@hasna/skills 0.5.2 → 0.5.4

package/bin/index.js

@@ -20,12 +20,14 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -48,7 +50,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
 // ../../node_modules/.bun/react@18.3.1/node_modules/react/cjs/react.development.js
-var require_react_development = __commonJS((exports, module) => {
+var require_react_development = __commonJS(function(exports, module) {
   if (true) {
     (function() {
       if (typeof __REACT_DEVTOOLS_GLOBAL_HOOK__ !== "undefined" && typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.registerInternalModuleStart === "function") {
@@ -1851,7 +1853,7 @@ Check the top-level render call using <` + parentName + ">.";
 });
 
 // ../../node_modules/.bun/react@18.3.1/node_modules/react/index.js
-var require_react = __commonJS((exports, module) => {
+var require_react = __commonJS(function(exports, module) {
   var react_development = __toESM(require_react_development());
   if (false) {} else {
     module.exports = react_development;
@@ -1859,7 +1861,7 @@ var require_react = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/signal-exit@3.0.7/node_modules/signal-exit/signals.js
-var require_signals = __commonJS((exports, module) => {
+var require_signals = __commonJS(function(exports, module) {
   module.exports = [
     "SIGABRT",
     "SIGALRM",
@@ -1876,7 +1878,7 @@ var require_signals = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/signal-exit@3.0.7/node_modules/signal-exit/index.js
-var require_signal_exit = __commonJS((exports, module) => {
+var require_signal_exit = __commonJS(function(exports, module) {
   var process3 = global.process;
   var processOk = function(process4) {
     return process4 && typeof process4 === "object" && typeof process4.removeListener === "function" && typeof process4.emit === "function" && typeof process4.reallyExit === "function" && typeof process4.listeners === "function" && typeof process4.kill === "function" && typeof process4.pid === "number" && typeof process4.on === "function";
@@ -2029,7 +2031,7 @@ var require_signal_exit = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/scheduler@0.23.2/node_modules/scheduler/cjs/scheduler.development.js
-var require_scheduler_development = __commonJS((exports) => {
+var require_scheduler_development = __commonJS(function(exports) {
   if (true) {
     (function() {
       if (typeof __REACT_DEVTOOLS_GLOBAL_HOOK__ !== "undefined" && typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.registerInternalModuleStart === "function") {
@@ -2472,7 +2474,7 @@ var require_scheduler_development = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/scheduler@0.23.2/node_modules/scheduler/index.js
-var require_scheduler = __commonJS((exports, module) => {
+var require_scheduler = __commonJS(function(exports, module) {
   var scheduler_development = __toESM(require_scheduler_development());
   if (false) {} else {
     module.exports = scheduler_development;
@@ -2480,7 +2482,7 @@ var require_scheduler = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/react-reconciler@0.29.2+f4eacebf2041cd4f/node_modules/react-reconciler/cjs/react-reconciler.development.js
-var require_react_reconciler_development = __commonJS((exports, module) => {
+var require_react_reconciler_development = __commonJS(function(exports, module) {
   var React = __toESM(require_react());
   var Scheduler = __toESM(require_scheduler());
   if (true) {
@@ -17226,14 +17228,14 @@ Check the render method of \`` + ownerName + "`.";
 });
 
 // ../../node_modules/.bun/react-reconciler@0.29.2+f4eacebf2041cd4f/node_modules/react-reconciler/index.js
-var require_react_reconciler = __commonJS((exports, module) => {
+var require_react_reconciler = __commonJS(function(exports, module) {
   if (false) {} else {
     module.exports = require_react_reconciler_development();
   }
 });
 
 // ../../node_modules/.bun/react-reconciler@0.29.2+f4eacebf2041cd4f/node_modules/react-reconciler/cjs/react-reconciler-constants.development.js
-var require_react_reconciler_constants_development = __commonJS((exports) => {
+var require_react_reconciler_constants_development = __commonJS(function(exports) {
   if (true) {
     (function() {
       var SyncLane = 1;
@@ -17257,7 +17259,7 @@ var require_react_reconciler_constants_development = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/react-reconciler@0.29.2+f4eacebf2041cd4f/node_modules/react-reconciler/constants.js
-var require_constants = __commonJS((exports, module) => {
+var require_constants = __commonJS(function(exports, module) {
   if (false) {} else {
     module.exports = require_react_reconciler_constants_development();
   }
@@ -17317,7 +17319,7 @@ var init_devtools_window_polyfill = __esm(() => {
 });
 
 // ../../node_modules/.bun/react-devtools-core@7.0.1/node_modules/react-devtools-core/dist/backend.js
-var require_backend = __commonJS((exports, module) => {
+var require_backend = __commonJS(function(exports, module) {
   (function webpackUniversalModuleDefinition(root, factory) {
     if (typeof exports === "object" && typeof module === "object")
       module.exports = factory();
@@ -34120,7 +34122,7 @@ var init_devtools = __esm(() => {
 });
 
 // ../../node_modules/.bun/cli-boxes@3.0.0/node_modules/cli-boxes/boxes.json
-var require_boxes = __commonJS((exports, module) => {
+var require_boxes = __commonJS(function(exports, module) {
   module.exports = {
     single: {
       topLeft: "\u250C",
@@ -34206,7 +34208,7 @@ var require_boxes = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/cli-boxes@3.0.0/node_modules/cli-boxes/index.js
-var require_cli_boxes = __commonJS((exports, module) => {
+var require_cli_boxes = __commonJS(function(exports, module) {
   var cliBoxes = require_boxes();
   module.exports = cliBoxes;
   module.exports.default = cliBoxes;
@@ -34702,7 +34704,7 @@ var init_source = __esm(() => {
 });
 
 // ../../node_modules/.bun/mimic-fn@2.1.0/node_modules/mimic-fn/index.js
-var require_mimic_fn = __commonJS((exports, module) => {
+var require_mimic_fn = __commonJS(function(exports, module) {
   var mimicFn = (to, from) => {
     for (const prop of Reflect.ownKeys(from)) {
       Object.defineProperty(to, prop, Object.getOwnPropertyDescriptor(from, prop));
@@ -34714,7 +34716,7 @@ var require_mimic_fn = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/onetime@5.1.2/node_modules/onetime/index.js
-var require_onetime = __commonJS((exports, module) => {
+var require_onetime = __commonJS(function(exports, module) {
   var mimicFn = require_mimic_fn();
   var calledFunctions = new WeakMap;
   var onetime = (function_, options = {}) => {
@@ -34749,7 +34751,7 @@ var require_onetime = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/escape-string-regexp@2.0.0/node_modules/escape-string-regexp/index.js
-var require_escape_string_regexp = __commonJS((exports, module) => {
+var require_escape_string_regexp = __commonJS(function(exports, module) {
   var matchOperatorsRegex = /[|\\{}()[\]^$+*?.-]/g;
   module.exports = (string) => {
     if (typeof string !== "string") {
@@ -34760,7 +34762,7 @@ var require_escape_string_regexp = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/stack-utils@2.0.6/node_modules/stack-utils/index.js
-var require_stack_utils = __commonJS((exports, module) => {
+var require_stack_utils = __commonJS(function(exports, module) {
   var escapeStringRegexp = require_escape_string_regexp();
   var cwd = typeof process === "object" && process && typeof process.cwd === "function" ? process.cwd() : ".";
   var natives = [].concat(__require("module").builtinModules, "bootstrap_node", "node").map((n) => new RegExp(`(?:\\((?:node:)?${n}(?:\\.js)?:\\d+:\\d+\\)$|^\\s*at (?:node:)?${n}(?:\\.js)?:\\d+:\\d+$)`));
@@ -34998,7 +35000,7 @@ var require_stack_utils = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/error.js
-var require_error = __commonJS((exports) => {
+var require_error = __commonJS(function(exports) {
   class CommanderError extends Error {
     constructor(exitCode, code, message) {
       super(message);
@@ -35022,7 +35024,7 @@ var require_error = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/argument.js
-var require_argument = __commonJS((exports) => {
+var require_argument = __commonJS(function(exports) {
   var { InvalidArgumentError } = require_error();
 
   class Argument {
@@ -35101,7 +35103,7 @@ var require_argument = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/help.js
-var require_help = __commonJS((exports) => {
+var require_help = __commonJS(function(exports) {
   var { humanReadableArgName } = require_argument();
 
   class Help {
@@ -35350,7 +35352,7 @@ var require_help = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/option.js
-var require_option = __commonJS((exports) => {
+var require_option = __commonJS(function(exports) {
   var { InvalidArgumentError } = require_error();
 
   class Option {
@@ -35501,7 +35503,7 @@ var require_option = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/suggestSimilar.js
-var require_suggestSimilar = __commonJS((exports) => {
+var require_suggestSimilar = __commonJS(function(exports) {
   var maxDistance = 3;
   function editDistance(a, b) {
     if (Math.abs(a.length - b.length) > maxDistance)
@@ -35574,7 +35576,7 @@ var require_suggestSimilar = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/command.js
-var require_command = __commonJS((exports) => {
+var require_command = __commonJS(function(exports) {
   var EventEmitter3 = __require("events").EventEmitter;
   var childProcess = __require("child_process");
   var path = __require("path");
@@ -36817,7 +36819,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
 });
 
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/index.js
-var require_commander = __commonJS((exports) => {
+var require_commander = __commonJS(function(exports) {
   var { Argument } = require_argument();
   var { Command } = require_command();
   var { CommanderError, InvalidArgumentError } = require_error();
@@ -36860,7 +36862,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.5.2",
+    version: "0.5.4",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -36984,7 +36986,7 @@ var init_package = __esm(() => {
 });
 
 // ../../node_modules/.bun/react@18.3.1/node_modules/react/cjs/react-jsx-dev-runtime.development.js
-var require_react_jsx_dev_runtime_development = __commonJS((exports) => {
+var require_react_jsx_dev_runtime_development = __commonJS(function(exports) {
   var React13 = __toESM(require_react());
   if (true) {
     (function() {
@@ -37865,7 +37867,7 @@ Check the top-level render call using <` + parentName + ">.";
 });
 
 // ../../node_modules/.bun/react@18.3.1/node_modules/react/jsx-dev-runtime.js
-var require_jsx_dev_runtime = __commonJS((exports, module) => {
+var require_jsx_dev_runtime = __commonJS(function(exports, module) {
   var react_jsx_dev_runtime_development = __toESM(require_react_jsx_dev_runtime_development());
   if (false) {} else {
     module.exports = react_jsx_dev_runtime_development;
@@ -39322,11 +39324,13 @@ var init_skill_validation = __esm(() => {
   VALID_PROVENANCE_SOURCES = new Set(["official", "custom", "remote", "private", "private-hosted", "upstream", "extension"]);
   VALID_BIN_COMMAND = /^[a-z0-9][a-z0-9._-]*$/;
 });
-
 // src/lib/skill-hash.ts
 import { createHash } from "crypto";
 import { existsSync as existsSync9, readdirSync as readdirSync4, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
 import { join as join9, sep } from "path";
+function excludedHashEntry(name, directory) {
+  return name.startsWith(".") || directory && HASH_EXCLUDE_DIRS.has(name);
+}
 function normalizeLineEndings(content) {
   return content.replace(/\r\n/g, `
 `).replace(/\r/g, `
@@ -39397,7 +39401,7 @@ function collectDirectory(files, dir, rel) {
     if (stats.isSymbolicLink())
       continue;
     if (stats.isDirectory()) {
-      if (HASH_EXCLUDE_DIRS.has(entry))
+      if (excludedHashEntry(entry, true))
         continue;
       collectDirectory(files, absolute, childRel);
     } else if (stats.isFile()) {
@@ -39407,26 +39411,34 @@ function collectDirectory(files, dir, rel) {
 }
 function collectFile(files, absolute, rel) {
   const buffer = readFileSync5(absolute);
+  files.push(normalizeBundleFile(rel.split(sep).join("/"), buffer));
+}
+function normalizeBundleFile(rel, buffer) {
   if (rel === "skill.json") {
-    files.push({ rel: rel.split(sep).join("/"), content: new TextEncoder().encode(canonicalizeManifest(new TextDecoder().decode(buffer))) });
-    return;
+    return { rel, content: new TextEncoder().encode(canonicalizeManifest(new TextDecoder().decode(buffer))) };
   }
   if (looksLikeText(buffer)) {
     const normalized = normalizeLineEndings(new TextDecoder().decode(buffer));
-    files.push({ rel: rel.split(sep).join("/"), content: new TextEncoder().encode(normalized) });
-    return;
+    return { rel, content: new TextEncoder().encode(normalized) };
   }
-  files.push({ rel: rel.split(sep).join("/"), content: buffer });
+  return { rel, content: buffer };
 }
 function computeContentHash(skillPath) {
-  const hash = createHash(CONTENT_HASH_ALGORITHM);
-  for (const file of collectBundleFiles(skillPath)) {
-    hash.update(new TextEncoder().encode(file.rel));
-    hash.update(new TextEncoder().encode(`\x00${file.content.length}\x00`));
-    hash.update(file.content);
-    hash.update(new TextEncoder().encode("\x00"));
+  return hashBundleFiles(collectBundleFiles(skillPath));
+}
+function* bundleHashParts(files) {
+  for (const file of files) {
+    yield new TextEncoder().encode(file.rel);
+    yield new TextEncoder().encode(`\x00${file.content.length}\x00`);
+    yield file.content;
+    yield new TextEncoder().encode("\x00");
   }
-  hash.update(new TextEncoder().encode("\x00"));
+  yield new TextEncoder().encode("\x00");
+}
+function hashBundleFiles(files) {
+  const hash = createHash(CONTENT_HASH_ALGORITHM);
+  for (const part of bundleHashParts(files))
+    hash.update(part);
   return hash.digest("hex");
 }
 function verifyContentHash(skillPath, manifest) {
@@ -39463,7 +39475,7 @@ function hashSkillMarkdown(content) {
 function hashSkillMarkdownFile(path) {
   return hashSkillMarkdown(readFileSync5(path, "utf-8"));
 }
-var CONTENT_HASH_ALGORITHM = "sha256", HASH_EXCLUDE_DIRS, HASH_COVERAGE;
+var CONTENT_HASH_ALGORITHM = "sha256", HASH_EXCLUDE_DIRS, HASH_COVERAGE, CONTENT_HASH_LIMITS, typedArrayPrototype, byteLengthOf, bufferOf;
 var init_skill_hash = __esm(() => {
   HASH_EXCLUDE_DIRS = new Set([".git", "node_modules", "dist", "build", ".turbo"]);
   HASH_COVERAGE = [
@@ -39477,6 +39489,20 @@ var init_skill_hash = __esm(() => {
     "assets",
     "references"
   ];
+  CONTENT_HASH_LIMITS = Object.freeze({
+    entries: 1024,
+    rawBytes: 64 * 1024 * 1024,
+    normalizedBytes: 64 * 1024 * 1024,
+    fileBytes: 16 * 1024 * 1024,
+    normalizedFileBytes: 16 * 1024 * 1024,
+    pathBytes: 100,
+    manifestBytes: 16 * 1024,
+    manifestDepth: 64,
+    timeoutMs: 5000
+  });
+  typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
+  byteLengthOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteLength").get;
+  bufferOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer").get;
 });
 
 // src/lib/portable-skills-types.ts
@@ -40891,21 +40917,21 @@ var init_search = __esm(() => {
 // src/lib/registry.ts
 var exports_registry = {};
 __export(exports_registry, {
-  searchSkills: () => searchSkills,
-  loadRegistryProfile: () => loadRegistryProfile,
-  loadRegistry: () => loadRegistry,
-  loadBasicRegistry: () => loadBasicRegistry,
-  isBasicSkillName: () => isBasicSkillName,
-  getSkillsByTag: () => getSkillsByTag,
-  getSkillsByCategory: () => getSkillsByCategory,
-  getSkill: () => getSkill,
-  getAllTags: () => getAllTags,
-  findSimilarSkills: () => findSimilarSkills,
-  findExtensionSkillPath: () => findExtensionSkillPath,
-  clearRegistryCache: () => clearRegistryCache,
-  SKILLS: () => SKILLS,
+  BASIC_SKILL_NAMES: () => BASIC_SKILL_NAMES,
   CATEGORIES: () => CATEGORIES,
-  BASIC_SKILL_NAMES: () => BASIC_SKILL_NAMES
+  SKILLS: () => SKILLS,
+  clearRegistryCache: () => clearRegistryCache,
+  findExtensionSkillPath: () => findExtensionSkillPath,
+  findSimilarSkills: () => findSimilarSkills,
+  getAllTags: () => getAllTags,
+  getSkill: () => getSkill,
+  getSkillsByCategory: () => getSkillsByCategory,
+  getSkillsByTag: () => getSkillsByTag,
+  isBasicSkillName: () => isBasicSkillName,
+  loadBasicRegistry: () => loadBasicRegistry,
+  loadRegistry: () => loadRegistry,
+  loadRegistryProfile: () => loadRegistryProfile,
+  searchSkills: () => searchSkills
 });
 import { existsSync as existsSync12, readFileSync as readFileSync7, readdirSync as readdirSync6 } from "fs";
 import { join as join12 } from "path";
@@ -41082,7 +41108,7 @@ var init_registry = __esm(() => {
 });
 
