInvitationReadError;
+}
+function projection(v2, organizationId) {
+  if (!record(v2) || !uuid(v2.id) || v2.organizationId !== organizationId || !email(v2.email) || v2.email !== v2.email.trim().toLowerCase() || !role(v2.role) || !Number.isInteger(v2.generation) || Number(v2.generation) < 1 || Number(v2.generation) > 10 || typeof v2.status !== "string" || !["pending", "expired", "accepted", "revoked"].includes(v2.status) || !timestamp(v2.expiresAt) || !timestamp(v2.createdAt) || !record(v2.delivery) || typeof v2.delivery.state !== "string" || !["queued", "sending", "uncertain", "provider_accepted", "failed", "cancelled"].includes(v2.delivery.state) || !Number.isInteger(v2.delivery.attempts) || Number(v2.delivery.attempts) < 0 || Number(v2.delivery.attempts) > 5)
+    return invalid();
+  return {
+    id: v2.id,
+    organizationId,
+    email: v2.email,
+    role: v2.role,
+    generation: Number(v2.generation),
+    status: v2.status,
+    expiresAt: v2.expiresAt,
+    createdAt: v2.createdAt,
+    delivery: { state: v2.delivery.state, attempts: Number(v2.delivery.attempts) }
+  };
+}
+function parseInvitationResult(action, value, input, organizationId) {
+  if (!record(value))
+    return invalid();
+  const request = input;
+  if (action === "accept") {
+    if (!uuid(value.organizationId) || !uuid(value.membershipId) || value.accepted !== true || typeof value.changed !== "boolean")
+      return invalid();
+    return { organizationId: value.organizationId, membershipId: value.membershipId, accepted: true, changed: value.changed };
+  }
+  if (action === "list") {
+    if (value.organizationId !== organizationId || !Array.isArray(value.invitations) || value.invitations.length > 50 || value.nextCursor !== null && !uuid(value.nextCursor))
+      return invalid();
+    const invitations = value.invitations.map((v2) => projection(v2, organizationId));
+    if (invitations.some((v2, n2) => v2.id <= String(n2 ? invitations[n2 - 1].id : request.after ?? "")) || value.nextCursor !== null && (invitations.length !== 50 || value.nextCursor !== invitations.at(-1)?.id))
+      return invalid();
+    return { organizationId, invitations, nextCursor: value.nextCursor };
+  }
+  const invitation = projection(value.invitation, organizationId);
+  if (action !== "issue" && invitation.id !== request.invitationId)
+    return invalid();
+  if (action === "get")
+    return { invitation };
+  if (typeof value.changed !== "boolean")
+    return invalid();
+  if (action === "issue" && (invitation.email !== request.email || invitation.role !== request.role || value.changed && invitation.generation !== 1))
+    return invalid();
+  if (action === "resend" && (value.changed ? invitation.generation !== Number(request.expectedGeneration) + 1 : invitation.generation <= Number(request.expectedGeneration)))
+    return invalid();
+  if (action === "revoke" && (invitation.status !== "revoked" || invitation.generation < Number(request.expectedGeneration) || value.changed && invitation.generation !== request.expectedGeneration))
+    return invalid();
+  return { invitation, changed: value.changed };
+}
+
+// src/lib/remote-workspace-selection.ts
+var record2 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
+var uuid2 = (v2) => typeof v2 === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v2);
+var text = (v2, max = 1024) => typeof v2 === "string" && !!v2.trim() && v2.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v2);
+var role2 = (v2) => typeof v2 === "string" && ["owner", "admin", "member", "viewer"].includes(v2);
 var invalidWorkspaceResult = "The server returned an invalid workspace selection result.";
 
 class WorkspaceContextInputError extends Error {
@@ -52185,48 +52821,48 @@ class WorkspaceIdentityMismatchError extends Error {
   }
 }
 function workspaceExpectedUserId(value) {
-  if (!uuid(value))
+  if (!uuid2(value))
     throw new WorkspaceContextInputError;
   return value;
 }
 function workspaceContext(value) {
-  if (!record(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid(value.userId) || !uuid(value.membershipId))
+  if (!record2(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid2(value.userId) || !uuid2(value.membershipId))
     throw new WorkspaceContextInputError;
   return { userId: value.userId, membershipId: value.membershipId };
 }
-function invalid() {
+function invalid2() {
   throw new Error(invalidWorkspaceResult);
 }
 function organization(v2) {
-  if (!record(v2) || !uuid(v2.id) || !text(v2.slug) || !text(v2.name))
-    return invalid();
+  if (!record2(v2) || !uuid2(v2.id) || !text(v2.slug) || !text(v2.name))
+    return invalid2();
   return { id: v2.id, slug: v2.slug, name: v2.name };
 }
 function parseAccountWorkspaces(value) {
-  if (!record(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
-    return invalid();
+  if (!record2(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