 // ../../node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/spinners.json
-var require_spinners = __commonJS((exports, module) => {
+var require_spinners = __commonJS(function(exports, module) {
   module.exports = {
     dots: {
       interval: 80,
@@ -42708,7 +42734,7 @@ var require_spinners = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/index.js
-var require_cli_spinners = __commonJS((exports, module) => {
+var require_cli_spinners = __commonJS(function(exports, module) {
   var spinners = Object.assign({}, require_spinners());
   var spinnersList = Object.keys(spinners);
   Object.defineProperty(spinners, "random", {
@@ -43338,30 +43364,30 @@ var init_project_state = __esm(() => {
 // src/lib/installer.ts
 var exports_installer = {};
 __export(exports_installer, {
-  unpinSkill: () => unpinSkill,
-  skillExists: () => skillExists,
-  resolveAgents: () => resolveAgents,
-  removeSkillForAgent: () => removeSkillForAgent,
-  removeSkill: () => removeSkill,
-  pinSkill: () => pinSkill,
-  installSkills: () => installSkills,
-  installSkillSource: () => installSkillSource,
-  installSkillManifest: () => installSkillManifest,
-  installSkillForAgent: () => installSkillForAgent,
-  installSkill: () => installSkill,
-  installRemoteSkill: () => installRemoteSkill,
-  getSkillPath: () => getSkillPath,
-  getPinnedSkills: () => getPinnedSkills,
-  getInstalledSkills: () => getInstalledSkills,
-  getInstallMeta: () => getInstallMeta,
-  getDisabledSkills: () => getDisabledSkills,
-  getAgentSkillsDir: () => getAgentSkillsDir,
-  getAgentSkillPath: () => getAgentSkillPath,
-  enableSkill: () => enableSkill,
-  disableSkill: () => disableSkill,
-  createLocalSkillManifest: () => createLocalSkillManifest,
+  AGENT_LABELS: () => AGENT_LABELS,
   AGENT_TARGETS: () => AGENT_TARGETS,
-  AGENT_LABELS: () => AGENT_LABELS
+  createLocalSkillManifest: () => createLocalSkillManifest,
+  disableSkill: () => disableSkill,
+  enableSkill: () => enableSkill,
+  getAgentSkillPath: () => getAgentSkillPath,
+  getAgentSkillsDir: () => getAgentSkillsDir,
+  getDisabledSkills: () => getDisabledSkills,
+  getInstallMeta: () => getInstallMeta,
+  getInstalledSkills: () => getInstalledSkills,
+  getPinnedSkills: () => getPinnedSkills,
+  getSkillPath: () => getSkillPath,
+  installRemoteSkill: () => installRemoteSkill,
+  installSkill: () => installSkill,
+  installSkillForAgent: () => installSkillForAgent,
+  installSkillManifest: () => installSkillManifest,
+  installSkillSource: () => installSkillSource,
+  installSkills: () => installSkills,
+  pinSkill: () => pinSkill,
+  removeSkill: () => removeSkill,
+  removeSkillForAgent: () => removeSkillForAgent,
+  resolveAgents: () => resolveAgents,
+  skillExists: () => skillExists,
+  unpinSkill: () => unpinSkill
 });
 import { existsSync as existsSync16, readFileSync as readFileSync10, rmSync as rmSync4 } from "fs";
 import { dirname as dirname5, join as join16 } from "path";
@@ -43784,7 +43810,7 @@ import { isIP as isIP2 } from "net";
 import { spawnSync } from "child_process";
 import { closeSync, fstatSync, openSync, readFileSync as readFileSync11 } from "fs";
 import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
-import { createRequire } from "module";
+import { createRequire as createRequire2 } from "module";
 import { hostname as osHostname } from "os";
 import { isAbsolute as isAbsolute3, join as join17 } from "path";
 function envToken(name) {
@@ -43905,7 +43931,7 @@ function readAppConfigFile(path) {
     const uid = process.getuid?.() ?? process.geteuid?.();
     if (uid !== undefined && before2.uid !== uid)
       unsafe("the file is not owned by the current user");
-    if (before2.size > MAX_CREDENTIAL_FILE_BYTES)
+    if (before2.size > MAX_CREDENTIAL_FILE_BYTES2)
       unsafe("the file exceeds the size limit");
     const bytes = readFileSync11(fd);
     const after2 = fstatSync(fd);
@@ -43989,13 +44015,13 @@ function sealCredential(fields) {
       configurable: false
     });
   }
-  Object.defineProperty(sealed, INSPECT_CUSTOM, {
+  Object.defineProperty(sealed, INSPECT_CUSTOM2, {
     value: () => ({ ...visible, apiKey: "[redacted]" }),
     enumerable: false,
     writable: false,
     configurable: false
   });
-  Object.defineProperty(sealed, CREDENTIAL_SEAL, {
+  Object.defineProperty(sealed, CREDENTIAL_SEAL2, {
     value: true,
     enumerable: false,
     writable: false,
@@ -44014,7 +44040,7 @@ function firstEnvValue(env3, keys2) {
   return null;
 }
 function isAmbientEnvironment(env3) {
-  return env3 === process.env || env3[AMBIENT_ENVIRONMENT] === true;
+  return env3 === process.env || env3[AMBIENT_ENVIRONMENT2] === true;
 }
 function defaultKeychainRunner(argv) {
   const result2 = spawnSync(KEYCHAIN_SECURITY_BIN, [...argv], {
@@ -44108,7 +44134,7 @@ function snapshotClientEnvironment(name, env3) {
     snapshot[key] = descriptor.value;
   }
   if (ambient) {
-    Object.defineProperty(snapshot, AMBIENT_ENVIRONMENT, {
+    Object.defineProperty(snapshot, AMBIENT_ENVIRONMENT2, {
       value: true,
       enumerable: false,
       writable: false,
@@ -44265,7 +44291,7 @@ async function completePointerCredential(name, pointerResolution, env3 = process
   }
   let secretsSdk;
   try {
-    secretsSdk = requireSecretsSdk(SECRETS_PACKAGE_SPECIFIER);
+    secretsSdk = requireSecretsSdk2(SECRETS_PACKAGE_SPECIFIER2);
   } catch {
     throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
   }
@@ -44411,7 +44437,7 @@ function toV1BaseUrl(apiUrl) {
   url.pathname = `${path}/v1`;
   return url.toString().replace(/\/+$/, "");
 }
-var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM, CREDENTIAL_SEAL, AMBIENT_ENVIRONMENT, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS;
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES2, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM2, CREDENTIAL_SEAL2, AMBIENT_ENVIRONMENT2, SECRETS_PACKAGE_SPECIFIER2, requireSecretsSdk2, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, IDEMPOTENT_METHODS2, AUTHORITY_OVERRIDE_HEADERS2;
 var init_transport = __esm(() => {
   CredentialResolutionError = class CredentialResolutionError extends Error {
     appName;
@@ -44431,21 +44457,21 @@ var init_transport = __esm(() => {
       this.path = path;
     }
   };
-  MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
+  MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
   SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
   SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
   ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
   VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
   CREDENTIAL_SHAPED_KEY = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
-  INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
-  CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
-  AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
-  SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
-  requireSecretsSdk = createRequire(import.meta.url);
+  INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
+  CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
+  AMBIENT_ENVIRONMENT2 = Symbol.for("hasna:contracts:ambientClientEnvironment");
+  SECRETS_PACKAGE_SPECIFIER2 = "@hasna/" + "secrets";
+  requireSecretsSdk2 = createRequire2(import.meta.url);
   ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
   DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
-  IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-  AUTHORITY_OVERRIDE_HEADERS = new Set([
+  IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+  AUTHORITY_OVERRIDE_HEADERS2 = new Set([
     "host",
     ":authority",
     "forwarded",
@@ -44574,31 +44600,31 @@ var init_local_opt_in = __esm(() => {
 // src/lib/fleet-credentials.ts
 var exports_fleet_credentials = {};
 __export(exports_fleet_credentials, {
-  skillsCredentialOrReason: () => skillsCredentialOrReason,
-  skillsCredentialFiles: () => skillsCredentialFiles,
-  skillsCredentialFilePath: () => skillsCredentialFilePath,
-  selectsSkillsLocalMode: () => selectsSkillsLocalMode,
-  resolveSkillsFleet: () => resolveSkillsFleet,
-  resolveSkillsConnection: () => resolveSkillsConnection,
-  resolveSkillsApiOrigin: () => resolveSkillsApiOrigin,
-  resolveSkillsApiKey: () => resolveSkillsApiKey,
-  resetLocalSkillsModeNotice: () => resetLocalSkillsModeNotice,
-  requireSkillsFleet: () => requireSkillsFleet,
-  requireSkillsApiOrigin: () => requireSkillsApiOrigin,
-  requireSkillsApiKey: () => requireSkillsApiKey,
-  noticeLocalSkillsMode: () => noticeLocalSkillsMode,
-  normalizeSkillsApiOrigin: () => normalizeSkillsApiOrigin,
-  isSkillsLocalOptIn: () => isSkillsLocalOptIn,
-  isSkillsFleetCredentialError: () => isSkillsFleetCredentialError,
-  configuredSkillsApiUrl: () => configuredSkillsApiUrl,
-  SkillsFleetCredentialError: () => SkillsFleetCredentialError,
-  SKILLS_LOCAL_OPT_IN_ENV_KEYS: () => SKILLS_LOCAL_OPT_IN_ENV_KEYS,
-  SKILLS_APP: () => SKILLS_APP,
-  SKILLS_API_URL_ENV_KEYS: () => SKILLS_API_URL_ENV_KEYS,
-  SKILLS_API_URL_ENV: () => SKILLS_API_URL_ENV,
-  SKILLS_API_KEY_ENV_KEYS: () => SKILLS_API_KEY_ENV_KEYS,
+  MissingSkillsFleetError: () => MissingSkillsFleetError,
   SKILLS_API_KEY_ENV: () => SKILLS_API_KEY_ENV,
-  MissingSkillsFleetError: () => MissingSkillsFleetError
+  SKILLS_API_KEY_ENV_KEYS: () => SKILLS_API_KEY_ENV_KEYS,
+  SKILLS_API_URL_ENV: () => SKILLS_API_URL_ENV,
+  SKILLS_API_URL_ENV_KEYS: () => SKILLS_API_URL_ENV_KEYS,
+  SKILLS_APP: () => SKILLS_APP,
+  SKILLS_LOCAL_OPT_IN_ENV_KEYS: () => SKILLS_LOCAL_OPT_IN_ENV_KEYS,
+  SkillsFleetCredentialError: () => SkillsFleetCredentialError,
+  configuredSkillsApiUrl: () => configuredSkillsApiUrl,
+  isSkillsFleetCredentialError: () => isSkillsFleetCredentialError,
+  isSkillsLocalOptIn: () => isSkillsLocalOptIn,
+  normalizeSkillsApiOrigin: () => normalizeSkillsApiOrigin,
+  noticeLocalSkillsMode: () => noticeLocalSkillsMode,
+  requireSkillsApiKey: () => requireSkillsApiKey,
+  requireSkillsApiOrigin: () => requireSkillsApiOrigin,
+  requireSkillsFleet: () => requireSkillsFleet,
+  resetLocalSkillsModeNotice: () => resetLocalSkillsModeNotice,
+  resolveSkillsApiKey: () => resolveSkillsApiKey,
+  resolveSkillsApiOrigin: () => resolveSkillsApiOrigin,
+  resolveSkillsConnection: () => resolveSkillsConnection,
+  resolveSkillsFleet: () => resolveSkillsFleet,
+  selectsSkillsLocalMode: () => selectsSkillsLocalMode,
+  skillsCredentialFilePath: () => skillsCredentialFilePath,
+  skillsCredentialFiles: () => skillsCredentialFiles,
+  skillsCredentialOrReason: () => skillsCredentialOrReason
 });
 function isCredentialResolutionError(error) {
   return error instanceof CredentialResolutionError || typeof error === "object" && error !== null && error.name === "CredentialResolutionError";
@@ -48704,113 +48730,113 @@ var init_types = __esm(() => {
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
-  void: () => voidType,
-  util: () => util,
-  unknown: () => unknownType,
-  union: () => unionType,
-  undefined: () => undefinedType,
-  tuple: () => tupleType,
-  transformer: () => effectsType,
-  symbol: () => symbolType,
-  string: () => stringType,
-  strictObject: () => strictObjectType,
-  setErrorMap: () => setErrorMap,
-  set: () => setType,
-  record: () => recordType,
-  quotelessJson: () => quotelessJson,
-  promise: () => promiseType,
-  preprocess: () => preprocessType,
-  pipeline: () => pipelineType,
-  ostring: () => ostring,
-  optional: () => optionalType,
-  onumber: () => onumber,
-  oboolean: () => oboolean,
-  objectUtil: () => objectUtil,
-  object: () => objectType,
-  number: () => numberType,
-  nullable: () => nullableType,
-  null: () => nullType,
-  never: () => neverType,
-  nativeEnum: () => nativeEnumType,
-  nan: () => nanType,
-  map: () => mapType,
-  makeIssue: () => makeIssue,
-  literal: () => literalType,
-  lazy: () => lazyType,
-  late: () => late,
-  isValid: () => isValid,
-  isDirty: () => isDirty,
-  isAsync: () => isAsync,
-  isAborted: () => isAborted,
-  intersection: () => intersectionType,
-  instanceof: () => instanceOfType,
-  getParsedType: () => getParsedType,
-  getErrorMap: () => getErrorMap,
-  function: () => functionType,
-  enum: () => enumType,
-  effect: () => effectsType,
-  discriminatedUnion: () => discriminatedUnionType,
-  defaultErrorMap: () => en_default,
-  datetimeRegex: () => datetimeRegex,
-  date: () => dateType,
-  custom: () => custom,
-  coerce: () => coerce,
-  boolean: () => booleanType,
-  bigint: () => bigIntType,
-  array: () => arrayType,
-  any: () => anyType,
-  addIssueToContext: () => addIssueToContext,
-  ZodVoid: () => ZodVoid,
-  ZodUnknown: () => ZodUnknown,
-  ZodUnion: () => ZodUnion,
-  ZodUndefined: () => ZodUndefined,
-  ZodType: () => ZodType,
-  ZodTuple: () => ZodTuple,
-  ZodTransformer: () => ZodEffects,
-  ZodSymbol: () => ZodSymbol,
-  ZodString: () => ZodString,
-  ZodSet: () => ZodSet,
-  ZodSchema: () => ZodType,
-  ZodRecord: () => ZodRecord,
-  ZodReadonly: () => ZodReadonly,
-  ZodPromise: () => ZodPromise,
-  ZodPipeline: () => ZodPipeline,
-  ZodParsedType: () => ZodParsedType,
-  ZodOptional: () => ZodOptional,
-  ZodObject: () => ZodObject,
-  ZodNumber: () => ZodNumber,
-  ZodNullable: () => ZodNullable,
-  ZodNull: () => ZodNull,
-  ZodNever: () => ZodNever,
-  ZodNativeEnum: () => ZodNativeEnum,
-  ZodNaN: () => ZodNaN,
-  ZodMap: () => ZodMap,
-  ZodLiteral: () => ZodLiteral,
-  ZodLazy: () => ZodLazy,
-  ZodIssueCode: () => ZodIssueCode,
-  ZodIntersection: () => ZodIntersection,
-  ZodFunction: () => ZodFunction,
-  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
-  ZodError: () => ZodError,
-  ZodEnum: () => ZodEnum,
-  ZodEffects: () => ZodEffects,
-  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
-  ZodDefault: () => ZodDefault,
-  ZodDate: () => ZodDate,
-  ZodCatch: () => ZodCatch,
-  ZodBranded: () => ZodBranded,
-  ZodBoolean: () => ZodBoolean,
-  ZodBigInt: () => ZodBigInt,
-  ZodArray: () => ZodArray,
-  ZodAny: () => ZodAny,
-  Schema: () => ZodType,
-  ParseStatus: () => ParseStatus,
-  OK: () => OK,
-  NEVER: () => NEVER,
-  INVALID: () => INVALID,
-  EMPTY_PATH: () => EMPTY_PATH,
+  BRAND: () => BRAND,
   DIRTY: () => DIRTY,
-  BRAND: () => BRAND
+  EMPTY_PATH: () => EMPTY_PATH,
+  INVALID: () => INVALID,
+  NEVER: () => NEVER,
+  OK: () => OK,
+  ParseStatus: () => ParseStatus,
+  Schema: () => ZodType,
+  ZodAny: () => ZodAny,
+  ZodArray: () => ZodArray,
+  ZodBigInt: () => ZodBigInt,
+  ZodBoolean: () => ZodBoolean,
+  ZodBranded: () => ZodBranded,
+  ZodCatch: () => ZodCatch,
+  ZodDate: () => ZodDate,
+  ZodDefault: () => ZodDefault,
+  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
+  ZodEffects: () => ZodEffects,
+  ZodEnum: () => ZodEnum,
+  ZodError: () => ZodError,
+  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
+  ZodFunction: () => ZodFunction,
+  ZodIntersection: () => ZodIntersection,
+  ZodIssueCode: () => ZodIssueCode,
+  ZodLazy: () => ZodLazy,
+  ZodLiteral: () => ZodLiteral,
+  ZodMap: () => ZodMap,
+  ZodNaN: () => ZodNaN,
+  ZodNativeEnum: () => ZodNativeEnum,
+  ZodNever: () => ZodNever,
+  ZodNull: () => ZodNull,
+  ZodNullable: () => ZodNullable,
+  ZodNumber: () => ZodNumber,
+  ZodObject: () => ZodObject,
+  ZodOptional: () => ZodOptional,
+  ZodParsedType: () => ZodParsedType,
+  ZodPipeline: () => ZodPipeline,
+  ZodPromise: () => ZodPromise,
+  ZodReadonly: () => ZodReadonly,
+  ZodRecord: () => ZodRecord,
+  ZodSchema: () => ZodType,
+  ZodSet: () => ZodSet,
+  ZodString: () => ZodString,
+  ZodSymbol: () => ZodSymbol,
+  ZodTransformer: () => ZodEffects,
+  ZodTuple: () => ZodTuple,
+  ZodType: () => ZodType,
+  ZodUndefined: () => ZodUndefined,
+  ZodUnion: () => ZodUnion,
+  ZodUnknown: () => ZodUnknown,
+  ZodVoid: () => ZodVoid,
+  addIssueToContext: () => addIssueToContext,
+  any: () => anyType,
+  array: () => arrayType,
+  bigint: () => bigIntType,
+  boolean: () => booleanType,
+  coerce: () => coerce,
+  custom: () => custom,
+  date: () => dateType,
+  datetimeRegex: () => datetimeRegex,
+  defaultErrorMap: () => en_default,
+  discriminatedUnion: () => discriminatedUnionType,
+  effect: () => effectsType,
+  enum: () => enumType,
+  function: () => functionType,
+  getErrorMap: () => getErrorMap,
+  getParsedType: () => getParsedType,
+  instanceof: () => instanceOfType,
+  intersection: () => intersectionType,
+  isAborted: () => isAborted,
+  isAsync: () => isAsync,
+  isDirty: () => isDirty,
+  isValid: () => isValid,
+  late: () => late,
+  lazy: () => lazyType,
+  literal: () => literalType,
+  makeIssue: () => makeIssue,
+  map: () => mapType,
+  nan: () => nanType,
+  nativeEnum: () => nativeEnumType,
+  never: () => neverType,
+  null: () => nullType,
+  nullable: () => nullableType,
+  number: () => numberType,
+  object: () => objectType,
+  objectUtil: () => objectUtil,
+  oboolean: () => oboolean,
+  onumber: () => onumber,
+  optional: () => optionalType,
+  ostring: () => ostring,
+  pipeline: () => pipelineType,
+  preprocess: () => preprocessType,
+  promise: () => promiseType,
+  quotelessJson: () => quotelessJson,
+  record: () => recordType,
+  set: () => setType,
+  setErrorMap: () => setErrorMap,
+  strictObject: () => strictObjectType,
+  string: () => stringType,
+  symbol: () => symbolType,
+  transformer: () => effectsType,
+  tuple: () => tupleType,
+  undefined: () => undefinedType,
+  union: () => unionType,
+  unknown: () => unknownType,
+  util: () => util,
+  void: () => voidType
 });
 var init_external = __esm(() => {
   init_errors();
@@ -49045,50 +49071,210 @@ var init_read_access = __esm(() => {
   init_remote_registry();
 });
 
+// src/lib/remote-invitations.ts
+function invitationFailure(value, status) {
+  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(invitationFailures, value.code))
+    return null;
+  const code = value.code;
+  return invitationFailures[code][0] === status ? code : null;
+}
+function invitationId(value) {
+  return uuid(value) ? value : inputFailure();
+}
+function invitationInput(action, input) {
+  if (!record(input))
+    return inputFailure();
+  const keys2 = {
+    list: ["after"],
+    get: ["invitationId"],
+    issue: ["email", "role", "idempotencyKey", "confirm"],
+    resend: ["invitationId", "expectedGeneration", "idempotencyKey", "confirm"],
+    revoke: ["invitationId", "expectedGeneration", "confirm"],
+    accept: ["invitationId", "token", "confirm"]
+  };
+  if (Object.keys(input).some((key) => !keys2[action].includes(key)) || action !== "list" && keys2[action].some((key) => !Object.hasOwn(input, key)))
+    return inputFailure();
+  const value = { ...input };
+  if (action === "list") {
+    if (value.after !== undefined && !uuid(value.after))
+      return inputFailure();
+  }
+  if (["get", "resend", "revoke", "accept"].includes(action) && !uuid(value.invitationId))
+    return inputFailure();
+  if (!["list", "get"].includes(action) && value.confirm !== true)
+    return inputFailure();
+  if (["issue", "resend"].includes(action) && !uuid(value.idempotencyKey))
+    return inputFailure();
+  if (action === "issue") {
+    if (typeof value.email !== "string")
+      return inputFailure();
+    value.email = value.email.trim().toLowerCase();
+    if (!email(value.email) || !role(value.role))
+      return inputFailure();
+  }
+  if (["resend", "revoke"].includes(action) && (!Number.isInteger(value.expectedGeneration) || Number(value.expectedGeneration) < 1 || Number(value.expectedGeneration) > 10))
+    return inputFailure();
+  if (action === "accept" && (typeof value.token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value.token)))
+    return inputFailure();
+  return value;
+}
+function invitationRequest(action, input) {
+  const base2 = "/api/v1/workspace/invitations", value = input;
+  const { confirm: _confirm, invitationId: id, ...body } = value;
+  if (action === "list")
+    return { path: base2 + (value.after ? `?after=${value.after}` : ""), method: "GET" };
+  if (action === "get")
+    return { path: `${base2}/${id}`, method: "GET" };
+  if (action === "accept")
+    return { path: "/api/v1/account/invitations/accept", method: "POST", body: JSON.stringify({ invitationId: id, token: value.token }) };
+  return { path: action === "issue" ? base2 : `${base2}/${id}${action === "resend" ? "/resend" : ""}`, method: action === "revoke" ? "DELETE" : "POST", body: JSON.stringify(body) };
+}
+function invalid() {
+  throw new RemoteWorkspaceInvitationReadError;
+}
+function projection(v, organizationId) {
+  if (!record(v) || !uuid(v.id) || v.organizationId !== organizationId || !email(v.email) || v.email !== v.email.trim().toLowerCase() || !role(v.role) || !Number.isInteger(v.generation) || Number(v.generation) < 1 || Number(v.generation) > 10 || typeof v.status !== "string" || !["pending", "expired", "accepted", "revoked"].includes(v.status) || !timestamp(v.expiresAt) || !timestamp(v.createdAt) || !record(v.delivery) || typeof v.delivery.state !== "string" || !["queued", "sending", "uncertain", "provider_accepted", "failed", "cancelled"].includes(v.delivery.state) || !Number.isInteger(v.delivery.attempts) || Number(v.delivery.attempts) < 0 || Number(v.delivery.attempts) > 5)
+    return invalid();
+  return {
+    id: v.id,
+    organizationId,
+    email: v.email,
+    role: v.role,
+    generation: Number(v.generation),
+    status: v.status,
+    expiresAt: v.expiresAt,
+    createdAt: v.createdAt,
+    delivery: { state: v.delivery.state, attempts: Number(v.delivery.attempts) }
+  };
+}
+function parseInvitationResult(action, value, input, organizationId) {
+  if (!record(value))
+    return invalid();
+  const request = input;
+  if (action === "accept") {
+    if (!uuid(value.organizationId) || !uuid(value.membershipId) || value.accepted !== true || typeof value.changed !== "boolean")
+      return invalid();
+    return { organizationId: value.organizationId, membershipId: value.membershipId, accepted: true, changed: value.changed };
+  }
+  if (action === "list") {
+    if (value.organizationId !== organizationId || !Array.isArray(value.invitations) || value.invitations.length > 50 || value.nextCursor !== null && !uuid(value.nextCursor))
+      return invalid();
+    const invitations = value.invitations.map((v) => projection(v, organizationId));
+    if (invitations.some((v, n) => v.id <= String(n ? invitations[n - 1].id : request.after ?? "")) || value.nextCursor !== null && (invitations.length !== 50 || value.nextCursor !== invitations.at(-1)?.id))
+      return invalid();
+    return { organizationId, invitations, nextCursor: value.nextCursor };
+  }
+  const invitation = projection(value.invitation, organizationId);
+  if (action !== "issue" && invitation.id !== request.invitationId)
+    return invalid();
+  if (action === "get")
+    return { invitation };
+  if (typeof value.changed !== "boolean")
+    return invalid();
+  if (action === "issue" && (invitation.email !== request.email || invitation.role !== request.role || value.changed && invitation.generation !== 1))
+    return invalid();
+  if (action === "resend" && (value.changed ? invitation.generation !== Number(request.expectedGeneration) + 1 : invitation.generation <= Number(request.expectedGeneration)))
+    return invalid();
+  if (action === "revoke" && (invitation.status !== "revoked" || invitation.generation < Number(request.expectedGeneration) || value.changed && invitation.generation !== request.expectedGeneration))
+    return invalid();
+  return { invitation, changed: value.changed };
+}
+var WorkspaceInvitationInputError, invitationFailures, RemoteWorkspaceInvitationError, RemoteWorkspaceInvitationUnconfirmedError, RemoteWorkspaceInvitationReadError, record = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), role = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), email = (v) => typeof v === "string" && v.length <= 254 && !/[\p{Cc}\p{Cs}\u2028\u2029\s]/u.test(v) && /^[^@]+@[^@]+\.[^@]+$/.test(v), timestamp = (v) => typeof v === "string" && v.length <= 40 && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d{1,6})?(?:Z|[+-]\d\d:\d\d)$/.test(v) && Number.isFinite(Date.parse(v)), inputFailure = () => {
+  throw new WorkspaceInvitationInputError;
+};
+var init_remote_invitations = __esm(() => {
+  WorkspaceInvitationInputError = class WorkspaceInvitationInputError extends Error {
+    code = "INVITATION_INPUT_INVALID";
+    constructor() {
+      super("Provide only the documented invitation fields, exact lowercase IDs, expected generation and explicit confirmation. Issue and resend require your stable idempotency key.");
+      this.name = "WorkspaceInvitationInputError";
+    }
+  };
+  invitationFailures = {
+    INVALID_REQUEST: [400, "Invitation parameters were refused."],
+    ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required."],
+    WORKSPACE_ADMIN_REQUIRED: [403, "A current workspace owner or admin is required."],
+    INVITATION_FORBIDDEN: [403, "Your current role cannot manage this invitation."],
+    INVITATION_UNAVAILABLE: [404, "Invitation is unavailable for this account."],
+    INVITATION_CHANGED: [409, "Invitation changed. Read its current generation before another action."],
+    INVITATION_EXISTS: [409, "A pending invitation already exists. Read current invitations."],
+    ALREADY_MEMBER: [409, "An active membership already exists. An invitation cannot change its role."],
+    IDEMPOTENCY_CONFLICT: [409, "This request key was used for different invitation parameters. Reconcile the original request."],
+    INVITATION_LIMIT: [429, "Invitation limit reached. Wait before issuing or resending."],
+    INVITATION_BUSY: [503, "Invitation is busy. Read its state before another action."],
+    INVITATION_DELIVERY_UNAVAILABLE: [503, "Invitation email delivery is unavailable."]
+  };
+  RemoteWorkspaceInvitationError = class RemoteWorkspaceInvitationError extends Error {
+    code;
+    status;
+    constructor(code) {
+      super(invitationFailures[code][1]);
+      this.code = code;
+      this.name = "RemoteWorkspaceInvitationError";
+      this.status = invitationFailures[code][0];
+    }
+  };
+  RemoteWorkspaceInvitationUnconfirmedError = class RemoteWorkspaceInvitationUnconfirmedError extends Error {
+    code = "INVITATION_UNCONFIRMED";
+    constructor() {
+      super("The invitation outcome is unconfirmed. Read current invitations or memberships. Reconcile issue/resend only with the same request key, parameters, server and membership; never generate a new key or retry automatically. Saved credentials are unchanged.");
+      this.name = "RemoteWorkspaceInvitationUnconfirmedError";
+    }
+  };
+  RemoteWorkspaceInvitationReadError = class RemoteWorkspaceInvitationReadError extends Error {
+    code = "INVITATION_READ_FAILED";
+    constructor() {
+      super("Unable to read a valid invitation result. Check the selected server, account, current membership and permissions.");
+      this.name = "RemoteWorkspaceInvitationReadError";
+    }
+  };
+});
+
 // src/lib/remote-workspace-selection.ts
 function workspaceExpectedUserId(value) {
-  if (!uuid(value))
+  if (!uuid2(value))
     throw new WorkspaceContextInputError;
   return value;
 }
 function workspaceContext(value) {
-  if (!record(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid(value.userId) || !uuid(value.membershipId))
+  if (!record2(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid2(value.userId) || !uuid2(value.membershipId))
     throw new WorkspaceContextInputError;
   return { userId: value.userId, membershipId: value.membershipId };
 }
-function invalid() {
+function invalid2() {
   throw new Error(invalidWorkspaceResult);
 }
 function organization(v) {
-  if (!record(v) || !uuid(v.id) || !text(v.slug) || !text(v.name))
-    return invalid();
+  if (!record2(v) || !uuid2(v.id) || !text(v.slug) || !text(v.name))
+    return invalid2();
   return { id: v.id, slug: v.slug, name: v.name };
 }
 function parseAccountWorkspaces(value) {
-  if (!record(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
-    return invalid();
+  if (!record2(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
+    return invalid2();
   const workspaces = value.workspaces.map((v) => {
-    if (!record(v) || !uuid(v.membershipId) || !role(v.role) || typeof v.current !== "boolean")
-      return invalid();
+    if (!record2(v) || !uuid2(v.membershipId) || !role2(v.role) || typeof v.current !== "boolean")
+      return invalid2();
     return { membershipId: v.membershipId, organization: organization(v.organization), role: v.role, current: v.current };
   });
   if (workspaces.filter((w) => w.current).length !== 1 || new Set(workspaces.map((w) => w.membershipId)).size !== workspaces.length || new Set(workspaces.map((w) => w.organization.id)).size !== workspaces.length)
-    return invalid();
+    return invalid2();
   return { workspaces };
 }
 function parseWorkspaceIdentity(value, expectedUserId) {
-  if (!record(value))
-    return invalid();
+  if (!record2(value))
+    return invalid2();
   const user = value.user;
-  if (!record(user) || !uuid(user.id) || !uuid(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role(user.role))
-    return invalid();
+  if (!record2(user) || !uuid2(user.id) || !uuid2(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role2(user.role))
+    return invalid2();
   if (user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
   return { user: { id: user.id, membershipId: user.membershipId, email: user.email, displayName: user.displayName, role: user.role }, organization: organization(value.organization) };
 }
 function sessionToken(value) {
   if (typeof value !== "string" || !value || value.length > 8192 || /[^\x21-\x7e]/.test(value) || value.startsWith("sk_"))
-    return invalid();
+    return invalid2();
   return value;
 }
 function parseWorkspaceSession(value, expected) {
@@ -49098,20 +49284,20 @@ function parseWorkspaceSession(value, expected) {
   return { token: sessionToken(value.token), ...identity2 };
 }
 function parseWorkspaceLogin(value, expectedUserId) {
-  const user = record(value) && value.user;
-  if (!record(value) || !record(user) || !uuid(user.id))
-    return invalid();
+  const user = record2(value) && value.user;
+  if (!record2(value) || !record2(user) || !uuid2(user.id))
+    return invalid2();
   if (expectedUserId !== undefined && user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
   return { token: sessionToken(value.token), userId: user.id };
 }
 function workspaceSelectionFailure(value, status) {
-  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
+  if (!record2(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
     return null;
   const code = value.code;
   return workspaceSelectionFailures[code][0] === status ? code : null;
 }
-var record = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), text = (v, max2 = 1024) => typeof v === "string" && !!v.trim() && v.length <= max2 && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v), role = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), invalidWorkspaceResult = "The server returned an invalid workspace selection result.", WorkspaceContextInputError, WorkspaceIdentityMismatchError, workspaceSelectionFailures;
+var record2 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid2 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), text = (v, max2 = 1024) => typeof v === "string" && !!v.trim() && v.length <= max2 && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v), role2 = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), invalidWorkspaceResult = "The server returned an invalid workspace selection result.", WorkspaceContextInputError, WorkspaceIdentityMismatchError, workspaceSelectionFailures;
 var init_remote_workspace_selection = __esm(() => {
   WorkspaceContextInputError = class WorkspaceContextInputError extends Error {
     constructor() {
@@ -49137,7 +49323,7 @@ var init_remote_workspace_selection = __esm(() => {
 
 // src/lib/remote-workspace.ts
 function workspaceMembersQuery(options = {}) {
-  if (!record2(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+  if (!record3(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
     throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
   const query = new URLSearchParams;
   if (options.limit !== undefined)
@@ -49146,14 +49332,14 @@ function workspaceMembersQuery(options = {}) {
     query.set("cursor", options.cursor);
   return query.size ? `?${query}` : "";
 }
-function timestamp(value) {
+function timestamp2(value) {
   if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}Z$/.test(value))
     return false;
   const time = Date.parse(value);
   return Number.isFinite(time) && new Date(time).toISOString().slice(0, 23) === value.slice(0, 23);
 }
 function parseMember(row, fail2) {
-  if (!record2(row) || !uuid2(row.membershipId) || !uuid2(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp(row.createdAt))
+  if (!record3(row) || !uuid3(row.membershipId) || !uuid3(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp2(row.createdAt))
     return fail2();
   return {
     membershipId: row.membershipId,
@@ -49165,12 +49351,12 @@ function parseMember(row, fail2) {
   };
 }
 function mutationInput(membershipId, input, roleChange) {
-  if (typeof membershipId !== "string" || !uuid2(membershipId) || membershipId !== membershipId.toLowerCase() || !record2(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+  if (typeof membershipId !== "string" || !uuid3(membershipId) || membershipId !== membershipId.toLowerCase() || !record3(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
     throw new WorkspaceMemberInputError;
-  const expectedRole = input.expectedRole, role2 = roleChange ? input.role : undefined;
-  if (!isRole(expectedRole) || roleChange && !isRole(role2))
+  const expectedRole = input.expectedRole, role3 = roleChange ? input.role : undefined;
+  if (!isRole(expectedRole) || roleChange && !isRole(role3))
     throw new WorkspaceMemberInputError;
-  return { membershipId, role: role2, expectedRole };
+  return { membershipId, role: role3, expectedRole };
 }
 function workspaceMemberRoleInput(membershipId, input) {
   const value = mutationInput(membershipId, input, true);
@@ -49180,24 +49366,24 @@ function workspaceMemberRemovalInput(membershipId, input) {
   const value = mutationInput(membershipId, input, false);
   return { membershipId: value.membershipId, body: { expectedRole: value.expectedRole } };
 }
-function parseWorkspaceMemberRoleResult(value, membershipId, role2) {
+function parseWorkspaceMemberRoleResult(value, membershipId, role3) {
   const fail2 = () => {
     throw new Error(invalidMemberResult);
   };
-  if (!record2(value) || !uuid2(value.organizationId) || typeof value.changed !== "boolean")
+  if (!record3(value) || !uuid3(value.organizationId) || typeof value.changed !== "boolean")
     return fail2();
   const member = parseMember(value.member, fail2);
-  if (member.membershipId !== membershipId || member.role !== role2)
+  if (member.membershipId !== membershipId || member.role !== role3)
     return fail2();
   return { organizationId: value.organizationId, member, changed: value.changed };
 }
 function parseWorkspaceMemberRemovalResult(value, membershipId) {
-  if (!record2(value) || !uuid2(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+  if (!record3(value) || !uuid3(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
     throw new Error(invalidMemberResult);
   return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
 }
 function workspaceMemberFailure(value, status) {
-  if (!record2(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+  if (!record3(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
     return null;
   const code = value.code;
   return workspaceMemberFailures[code][0] === status ? code : null;
@@ -49206,14 +49392,14 @@ function parseWorkspaceMembersPage(value) {
   const fail2 = () => {
     throw new Error("The server returned an invalid workspace roster.");
   };
-  if (!record2(value) || !uuid2(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+  if (!record3(value) || !uuid3(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
     return fail2();
   const members = value.members.map((row) => parseMember(row, fail2));
   if (new Set(members.map((row) => row.membershipId)).size !== members.length)
     return fail2();
   return { organizationId: value.organizationId, members, nextCursor: value.nextCursor };
 }
-var record2 = (value) => !!value && typeof value === "object" && !Array.isArray(value), cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value), uuid2 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value), isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value), WorkspaceMemberInputError, invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.", workspaceMemberFailures;
+var record3 = (value) => !!value && typeof value === "object" && !Array.isArray(value), cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value), uuid3 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value), isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value), WorkspaceMemberInputError, invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.", workspaceMemberFailures;
 var init_remote_workspace = __esm(() => {
   WorkspaceMemberInputError = class WorkspaceMemberInputError extends Error {
     constructor() {
@@ -49322,14 +49508,14 @@ function readIdentity(env3 = process.env) {
     const parsed = JSON.parse(readFileSync12(getIdentityFilePath(env3), "utf-8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
-    const record3 = parsed;
+    const record4 = parsed;
     const selected = resolveSkillsApiOrigin(env3)?.origin;
-    const bound = typeof record3.apiUrl === "string" ? record3.apiUrl : readCredentialValue(SKILLS_BOUND_API_URL, env3) ?? readStoredApiUrl(env3) ?? defaultFleetGatewayBaseUrl("skills");
+    const bound = typeof record4.apiUrl === "string" ? record4.apiUrl : readCredentialValue(SKILLS_BOUND_API_URL, env3) ?? readStoredApiUrl(env3) ?? defaultFleetGatewayBaseUrl("skills");
     if (selected && normalizeSkillsApiOrigin(bound) !== selected)
       return {};
     const identity2 = {};
     for (const field of ["email", "orgId", "orgSlug", "userId"]) {
-      const value = record3[field];
+      const value = record4[field];
       if (typeof value === "string" && value.length > 0)
         identity2[field] = value;
     }
@@ -49478,44 +49664,44 @@ var init_auth_store = __esm(() => {
 
 // src/lib/remote-run-contract.ts
 function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
-  const record3 = isRecord3(payload) ? payload : {};
+  const record4 = isRecord3(payload) ? payload : {};
   return {
     contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
-    ...pickString(record3, "id"),
-    skill: pickStringValue(record3, "skill") ?? fallbackSkill,
-    ...pickString(record3, "requestedSlug"),
-    ...pickString(record3, "status"),
-    ...pickNumber(record3, "exitCode"),
-    ...pickString(record3, "correlationId"),
-    ...pickString(record3, "createdAt"),
-    ...pickString(record3, "startedAt"),
-    ...pickString(record3, "completedAt"),
-    ...pickNumber(record3, "durationMs"),
-    ...pickString(record3, "outputType"),
-    ...hasOwn(record3, "outputPreview") ? { outputPreview: record3.outputPreview } : {},
-    ...pickString(record3, "errorCode"),
-    ...pickString(record3, "errorMessage"),
-    ...pickString(record3, "error"),
-    ...pickString(record3, "code"),
-    ...hasOwn(record3, "details") ? { details: record3.details } : {}
+    ...pickString(record4, "id"),
+    skill: pickStringValue(record4, "skill") ?? fallbackSkill,
+    ...pickString(record4, "requestedSlug"),
+    ...pickString(record4, "status"),
+    ...pickNumber(record4, "exitCode"),
+    ...pickString(record4, "correlationId"),
+    ...pickString(record4, "createdAt"),
+    ...pickString(record4, "startedAt"),
+    ...pickString(record4, "completedAt"),
+    ...pickNumber(record4, "durationMs"),
+    ...pickString(record4, "outputType"),
+    ...hasOwn(record4, "outputPreview") ? { outputPreview: record4.outputPreview } : {},
+    ...pickString(record4, "errorCode"),
+    ...pickString(record4, "errorMessage"),
+    ...pickString(record4, "error"),
+    ...pickString(record4, "code"),
+    ...hasOwn(record4, "details") ? { details: record4.details } : {}
   };
 }
 function isRecord3(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function hasOwn(record3, key) {
-  return Object.prototype.hasOwnProperty.call(record3, key);
+function hasOwn(record4, key) {
+  return Object.prototype.hasOwnProperty.call(record4, key);
 }
-function pickString(record3, key) {
-  const value = pickStringValue(record3, key);
+function pickString(record4, key) {
+  const value = pickStringValue(record4, key);
   return value === undefined ? {} : { [key]: value };
 }
-function pickStringValue(record3, key) {
-  const value = record3[key];
+function pickStringValue(record4, key) {
+  const value = record4[key];
   return typeof value === "string" ? value : undefined;
 }
-function pickNumber(record3, key) {
-  const value = record3[key];
+function pickNumber(record4, key) {
+  const value = record4[key];
   return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
 }
 var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
@@ -49602,11 +49788,11 @@ var init_remote_account = __esm(() => {
 // src/lib/remote-files.ts
 var exports_remote_files = {};
 __export(exports_remote_files, {
-  sha256: () => sha256,
-  readBoundedResponse: () => readBoundedResponse,
-  describeRemoteFiles: () => describeRemoteFiles,
+  MAX_REMOTE_FILE_BYTES: () => MAX_REMOTE_FILE_BYTES,
   decodeRemoteFiles: () => decodeRemoteFiles,
-  MAX_REMOTE_FILE_BYTES: () => MAX_REMOTE_FILE_BYTES
+  describeRemoteFiles: () => describeRemoteFiles,
+  readBoundedResponse: () => readBoundedResponse,
+  sha256: () => sha256
 });
 import { createHash as createHash2 } from "crypto";
 function describeRemoteFiles(files) {
@@ -49714,17 +49900,84 @@ function parseUpdatedWorkspace(value) {
   return { organization: { id: organization2.id, slug: organization2.slug, name: organization2.name } };
 }
 
+// src/lib/remote-quote-errors.ts
+async function readQuoteUnavailableCode(response) {
+  const maximum = 16 * 1024;
+  const length = response.headers.get("content-length");
+  if (response.status !== 503 || response.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > maximum)) {
+    response.body?.cancel().catch(() => {});
+    return null;
+  }
+  const reader = response.body?.getReader();
+  if (!reader)
+    return null;
+  let timer;
+  let deadlineExceeded = false;
+  const expired = Symbol("quote body deadline");
+  const deadline = new Promise((resolve3) => {
+    timer = setTimeout(() => {
+      deadlineExceeded = true;
+      resolve3(expired);
+      reader.cancel().catch(() => {});
+    }, 1500);
+  });
+  const chunks = [];
+  let size2 = 0;
+  try {
+    while (true) {
+      const next = await Promise.race([reader.read(), deadline]);
+      if (next === expired || deadlineExceeded)
+        return null;
+      if (next.done)
+        break;
+      size2 += next.value.byteLength;
+      if (size2 > maximum)
+        return null;
+      chunks.push(next.value);
+    }
+    const bytes = new Uint8Array(size2);
+    let offset = 0;
+    for (const chunk2 of chunks) {
+      bytes.set(chunk2, offset);
+      offset += chunk2.byteLength;
+    }
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      return null;
+    const code = value.code;
+    return typeof code === "string" && Object.hasOwn(quoteUnavailableMessages, code) ? code : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+    reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+}
+var quoteUnavailableMessages;
+var init_remote_quote_errors = __esm(() => {
+  quoteUnavailableMessages = Object.freeze({
+    HOSTED_PROVIDER_UNAVAILABLE: "Hosted execution is temporarily unavailable on this Skills instance.",
+    HOSTED_CONNECTORS_UNAVAILABLE: "Hosted connector execution is unavailable on this Skills instance.",
+    SKILL_IMPLEMENTATION_UNAVAILABLE: "This skill has no hosted execution implementation.",
+    HOSTED_PRICING_UNAVAILABLE: "Hosted execution is unavailable while this skill's pricing is reviewed.",
+    RUNTIME_ALLOWLIST_REQUIRED: "Hosted execution is unavailable until this Skills instance enables its skill catalog.",
+    RUNTIME_SKILL_NOT_ALLOWED: "This skill is not enabled for hosted execution on this Skills instance."
+  });
+});
+
 // src/lib/remote-client.ts
 var exports_remote_client = {};
 __export(exports_remote_client, {
-  createRemoteSkillsClientReadOnly: () => createRemoteSkillsClientReadOnly,
-  createRemoteSkillsClient: () => createRemoteSkillsClient,
-  RemoteWorkspaceSelectionError: () => RemoteWorkspaceSelectionError,
-  RemoteWorkspaceMemberError: () => RemoteWorkspaceMemberError,
-  RemoteSkillsClient: () => RemoteSkillsClient,
-  RemoteRouteUnsupportedError: () => RemoteRouteUnsupportedError,
+  RemoteCapabilityUnavailableError: () => RemoteCapabilityUnavailableError,
+  RemoteQuoteUnavailableError: () => RemoteQuoteUnavailableError,
   RemoteRequestError: () => RemoteRequestError,
-  RemoteCapabilityUnavailableError: () => RemoteCapabilityUnavailableError
+  RemoteRouteUnsupportedError: () => RemoteRouteUnsupportedError,
+  RemoteSkillsClient: () => RemoteSkillsClient,
+  RemoteWorkspaceMemberError: () => RemoteWorkspaceMemberError,
+  RemoteWorkspaceSelectionError: () => RemoteWorkspaceSelectionError,
+  createRemoteSkillsClient: () => createRemoteSkillsClient,
+  createRemoteSkillsClientReadOnly: () => createRemoteSkillsClientReadOnly
 });
 