+    return invalid2();
   const workspaces = value.workspaces.map((v2) => {
-    if (!record(v2) || !uuid(v2.membershipId) || !role(v2.role) || typeof v2.current !== "boolean")
-      return invalid();
+    if (!record2(v2) || !uuid2(v2.membershipId) || !role2(v2.role) || typeof v2.current !== "boolean")
+      return invalid2();
     return { membershipId: v2.membershipId, organization: organization(v2.organization), role: v2.role, current: v2.current };
   });
   if (workspaces.filter((w2) => w2.current).length !== 1 || new Set(workspaces.map((w2) => w2.membershipId)).size !== workspaces.length || new Set(workspaces.map((w2) => w2.organization.id)).size !== workspaces.length)
-    return invalid();
+    return invalid2();
   return { workspaces };
 }
 function parseWorkspaceIdentity(value, expectedUserId) {
-  if (!record(value))
-    return invalid();
+  if (!record2(value))
+    return invalid2();
   const user = value.user;
-  if (!record(user) || !uuid(user.id) || !uuid(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role(user.role))
-    return invalid();
+  if (!record2(user) || !uuid2(user.id) || !uuid2(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role2(user.role))
+    return invalid2();
   if (user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
   return { user: { id: user.id, membershipId: user.membershipId, email: user.email, displayName: user.displayName, role: user.role }, organization: organization(value.organization) };
 }
 function sessionToken(value) {
   if (typeof value !== "string" || !value || value.length > 8192 || /[^\x21-\x7e]/.test(value) || value.startsWith("sk_"))
-    return invalid();
+    return invalid2();
   return value;
 }
 function parseWorkspaceSession(value, expected) {
@@ -52236,9 +52872,9 @@ function parseWorkspaceSession(value, expected) {
   return { token: sessionToken(value.token), ...identity };
 }
 function parseWorkspaceLogin(value, expectedUserId) {
-  const user = record(value) && value.user;
-  if (!record(value) || !record(user) || !uuid(user.id))
-    return invalid();
+  const user = record2(value) && value.user;
+  if (!record2(value) || !record2(user) || !uuid2(user.id))
+    return invalid2();
   if (expectedUserId !== undefined && user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
   return { token: sessionToken(value.token), userId: user.id };
@@ -52252,18 +52888,18 @@ var workspaceSelectionFailures = {
   WORKSPACE_BUSY: [503, "Workspace is busy. Refresh before retrying."]
 };
 function workspaceSelectionFailure(value, status) {
-  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
+  if (!record2(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
     return null;
   const code = value.code;
   return workspaceSelectionFailures[code][0] === status ? code : null;
 }
 
 // src/lib/remote-workspace.ts
-var record2 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+var record3 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
 var cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value);
-var uuid2 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value);
+var uuid3 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value);
 function workspaceMembersQuery(options = {}) {
-  if (!record2(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+  if (!record3(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
     throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
   const query = new URLSearchParams;
   if (options.limit !== undefined)
@@ -52272,14 +52908,14 @@ function workspaceMembersQuery(options = {}) {
     query.set("cursor", options.cursor);
   return query.size ? `?${query}` : "";
 }
-function timestamp(value) {
+function timestamp2(value) {
   if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}Z$/.test(value))
     return false;
   const time = Date.parse(value);
   return Number.isFinite(time) && new Date(time).toISOString().slice(0, 23) === value.slice(0, 23);
 }
 function parseMember(row, fail) {
-  if (!record2(row) || !uuid2(row.membershipId) || !uuid2(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp(row.createdAt))
+  if (!record3(row) || !uuid3(row.membershipId) || !uuid3(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp2(row.createdAt))
     return fail();
   return {
     membershipId: row.membershipId,
@@ -52299,12 +52935,12 @@ class WorkspaceMemberInputError extends Error {
   }
 }
 function mutationInput(membershipId, input, roleChange) {
-  if (typeof membershipId !== "string" || !uuid2(membershipId) || membershipId !== membershipId.toLowerCase() || !record2(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+  if (typeof membershipId !== "string" || !uuid3(membershipId) || membershipId !== membershipId.toLowerCase() || !record3(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
     throw new WorkspaceMemberInputError;