 class RemoteSkillsClient {
@@ -49759,6 +50012,11 @@ class RemoteSkillsClient {
       throw new RemoteRouteUnsupportedError(routePath, response.status, this.apiUrl);
     }
     if (!response.ok) {
+      if (opts.quoteRefusal && options?.method === "POST" && /^\/api\/v1\/skills\/[^/?#]+\/quote$/.test(routePath) && response.status === 503) {
+        const code = await readQuoteUnavailableCode(response);
+        if (code)
+          throw new RemoteQuoteUnavailableError(routePath, code);
+      }
       if (path === "/api/v1/billing/checkout" && options?.method === "POST" && response.status === 503 && await responseBodyCarriesCode(response, ["SUBSCRIPTION_CHECKOUT_UNAVAILABLE"])) {
         throw new RemoteCapabilityUnavailableError;
       }
@@ -49816,7 +50074,7 @@ class RemoteSkillsClient {
     const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/quote`, {
       method: "POST",
       body: JSON.stringify({ input, args })
-    });
+    }, { quoteRefusal: true });
     return parseRemoteRunQuote(await response.json());
   }
   getCapabilities() {
@@ -49981,6 +50239,53 @@ class RemoteSkillsClient {
     }
     return parseWorkspaceLeaveResult(body, captured.context.membershipId, identity2.organization.id);
   }
+  listWorkspaceInvitations(context, options = {}) {
+    return this.requestWorkspaceInvitation(context, "list", options);
+  }
+  getWorkspaceInvitation(context, invitationId2) {
+    return this.requestWorkspaceInvitation(context, "get", { invitationId: invitationId2 });
+  }
+  issueWorkspaceInvitation(context, input) {
+    return this.requestWorkspaceInvitation(context, "issue", input);
+  }
+  resendWorkspaceInvitation(context, invitationId2, input) {
+    return this.requestWorkspaceInvitation(context, "resend", { ...input, invitationId: invitationId2 });
+  }
+  revokeWorkspaceInvitation(context, invitationId2, input) {
+    return this.requestWorkspaceInvitation(context, "revoke", { ...input, invitationId: invitationId2 });
+  }
+  acceptWorkspaceInvitation(context, invitationId2, input) {
+    return this.requestWorkspaceInvitation(context, "accept", { ...input, invitationId: invitationId2 });
+  }
+  async requestWorkspaceInvitation(context, action, input) {
+    const target = workspaceContext(context), captured = invitationInput(action, input);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const identityValue = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!identityValue || typeof identityValue !== "object" || identityValue.authMethod !== "jwt")
+      throw new RemoteWorkspaceInvitationError("INTERACTIVE_SESSION_REQUIRED");
+    const identity2 = parseWorkspaceIdentity(identityValue, target.userId);
+    if (identity2.user.membershipId !== target.membershipId)
+      throw new WorkspaceIdentityMismatchError;
+    const request = invitationRequest(action, captured), read = action === "list" || action === "get";
+    let response, value;
+    try {
+      response = await connection.request(request.path, { method: request.method, ...request.body ? { body: request.body } : {}, credentials: "omit" });
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 64 * 1024 : 4096)));
+    } catch {
+      throw read ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+    }
+    if (!response.ok) {
+      const code = invitationFailure(value, response.status);
+      if (code)
+        throw new RemoteWorkspaceInvitationError(code);
+      throw read ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+    }
+    try {
+      return parseInvitationResult(action, value, captured, identity2.organization.id);
+    } catch {
+      throw read ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+    }
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -50231,13 +50536,13 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record3, field) {
-  if (record3[field] === undefined)
+function requireOptionalString(record4, field) {
+  if (record4[field] === undefined)
     return;
-  if (typeof record3[field] !== "string") {
+  if (typeof record4[field] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field} must be a string when present)`);
   }
-  return record3[field];
+  return record4[field];
 }
 function isVersionRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -50259,19 +50564,19 @@ function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record3 = entry;
-  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  const record4 = entry;
+  const slug = typeof record4.slug === "string" && record4.slug.trim() ? record4.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record3.metadata !== undefined) {
-    if (!record3.metadata || typeof record3.metadata !== "object" || Array.isArray(record3.metadata)) {
+  if (record4.metadata !== undefined) {
+    if (!record4.metadata || typeof record4.metadata !== "object" || Array.isArray(record4.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record3.metadata;
+    metadata = record4.metadata;
   }
-  const pinnedAt = requireOptionalString(record3, "pinnedAt");
+  const pinnedAt = requireOptionalString(record4, "pinnedAt");
   return {
     slug,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -50288,16 +50593,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record3 = entry;
-  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  const record4 = entry;
+  const slug = typeof record4.slug === "string" && record4.slug.trim() ? record4.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug,
-    ...requireOptionalString(record3, "name") !== undefined ? { name: requireOptionalString(record3, "name") } : {},
-    ...requireOptionalString(record3, "version") !== undefined ? { version: requireOptionalString(record3, "version") } : {},
-    ...requireOptionalString(record3, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record3, "updatedAt") } : {}
+    ...requireOptionalString(record4, "name") !== undefined ? { name: requireOptionalString(record4, "name") } : {},
+    ...requireOptionalString(record4, "version") !== undefined ? { version: requireOptionalString(record4, "version") } : {},
+    ...requireOptionalString(record4, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record4, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -50350,12 +50655,12 @@ function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record3 = payload;
-  if (!Array.isArray(record3.skills)) {
+  const record4 = payload;
+  if (!Array.isArray(record4.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record3.skills.map(normalizeSkillSummary);
-  const nextCursor = record3.nextCursor === undefined || record3.nextCursor === null ? null : record3.nextCursor;
+  const skills = record4.skills.map(normalizeSkillSummary);
+  const nextCursor = record4.nextCursor === undefined || record4.nextCursor === null ? null : record4.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -50368,8 +50673,9 @@ async function createRemoteSkillsClient(env3 = process.env) {
 function createRemoteSkillsClientReadOnly(env3 = process.env) {
   return createRemoteSkillsClient(env3);
 }
-var RemoteRouteUnsupportedError, RemoteRequestError, RemoteWorkspaceMemberError, RemoteWorkspaceSelectionError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
+var RemoteRouteUnsupportedError, RemoteRequestError, RemoteQuoteUnavailableError, RemoteWorkspaceMemberError, RemoteWorkspaceSelectionError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 var init_remote_client = __esm(() => {
+  init_remote_invitations();
   init_remote_workspace_leave();
   init_remote_workspace_selection();
   init_remote_workspace();
@@ -50378,6 +50684,7 @@ var init_remote_client = __esm(() => {
   init_fleet_credentials();
   init_remote_account();
   init_remote_files();
+  init_remote_quote_errors();
   RemoteRouteUnsupportedError = class RemoteRouteUnsupportedError extends Error {
     path;
     status;
@@ -50400,6 +50707,17 @@ var init_remote_client = __esm(() => {
       this.name = "RemoteRequestError";
     }
   };
+  RemoteQuoteUnavailableError = class RemoteQuoteUnavailableError extends RemoteRequestError {
+    code;
+    constructor(path, code) {
+      super(path, 503);
+      this.code = code;
+      if (!Object.hasOwn(quoteUnavailableMessages, code))
+        throw new Error("Unknown quote refusal code");
+      this.name = "RemoteQuoteUnavailableError";
+      this.message = quoteUnavailableMessages[code];
+    }
+  };
   RemoteWorkspaceMemberError = class RemoteWorkspaceMemberError extends RemoteRequestError {
     code;
     constructor(path, code) {
@@ -50654,7 +50972,7 @@ function concat2(chunks) {
   }
   return merged;
 }
-var BLOCK = 512, ANY_SEGMENT_EXCLUDES, ROOT_EXCLUDES, TOOL_SIDECAR_FILENAMES, CREDENTIAL_FILENAMES, CREDENTIAL_EXTENSIONS, ENV_TEMPLATE_NAMES, NON_DOTENV_EXTENSIONS;
+var BLOCK = 512, ANY_SEGMENT_EXCLUDES, ROOT_EXCLUDES, TOOL_SIDECAR_FILENAMES, CREDENTIAL_FILENAMES, CREDENTIAL_EXTENSIONS, ENV_TEMPLATE_NAMES, NON_DOTENV_EXTENSIONS, SKILL_BUNDLE_INSPECTION_LIMITS;
 var init_skill_bundle = __esm(() => {
   ANY_SEGMENT_EXCLUDES = new Set([
     ".git",
@@ -50778,6 +51096,14 @@ var init_skill_bundle = __esm(() => {
     "tar",
     "wasm"
   ]);
+  SKILL_BUNDLE_INSPECTION_LIMITS = Object.freeze({
+    compressedBytes: 16 * 1024 * 1024,
+    decompressedBytes: 64 * 1024 * 1024,
+    entries: 1024,
+    fileBytes: 16 * 1024 * 1024,
+    pathBytes: 100,
+    timeoutMs: 5000
+  });
 });
 
 // src/lib/skill-version.ts
@@ -51146,16 +51472,16 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
   }
   return { path: target, created };
 }
-function writePullMarker(dir, record3) {
+function writePullMarker(dir, record4) {
   const marker = {
     managedBy: "@hasna/skills",
-    skill: record3.skill,
-    source: record3.source ?? "pull",
-    ...record3.version ? { version: record3.version } : {},
-    ...record3.contentHash ? { contentHash: record3.contentHash } : {},
-    ...record3.sourceCommit ? { sourceCommit: record3.sourceCommit } : {},
-    ...record3.signature ? { signature: record3.signature } : {},
-    ...record3.revisionId ? { revisionId: record3.revisionId } : {},
+    skill: record4.skill,
+    source: record4.source ?? "pull",
+    ...record4.version ? { version: record4.version } : {},
+    ...record4.contentHash ? { contentHash: record4.contentHash } : {},
+    ...record4.sourceCommit ? { sourceCommit: record4.sourceCommit } : {},
+    ...record4.signature ? { signature: record4.signature } : {},
+    ...record4.revisionId ? { revisionId: record4.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
   writeFileSync8(join20(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
@@ -51170,19 +51496,19 @@ async function safeMeta(client, slug) {
   }
   if (!raw || typeof raw !== "object")
     return null;
-  const record3 = raw;
-  const kind = record3.kind === "instruction" || record3.kind === "executable" ? record3.kind : undefined;
-  const tags = Array.isArray(record3.tags) ? record3.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
+  const record4 = raw;
+  const kind = record4.kind === "instruction" || record4.kind === "executable" ? record4.kind : undefined;
+  const tags = Array.isArray(record4.tags) ? record4.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
   return {
-    ...str(record3.displayName) ? { displayName: str(record3.displayName) } : {},
-    ...str(record3.description) ? { description: str(record3.description) } : {},
-    ...str(record3.category) ? { category: str(record3.category) } : {},
+    ...str(record4.displayName) ? { displayName: str(record4.displayName) } : {},
+    ...str(record4.description) ? { description: str(record4.description) } : {},
+    ...str(record4.category) ? { category: str(record4.category) } : {},
     ...tags && tags.length ? { tags } : {},
-    ...str(record3.version) ? { version: str(record3.version) } : {},
+    ...str(record4.version) ? { version: str(record4.version) } : {},
     ...kind ? { kind } : {},
-    ...REVISION_ID_PATTERN.test(str(record3.revisionId) ?? "") ? { revisionId: str(record3.revisionId) } : {},
-    ...typeof record3.skillMd === "string" && record3.skillMd.length > 0 ? { skillMd: record3.skillMd } : {},
-    ...str(record3.publishedSource) ? { publishedSource: str(record3.publishedSource) } : {}
+    ...REVISION_ID_PATTERN.test(str(record4.revisionId) ?? "") ? { revisionId: str(record4.revisionId) } : {},
+    ...typeof record4.skillMd === "string" && record4.skillMd.length > 0 ? { skillMd: record4.skillMd } : {},
+    ...str(record4.publishedSource) ? { publishedSource: str(record4.publishedSource) } : {}
   };
 }
 function pickCorpusOptions(options) {
@@ -51191,8 +51517,8 @@ function pickCorpusOptions(options) {
 function extractSlug(entry) {
   if (!entry || typeof entry !== "object")
     return;
-  const record3 = entry;
-  return str(record3.slug) ?? str(record3.name);
+  const record4 = entry;
+  return str(record4.slug) ?? str(record4.name);
 }
 function dedupe(values2) {
   return [...new Set(values2)];
@@ -51233,8 +51559,8 @@ var init_pull = __esm(() => {
 // src/cli/commands/install.ts
 var exports_install = {};
 __export(exports_install, {
-  registerInstall: () => registerInstall,
-  pinExactVersion: () => pinExactVersion
+  pinExactVersion: () => pinExactVersion,
+  registerInstall: () => registerInstall
 });
 function registerInstall(parent) {
   parent.command("install").argument("[args...]", "Deprecated. Use 'skills pin <name>' for project skill pins.").option("--json", "Output result as JSON", false).description("Deprecated. Render skills into native agent folders with 'skills render'.").action((args, options) => handleDeprecatedInstall(args, options));
@@ -51913,14 +52239,14 @@ var init_list = __esm(() => {
 // src/lib/skillinfo.ts
 var exports_skillinfo = {};
 __export(exports_skillinfo, {
-  runSkill: () => runSkill,
-  getSkillRequirements: () => getSkillRequirements,
-  getSkillDocs: () => getSkillDocs,
-  getSkillDependencyStatus: () => getSkillDependencyStatus,
-  getSkillBestDoc: () => getSkillBestDoc,
-  generateSkillMd: () => generateSkillMd,
+  detectProjectSkills: () => detectProjectSkills,
   generateEnvExample: () => generateEnvExample,
-  detectProjectSkills: () => detectProjectSkills
+  generateSkillMd: () => generateSkillMd,
+  getSkillBestDoc: () => getSkillBestDoc,
+  getSkillDependencyStatus: () => getSkillDependencyStatus,
+  getSkillDocs: () => getSkillDocs,
+  getSkillRequirements: () => getSkillRequirements,
+  runSkill: () => runSkill
 });
 import { existsSync as existsSync19, readFileSync as readFileSync15 } from "fs";
 import { join as join21 } from "path";
@@ -53515,8 +53841,8 @@ function writeRollbackRecord(mode, entries, appDir = getDataDir()) {
   const dir = join24(appDir, ROLLBACK_DIRNAME);
   mkdirSync9(dir, { recursive: true });
   const file = join24(dir, `${mode}-${Date.now()}.json`);
-  const record3 = { version: 1, mode, timestamp: new Date().toISOString(), entries };
-  writeFileSync10(file, `${JSON.stringify(record3, null, 2)}
+  const record4 = { version: 1, mode, timestamp: new Date().toISOString(), entries };
+  writeFileSync10(file, `${JSON.stringify(record4, null, 2)}
 `);
   return file;
 }
@@ -54207,10 +54533,10 @@ var init_diagnostic = __esm(() => {
 // src/lib/blog-article.ts
 var exports_blog_article = {};
 __export(exports_blog_article, {
-  validateBlogArticleRunOptions: () => validateBlogArticleRunOptions,
-  ARTICLE_MAX_COUNT: () => ARTICLE_MAX_COUNT,
+  ARTICLE_COUNT_ERROR: () => ARTICLE_COUNT_ERROR,
   ARTICLE_GENERATION_SLUG: () => ARTICLE_GENERATION_SLUG,
-  ARTICLE_COUNT_ERROR: () => ARTICLE_COUNT_ERROR
+  ARTICLE_MAX_COUNT: () => ARTICLE_MAX_COUNT,
+  validateBlogArticleRunOptions: () => validateBlogArticleRunOptions
 });
 function validateBlogArticleRunOptions(input, args = [], validation = {}) {
   const options = collectRunOptions(input, args);
@@ -54394,7 +54720,7 @@ function createSkillRun(params, targetDir = process.cwd()) {
   mkdirSync10(logsDir, { recursive: true });
   mkdirSync10(exportDir, { recursive: true });
   mkdirSync10(join27(root, "tmp"), { recursive: true });
-  const record3 = {
+  const record4 = {
     id,
     skill: skillName,
     status: params.status ?? "running",
@@ -54412,10 +54738,10 @@ function createSkillRun(params, targetDir = process.cwd()) {
       logsDir: toProjectRelative(targetDir, logsDir)
     }
   };
-  const context = { targetDir, runDir, exportDir, logsDir, record: record3 };
+  const context = { targetDir, runDir, exportDir, logsDir, record: record4 };
   writeRunRecord(context);
   writeArtifactsManifest(context, []);
-  appendRunEvent(context, "created", { status: record3.status });
+  appendRunEvent(context, "created", { status: record4.status });
   return context;
 }
 function completeSkillRun(context, patch) {
@@ -54465,9 +54791,9 @@ function listSkillRuns(targetDir = process.cwd(), limit = 50) {
     if (!statSync14(dayDir).isDirectory())
       continue;
     for (const runId of readdirSync13(dayDir).sort().reverse()) {
-      const record3 = readRunRecord(join27(dayDir, runId));
-      if (record3)
-        records.push(record3);
+      const record4 = readRunRecord(join27(dayDir, runId));
+      if (record4)
+        records.push(record4);
       if (records.length >= limit)
         return records;
     }
@@ -54479,9 +54805,9 @@ function findSkillRun(runId, targetDir = process.cwd()) {
   if (!existsSync25(runsRoot))
     return null;
   for (const day of readdirSync13(runsRoot)) {
-    const record3 = readRunRecord(join27(runsRoot, day, runId));
-    if (record3)
-      return record3;
+    const record4 = readRunRecord(join27(runsRoot, day, runId));
+    if (record4)
+      return record4;
   }
   return null;
 }
@@ -54650,55 +54976,55 @@ var init_core = __esm(() => {
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v4/core/util.js
 var exports_util = {};
 __export(exports_util, {
-  unwrapMessage: () => unwrapMessage,
-  stringifyPrimitive: () => stringifyPrimitive,
-  required: () => required,
-  randomString: () => randomString,
-  propertyKeyTypes: () => propertyKeyTypes,
-  promiseAllObject: () => promiseAllObject,
-  primitiveTypes: () => primitiveTypes,
-  prefixIssues: () => prefixIssues,
-  pick: () => pick2,
-  partial: () => partial2,
-  optionalKeys: () => optionalKeys,
-  omit: () => omit2,
-  numKeys: () => numKeys,
-  nullish: () => nullish,
-  normalizeParams: () => normalizeParams,
-  merge: () => merge2,
-  jsonStringifyReplacer: () => jsonStringifyReplacer,
-  joinValues: () => joinValues,
-  issue: () => issue,
-  isPlainObject: () => isPlainObject2,
-  isObject: () => isObject2,
-  getSizableOrigin: () => getSizableOrigin,
-  getParsedType: () => getParsedType2,
-  getLengthableOrigin: () => getLengthableOrigin,
-  getEnumValues: () => getEnumValues,
-  getElementAtPath: () => getElementAtPath,
-  floatSafeRemainder: () => floatSafeRemainder2,
-  finalizeIssue: () => finalizeIssue,
-  extend: () => extend,
-  escapeRegex: () => escapeRegex,
-  esc: () => esc,
-  defineLazy: () => defineLazy,
-  createTransparentProxy: () => createTransparentProxy,
-  clone: () => clone3,
-  cleanRegex: () => cleanRegex,
-  cleanEnum: () => cleanEnum,
-  captureStackTrace: () => captureStackTrace,
-  cached: () => cached,
-  assignProp: () => assignProp,
-  assertNotEqual: () => assertNotEqual,
-  assertNever: () => assertNever,
-  assertIs: () => assertIs,
-  assertEqual: () => assertEqual,
-  assert: () => assert,
-  allowsEval: () => allowsEval,
-  aborted: () => aborted,
-  NUMBER_FORMAT_RANGES: () => NUMBER_FORMAT_RANGES,
+  BIGINT_FORMAT_RANGES: () => BIGINT_FORMAT_RANGES,
   Class: () => Class,
-  BIGINT_FORMAT_RANGES: () => BIGINT_FORMAT_RANGES
+  NUMBER_FORMAT_RANGES: () => NUMBER_FORMAT_RANGES,
+  aborted: () => aborted,
+  allowsEval: () => allowsEval,
+  assert: () => assert,
+  assertEqual: () => assertEqual,
+  assertIs: () => assertIs,
+  assertNever: () => assertNever,
+  assertNotEqual: () => assertNotEqual,
+  assignProp: () => assignProp,
+  cached: () => cached,
+  captureStackTrace: () => captureStackTrace,
+  cleanEnum: () => cleanEnum,
+  cleanRegex: () => cleanRegex,
+  clone: () => clone3,
+  createTransparentProxy: () => createTransparentProxy,
+  defineLazy: () => defineLazy,
+  esc: () => esc,
+  escapeRegex: () => escapeRegex,
+  extend: () => extend,
+  finalizeIssue: () => finalizeIssue,
+  floatSafeRemainder: () => floatSafeRemainder2,
+  getElementAtPath: () => getElementAtPath,
+  getEnumValues: () => getEnumValues,
+  getLengthableOrigin: () => getLengthableOrigin,
+  getParsedType: () => getParsedType2,
+  getSizableOrigin: () => getSizableOrigin,
+  isObject: () => isObject2,
+  isPlainObject: () => isPlainObject2,
+  issue: () => issue,
+  joinValues: () => joinValues,
+  jsonStringifyReplacer: () => jsonStringifyReplacer,
+  merge: () => merge2,
+  normalizeParams: () => normalizeParams,
+  nullish: () => nullish,
+  numKeys: () => numKeys,
+  omit: () => omit2,
+  optionalKeys: () => optionalKeys,
+  partial: () => partial2,
+  pick: () => pick2,
+  prefixIssues: () => prefixIssues,
+  primitiveTypes: () => primitiveTypes,
+  promiseAllObject: () => promiseAllObject,
+  propertyKeyTypes: () => propertyKeyTypes,
+  randomString: () => randomString,
+  required: () => required,
+  stringifyPrimitive: () => stringifyPrimitive,
+  unwrapMessage: () => unwrapMessage
 });
 function assertEqual(val) {
   return val;
@@ -55317,11 +55643,11 @@ function datetime(args) {
   const timeRegex2 = `${time2}(?:${opts.join("|")})`;
   return new RegExp(`^${dateSource}T(?:${timeRegex2})$`);
 }
-var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid3 = (version) => {
+var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid4 = (version) => {
   if (!version)
     return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000)$/;
   return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
-}, email, _emoji = `^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`, ipv4, ipv6, cidrv4, cidrv6, base64, base64url, hostname, e164, dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`, date, string2 = (params) => {
+}, email2, _emoji = `^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`, ipv4, ipv6, cidrv4, cidrv6, base64, base64url, hostname, e164, dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`, date, string2 = (params) => {
   const regex2 = params ? `[\\s\\S]{${params?.minimum ?? 0},${params?.maximum ?? ""}}` : `[\\s\\S]*`;
   return new RegExp(`^${regex2}$`);
 }, integer, number, boolean, _null, lowercase, uppercase;
@@ -55334,7 +55660,7 @@ var init_regexes = __esm(() => {
   nanoid = /^[a-zA-Z0-9_-]{21}$/;
   duration = /^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/;
   guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
-  email = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
+  email2 = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
   ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
   ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})$/;
   cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -56111,13 +56437,13 @@ var init_schemas = __esm(() => {
       const v = versionMap[def.version];
       if (v === undefined)
         throw new Error(`Invalid UUID version: "${def.version}"`);
-      def.pattern ?? (def.pattern = uuid3(v));
+      def.pattern ?? (def.pattern = uuid4(v));
     } else
-      def.pattern ?? (def.pattern = uuid3());
+      def.pattern ?? (def.pattern = uuid4());
     $ZodStringFormat.init(inst, def);
   });
   $ZodEmail = /* @__PURE__ */ $constructor("$ZodEmail", (inst, def) => {
-    def.pattern ?? (def.pattern = email);
+    def.pattern ?? (def.pattern = email2);
     $ZodStringFormat.init(inst, def);
   });
   $ZodURL = /* @__PURE__ */ $constructor("$ZodURL", (inst, def) => {
@@ -58437,14 +58763,14 @@ var init_checks2 = __esm(() => {
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v4/classic/iso.js
 var exports_iso = {};
 __export(exports_iso, {
-  time: () => time2,
-  duration: () => duration2,
-  datetime: () => datetime2,
-  date: () => date2,
-  ZodISOTime: () => ZodISOTime,
-  ZodISODuration: () => ZodISODuration,
+  ZodISODate: () => ZodISODate,
   ZodISODateTime: () => ZodISODateTime,
-  ZodISODate: () => ZodISODate
+  ZodISODuration: () => ZodISODuration,
+  ZodISOTime: () => ZodISOTime,
+  date: () => date2,
+  datetime: () => datetime2,
+  duration: () => duration2,
+  time: () => time2
 });
 function datetime2(params) {
   return _isoDateTime(ZodISODateTime, params);
@@ -58593,7 +58919,7 @@ function intersection2(left, right) {
     right
   });
 }
-function record3(keyType, valueType, params) {
+function record4(keyType, valueType, params) {
   return new ZodRecord2({
     type: "record",
     keyType,
@@ -59294,7 +59620,7 @@ var init_types2 = __esm(() => {
   });
   FormElicitationCapabilitySchema = intersection2(object2({
     applyDefaults: boolean2().optional()
-  }), record3(string3(), unknown()));
+  }), record4(string3(), unknown()));
   ElicitationCapabilitySchema = preprocess((value) => {
     if (value && typeof value === "object" && !Array.isArray(value)) {
       if (Object.keys(value).length === 0) {
@@ -59305,7 +59631,7 @@ var init_types2 = __esm(() => {
   }, intersection2(object2({
     form: FormElicitationCapabilitySchema.optional(),
     url: AssertObjectSchema.optional()
-  }), record3(string3(), unknown()).optional()));
+  }), record4(string3(), unknown()).optional()));
   ClientTasksCapabilitySchema = looseObject({
     list: AssertObjectSchema.optional(),
     cancel: AssertObjectSchema.optional(),
@@ -59328,7 +59654,7 @@ var init_types2 = __esm(() => {
     }).optional()
   });
   ClientCapabilitiesSchema = object2({
-    experimental: record3(string3(), AssertObjectSchema).optional(),
+    experimental: record4(string3(), AssertObjectSchema).optional(),
     sampling: object2({
       context: AssertObjectSchema.optional(),
       tools: AssertObjectSchema.optional()
@@ -59338,7 +59664,7 @@ var init_types2 = __esm(() => {
       listChanged: boolean2().optional()
     }).optional(),
     tasks: ClientTasksCapabilitySchema.optional(),
-    extensions: record3(string3(), AssertObjectSchema).optional()
+    extensions: record4(string3(), AssertObjectSchema).optional()
   });
   InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
     protocolVersion: string3(),
@@ -59350,7 +59676,7 @@ var init_types2 = __esm(() => {
     params: InitializeRequestParamsSchema
   });
   ServerCapabilitiesSchema = object2({
-    experimental: record3(string3(), AssertObjectSchema).optional(),
+    experimental: record4(string3(), AssertObjectSchema).optional(),
     logging: AssertObjectSchema.optional(),
     completions: AssertObjectSchema.optional(),
     prompts: object2({
@@ -59364,7 +59690,7 @@ var init_types2 = __esm(() => {
       listChanged: boolean2().optional()
     }).optional(),
     tasks: ServerTasksCapabilitySchema.optional(),
-    extensions: record3(string3(), AssertObjectSchema).optional()
+    extensions: record4(string3(), AssertObjectSchema).optional()
   });
   InitializeResultSchema = ResultSchema.extend({
     protocolVersion: string3(),
@@ -59451,7 +59777,7 @@ var init_types2 = __esm(() => {
   ResourceContentsSchema = object2({
     uri: string3(),
     mimeType: optional(string3()),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   TextResourceContentsSchema = ResourceContentsSchema.extend({
     text: string3()
@@ -59556,7 +59882,7 @@ var init_types2 = __esm(() => {
   });
   GetPromptRequestParamsSchema = BaseRequestParamsSchema.extend({
     name: string3(),
-    arguments: record3(string3(), string3()).optional()
+    arguments: record4(string3(), string3()).optional()
   });
   GetPromptRequestSchema = RequestSchema.extend({
     method: literal("prompts/get"),
@@ -59566,34 +59892,34 @@ var init_types2 = __esm(() => {
     type: literal("text"),
     text: string3(),
     annotations: AnnotationsSchema.optional(),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   ImageContentSchema = object2({
     type: literal("image"),
     data: Base64Schema,
     mimeType: string3(),
     annotations: AnnotationsSchema.optional(),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   AudioContentSchema = object2({
     type: literal("audio"),
     data: Base64Schema,
     mimeType: string3(),
     annotations: AnnotationsSchema.optional(),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   ToolUseContentSchema = object2({
     type: literal("tool_use"),
     name: string3(),
     id: string3(),
-    input: record3(string3(), unknown()),
-    _meta: record3(string3(), unknown()).optional()
+    input: record4(string3(), unknown()),
+    _meta: record4(string3(), unknown()).optional()
   });
   EmbeddedResourceSchema = object2({
     type: literal("resource"),
     resource: union2([TextResourceContentsSchema, BlobResourceContentsSchema]),
     annotations: AnnotationsSchema.optional(),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   ResourceLinkSchema = ResourceSchema.extend({
     type: literal("resource_link")
@@ -59633,17 +59959,17 @@ var init_types2 = __esm(() => {
     description: string3().optional(),
     inputSchema: object2({
       type: literal("object"),
-      properties: record3(string3(), AssertObjectSchema).optional(),
+      properties: record4(string3(), AssertObjectSchema).optional(),
       required: array(string3()).optional()
     }).catchall(unknown()),
     outputSchema: object2({
       type: literal("object"),
-      properties: record3(string3(), AssertObjectSchema).optional(),
+      properties: record4(string3(), AssertObjectSchema).optional(),
       required: array(string3()).optional()
     }).catchall(unknown()).optional(),
     annotations: ToolAnnotationsSchema.optional(),
     execution: ToolExecutionSchema.optional(),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   ListToolsRequestSchema = PaginatedRequestSchema.extend({
     method: literal("tools/list")
@@ -59653,7 +59979,7 @@ var init_types2 = __esm(() => {
   });
   CallToolResultSchema = ResultSchema.extend({
     content: array(ContentBlockSchema).default([]),
-    structuredContent: record3(string3(), unknown()).optional(),
+    structuredContent: record4(string3(), unknown()).optional(),
     isError: boolean2().optional()
   });
   CompatibilityCallToolResultSchema = CallToolResultSchema.or(ResultSchema.extend({
@@ -59661,7 +59987,7 @@ var init_types2 = __esm(() => {
   }));
   CallToolRequestParamsSchema = TaskAugmentedRequestParamsSchema.extend({
     name: string3(),
-    arguments: record3(string3(), unknown()).optional()
+    arguments: record4(string3(), unknown()).optional()
   });
   CallToolRequestSchema = RequestSchema.extend({
     method: literal("tools/call"),
@@ -59710,7 +60036,7 @@ var init_types2 = __esm(() => {
     content: array(ContentBlockSchema).default([]),
     structuredContent: object2({}).loose().optional(),
     isError: boolean2().optional(),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   SamplingContentSchema = discriminatedUnion("type", [TextContentSchema, ImageContentSchema, AudioContentSchema]);
   SamplingMessageContentBlockSchema = discriminatedUnion("type", [
@@ -59723,7 +60049,7 @@ var init_types2 = __esm(() => {
   SamplingMessageSchema = object2({
     role: RoleSchema,
     content: union2([SamplingMessageContentBlockSchema, array(SamplingMessageContentBlockSchema)]),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   CreateMessageRequestParamsSchema = TaskAugmentedRequestParamsSchema.extend({
     messages: array(SamplingMessageSchema),
@@ -59836,7 +60162,7 @@ var init_types2 = __esm(() => {
     message: string3(),
     requestedSchema: object2({
       type: literal("object"),
-      properties: record3(string3(), PrimitiveSchemaDefinitionSchema),
+      properties: record4(string3(), PrimitiveSchemaDefinitionSchema),
       required: array(string3()).optional()
     })
   });
@@ -59860,7 +60186,7 @@ var init_types2 = __esm(() => {
   });
   ElicitResultSchema = ResultSchema.extend({
     action: _enum(["accept", "decline", "cancel"]),
-    content: preprocess((val) => val === null ? undefined : val, record3(string3(), union2([string3(), number2(), boolean2(), array(string3())])).optional())
+    content: preprocess((val) => val === null ? undefined : val, record4(string3(), union2([string3(), number2(), boolean2(), array(string3())])).optional())
   });
   ResourceTemplateReferenceSchema = object2({
     type: literal("ref/resource"),
@@ -59877,7 +60203,7 @@ var init_types2 = __esm(() => {
       value: string3()
     }),
     context: object2({
-      arguments: record3(string3(), string3()).optional()
+      arguments: record4(string3(), string3()).optional()
     }).optional()
   });
   CompleteRequestSchema = RequestSchema.extend({
@@ -59894,7 +60220,7 @@ var init_types2 = __esm(() => {
   RootSchema = object2({
     uri: string3().startsWith("file://"),
     name: string3().optional(),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   ListRootsRequestSchema = RequestSchema.extend({
     method: literal("roots/list"),
@@ -62666,7 +62992,7 @@ var init_protocol = __esm(() => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
-var require_code = __commonJS((exports) => {
+var require_code = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.regexpCode = exports.getEsmExportName = exports.getProperty = exports.safeStringify = exports.stringify = exports.strConcat = exports.addCodeArg = exports.str = exports._ = exports.nil = exports._Code = exports.Name = exports.IDENTIFIER = exports._CodeOrName = undefined;
 
@@ -62820,7 +63146,7 @@ var require_code = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/scope.js
-var require_scope = __commonJS((exports) => {
+var require_scope = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.ValueScope = exports.ValueScopeName = exports.Scope = exports.varKinds = exports.UsedValueState = undefined;
   var code_1 = require_code();
@@ -62966,7 +63292,7 @@ var require_scope = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/index.js
-var require_codegen = __commonJS((exports) => {
+var require_codegen = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.or = exports.and = exports.not = exports.CodeGen = exports.operators = exports.varKinds = exports.ValueScopeName = exports.ValueScope = exports.Scope = exports.Name = exports.regexpCode = exports.stringify = exports.getProperty = exports.nil = exports.strConcat = exports.str = exports._ = undefined;
   var code_1 = require_code();
@@ -63676,7 +64002,7 @@ var require_codegen = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/util.js
-var require_util = __commonJS((exports) => {
+var require_util = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.checkStrictMode = exports.getErrorPath = exports.Type = exports.useFunc = exports.setEvaluated = exports.evaluatedPropsToName = exports.mergeEvaluated = exports.eachItem = exports.unescapeJsonPointer = exports.escapeJsonPointer = exports.escapeFragment = exports.unescapeFragment = exports.schemaRefOrVal = exports.schemaHasRulesButRef = exports.schemaHasRules = exports.checkUnknownRules = exports.alwaysValidSchema = exports.toHash = undefined;
   var codegen_1 = require_codegen();
@@ -63840,7 +64166,7 @@ var require_util = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/names.js
-var require_names = __commonJS((exports) => {
+var require_names = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var names = {
@@ -63865,7 +64191,7 @@ var require_names = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/errors.js
-var require_errors = __commonJS((exports) => {
+var require_errors = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.extendErrors = exports.resetErrorsCount = exports.reportExtraError = exports.reportError = exports.keyword$DataError = exports.keywordError = undefined;
   var codegen_1 = require_codegen();
@@ -63983,7 +64309,7 @@ var require_errors = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/boolSchema.js
-var require_boolSchema = __commonJS((exports) => {
+var require_boolSchema = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.boolOrEmptySchema = exports.topBoolOrEmptySchema = undefined;
   var errors_1 = require_errors();
@@ -64031,7 +64357,7 @@ var require_boolSchema = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/rules.js
-var require_rules = __commonJS((exports) => {
+var require_rules = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getRules = exports.isJSONType = undefined;
   var _jsonTypes = ["string", "number", "integer", "boolean", "null", "object", "array"];
@@ -64059,7 +64385,7 @@ var require_rules = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/applicability.js
-var require_applicability = __commonJS((exports) => {
+var require_applicability = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.shouldUseRule = exports.shouldUseGroup = exports.schemaHasRulesForType = undefined;
   function schemaHasRulesForType({ schema, self: self2 }, type) {
@@ -64079,7 +64405,7 @@ var require_applicability = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/dataType.js
-var require_dataType = __commonJS((exports) => {
+var require_dataType = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.reportTypeError = exports.checkDataTypes = exports.checkDataType = exports.coerceAndCheckDataType = exports.getJSONTypes = exports.getSchemaTypes = exports.DataType = undefined;
   var rules_1 = require_rules();
@@ -64260,7 +64586,7 @@ var require_dataType = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/defaults.js
-var require_defaults = __commonJS((exports) => {
+var require_defaults = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.assignDefaults = undefined;
   var codegen_1 = require_codegen();
@@ -64294,7 +64620,7 @@ var require_defaults = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/code.js
-var require_code2 = __commonJS((exports) => {
+var require_code2 = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateUnion = exports.validateArray = exports.usePattern = exports.callValidateCode = exports.schemaProperties = exports.allSchemaProperties = exports.noPropertyInData = exports.propertyInData = exports.isOwnProperty = exports.hasPropFunc = exports.reportMissingProp = exports.checkMissingProp = exports.checkReportMissingProp = undefined;
   var codegen_1 = require_codegen();
@@ -64423,7 +64749,7 @@ var require_code2 = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/keyword.js
-var require_keyword = __commonJS((exports) => {
+var require_keyword = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateKeywordUsage = exports.validSchemaType = exports.funcKeywordCode = exports.macroKeywordCode = undefined;
   var codegen_1 = require_codegen();
@@ -64538,7 +64864,7 @@ var require_keyword = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/subschema.js
-var require_subschema = __commonJS((exports) => {
+var require_subschema = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.extendSubschemaMode = exports.extendSubschemaData = exports.getSubschema = undefined;
   var codegen_1 = require_codegen();
@@ -64618,7 +64944,7 @@ var require_subschema = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/fast-deep-equal@3.1.3/node_modules/fast-deep-equal/index.js
-var require_fast_deep_equal = __commonJS((exports, module) => {
+var require_fast_deep_equal = __commonJS(function(exports, module) {
   module.exports = function equal(a, b) {
     if (a === b)
       return true;
@@ -64660,7 +64986,7 @@ var require_fast_deep_equal = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/json-schema-traverse@1.0.0/node_modules/json-schema-traverse/index.js
-var require_json_schema_traverse = __commonJS((exports, module) => {
+var require_json_schema_traverse = __commonJS(function(exports, module) {
   var traverse = module.exports = function(schema, opts, cb) {
     if (typeof opts == "function") {
       cb = opts;
@@ -64743,7 +65069,7 @@ var require_json_schema_traverse = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/resolve.js
-var require_resolve = __commonJS((exports) => {
+var require_resolve = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getSchemaRefs = exports.resolveUrl = exports.normalizeId = exports._getFullPath = exports.getFullPath = exports.inlineRef = undefined;
   var util_1 = require_util();
@@ -64896,7 +65222,7 @@ var require_resolve = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/index.js
-var require_validate = __commonJS((exports) => {
+var require_validate = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getData = exports.KeywordCxt = exports.validateFunctionCode = undefined;
   var boolSchema_1 = require_boolSchema();
@@ -65401,7 +65727,7 @@ var require_validate = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/runtime/validation_error.js
-var require_validation_error = __commonJS((exports) => {
+var require_validation_error = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
 
   class ValidationError extends Error {
@@ -65415,7 +65741,7 @@ var require_validation_error = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/ref_error.js
-var require_ref_error = __commonJS((exports) => {
+var require_ref_error = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var resolve_1 = require_resolve();
 