-  const expectedRole = input.expectedRole, role2 = roleChange ? input.role : undefined;
-  if (!isRole(expectedRole) || roleChange && !isRole(role2))
+  const expectedRole = input.expectedRole, role3 = roleChange ? input.role : undefined;
+  if (!isRole(expectedRole) || roleChange && !isRole(role3))
     throw new WorkspaceMemberInputError;
-  return { membershipId, role: role2, expectedRole };
+  return { membershipId, role: role3, expectedRole };
 }
 function workspaceMemberRoleInput(membershipId, input) {
   const value = mutationInput(membershipId, input, true);
@@ -52315,19 +52951,19 @@ function workspaceMemberRemovalInput(membershipId, input) {
   return { membershipId: value.membershipId, body: { expectedRole: value.expectedRole } };
 }
 var invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.";
-function parseWorkspaceMemberRoleResult(value, membershipId, role2) {
+function parseWorkspaceMemberRoleResult(value, membershipId, role3) {
   const fail = () => {
     throw new Error(invalidMemberResult);
   };
-  if (!record2(value) || !uuid2(value.organizationId) || typeof value.changed !== "boolean")
+  if (!record3(value) || !uuid3(value.organizationId) || typeof value.changed !== "boolean")
     return fail();
   const member = parseMember(value.member, fail);
-  if (member.membershipId !== membershipId || member.role !== role2)
+  if (member.membershipId !== membershipId || member.role !== role3)
     return fail();
   return { organizationId: value.organizationId, member, changed: value.changed };
 }
 function parseWorkspaceMemberRemovalResult(value, membershipId) {
-  if (!record2(value) || !uuid2(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+  if (!record3(value) || !uuid3(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
     throw new Error(invalidMemberResult);
   return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
 }
@@ -52344,7 +52980,7 @@ var workspaceMemberFailures = {
   MEMBERSHIP_BUSY: [503, "Membership is busy. Refresh the roster before another action."]
 };
 function workspaceMemberFailure(value, status) {
-  if (!record2(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+  if (!record3(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
     return null;
   const code = value.code;
   return workspaceMemberFailures[code][0] === status ? code : null;
@@ -52353,7 +52989,7 @@ function parseWorkspaceMembersPage(value) {
   const fail = () => {
     throw new Error("The server returned an invalid workspace roster.");
   };
-  if (!record2(value) || !uuid2(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+  if (!record3(value) || !uuid3(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
     return fail();
   const members = value.members.map((row) => parseMember(row, fail));
   if (new Set(members.map((row) => row.membershipId)).size !== members.length)
@@ -52898,6 +53534,53 @@ class RemoteSkillsClient {
     }
     return parseWorkspaceLeaveResult(body, captured.context.membershipId, identity.organization.id);
   }
+  listWorkspaceInvitations(context, options = {}) {
+    return this.requestWorkspaceInvitation(context, "list", options);
+  }
+  getWorkspaceInvitation(context, invitationId) {
+    return this.requestWorkspaceInvitation(context, "get", { invitationId });
+  }
+  issueWorkspaceInvitation(context, input) {
+    return this.requestWorkspaceInvitation(context, "issue", input);
+  }
+  resendWorkspaceInvitation(context, invitationId, input) {
+    return this.requestWorkspaceInvitation(context, "resend", { ...input, invitationId });
+  }
+  revokeWorkspaceInvitation(context, invitationId, input) {
+    return this.requestWorkspaceInvitation(context, "revoke", { ...input, invitationId });
+  }
+  acceptWorkspaceInvitation(context, invitationId, input) {
+    return this.requestWorkspaceInvitation(context, "accept", { ...input, invitationId });
+  }
+  async requestWorkspaceInvitation(context, action, input) {
+    const target = workspaceContext(context), captured = invitationInput(action, input);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const identityValue = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!identityValue || typeof identityValue !== "object" || identityValue.authMethod !== "jwt")
+      throw new RemoteWorkspaceInvitationError("INTERACTIVE_SESSION_REQUIRED");
+    const identity = parseWorkspaceIdentity(identityValue, target.userId);
+    if (identity.user.membershipId !== target.membershipId)
+      throw new WorkspaceIdentityMismatchError;
+    const request = invitationRequest(action, captured), read = action === "list" || action === "get";
+    let response, value;
+    try {
+      response = await connection.request(request.path, { method: request.method, ...request.body ? { body: request.body } : {}, credentials: "omit" });
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 64 * 1024 : 4096)));
+    } catch {
+      throw read ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+    }
+    if (!response.ok) {
+      const code = invitationFailure(value, response.status);
+      if (code)
+        throw new RemoteWorkspaceInvitationError(code);
+      throw read ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+    }
+    try {
+      return parseInvitationResult(action, value, captured, identity.organization.id);
+    } catch {
+      throw read ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+    }
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -53148,13 +53831,13 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record3, field) {
-  if (record3[field] === undefined)
+function requireOptionalString(record4, field) {
+  if (record4[field] === undefined)
     return;
-  if (typeof record3[field] !== "string") {
+  if (typeof record4[field] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field} must be a string when present)`);
   }
-  return record3[field];
+  return record4[field];
 }
 var INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 function isVersionRecord(value) {
@@ -53177,19 +53860,19 @@ function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record3 = entry;
-  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  const record4 = entry;
+  const slug = typeof record4.slug === "string" && record4.slug.trim() ? record4.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record3.metadata !== undefined) {
-    if (!record3.metadata || typeof record3.metadata !== "object" || Array.isArray(record3.metadata)) {
+  if (record4.metadata !== undefined) {
+    if (!record4.metadata || typeof record4.metadata !== "object" || Array.isArray(record4.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record3.metadata;
+    metadata = record4.metadata;
   }
-  const pinnedAt = requireOptionalString(record3, "pinnedAt");
+  const pinnedAt = requireOptionalString(record4, "pinnedAt");
   return {
     slug,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -53206,16 +53889,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record3 = entry;
-  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  const record4 = entry;
+  const slug = typeof record4.slug === "string" && record4.slug.trim() ? record4.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug,
-    ...requireOptionalString(record3, "name") !== undefined ? { name: requireOptionalString(record3, "name") } : {},
-    ...requireOptionalString(record3, "version") !== undefined ? { version: requireOptionalString(record3, "version") } : {},
-    ...requireOptionalString(record3, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record3, "updatedAt") } : {}
+    ...requireOptionalString(record4, "name") !== undefined ? { name: requireOptionalString(record4, "name") } : {},
+    ...requireOptionalString(record4, "version") !== undefined ? { version: requireOptionalString(record4, "version") } : {},
+    ...requireOptionalString(record4, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record4, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -53268,12 +53951,12 @@ function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record3 = payload;
-  if (!Array.isArray(record3.skills)) {
+  const record4 = payload;
+  if (!Array.isArray(record4.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record3.skills.map(normalizeSkillSummary);
-  const nextCursor = record3.nextCursor === undefined || record3.nextCursor === null ? null : record3.nextCursor;
+  const skills = record4.skills.map(normalizeSkillSummary);
+  const nextCursor = record4.nextCursor === undefined || record4.nextCursor === null ? null : record4.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -53283,6 +53966,101 @@ async function createRemoteSkillsClient(env = process.env) {
   const connection = await resolveSkillsConnection(env);
   return connection ? new RemoteSkillsClient(connection.apiKey, connection.apiOrigin) : null;
 }
+// src/lib/remote-invitation-recovery.ts
+class InvitationEmailInputError extends Error {
+  code = "INVITATION_EMAIL_INPUT_INVALID";
+  constructor() {
+    super("Use an explicit Skills API URL, exact invitation and retained challenge IDs, secret input, and deliberate confirmation.");
+    this.name = "InvitationEmailInputError";
+  }
+}
+var refusals = {
+  INVALID_REQUEST: [400, "Invitation recovery parameters were refused."],
+  ORIGIN_REQUIRED: [403, "Invitation recovery requires the configured site origin."],
+  INVITATION_PROOF_UNAVAILABLE: [401, "Invitation proof is unavailable. Sign in or explicitly request another recovery code."],
+  RATE_LIMITED: [429, "Invitation verification is rate limited. Wait before another deliberate action."],
+  INVITATION_BUSY: [503, "Invitation is busy. Sign in to check membership before another deliberate action."],
+  INVITATION_DELIVERY_UNAVAILABLE: [503, "Invitation recovery is unavailable on this service."]