@@ -65430,7 +65756,7 @@ var require_ref_error = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/index.js
-var require_compile = __commonJS((exports) => {
+var require_compile = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.resolveSchema = exports.getCompilingSchema = exports.resolveRef = exports.compileSchema = exports.SchemaEnv = undefined;
   var codegen_1 = require_codegen();
@@ -65651,7 +65977,7 @@ var require_compile = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/refs/data.json
-var require_data = __commonJS((exports, module) => {
+var require_data = __commonJS(function(exports, module) {
   module.exports = {
     $id: "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#",
     description: "Meta-schema for $data reference (JSON AnySchema extension proposal)",
@@ -65668,7 +65994,7 @@ var require_data = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/lib/utils.js
-var require_utils = __commonJS((exports, module) => {
+var require_utils = __commonJS(function(exports, module) {
   var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
   var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
   var isPort = RegExp.prototype.test.bind(/^\d*$/u);
@@ -66185,7 +66511,7 @@ var require_utils = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/lib/schemes.js
-var require_schemes = __commonJS((exports, module) => {
+var require_schemes = __commonJS(function(exports, module) {
   var { isUUID } = require_utils();
   var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
   var supportedSchemeNames = [
@@ -66360,7 +66686,7 @@ var require_schemes = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/index.js
-var require_fast_uri = __commonJS((exports, module) => {
+var require_fast_uri = __commonJS(function(exports, module) {
   var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
   var { SCHEMES, getSchemeHandler } = require_schemes();
   var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
@@ -66762,7 +67088,7 @@ var require_fast_uri = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/runtime/uri.js
-var require_uri = __commonJS((exports) => {
+var require_uri = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var uri = require_fast_uri();
   uri.code = 'require("ajv/dist/runtime/uri").default';
@@ -66770,7 +67096,7 @@ var require_uri = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/core.js
-var require_core = __commonJS((exports) => {
+var require_core = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.CodeGen = exports.Name = exports.nil = exports.stringify = exports.str = exports._ = exports.KeywordCxt = undefined;
   var validate_1 = require_validate();
@@ -67363,7 +67689,7 @@ var require_core = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/core/id.js
-var require_id = __commonJS((exports) => {
+var require_id = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var def = {
     keyword: "id",
@@ -67375,7 +67701,7 @@ var require_id = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/core/ref.js
-var require_ref = __commonJS((exports) => {
+var require_ref = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.callRef = exports.getValidate = undefined;
   var ref_error_1 = require_ref_error();
@@ -67494,7 +67820,7 @@ var require_ref = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/core/index.js
-var require_core2 = __commonJS((exports) => {
+var require_core2 = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var id_1 = require_id();
   var ref_1 = require_ref();
@@ -67512,7 +67838,7 @@ var require_core2 = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitNumber.js
-var require_limitNumber = __commonJS((exports) => {
+var require_limitNumber = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var ops = codegen_1.operators;
@@ -67541,7 +67867,7 @@ var require_limitNumber = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/multipleOf.js
-var require_multipleOf = __commonJS((exports) => {
+var require_multipleOf = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var error2 = {
@@ -67558,15 +67884,15 @@ var require_multipleOf = __commonJS((exports) => {
       const { gen, data, schemaCode, it } = cxt;
       const prec = it.opts.multipleOfPrecision;
       const res = gen.let("res");
-      const invalid2 = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
-      cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid2}))`);
+      const invalid3 = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
+      cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid3}))`);
     }
   };
   exports.default = def;
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/runtime/ucs2length.js
-var require_ucs2length = __commonJS((exports) => {
+var require_ucs2length = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   function ucs2length(str2) {
     const len = str2.length;
@@ -67589,7 +67915,7 @@ var require_ucs2length = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitLength.js
-var require_limitLength = __commonJS((exports) => {
+var require_limitLength = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -67618,7 +67944,7 @@ var require_limitLength = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/pattern.js
-var require_pattern = __commonJS((exports) => {
+var require_pattern = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
   var util_1 = require_util();
@@ -67652,7 +67978,7 @@ var require_pattern = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitProperties.js
-var require_limitProperties = __commonJS((exports) => {
+var require_limitProperties = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var error2 = {
@@ -67678,7 +68004,7 @@ var require_limitProperties = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/required.js
-var require_required = __commonJS((exports) => {
+var require_required = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
   var codegen_1 = require_codegen();
@@ -67757,7 +68083,7 @@ var require_required = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitItems.js
-var require_limitItems = __commonJS((exports) => {
+var require_limitItems = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var error2 = {
@@ -67783,7 +68109,7 @@ var require_limitItems = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/runtime/equal.js
-var require_equal = __commonJS((exports) => {
+var require_equal = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var equal = require_fast_deep_equal();
   equal.code = 'require("ajv/dist/runtime/equal").default';
@@ -67791,7 +68117,7 @@ var require_equal = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/uniqueItems.js
-var require_uniqueItems = __commonJS((exports) => {
+var require_uniqueItems = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var dataType_1 = require_dataType();
   var codegen_1 = require_codegen();
@@ -67855,7 +68181,7 @@ var require_uniqueItems = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/const.js
-var require_const = __commonJS((exports) => {
+var require_const = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -67881,7 +68207,7 @@ var require_const = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/enum.js
-var require_enum = __commonJS((exports) => {
+var require_enum = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -67927,7 +68253,7 @@ var require_enum = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/index.js
-var require_validation = __commonJS((exports) => {
+var require_validation = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var limitNumber_1 = require_limitNumber();
   var multipleOf_1 = require_multipleOf();
@@ -67957,7 +68283,7 @@ var require_validation = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/additionalItems.js
-var require_additionalItems = __commonJS((exports) => {
+var require_additionalItems = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateAdditionalItems = undefined;
   var codegen_1 = require_codegen();
@@ -68007,7 +68333,7 @@ var require_additionalItems = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/items.js
-var require_items = __commonJS((exports) => {
+var require_items = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateTuple = undefined;
   var codegen_1 = require_codegen();
@@ -68061,7 +68387,7 @@ var require_items = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/prefixItems.js
-var require_prefixItems = __commonJS((exports) => {
+var require_prefixItems = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var items_1 = require_items();
   var def = {
@@ -68075,7 +68401,7 @@ var require_prefixItems = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/items2020.js
-var require_items2020 = __commonJS((exports) => {
+var require_items2020 = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -68107,7 +68433,7 @@ var require_items2020 = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/contains.js
-var require_contains = __commonJS((exports) => {
+var require_contains = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -68198,7 +68524,7 @@ var require_contains = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/dependencies.js
-var require_dependencies = __commonJS((exports) => {
+var require_dependencies = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateSchemaDeps = exports.validatePropertyDeps = exports.error = undefined;
   var codegen_1 = require_codegen();
@@ -68283,7 +68609,7 @@ var require_dependencies = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/propertyNames.js
-var require_propertyNames = __commonJS((exports) => {
+var require_propertyNames = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -68323,7 +68649,7 @@ var require_propertyNames = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/additionalProperties.js
-var require_additionalProperties = __commonJS((exports) => {
+var require_additionalProperties = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
   var codegen_1 = require_codegen();
@@ -68426,7 +68752,7 @@ var require_additionalProperties = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/properties.js
-var require_properties = __commonJS((exports) => {
+var require_properties = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var validate_1 = require_validate();
   var code_1 = require_code2();
@@ -68481,7 +68807,7 @@ var require_properties = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/patternProperties.js
-var require_patternProperties = __commonJS((exports) => {
+var require_patternProperties = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
   var codegen_1 = require_codegen();
@@ -68552,7 +68878,7 @@ var require_patternProperties = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/not.js
-var require_not = __commonJS((exports) => {
+var require_not = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var util_1 = require_util();
   var def = {
@@ -68580,7 +68906,7 @@ var require_not = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/anyOf.js
-var require_anyOf = __commonJS((exports) => {
+var require_anyOf = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
   var def = {
@@ -68594,7 +68920,7 @@ var require_anyOf = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/oneOf.js
-var require_oneOf = __commonJS((exports) => {
+var require_oneOf = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -68649,7 +68975,7 @@ var require_oneOf = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/allOf.js
-var require_allOf = __commonJS((exports) => {
+var require_allOf = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var util_1 = require_util();
   var def = {
@@ -68673,7 +68999,7 @@ var require_allOf = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/if.js
-var require_if = __commonJS((exports) => {
+var require_if = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -68739,7 +69065,7 @@ var require_if = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/thenElse.js
-var require_thenElse = __commonJS((exports) => {
+var require_thenElse = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var util_1 = require_util();
   var def = {
@@ -68754,7 +69080,7 @@ var require_thenElse = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/index.js
-var require_applicator = __commonJS((exports) => {
+var require_applicator = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var additionalItems_1 = require_additionalItems();
   var prefixItems_1 = require_prefixItems();
@@ -68797,7 +69123,7 @@ var require_applicator = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/format/format.js
-var require_format = __commonJS((exports) => {
+var require_format = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var error2 = {
@@ -68884,7 +69210,7 @@ var require_format = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/format/index.js
-var require_format2 = __commonJS((exports) => {
+var require_format2 = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var format_1 = require_format();
   var format = [format_1.default];
@@ -68892,7 +69218,7 @@ var require_format2 = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/metadata.js
-var require_metadata = __commonJS((exports) => {
+var require_metadata = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.contentVocabulary = exports.metadataVocabulary = undefined;
   exports.metadataVocabulary = [
@@ -68912,7 +69238,7 @@ var require_metadata = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/draft7.js
-var require_draft7 = __commonJS((exports) => {
+var require_draft7 = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var core_1 = require_core2();
   var validation_1 = require_validation();
@@ -68931,7 +69257,7 @@ var require_draft7 = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/discriminator/types.js
-var require_types = __commonJS((exports) => {
+var require_types = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.DiscrError = undefined;
   var DiscrError;
@@ -68942,7 +69268,7 @@ var require_types = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/discriminator/index.js
-var require_discriminator = __commonJS((exports) => {
+var require_discriminator = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var types_1 = require_types();
@@ -69044,7 +69370,7 @@ var require_discriminator = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/refs/json-schema-draft-07.json
-var require_json_schema_draft_07 = __commonJS((exports, module) => {
+var require_json_schema_draft_07 = __commonJS(function(exports, module) {
   module.exports = {
     $schema: "http://json-schema.org/draft-07/schema#",
     $id: "http://json-schema.org/draft-07/schema#",
@@ -69199,7 +69525,7 @@ var require_json_schema_draft_07 = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/ajv.js
-var require_ajv = __commonJS((exports, module) => {
+var require_ajv = __commonJS(function(exports, module) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.MissingRefError = exports.ValidationError = exports.CodeGen = exports.Name = exports.nil = exports.stringify = exports.str = exports._ = exports.KeywordCxt = exports.Ajv = undefined;
   var core_1 = require_core();
@@ -69267,7 +69593,7 @@ var require_ajv = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/ajv-formats@3.0.1/node_modules/ajv-formats/dist/formats.js
-var require_formats = __commonJS((exports) => {
+var require_formats = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.formatNames = exports.fastFormats = exports.fullFormats = undefined;
   function fmtDef(validate2, compare) {
@@ -69444,7 +69770,7 @@ var require_formats = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv-formats@3.0.1/node_modules/ajv-formats/dist/limit.js
-var require_limit = __commonJS((exports) => {
+var require_limit = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.formatLimitDefinition = undefined;
   var ajv_1 = require_ajv();
@@ -69513,7 +69839,7 @@ var require_limit = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/ajv-formats@3.0.1/node_modules/ajv-formats/dist/index.js
-var require_dist = __commonJS((exports, module) => {
+var require_dist = __commonJS(function(exports, module) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var formats_1 = require_formats();
   var limit_1 = require_limit();
@@ -72338,9 +72664,9 @@ var init_discovery_tools = __esm(() => {
 // src/lib/run-routing.ts
 var exports_run_routing = {};
 __export(exports_run_routing, {
-  resolveRunRouting: () => resolveRunRouting,
+  isServerOwnedSkill: () => isServerOwnedSkill,
   resolveConfiguredRunRouting: () => resolveConfiguredRunRouting,
-  isServerOwnedSkill: () => isServerOwnedSkill
+  resolveRunRouting: () => resolveRunRouting
 });
 function isServerOwnedSkill(skill) {
   return skill.serverOwned === true;
@@ -73636,6 +73962,107 @@ var init_storage_tools = __esm(() => {
   init_helpers();
 });
 
+// src/lib/remote-invitation-recovery.ts
+function invitationEmailIds(invitationId2, challengeId) {
+  if (!uuid5(invitationId2) || !uuid5(challengeId))
+    throw new InvitationEmailInputError;
+  return { invitationId: invitationId2, challengeId };
+}
+function invitationEmailInput(action, input) {
+  const keys2 = ["invitationId", "token", "challengeId", "confirm", ...action === "accept" ? ["code"] : []];
+  if (!record6(input) || Object.keys(input).length !== keys2.length || keys2.some((key) => !Object.hasOwn(input, key)))
+    throw new InvitationEmailInputError;
+  const value = { ...input };
+  const ids = invitationEmailIds(value.invitationId, value.challengeId);
+  if (value.confirm !== true || typeof value.token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value.token) || action === "accept" && (typeof value.code !== "string" || !/^\d{6}$/.test(value.code)))
+    throw new InvitationEmailInputError;
+  return { ...ids, token: value.token, confirm: true, ...action === "accept" ? { code: value.code } : {} };
+}
+async function requestInvitationEmail(origin, action, input) {
+  const value = invitationEmailInput(action, input);
+  let target;
+  try {
+    target = normalizeSkillsApiOrigin(origin);
+  } catch {
+    throw new InvitationEmailInputError;
+  }
+  const body = JSON.stringify({ invitationId: value.invitationId, token: value.token, challengeId: value.challengeId, ...action === "accept" ? { code: value.code } : {} });
+  try {
+    const response = await fetch(`${target}/api/v1/account/invitations/email-${action}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body,
+      credentials: "omit",
+      redirect: "error",
+      cache: "no-store",
+      referrerPolicy: "no-referrer",
+      signal: AbortSignal.timeout(15000)
+    });
+    const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 4096)));
+    if (!response.ok && record6(parsed) && typeof parsed.code === "string" && Object.hasOwn(refusals, parsed.code)) {
+      const code = parsed.code;
+      if (response.status === refusals[code][0])
+        throw new RemoteInvitationEmailError(code);
+    }
+    if (!record6(parsed))
+      throw new RemoteInvitationEmailUnconfirmedError(action);
+    if (action === "challenge" && response.status === 202 && parsed.challengeId === value.challengeId && parsed.expiresIn === 600 && typeof parsed.message === "string" && parsed.message.length <= 256) {
+      return { challengeId: value.challengeId, message: "If this invitation is eligible, a verification code will arrive. Delivery is not confirmed.", expiresIn: 600 };
+    }
+    if (action === "accept" && response.status === 200 && uuid5(parsed.organizationId) && uuid5(parsed.membershipId) && parsed.accepted === true && parsed.changed === true && parsed.signInRequired === true) {
+      return { organizationId: parsed.organizationId, membershipId: parsed.membershipId, accepted: true, changed: true, signInRequired: true };
+    }
+  } catch (error2) {
+    if (error2 instanceof RemoteInvitationEmailError)
+      throw error2;
+  }
+  throw new RemoteInvitationEmailUnconfirmedError(action);
+}
+function invitationEmailCustomerError(error2) {
+  if (error2 instanceof InvitationEmailInputError || error2 instanceof RemoteInvitationEmailError || error2 instanceof RemoteInvitationEmailUnconfirmedError)
+    return { code: error2.code, error: error2.message };
+  return { code: "INVITATION_EMAIL_UNAVAILABLE", error: "Unable to prepare this recovery action. Check the explicit server and stable profile. No credential was saved." };
+}
+var InvitationEmailInputError, refusals, RemoteInvitationEmailError, RemoteInvitationEmailUnconfirmedError, record6 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid5 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
+var init_remote_invitation_recovery = __esm(() => {
+  init_fleet_credentials();
+  init_remote_files();
+  InvitationEmailInputError = class InvitationEmailInputError extends Error {
+    code = "INVITATION_EMAIL_INPUT_INVALID";
+    constructor() {
+      super("Use an explicit Skills API URL, exact invitation and retained challenge IDs, secret input, and deliberate confirmation.");
+      this.name = "InvitationEmailInputError";
+    }
+  };
+  refusals = {
+    INVALID_REQUEST: [400, "Invitation recovery parameters were refused."],
+    ORIGIN_REQUIRED: [403, "Invitation recovery requires the configured site origin."],
+    INVITATION_PROOF_UNAVAILABLE: [401, "Invitation proof is unavailable. Sign in or explicitly request another recovery code."],
+    RATE_LIMITED: [429, "Invitation verification is rate limited. Wait before another deliberate action."],
+    INVITATION_BUSY: [503, "Invitation is busy. Sign in to check membership before another deliberate action."],
+    INVITATION_DELIVERY_UNAVAILABLE: [503, "Invitation recovery is unavailable on this service."]
+  };
+  RemoteInvitationEmailError = class RemoteInvitationEmailError extends Error {
+    code;
+    status;
+    constructor(code) {
+      super(refusals[code][1]);
+      this.code = code;
+      this.name = "RemoteInvitationEmailError";
+      this.status = refusals[code][0];
+    }
+  };
+  RemoteInvitationEmailUnconfirmedError = class RemoteInvitationEmailUnconfirmedError extends Error {
+    action;
+    code = "INVITATION_EMAIL_UNCONFIRMED";
+    constructor(action) {
+      super(action === "challenge" ? "The recovery challenge outcome is unconfirmed. Retain the same invitation, challenge ID and server. Check your inbox; never rotate the challenge or retry automatically. No delivery is confirmed." : "Invitation acceptance is unconfirmed. Use fresh ordinary sign-in to inspect available memberships. Do not retry acceptance automatically; explicitly request another recovery code only if needed. Saved credentials are unchanged.");
+      this.action = action;
+      this.name = "RemoteInvitationEmailUnconfirmedError";
+    }
+  };
+});
+
 // src/lib/remote-auth.ts
 async function requestAuthApi(instance, path, options) {
   const url = normalizeSkillsApiOrigin(instance);
@@ -73658,10 +74085,10 @@ async function requestAuthApi(instance, path, options) {
   const text2 = await res.text();
   const body = text2 ? parseJsonBody(text2) : {};
   if (!res.ok) {
-    const record5 = isRecord5(body) ? body : {};
-    const detail = typeof record5.detail === "string" ? record5.detail : undefined;
-    const error2 = typeof record5.error === "string" ? record5.error : undefined;
-    const code = typeof record5.code === "string" ? record5.code : undefined;
+    const record7 = isRecord5(body) ? body : {};
+    const detail = typeof record7.detail === "string" ? record7.detail : undefined;
+    const error2 = typeof record7.error === "string" ? record7.error : undefined;
+    const code = typeof record7.code === "string" ? record7.code : undefined;
     throw new HostedApiError(detail || error2 || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -73695,11 +74122,17 @@ class RemoteSkillsAuthClient {
   constructor(apiUrl) {
     this.apiOrigin = normalizeSkillsApiOrigin(apiUrl);
   }
-  requestCode(email2) {
-    return this.request("/api/auth/login", { method: "POST", body: JSON.stringify({ email: email2 }) });
+  requestInvitationEmailChallenge(input) {
+    return requestInvitationEmail(this.apiOrigin, "challenge", input);
   }
-  verifyCode(email2, code) {
-    return this.request("/api/auth/verify", { method: "POST", body: JSON.stringify({ email: email2, code }) });
+  acceptInvitationEmailChallenge(input) {
+    return requestInvitationEmail(this.apiOrigin, "accept", input);
+  }
+  requestCode(email3) {
+    return this.request("/api/auth/login", { method: "POST", body: JSON.stringify({ email: email3 }) });
+  }
+  verifyCode(email3, code) {
+    return this.request("/api/auth/verify", { method: "POST", body: JSON.stringify({ email: email3, code }) });
   }
   startDevice() {
     return this.request("/api/auth/device/start", { method: "POST", body: JSON.stringify({ client: "skills-sdk" }) });
@@ -73707,34 +74140,34 @@ class RemoteSkillsAuthClient {
   pollDevice(deviceCode) {
     return this.request("/api/auth/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) });
   }
-  async sessionClient(email2, code, context) {
+  async sessionClient(email3, code, context) {
     if (context !== undefined) {
       const target = workspaceContext(context), apiOrigin2 = this.apiOrigin;
-      const session = await this.switchWorkspace(email2, code, target);
+      const session = await this.switchWorkspace(email3, code, target);
       return new RemoteSkillsClient(session.token, apiOrigin2);
     }
     const apiOrigin = this.apiOrigin;
-    if (!email2.includes("@") || !/^\d{6}$/.test(code))
+    if (!email3.includes("@") || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
-    const login = await this.verifyCode(email2, code);
+    const login = await this.verifyCode(email3, code);
     if (!login || typeof login.token !== "string" || !login.token)
       throw new Error("The server did not return an authorized account session");
     return new RemoteSkillsClient(login.token, apiOrigin);
   }
-  async listAccountWorkspaces(email2, code, expectedUserId) {
-    const login = await this.workspaceLogin(email2, code, expectedUserId);
+  async listAccountWorkspaces(email3, code, expectedUserId) {
+    const login = await this.workspaceLogin(email3, code, expectedUserId);
     const result2 = await new RemoteSkillsClient(login.token, login.apiOrigin).listAccountWorkspaces(login.userId);
     return { userId: login.userId, ...result2 };
   }
-  async switchWorkspace(email2, code, context) {
+  async switchWorkspace(email3, code, context) {
     const target = workspaceContext(context);
-    const login = await this.workspaceLogin(email2, code, target.userId);
+    const login = await this.workspaceLogin(email3, code, target.userId);
     return new RemoteSkillsClient(login.token, login.apiOrigin).switchWorkspace(target);
   }
-  async workspaceLogin(email2, code, expectedUserId) {
+  async workspaceLogin(email3, code, expectedUserId) {
     const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
     const apiOrigin = this.apiOrigin;
-    if (typeof email2 !== "string" || !email2.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
+    if (typeof email3 !== "string" || !email3.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
     let response;
     try {
@@ -73744,7 +74177,7 @@ class RemoteSkillsAuthClient {
         credentials: "omit",
         signal: AbortSignal.timeout(15000),
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ email: email2, code })
+        body: JSON.stringify({ email: email3, code })
       });
     } catch {
       throw new HostedApiError("Unable to verify the Skills account.");
@@ -73761,40 +74194,67 @@ class RemoteSkillsAuthClient {
     }
     return { ...parseWorkspaceLogin(value, expected), apiOrigin };
   }
-  async createApiKey(email2, code, name, scopes, context) {
+  async listWorkspaceInvitations(email3, code, context, options = {}) {
+    const target = workspaceContext(context), captured = invitationInput("list", options);
+    return (await this.sessionClient(email3, code, target)).listWorkspaceInvitations(target, captured);
+  }
+  async getWorkspaceInvitation(email3, code, context, invitationId2) {
+    const target = workspaceContext(context), captured = invitationInput("get", { invitationId: invitationId2 });
+    return (await this.sessionClient(email3, code, target)).getWorkspaceInvitation(target, captured.invitationId);
+  }
+  async issueWorkspaceInvitation(email3, code, context, input) {
+    const target = workspaceContext(context), captured = invitationInput("issue", input);
+    return (await this.sessionClient(email3, code, target)).issueWorkspaceInvitation(target, captured);
+  }
+  async resendWorkspaceInvitation(email3, code, context, invitationId2, input) {
+    const target = workspaceContext(context), captured = invitationInput("resend", { ...input, invitationId: invitationId2 });
+    const { invitationId: id, ...options } = captured;
+    return (await this.sessionClient(email3, code, target)).resendWorkspaceInvitation(target, id, options);
+  }
+  async revokeWorkspaceInvitation(email3, code, context, invitationId2, input) {
+    const target = workspaceContext(context), captured = invitationInput("revoke", { ...input, invitationId: invitationId2 });
+    const { invitationId: id, ...options } = captured;
+    return (await this.sessionClient(email3, code, target)).revokeWorkspaceInvitation(target, id, options);
+  }
+  async acceptWorkspaceInvitation(email3, code, context, invitationId2, input) {
+    const target = workspaceContext(context), captured = invitationInput("accept", { ...input, invitationId: invitationId2 });
+    const { invitationId: id, ...options } = captured;
+    return (await this.sessionClient(email3, code, target)).acceptWorkspaceInvitation(target, id, options);
+  }
+  async createApiKey(email3, code, name, scopes, context) {
     const capturedScopes = scopes === undefined ? undefined : [...scopes];
-    return (await this.sessionClient(email2, code, context)).createApiKey(name, capturedScopes);
+    return (await this.sessionClient(email3, code, context)).createApiKey(name, capturedScopes);
   }
-  async listApiKeys(email2, code, context) {
-    return (await this.sessionClient(email2, code, context)).listApiKeys();
+  async listApiKeys(email3, code, context) {
+    return (await this.sessionClient(email3, code, context)).listApiKeys();
   }
-  async revokeApiKey(email2, code, keyId, context) {
-    return (await this.sessionClient(email2, code, context)).revokeApiKey(keyId);
+  async revokeApiKey(email3, code, keyId, context) {
+    return (await this.sessionClient(email3, code, context)).revokeApiKey(keyId);
   }
-  async updateProfile(email2, code, input, context) {
+  async updateProfile(email3, code, input, context) {
     const body = customerNamePatch(input, "displayName");
-    return (await this.sessionClient(email2, code, context)).updateProfile({ displayName: body.displayName });
+    return (await this.sessionClient(email3, code, context)).updateProfile({ displayName: body.displayName });
   }
-  async updateCurrentWorkspace(email2, code, input, context) {
+  async updateCurrentWorkspace(email3, code, input, context) {
     const body = customerNamePatch(input, "name");
-    return (await this.sessionClient(email2, code, context)).updateCurrentWorkspace({ name: body.name });
+    return (await this.sessionClient(email3, code, context)).updateCurrentWorkspace({ name: body.name });
   }
-  async listWorkspaceMembers(email2, code, options = {}, context) {
+  async listWorkspaceMembers(email3, code, options = {}, context) {
     workspaceMembersQuery(options);
     const captured = { ...options };
-    return (await this.sessionClient(email2, code, context)).listWorkspaceMembers(captured);
+    return (await this.sessionClient(email3, code, context)).listWorkspaceMembers(captured);
   }
-  async setWorkspaceMemberRole(email2, code, membershipId, input, context) {
+  async setWorkspaceMemberRole(email3, code, membershipId, input, context) {
     const captured = workspaceMemberRoleInput(membershipId, input);
-    return (await this.sessionClient(email2, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
+    return (await this.sessionClient(email3, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
   }
-  async leaveWorkspace(email2, code, context, input) {
+  async leaveWorkspace(email3, code, context, input) {
     const captured = workspaceLeaveInput(context, input);
-    return (await this.sessionClient(email2, code, captured.context)).leaveWorkspace(captured.context, captured.input);
+    return (await this.sessionClient(email3, code, captured.context)).leaveWorkspace(captured.context, captured.input);
   }
-  async removeWorkspaceMember(email2, code, membershipId, input, context) {
+  async removeWorkspaceMember(email3, code, membershipId, input, context) {
     const captured = workspaceMemberRemovalInput(membershipId, input);
-    return (await this.sessionClient(email2, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
+    return (await this.sessionClient(email3, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
   }
   request(path, options) {
     if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
@@ -73804,6 +74264,8 @@ class RemoteSkillsAuthClient {
 }
 var MAX_ERROR_DETAIL_LENGTH = 200, HostedApiError;
 var init_remote_auth = __esm(() => {
+  init_remote_invitation_recovery();
+  init_remote_invitations();
   init_remote_workspace_leave();
   init_remote_workspace_selection();
   init_remote_files();
@@ -73950,20 +74412,20 @@ async function prepareWorkspaceEnrollment(membershipId, source = process.env) {
   return {
     profile,
     origin,
-    async complete(email2, code) {
+    async complete(email3, code) {
       unchanged2();
-      if (!email2.includes("@") || !/^\d{6}$/.test(code))
+      if (!email3.includes("@") || !/^\d{6}$/.test(code))
         return fail2("A fresh email and six-digit verification code are required.");
-      if (expected && expected.user.email.toLowerCase() !== email2.toLowerCase())
+      if (expected && expected.user.email.toLowerCase() !== email3.toLowerCase())
         return fail2("This profile belongs to another account. Use a different profile or ordinary replacement login.");
       let issued = false;
       try {
-        const result2 = await new RemoteSkillsAuthClient(origin).verifyCode(email2, code);
+        const result2 = await new RemoteSkillsAuthClient(origin).verifyCode(email3, code);
         const login = parseWorkspaceLogin(result2, expected?.user.id);
         if (result2.firstLogin === true)
           return fail2("This sign-in created a new account using the server signup policy. Finish ordinary account login before enrolling a workspace profile.");
         const session = await new RemoteSkillsClient(login.token, origin).switchWorkspace({ userId: login.userId, membershipId });
-        if (session.user.email.toLowerCase() !== email2.toLowerCase())
+        if (session.user.email.toLowerCase() !== email3.toLowerCase())
           return fail2("The verified account does not match the requested email.");
         if (session.user.role === "viewer")
           return fail2("Viewer memberships cannot enroll API keys.");
@@ -74047,8 +74509,103 @@ var init_workspace_profile = __esm(() => {
   };
 });
 