+};
+
+class RemoteInvitationEmailError extends Error {
+  code;
+  status;
+  constructor(code) {
+    super(refusals[code][1]);
+    this.code = code;
+    this.name = "RemoteInvitationEmailError";
+    this.status = refusals[code][0];
+  }
+}
+
+class RemoteInvitationEmailUnconfirmedError extends Error {
+  action;
+  code = "INVITATION_EMAIL_UNCONFIRMED";
+  constructor(action) {
+    super(action === "challenge" ? "The recovery challenge outcome is unconfirmed. Retain the same invitation, challenge ID and server. Check your inbox; never rotate the challenge or retry automatically. No delivery is confirmed." : "Invitation acceptance is unconfirmed. Use fresh ordinary sign-in to inspect available memberships. Do not retry acceptance automatically; explicitly request another recovery code only if needed. Saved credentials are unchanged.");
+    this.action = action;
+    this.name = "RemoteInvitationEmailUnconfirmedError";
+  }
+}
+var record4 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
+var uuid4 = (v2) => typeof v2 === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v2);
+function invitationEmailIds(invitationId, challengeId) {
+  if (!uuid4(invitationId) || !uuid4(challengeId))
+    throw new InvitationEmailInputError;
+  return { invitationId, challengeId };
+}
+function invitationEmailInput(action, input) {
+  const keys = ["invitationId", "token", "challengeId", "confirm", ...action === "accept" ? ["code"] : []];
+  if (!record4(input) || Object.keys(input).length !== keys.length || keys.some((key) => !Object.hasOwn(input, key)))
+    throw new InvitationEmailInputError;
+  const value = { ...input };
+  const ids = invitationEmailIds(value.invitationId, value.challengeId);
+  if (value.confirm !== true || typeof value.token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value.token) || action === "accept" && (typeof value.code !== "string" || !/^\d{6}$/.test(value.code)))
+    throw new InvitationEmailInputError;
+  return { ...ids, token: value.token, confirm: true, ...action === "accept" ? { code: value.code } : {} };
+}
+async function requestInvitationEmail(origin, action, input) {
+  const value = invitationEmailInput(action, input);
+  let target;
+  try {
+    target = normalizeSkillsApiOrigin(origin);
+  } catch {
+    throw new InvitationEmailInputError;
+  }
+  const body = JSON.stringify({ invitationId: value.invitationId, token: value.token, challengeId: value.challengeId, ...action === "accept" ? { code: value.code } : {} });
+  try {
+    const response = await fetch(`${target}/api/v1/account/invitations/email-${action}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body,
+      credentials: "omit",
+      redirect: "error",
+      cache: "no-store",
+      referrerPolicy: "no-referrer",
+      signal: AbortSignal.timeout(15000)
+    });
+    const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 4096)));
+    if (!response.ok && record4(parsed) && typeof parsed.code === "string" && Object.hasOwn(refusals, parsed.code)) {
+      const code = parsed.code;
+      if (response.status === refusals[code][0])
+        throw new RemoteInvitationEmailError(code);
+    }
+    if (!record4(parsed))
+      throw new RemoteInvitationEmailUnconfirmedError(action);
+    if (action === "challenge" && response.status === 202 && parsed.challengeId === value.challengeId && parsed.expiresIn === 600 && typeof parsed.message === "string" && parsed.message.length <= 256) {
+      return { challengeId: value.challengeId, message: "If this invitation is eligible, a verification code will arrive. Delivery is not confirmed.", expiresIn: 600 };
+    }
+    if (action === "accept" && response.status === 200 && uuid4(parsed.organizationId) && uuid4(parsed.membershipId) && parsed.accepted === true && parsed.changed === true && parsed.signInRequired === true) {
+      return { organizationId: parsed.organizationId, membershipId: parsed.membershipId, accepted: true, changed: true, signInRequired: true };
+    }
+  } catch (error) {
+    if (error instanceof RemoteInvitationEmailError)
+      throw error;
+  }
+  throw new RemoteInvitationEmailUnconfirmedError(action);
+}
+
 // src/lib/remote-auth.ts
 var MAX_ERROR_DETAIL_LENGTH = 200;
 
@@ -53323,10 +54101,10 @@ async function requestAuthApi(instance, path, options) {
   const text2 = await res.text();
   const body = text2 ? parseJsonBody(text2) : {};
   if (!res.ok) {
-    const record3 = isRecord6(body) ? body : {};
-    const detail = typeof record3.detail === "string" ? record3.detail : undefined;
-    const error = typeof record3.error === "string" ? record3.error : undefined;
-    const code = typeof record3.code === "string" ? record3.code : undefined;
+    const record5 = isRecord6(body) ? body : {};
+    const detail = typeof record5.detail === "string" ? record5.detail : undefined;
+    const error = typeof record5.error === "string" ? record5.error : undefined;
+    const code = typeof record5.code === "string" ? record5.code : undefined;
     throw new HostedApiError(detail || error || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -53360,11 +54138,17 @@ class RemoteSkillsAuthClient {
   constructor(apiUrl) {
     this.apiOrigin = normalizeSkillsApiOrigin(apiUrl);
   }
-  requestCode(email) {
-    return this.request("/api/auth/login", { method: "POST", body: JSON.stringify({ email }) });
+  requestInvitationEmailChallenge(input) {
+    return requestInvitationEmail(this.apiOrigin, "challenge", input);
+  }
+  acceptInvitationEmailChallenge(input) {
+    return requestInvitationEmail(this.apiOrigin, "accept", input);
+  }
+  requestCode(email2) {
+    return this.request("/api/auth/login", { method: "POST", body: JSON.stringify({ email: email2 }) });
   }
-  verifyCode(email, code) {
-    return this.request("/api/auth/verify", { method: "POST", body: JSON.stringify({ email, code }) });
+  verifyCode(email2, code) {
+    return this.request("/api/auth/verify", { method: "POST", body: JSON.stringify({ email: email2, code }) });
   }
   startDevice() {
     return this.request("/api/auth/device/start", { method: "POST", body: JSON.stringify({ client: "skills-sdk" }) });
@@ -53372,34 +54156,34 @@ class RemoteSkillsAuthClient {
   pollDevice(deviceCode) {
     return this.request("/api/auth/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) });
   }
-  async sessionClient(email, code, context) {
+  async sessionClient(email2, code, context) {
     if (context !== undefined) {
       const target = workspaceContext(context), apiOrigin2 = this.apiOrigin;
-      const session = await this.switchWorkspace(email, code, target);
+      const session = await this.switchWorkspace(email2, code, target);
       return new RemoteSkillsClient(session.token, apiOrigin2);
     }
     const apiOrigin = this.apiOrigin;
-    if (!email.includes("@") || !/^\d{6}$/.test(code))
+    if (!email2.includes("@") || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
-    const login = await this.verifyCode(email, code);
+    const login = await this.verifyCode(email2, code);
     if (!login || typeof login.token !== "string" || !login.token)
       throw new Error("The server did not return an authorized account session");
     return new RemoteSkillsClient(login.token, apiOrigin);
   }
-  async listAccountWorkspaces(email, code, expectedUserId) {
-    const login = await this.workspaceLogin(email, code, expectedUserId);
+  async listAccountWorkspaces(email2, code, expectedUserId) {
+    const login = await this.workspaceLogin(email2, code, expectedUserId);
     const result = await new RemoteSkillsClient(login.token, login.apiOrigin).listAccountWorkspaces(login.userId);
     return { userId: login.userId, ...result };
   }
-  async switchWorkspace(email, code, context) {
+  async switchWorkspace(email2, code, context) {
     const target = workspaceContext(context);
-    const login = await this.workspaceLogin(email, code, target.userId);
+    const login = await this.workspaceLogin(email2, code, target.userId);
     return new RemoteSkillsClient(login.token, login.apiOrigin).switchWorkspace(target);
   }
-  async workspaceLogin(email, code, expectedUserId) {
+  async workspaceLogin(email2, code, expectedUserId) {
     const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
     const apiOrigin = this.apiOrigin;
-    if (typeof email !== "string" || !email.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