+// src/lib/invitation-customer-action.ts
+function invitationProfileContext(userId, membershipId, profile) {
+  const target = workspaceContext({ userId, membershipId });
+  if (profile && (profile.userId !== target.userId || profile.membershipId !== target.membershipId))
+    throw new WorkspaceIdentityMismatchError;
+  return target;
+}
+async function invokeFreshInvitation(client, email3, code, context, action, input) {
+  const target = workspaceContext(context), captured = invitationInput(action, input);
+  let result2;
+  switch (action) {
+    case "list":
+      result2 = await client.listWorkspaceInvitations(email3, code, target, captured);
+      break;
+    case "get":
+      result2 = await client.getWorkspaceInvitation(email3, code, target, captured.invitationId);
+      break;
+    case "issue":
+      result2 = await client.issueWorkspaceInvitation(email3, code, target, captured);
+      break;
+    case "resend": {
+      const { invitationId: invitationId2, ...options } = captured;
+      result2 = await client.resendWorkspaceInvitation(email3, code, target, invitationId2, options);
+      break;
+    }
+    case "revoke": {
+      const { invitationId: invitationId2, ...options } = captured;
+      result2 = await client.revokeWorkspaceInvitation(email3, code, target, invitationId2, options);
+      break;
+    }
+    case "accept": {
+      const { invitationId: invitationId2, ...options } = captured;
+      result2 = await client.acceptWorkspaceInvitation(email3, code, target, invitationId2, options);
+      break;
+    }
+    default:
+      throw new WorkspaceInvitationInputError;
+  }
+  return result2;
+}
+function invitationCustomerError(error2) {
+  if (error2 instanceof WorkspaceInvitationInputError || error2 instanceof RemoteWorkspaceInvitationError || error2 instanceof RemoteWorkspaceInvitationUnconfirmedError || error2 instanceof RemoteWorkspaceInvitationReadError)
+    return { code: error2.code, error: error2.message };
+  return { code: "INVITATION_VERIFICATION_FAILED", error: "Invitation verification failed. Check the selected server, profile, exact user and current membership, then obtain a fresh code. No invitation result was confirmed; saved credentials are unchanged." };
+}
+var init_invitation_customer_action = __esm(() => {
+  init_remote_workspace_selection();
+  init_remote_invitations();
+});
+
+// src/mcp/remote-invitation-tools.ts
+function registerRemoteInvitationTools(server) {
+  const uuid6 = exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/);
+  const verification = { userId: uuid6, membershipId: uuid6, email: exports_external.string().email().max(254), code: exports_external.string().regex(/^\d{6}$/) };
+  const schemas4 = {
+    list: exports_external.object({ ...verification, after: uuid6.optional() }).strict(),
+    get: exports_external.object({ ...verification, invitationId: uuid6 }).strict(),
+    issue: exports_external.object({ ...verification, recipient: exports_external.string().email().max(254), role: exports_external.enum(["owner", "admin", "member", "viewer"]), idempotencyKey: uuid6, confirm: exports_external.literal(true) }).strict(),
+    resend: exports_external.object({ ...verification, invitationId: uuid6, expectedGeneration: exports_external.number().int().min(1).max(10), idempotencyKey: uuid6, confirm: exports_external.literal(true) }).strict(),
+    revoke: exports_external.object({ ...verification, invitationId: uuid6, expectedGeneration: exports_external.number().int().min(1).max(10), confirm: exports_external.literal(true) }).strict(),
+    accept: exports_external.object({ ...verification, invitationId: uuid6, token: exports_external.string().regex(/^[A-Za-z0-9_-]{43}$/).describe("Secret from the invitation email; supplied only in the MCP request, never returned or saved."), confirm: exports_external.literal(true) }).strict()
+  };
+  for (const action of ["list", "get", "issue", "resend", "revoke", "accept"]) {
+    const read = action === "list" || action === "get";
+    server.registerTool(action === "list" ? "list_workspace_invitations" : `${action}_workspace_invitation`, {
+      title: `${action[0].toUpperCase() + action.slice(1)} Workspace Invitation${action === "list" ? "s" : ""}`,
+      description: "Use fresh verification bound to the exact observed user/current membership and any selected profile. Mutations require confirm=true; issue/resend require a stable caller request key. Never retry uncertain outcomes automatically. Acceptance does not switch workspace or create credentials. Zero-membership account recovery is not supported by this flow.",
+      annotations: { destructiveHint: !read, idempotentHint: true, readOnlyHint: read },
+      inputSchema: schemas4[action]
+    }, async (value) => {
+      try {
+        const { userId, membershipId, email: email3, code, recipient, ...rest2 } = value;
+        const input = invitationInput(action, action === "issue" ? { ...rest2, email: recipient } : rest2);
+        const context = invitationProfileContext(String(userId), String(membershipId));
+        const target = await captureProfileWorkspace("Manage invitations");
+        invitationProfileContext(context.userId, context.membershipId, target.context);
+        target.unchanged();
+        return mcpJson(await invokeFreshInvitation(new RemoteSkillsAuthClient(target.origin), String(email3), String(code), context, action, input));
+      } catch (error2) {
+        const result2 = invitationCustomerError(error2);
+        return mcpError(result2.code, result2.error);
+      }
+    });
+  }
+}
+var init_remote_invitation_tools = __esm(() => {
+  init_zod();
+  init_remote_auth();
+  init_workspace_profile();
+  init_invitation_customer_action();
+  init_remote_invitations();
+  init_helpers();
+});
+
 // src/mcp/remote-customer-tools.ts
 function registerRemoteCustomerTools(server) {
+  registerRemoteInvitationTools(server);
   const memberRole = exports_external.enum(["owner", "admin", "member", "viewer"]);
   const memberInput = {
     membershipId: exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/),
@@ -74061,9 +74618,9 @@ function registerRemoteCustomerTools(server) {
     description: "Leave exactly the observed user and membership with confirm=true and fresh verification. The server enforces last-owner and last-workspace safeguards. Sign in again afterwards; no automatic retry or saved-profile deletion.",
     annotations: { destructiveHint: true, idempotentHint: false, readOnlyHint: false },
     inputSchema: exports_external.object({ ...memberInput, userId: memberInput.membershipId, confirm: exports_external.literal(true) }).strict()
-  }, async ({ membershipId, userId, expectedRole, email: email2, code, confirm }) => {
+  }, async ({ membershipId, userId, expectedRole, email: email3, code, confirm }) => {
     try {
-      return mcpJson(await freshAccount("Leave workspace", (client, context) => client.leaveWorkspace(email2, code, workspaceLeaveProfileContext(membershipId, userId, context), { expectedRole, confirm })));
+      return mcpJson(await freshAccount("Leave workspace", (client, context) => client.leaveWorkspace(email3, code, workspaceLeaveProfileContext(membershipId, userId, context), { expectedRole, confirm })));
     } catch (error2) {
       return error2 instanceof RemoteWorkspaceLeaveError || error2 instanceof RemoteWorkspaceLeaveUnconfirmedError ? mcpError(error2.code, error2.message) : mcpError("WORKSPACE_LEAVE_UNCONFIRMED", "Leaving could not be confirmed. Check the selected profile and exact membership, sign in again and inspect available workspaces before another action. Do not retry automatically; saved credentials are unchanged.");
     }
@@ -74072,9 +74629,9 @@ function registerRemoteCustomerTools(server) {
     title: "Set Current Workspace Member Role",
     description: "Change exactly this membership incarnation with its observed expectedRole and fresh verification. The server enforces owner/admin policy. No automatic refresh or retry; saved credentials stay unchanged.",
     inputSchema: exports_external.object({ ...memberInput, role: memberRole }).strict()
-  }, async ({ membershipId, role: role2, expectedRole, email: email2, code }) => {
+  }, async ({ membershipId, role: role3, expectedRole, email: email3, code }) => {
     try {
-      return mcpJson(await freshAccount("Set workspace member role", (client, context) => client.setWorkspaceMemberRole(email2, code, membershipId, { role: role2, expectedRole }, context)));
+      return mcpJson(await freshAccount("Set workspace member role", (client, context) => client.setWorkspaceMemberRole(email3, code, membershipId, { role: role3, expectedRole }, context)));
     } catch (error2) {
       return memberError(error2);
     }
@@ -74083,9 +74640,9 @@ function registerRemoteCustomerTools(server) {
     title: "Remove Current Workspace Member",
     description: "Remove exactly this membership incarnation using its observed expectedRole and fresh verification. Self-removal is unavailable. A retry cannot remove a later replacement membership; saved credentials stay unchanged.",
     inputSchema: exports_external.object(memberInput).strict()
-  }, async ({ membershipId, expectedRole, email: email2, code }) => {
+  }, async ({ membershipId, expectedRole, email: email3, code }) => {
     try {
-      return mcpJson(await freshAccount("Remove workspace member", (client, context) => client.removeWorkspaceMember(email2, code, membershipId, { expectedRole }, context)));
+      return mcpJson(await freshAccount("Remove workspace member", (client, context) => client.removeWorkspaceMember(email3, code, membershipId, { expectedRole }, context)));
     } catch (error2) {
       return memberError(error2);
     }
@@ -74099,9 +74656,9 @@ function registerRemoteCustomerTools(server) {
       limit: exports_external.number().int().min(1).max(100).optional(),
       cursor: exports_external.string().regex(/^[A-Za-z0-9_-]{1,512}$/).optional()
     }).strict()
-  }, async ({ email: email2, code, limit, cursor: cursor2 }) => {
+  }, async ({ email: email3, code, limit, cursor: cursor2 }) => {
     try {
-      return mcpJson(await freshAccount("List workspace members", (client, context) => client.listWorkspaceMembers(email2, code, { limit, cursor: cursor2 }, context)));
+      return mcpJson(await freshAccount("List workspace members", (client, context) => client.listWorkspaceMembers(email3, code, { limit, cursor: cursor2 }, context)));
     } catch {
       return mcpError("WORKSPACE_MEMBERS_FAILED", "Unable to list workspace members. Check the selected server, owner/admin permissions, pagination and fresh verification code.");
     }
@@ -74111,9 +74668,9 @@ function registerRemoteCustomerTools(server) {
       title: kind === "profile" ? "Update Account Display Name" : "Update Workspace Name",
       description: "Update only the name on the explicitly selected Skills server using fresh email OTP. Workspace changes require an owner/admin. Saved credentials are unchanged.",
       inputSchema: exports_external.object({ name: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }).strict()
-    }, async ({ name, email: email2, code }) => {
+    }, async ({ name, email: email3, code }) => {
       try {
-        return mcpJson(await freshAccount("Update customer name", async (client, context) => kind === "profile" ? client.updateProfile(email2, code, { displayName: name }, context) : client.updateCurrentWorkspace(email2, code, { name }, context)));
+        return mcpJson(await freshAccount("Update customer name", async (client, context) => kind === "profile" ? client.updateProfile(email3, code, { displayName: name }, context) : client.updateCurrentWorkspace(email3, code, { name }, context)));
       } catch {
         return mcpError("NAME_UPDATE_FAILED", "Unable to update the name. Check the selected server, name, permissions and fresh verification code.");
       }
@@ -74133,9 +74690,9 @@ function registerRemoteCustomerTools(server) {
     title: "List API Keys",
     description: "List account API keys using fresh email OTP reauthentication.",
     inputSchema: { email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }
-  }, async ({ email: email2, code }) => {
+  }, async ({ email: email3, code }) => {
     try {
-      return mcpJson(await freshAccount("List API keys", (client, context) => client.listApiKeys(email2, code, context)));
+      return mcpJson(await freshAccount("List API keys", (client, context) => client.listApiKeys(email3, code, context)));
     } catch {
       return mcpError("KEY_LIST_FAILED", "Unable to list API keys. Check the selected profile, server, account and fresh verification code.");
     }
@@ -74144,9 +74701,9 @@ function registerRemoteCustomerTools(server) {
     title: "Revoke API Key",
     description: "Revoke an account API key using fresh email OTP reauthentication.",
     inputSchema: { key_id: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }
-  }, async ({ key_id, email: email2, code }) => {
+  }, async ({ key_id, email: email3, code }) => {
     try {
-      return mcpJson(await freshAccount("Revoke API key", (client, context) => client.revokeApiKey(email2, code, key_id, context)));
+      return mcpJson(await freshAccount("Revoke API key", (client, context) => client.revokeApiKey(email3, code, key_id, context)));
     } catch {
       return mcpError("KEY_REVOKE_FAILED", "Unable to revoke this API key. Check the selected profile, key, account and fresh verification code.");
     }
@@ -74155,10 +74712,10 @@ function registerRemoteCustomerTools(server) {
     title: "Create API Key",
     description: "Create an API key using fresh email OTP reauthentication; returns its secret once. A stored API key cannot grant this authority.",
     inputSchema: { name: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/), scopes: exports_external.array(exports_external.string()).optional() }
-  }, async ({ name, email: email2, code, scopes }) => {
+  }, async ({ name, email: email3, code, scopes }) => {
     const capturedScopes = scopes === undefined ? undefined : [...scopes];
     try {
-      return mcpJson(await freshAccount("Create API key", (client, context) => client.createApiKey(email2, code, name, capturedScopes, context)));
+      return mcpJson(await freshAccount("Create API key", (client, context) => client.createApiKey(email3, code, name, capturedScopes, context)));
     } catch {
       return mcpError("KEY_CREATION_FAILED", "API key creation could not be confirmed. Check the selected profile and workspace keys before retrying; a lost response may still have created a key.");
     }
@@ -74200,6 +74757,7 @@ async function freshAccount(action, operation) {
   return operation(new RemoteSkillsAuthClient(target.origin), target.context);
 }
 var init_remote_customer_tools = __esm(() => {
+  init_remote_invitation_tools();
   init_zod();
   init_remote_auth();
   init_workspace_profile();
@@ -74210,6 +74768,11 @@ var init_remote_customer_tools = __esm(() => {
 });
 
 // src/mcp/server.ts
+var exports_server = {};
+__export(exports_server, {
+  buildServer: () => buildServer,
+  server: () => server
+});
 function buildServer() {
   const server = new McpServer({
     name: "skills",
@@ -74236,372 +74799,11 @@ var init_server3 = __esm(() => {
   server = buildServer();
 });
 