+    if (typeof email2 !== "string" || !email2.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
     let response;
     try {
@@ -53409,7 +54193,7 @@ class RemoteSkillsAuthClient {
         credentials: "omit",
         signal: AbortSignal.timeout(15000),
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ email, code })
+        body: JSON.stringify({ email: email2, code })
       });
     } catch {
       throw new HostedApiError("Unable to verify the Skills account.");
@@ -53426,40 +54210,67 @@ class RemoteSkillsAuthClient {
     }
     return { ...parseWorkspaceLogin(value, expected), apiOrigin };
   }
-  async createApiKey(email, code, name, scopes, context) {
+  async listWorkspaceInvitations(email2, code, context, options = {}) {
+    const target = workspaceContext(context), captured = invitationInput("list", options);
+    return (await this.sessionClient(email2, code, target)).listWorkspaceInvitations(target, captured);
+  }
+  async getWorkspaceInvitation(email2, code, context, invitationId) {
+    const target = workspaceContext(context), captured = invitationInput("get", { invitationId });
+    return (await this.sessionClient(email2, code, target)).getWorkspaceInvitation(target, captured.invitationId);
+  }
+  async issueWorkspaceInvitation(email2, code, context, input) {
+    const target = workspaceContext(context), captured = invitationInput("issue", input);
+    return (await this.sessionClient(email2, code, target)).issueWorkspaceInvitation(target, captured);
+  }
+  async resendWorkspaceInvitation(email2, code, context, invitationId, input) {
+    const target = workspaceContext(context), captured = invitationInput("resend", { ...input, invitationId });
+    const { invitationId: id, ...options } = captured;
+    return (await this.sessionClient(email2, code, target)).resendWorkspaceInvitation(target, id, options);
+  }
+  async revokeWorkspaceInvitation(email2, code, context, invitationId, input) {
+    const target = workspaceContext(context), captured = invitationInput("revoke", { ...input, invitationId });
+    const { invitationId: id, ...options } = captured;
+    return (await this.sessionClient(email2, code, target)).revokeWorkspaceInvitation(target, id, options);
+  }
+  async acceptWorkspaceInvitation(email2, code, context, invitationId, input) {
+    const target = workspaceContext(context), captured = invitationInput("accept", { ...input, invitationId });
+    const { invitationId: id, ...options } = captured;
+    return (await this.sessionClient(email2, code, target)).acceptWorkspaceInvitation(target, id, options);
+  }
+  async createApiKey(email2, code, name, scopes, context) {
     const capturedScopes = scopes === undefined ? undefined : [...scopes];
-    return (await this.sessionClient(email, code, context)).createApiKey(name, capturedScopes);
+    return (await this.sessionClient(email2, code, context)).createApiKey(name, capturedScopes);
   }
-  async listApiKeys(email, code, context) {
-    return (await this.sessionClient(email, code, context)).listApiKeys();
+  async listApiKeys(email2, code, context) {
+    return (await this.sessionClient(email2, code, context)).listApiKeys();
   }
-  async revokeApiKey(email, code, keyId, context) {
-    return (await this.sessionClient(email, code, context)).revokeApiKey(keyId);
+  async revokeApiKey(email2, code, keyId, context) {
+    return (await this.sessionClient(email2, code, context)).revokeApiKey(keyId);
   }
-  async updateProfile(email, code, input, context) {
+  async updateProfile(email2, code, input, context) {
     const body = customerNamePatch(input, "displayName");
-    return (await this.sessionClient(email, code, context)).updateProfile({ displayName: body.displayName });
+    return (await this.sessionClient(email2, code, context)).updateProfile({ displayName: body.displayName });
   }
-  async updateCurrentWorkspace(email, code, input, context) {
+  async updateCurrentWorkspace(email2, code, input, context) {
     const body = customerNamePatch(input, "name");
-    return (await this.sessionClient(email, code, context)).updateCurrentWorkspace({ name: body.name });
+    return (await this.sessionClient(email2, code, context)).updateCurrentWorkspace({ name: body.name });
   }
-  async listWorkspaceMembers(email, code, options = {}, context) {
+  async listWorkspaceMembers(email2, code, options = {}, context) {
     workspaceMembersQuery(options);
     const captured = { ...options };
-    return (await this.sessionClient(email, code, context)).listWorkspaceMembers(captured);
+    return (await this.sessionClient(email2, code, context)).listWorkspaceMembers(captured);
   }
-  async setWorkspaceMemberRole(email, code, membershipId, input, context) {
+  async setWorkspaceMemberRole(email2, code, membershipId, input, context) {
     const captured = workspaceMemberRoleInput(membershipId, input);
-    return (await this.sessionClient(email, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
+    return (await this.sessionClient(email2, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
   }
-  async leaveWorkspace(email, code, context, input) {
+  async leaveWorkspace(email2, code, context, input) {
     const captured = workspaceLeaveInput(context, input);
-    return (await this.sessionClient(email, code, captured.context)).leaveWorkspace(captured.context, captured.input);
+    return (await this.sessionClient(email2, code, captured.context)).leaveWorkspace(captured.context, captured.input);
   }
-  async removeWorkspaceMember(email, code, membershipId, input, context) {
+  async removeWorkspaceMember(email2, code, membershipId, input, context) {
     const captured = workspaceMemberRemovalInput(membershipId, input);
-    return (await this.sessionClient(email, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
+    return (await this.sessionClient(email2, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
   }
   request(path, options) {
     if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
@@ -53468,6 +54279,7 @@ class RemoteSkillsAuthClient {
   }
 }
 export {
+  verifyContentHashFromEntries,
   validateRunLifecycleEvent,
   startedByFor,
   startSkillsServer,
@@ -53482,6 +54294,7 @@ export {
   runPointersOf,
   runLeaseSchema,
   runAdmissionSchema,
+  revisionIdOf,
   resolveSkillsFleet,
   resolveSkillsApiOrigin,
   resolveServerConfig,
@@ -53495,6 +54308,7 @@ export {
   redactRunOutput,
   receiptId,
   protocolStateOf,
+  packSkillBundle,
   noticeLocalSkillsMode,
   normalizeSkillsApiOrigin,
   normalizeRemoteSkillRunContract,
@@ -53506,6 +54320,7 @@ export {
   isTerminalStatus,
   isSkillsLocalOptIn,
   isActiveStatus,
+  inspectSkillBundle,
   getServerSkillMd,
   getServerSkill,
   expiresAtFor,
@@ -53531,6 +54346,7 @@ export {
   createCancelService,
   createAwsEcsClient,
   configuredSkillsApiUrl,
+  computeContentHashFromEntries,
   clientTokenFor,
   canonicalSystemDepsKey,
   canonicalJson,
@@ -53541,12 +54357,15 @@ export {
   assertDurableStore,
   artifactStorageSeam,
   WorkspaceLeaveInputError,
+  WorkspaceInvitationInputError,
   WorkspaceIdentityMismatchError,
   WorkspaceContextInputError,
   SqliteSkillsStore,
   SqliteRunExecutionStore,
   SqliteGovernanceStore,
   SkillsFleetCredentialError,
+  SkillBundleInspectionError,
+  SKILL_BUNDLE_INSPECTION_LIMITS,
   SKILLS_LOCAL_OPT_IN_ENV_KEYS,
   SKILLS_APP,
   SKILLS_API_URL_ENV,
@@ -53555,10 +54374,15 @@ export {
   RemoteWorkspaceMemberError,
   RemoteWorkspaceLeaveUnconfirmedError,
   RemoteWorkspaceLeaveError,
+  RemoteWorkspaceInvitationUnconfirmedError,
+  RemoteWorkspaceInvitationReadError,
+  RemoteWorkspaceInvitationError,
   RemoteSkillsClient,
   RemoteSkillsAuthClient,
   RemoteRouteUnsupportedError,
   RemoteRequestError,
+  RemoteInvitationEmailUnconfirmedError,
+  RemoteInvitationEmailError,
   RemoteCreditApprovalError,
   RemoteCapabilityUnavailableError,
   RUN_PROTOCOL_VERSION,
@@ -53573,6 +54397,7 @@ export {
   MemoryRunExecutionStore,
   MemoryGovernanceStore,
   LEGAL_TRANSITIONS,
+  InvitationEmailInputError,
   ImageProfileResolutionError,
   HostedApiError,
   GovernanceError,
@@ -53588,6 +54413,8 @@ export {
   DEFAULT_RUN_LIMITS,
   DEFAULT_OUTPUT_GOVERNANCE,
   DEFAULT_IMAGE_PROFILES,
+  ContentHashInputError,
+  CONTENT_HASH_LIMITS,
   CLIENT_TOKEN_BYTES,
   ArtifactStorage
 };