-// ../../node_modules/.bun/@hono+node-server@1.19.17+2145b681a064c8e9/node_modules/@hono/node-server/dist/index.mjs
-import { Readable } from "stream";
-import crypto2 from "crypto";
-var GlobalRequest, Request, newHeadersFromIncoming = (incoming) => {
-  const headerRecord = [];
-  const rawHeaders = incoming.rawHeaders;
-  for (let i = 0;i < rawHeaders.length; i += 2) {
-    const { [i]: key, [i + 1]: value } = rawHeaders;
-    if (key.charCodeAt(0) !== 58) {
-      headerRecord.push([key, value]);
-    }
-  }
-  return new Headers(headerRecord);
-}, wrapBodyStream, newRequestFromIncoming = (method2, url, headers, incoming, abortController) => {
-  const init = {
-    method: method2,
-    headers,
-    signal: abortController.signal
-  };
-  if (method2 === "TRACE") {
-    init.method = "GET";
-    const req = new Request(url, init);
-    Object.defineProperty(req, "method", {
-      get() {
-        return "TRACE";
-      }
-    });
-    return req;
-  }
-  if (!(method2 === "GET" || method2 === "HEAD")) {
-    if ("rawBody" in incoming && incoming.rawBody instanceof Buffer) {
-      init.body = new ReadableStream({
-        start(controller) {
-          controller.enqueue(incoming.rawBody);
-          controller.close();
-        }
-      });
-    } else if (incoming[wrapBodyStream]) {
-      let reader;
-      init.body = new ReadableStream({
-        async pull(controller) {
-          try {
-            reader ||= Readable.toWeb(incoming).getReader();
-            const { done, value } = await reader.read();
-            if (done) {
-              controller.close();
-            } else {
-              controller.enqueue(value);
-            }
-          } catch (error2) {
-            controller.error(error2);
-          }
-        }
-      });
-    } else {
-      init.body = Readable.toWeb(incoming);
-    }
-  }
-  return new Request(url, init);
-}, getRequestCache, requestCache, incomingKey, urlKey, headersKey, abortControllerKey, getAbortController, requestPrototype, responseCache, getResponseCache, cacheKey, GlobalResponse, Response2, outgoingEnded, incomingDraining, MAX_DRAIN_BYTES;
-var init_dist = __esm(() => {
-  GlobalRequest = global.Request;
-  Request = class extends GlobalRequest {
-    constructor(input, options) {
-      if (typeof input === "object" && getRequestCache in input) {
-        input = input[getRequestCache]();
-      }
-      if (typeof options?.body?.getReader !== "undefined") {
-        options.duplex ??= "half";
-      }
-      super(input, options);
-    }
-  };
-  wrapBodyStream = Symbol("wrapBodyStream");
-  getRequestCache = Symbol("getRequestCache");
-  requestCache = Symbol("requestCache");
-  incomingKey = Symbol("incomingKey");
-  urlKey = Symbol("urlKey");
-  headersKey = Symbol("headersKey");
-  abortControllerKey = Symbol("abortControllerKey");
-  getAbortController = Symbol("getAbortController");
-  requestPrototype = {
-    get method() {
-      return this[incomingKey].method || "GET";
-    },
-    get url() {
-      return this[urlKey];
-    },
-    get headers() {
-      return this[headersKey] ||= newHeadersFromIncoming(this[incomingKey]);
-    },
-    [getAbortController]() {
-      this[getRequestCache]();
-      return this[abortControllerKey];
-    },
-    [getRequestCache]() {
-      this[abortControllerKey] ||= new AbortController;
-      return this[requestCache] ||= newRequestFromIncoming(this.method, this[urlKey], this.headers, this[incomingKey], this[abortControllerKey]);
-    }
-  };
-  [
-    "body",
-    "bodyUsed",
-    "cache",
-    "credentials",
-    "destination",
-    "integrity",
-    "mode",
-    "redirect",
-    "referrer",
-    "referrerPolicy",
-    "signal",
-    "keepalive"
-  ].forEach((k) => {
-    Object.defineProperty(requestPrototype, k, {
-      get() {
-        return this[getRequestCache]()[k];
-      }
-    });
-  });
-  ["arrayBuffer", "blob", "clone", "formData", "json", "text"].forEach((k) => {
-    Object.defineProperty(requestPrototype, k, {
-      value: function() {
-        return this[getRequestCache]()[k]();
-      }
-    });
-  });
-  Object.defineProperty(requestPrototype, Symbol.for("nodejs.util.inspect.custom"), {
-    value: function(depth, options, inspectFn) {
-      const props = {
-        method: this.method,
-        url: this.url,
-        headers: this.headers,
-        nativeRequest: this[requestCache]
-      };
-      return `Request (lightweight) ${inspectFn(props, { ...options, depth: depth == null ? null : depth - 1 })}`;
-    }
-  });
-  Object.setPrototypeOf(requestPrototype, Request.prototype);
-  responseCache = Symbol("responseCache");
-  getResponseCache = Symbol("getResponseCache");
-  cacheKey = Symbol("cache");
-  GlobalResponse = global.Response;
-  Response2 = class _Response {
-    #body;
-    #init;
-    [getResponseCache]() {
-      delete this[cacheKey];
-      return this[responseCache] ||= new GlobalResponse(this.#body, this.#init);
-    }
-    constructor(body, init) {
-      let headers;
-      this.#body = body;
-      if (init instanceof _Response) {
-        const cachedGlobalResponse = init[responseCache];
-        if (cachedGlobalResponse) {
-          this.#init = cachedGlobalResponse;
-          this[getResponseCache]();
-          return;
-        } else {
-          this.#init = init.#init;
-          headers = new Headers(init.#init.headers);
-        }
-      } else {
-        this.#init = init;
-      }
-      if (typeof body === "string" || typeof body?.getReader !== "undefined" || body instanceof Blob || body instanceof Uint8Array) {
-        this[cacheKey] = [init?.status || 200, body, headers || init?.headers];
-      }
-    }
-    get headers() {
-      const cache3 = this[cacheKey];
-      if (cache3) {
-        if (!(cache3[2] instanceof Headers)) {
-          cache3[2] = new Headers(cache3[2] || { "content-type": "text/plain; charset=UTF-8" });
-        }
-        return cache3[2];
-      }
-      return this[getResponseCache]().headers;
-    }
-    get status() {
-      return this[cacheKey]?.[0] ?? this[getResponseCache]().status;
-    }
-    get ok() {
-      const status = this.status;
-      return status >= 200 && status < 300;
-    }
-  };
-  ["body", "bodyUsed", "redirected", "statusText", "trailers", "type", "url"].forEach((k) => {
-    Object.defineProperty(Response2.prototype, k, {
-      get() {
-        return this[getResponseCache]()[k];
-      }
-    });
-  });
-  ["arrayBuffer", "blob", "clone", "formData", "json", "text"].forEach((k) => {
-    Object.defineProperty(Response2.prototype, k, {
-      value: function() {
-        return this[getResponseCache]()[k]();
-      }
-    });
-  });
-  Object.defineProperty(Response2.prototype, Symbol.for("nodejs.util.inspect.custom"), {
-    value: function(depth, options, inspectFn) {
-      const props = {
-        status: this.status,
-        headers: this.headers,
-        ok: this.ok,
-        nativeResponse: this[responseCache]
-      };
-      return `Response (lightweight) ${inspectFn(props, { ...options, depth: depth == null ? null : depth - 1 })}`;
-    }
-  });
-  Object.setPrototypeOf(Response2, GlobalResponse);
-  Object.setPrototypeOf(Response2.prototype, GlobalResponse.prototype);
-  if (typeof global.crypto === "undefined") {
-    global.crypto = crypto2;
-  }
-  outgoingEnded = Symbol("outgoingEnded");
-  incomingDraining = Symbol("incomingDraining");
-  MAX_DRAIN_BYTES = 64 * 1024 * 1024;
-});
-
-// ../../node_modules/.bun/content-type@1.0.5/node_modules/content-type/index.js
-var require_content_type = __commonJS((exports) => {
-  /*!
-   * content-type
-   * Copyright(c) 2015 Douglas Christopher Wilson
-   * MIT Licensed
-   */
-  var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g;
-  var TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/;
-  var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-  var QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g;
-  var QUOTE_REGEXP = /([\\"])/g;
-  var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-  exports.format = format;
-  exports.parse = parse6;
-  function format(obj) {
-    if (!obj || typeof obj !== "object") {
-      throw new TypeError("argument obj is required");
-    }
-    var parameters = obj.parameters;
-    var type = obj.type;
-    if (!type || !TYPE_REGEXP.test(type)) {
-      throw new TypeError("invalid type");
-    }
-    var string5 = type;
-    if (parameters && typeof parameters === "object") {
-      var param;
-      var params = Object.keys(parameters).sort();
-      for (var i = 0;i < params.length; i++) {
-        param = params[i];
-        if (!TOKEN_REGEXP.test(param)) {
-          throw new TypeError("invalid parameter name");
-        }
-        string5 += "; " + param + "=" + qstring(parameters[param]);
-      }
-    }
-    return string5;
-  }
-  function parse6(string5) {
-    if (!string5) {
-      throw new TypeError("argument string is required");
-    }
-    var header = typeof string5 === "object" ? getcontenttype(string5) : string5;
-    if (typeof header !== "string") {
-      throw new TypeError("argument string is required to be a string");
-    }
-    var index = header.indexOf(";");
-    var type = index !== -1 ? header.slice(0, index).trim() : header.trim();
-    if (!TYPE_REGEXP.test(type)) {
-      throw new TypeError("invalid media type");
-    }
-    var obj = new ContentType(type.toLowerCase());
-    if (index !== -1) {
-      var key;
-      var match;
-      var value;
-      PARAM_REGEXP.lastIndex = index;
-      while (match = PARAM_REGEXP.exec(header)) {
-        if (match.index !== index) {
-          throw new TypeError("invalid parameter format");
-        }
-        index += match[0].length;
-        key = match[1].toLowerCase();
-        value = match[2];
-        if (value.charCodeAt(0) === 34) {
-          value = value.slice(1, -1);
-          if (value.indexOf("\\") !== -1) {
-            value = value.replace(QESC_REGEXP, "$1");
-          }
-        }
-        obj.parameters[key] = value;
-      }
-      if (index !== header.length) {
-        throw new TypeError("invalid parameter format");
-      }
-    }
-    return obj;
-  }
-  function getcontenttype(obj) {
-    var header;
-    if (typeof obj.getHeader === "function") {
-      header = obj.getHeader("content-type");
-    } else if (typeof obj.headers === "object") {
-      header = obj.headers && obj.headers["content-type"];
-    }
-    if (typeof header !== "string") {
-      throw new TypeError("content-type header is missing from object");
-    }
-    return header;
-  }
-  function qstring(val) {
-    var str2 = String(val);
-    if (TOKEN_REGEXP.test(str2)) {
-      return str2;
-    }
-    if (str2.length > 0 && !TEXT_REGEXP.test(str2)) {
-      throw new TypeError("invalid parameter value");
-    }
-    return '"' + str2.replace(QUOTE_REGEXP, "\\$1") + '"';
-  }
-  function ContentType(type) {
-    this.parameters = Object.create(null);
-    this.type = type;
-  }
-});
-
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
-var import_content_type;
-var init_mediaType = __esm(() => {
-  import_content_type = __toESM(require_content_type(), 1);
-});
-
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/sseKeepAlive.js
-var MAX_TIMER_DELAY_MS;
-var init_sseKeepAlive = __esm(() => {
-  MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
-});
-
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
-var init_webStandardStreamableHttp = __esm(() => {
-  init_mediaType();
-  init_sseKeepAlive();
-  init_types2();
-});
-
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/streamableHttp.js
-var init_streamableHttp = __esm(() => {
-  init_dist();
-  init_webStandardStreamableHttp();
-});
-
-// src/mcp/http.ts
-var init_http = __esm(() => {
-  init_streamableHttp();
-  init_server3();
-});
-
 // src/mcp/index.ts
 var exports_mcp = {};
 __export(exports_mcp, {
-  startMcpStdio: () => startMcpStdio,
-  buildServer: () => buildServer,
-  assertSkillsMcpConfigured: () => assertSkillsMcpConfigured
+  assertSkillsMcpConfigured: () => assertSkillsMcpConfigured,
+  startMcpStdio: () => startMcpStdio
 });
 function printHelp() {
   console.log(`Usage: skills-mcp [options]
@@ -74611,6 +74813,7 @@ MCP server for ${package_default.name}
 Options:
   -V, --version  output the version number
   -h, --help     display help for command
+  --invitation-recovery --stdio  expose only anonymous invitation recovery tools
   --stdio        run newline-delimited JSON-RPC for agent hosts
   --http         run Streamable HTTP transport on 127.0.0.1 (default; port 8836)
   --port <n>     HTTP port (--http or MCP_HTTP=1)`);
@@ -74627,23 +74830,21 @@ function assertSkillsMcpConfigured(env3 = process.env) {
 }
 async function startMcpStdio() {
   assertSkillsMcpConfigured();
-  const server2 = buildServer();
+  const { buildServer: buildServer2 } = await Promise.resolve().then(() => (init_server3(), exports_server));
+  const server2 = buildServer2();
   await server2.connect(new StdioServerTransport);
 }
 var args;
 var init_mcp2 = __esm(() => {
   init_stdio2();
   init_package();
-  init_server3();
-  init_http();
   init_fleet_credentials();
-  init_server3();
   args = process.argv.slice(2);
-  if (args.includes("--help") || args.includes("-h")) {
+  if (!args.some((value) => value.startsWith("--invitation-recovery")) && (args.includes("--help") || args.includes("-h"))) {
     printHelp();
     process.exit(0);
   }
-  if (args.includes("--version") || args.includes("-V")) {
+  if (!args.some((value) => value.startsWith("--invitation-recovery")) && (args.includes("--version") || args.includes("-V"))) {
     console.log(package_default.version);
     process.exit(0);
   }
@@ -74876,8 +75077,8 @@ var init_runtime_mcp = __esm(() => {
 // src/cli/commands/remote-account.ts
 var exports_remote_account = {};
 __export(exports_remote_account, {
-  registerRemoteAccount: () => registerRemoteAccount,
-  execute: () => execute
+  execute: () => execute,
+  registerRemoteAccount: () => registerRemoteAccount
 });
 function registerRemoteAccount(parent) {
   parent.command("capabilities").option("--json", "Output as JSON", false).description("Inspect the selected server's supported API contract").action((options) => execute(options, (client) => client.getCapabilities()));
@@ -74904,7 +75105,7 @@ async function execute(options, action) {
     if (options.json)
       console.log(JSON.stringify({
         error: message,
-        ...error2 instanceof RemoteCapabilityUnavailableError ? { code: error2.code, status: error2.status } : {}
+        ...error2 instanceof RemoteCapabilityUnavailableError || error2 instanceof RemoteQuoteUnavailableError ? { code: error2.code, status: error2.status } : {}
       }));
     else
       console.error(message);
@@ -77471,9 +77672,9 @@ var init_registry_sync = __esm(() => {
 // src/cli/commands/registry.ts
 var exports_registry2 = {};
 __export(exports_registry2, {
-  registerVersions: () => registerVersions,
+  registerPull: () => registerPull,
   registerRegistry: () => registerRegistry,
-  registerPull: () => registerPull
+  registerVersions: () => registerVersions
 });
 function registerRegistry(parent) {
   const registry2 = parent.command("registry").description("Generate registry artifacts for hosted skills services");
@@ -77515,10 +77716,10 @@ async function handleRegistrySync(options) {
     await writeJson2(artifact, 2);
     return;
   }
-  const invalid2 = artifact.summary.invalidSkillCount ?? "not checked";
+  const invalid3 = artifact.summary.invalidSkillCount ?? "not checked";
   console.log(source_default.green(`Registry sync artifact written to ${options.output}`));
   console.log(source_default.dim(`  Skills: ${artifact.summary.skillCount}`));
-  console.log(source_default.dim(`  Invalid: ${invalid2}`));
+  console.log(source_default.dim(`  Invalid: ${invalid3}`));
 }
 function registerPull(parent) {
   parent.command("pull").argument("[names...]", "Skills to pull from the configured instance (name or name@version)").option("--all", "Pull every skill the instance serves", false).option("--for-machine", "Prepare this machine with the instance's full catalog (implies --all)", false).option("--json", "Output results as JSON", false).description("Fetch skills from the configured Skills instance into this machine's corpus").action(async (names, options) => {
@@ -77615,12 +77816,12 @@ var init_registry2 = __esm(() => {
 // src/cli/commands/publish.ts
 var exports_publish = {};
 __export(exports_publish, {
-  sanitizeGitRemote: () => sanitizeGitRemote,
-  registerPublish: () => registerPublish,
-  pushSkill: () => pushSkill,
-  bumpPatch: () => bumpPatch,
+  PushSkillError: () => PushSkillError,
   buildVersionManifest: () => buildVersionManifest,
-  PushSkillError: () => PushSkillError
+  bumpPatch: () => bumpPatch,
+  pushSkill: () => pushSkill,
+  registerPublish: () => registerPublish,
+  sanitizeGitRemote: () => sanitizeGitRemote
 });
 import { execFileSync } from "child_process";
 import { existsSync as existsSync32, readFileSync as readFileSync30 } from "fs";
@@ -77738,21 +77939,21 @@ async function readPublishRevision(client, slug) {
     throw new PushSkillError("Publishing was refused because the current skill revision could not be verified.", ["Check the configured instance and connection, then retry the push. No upload was attempted."]);
   }
   const body = lookup.body;
-  const record5 = body !== null && typeof body === "object" && !Array.isArray(body) ? body : undefined;
-  const nestedError = record5?.error;
-  const code = typeof record5?.code === "string" ? record5.code : nestedError !== null && typeof nestedError === "object" && !Array.isArray(nestedError) ? nestedError.code : undefined;
+  const record7 = body !== null && typeof body === "object" && !Array.isArray(body) ? body : undefined;
+  const nestedError = record7?.error;
+  const code = typeof record7?.code === "string" ? record7.code : nestedError !== null && typeof nestedError === "object" && !Array.isArray(nestedError) ? nestedError.code : undefined;
   if (lookup.status === 404 && code === "SKILL_NOT_FOUND")
     return;
   if (lookup.status < 200 || lookup.status >= 300) {
     throw new PushSkillError(`Publishing was refused because the current skill lookup failed: HTTP ${lookup.status}.`, ["Only an explicit SKILL_NOT_FOUND response establishes an initial publish. Check access and server compatibility before retrying."]);
   }
-  const revision = record5?.revisionId;
-  if (record5?.publicationState === "catalogue-only") {
-    if (record5.name === slug && (record5.slug === undefined || record5.slug === slug) && revision === null)
+  const revision = record7?.revisionId;
+  if (record7?.publicationState === "catalogue-only") {
+    if (record7.name === slug && (record7.slug === undefined || record7.slug === slug) && revision === null)
       return;
     throw new PushSkillError("Publishing was refused because the catalogue-only response had contradictory identity or revision state.", ["Check the configured instance and server compatibility. No upload was attempted."]);
   }
-  if (record5?.slug !== slug || typeof revision !== "string" || revision.length === 0 || revision !== revision.trim() || !/^[\x21-\x7e]+$/.test(revision)) {
+  if (record7?.slug !== slug || typeof revision !== "string" || revision.length === 0 || revision !== revision.trim() || !/^[\x21-\x7e]+$/.test(revision)) {
     throw new PushSkillError("Publishing was refused because the current skill response did not contain a matching slug and valid revision.", ["Check the configured instance and server compatibility. No upload was attempted."]);
   }
   return revision;
@@ -78126,22 +78327,22 @@ function authIdentityPayload(authSource, live, cached2, offline = false) {
   const data = recordField(root.data);
   const user = recordField(root.user) ?? recordField(data?.user);
   const organization2 = recordField(root.organization) ?? recordField(root.org) ?? recordField(data?.organization);
-  const email2 = stringField2(user?.email) ?? cached2?.email;
+  const email3 = stringField2(user?.email) ?? cached2?.email;
   const orgSlug = stringField2(organization2?.slug) ?? cached2?.orgSlug;
   const orgName = stringField2(organization2?.name);
   const userId = stringField2(user?.id) ?? cached2?.userId;
   const orgId = stringField2(organization2?.id) ?? cached2?.orgId;
-  const role2 = stringField2(user?.role);
+  const role3 = stringField2(user?.role);
   return {
     status: "authenticated",
     authSource,
     ...offline ? { offline: true } : {},
-    ...email2 ? { email: email2 } : {},
+    ...email3 ? { email: email3 } : {},
     ...orgSlug ? { organization: orgSlug } : {},
     ...orgName ? { organizationName: orgName } : {},
     ...userId ? { userId } : {},
     ...orgId ? { orgId } : {},
-    ...role2 ? { role: role2 } : {}
+    ...role3 ? { role: role3 } : {}
   };
 }
 function printWhoami(payload) {
@@ -78218,7 +78419,7 @@ function printLoginSuccess(loginResult, json) {
     console.log(source_default.dim(`  API key saved to ${getAuthFilePath()}`));
   }
 }
-async function doLogin(email2, code, json) {
+async function doLogin(email3, code, json) {
   const env3 = { ...process.env };
   let origin;
   try {
@@ -78227,7 +78428,7 @@ async function doLogin(email2, code, json) {
     writeCommandError(error2, "Configure a Skills API before signing in", json);
     return;
   }
-  if (!email2 || !email2.includes("@")) {
+  if (!email3 || !email3.includes("@")) {
     writeCommandError(new Error("Invalid email"), "Invalid email", json);
     process.exitCode = 1;
     return;
@@ -78239,7 +78440,7 @@ async function doLogin(email2, code, json) {
     try {
       sendRes = await apiRequest("/api/auth/login", {
         method: "POST",
-        body: JSON.stringify({ email: email2 })
+        body: JSON.stringify({ email: email3 })
       }, origin);
     } catch (err) {
       writeCommandError(err, "Failed to request login code", json);
@@ -78250,9 +78451,9 @@ async function doLogin(email2, code, json) {
       return;
     }
     if (!json)
-      console.log(source_default.green("\u2713 Code sent to " + email2));
+      console.log(source_default.green("\u2713 Code sent to " + email3));
     if (json || !isTTY) {
-      console.log(JSON.stringify({ status: "code_sent", email: email2, message: "Check email for 6-digit code, then run: skills auth login --email " + email2 + " --code <CODE>" }));
+      console.log(JSON.stringify({ status: "code_sent", email: email3, message: "Check email for 6-digit code, then run: skills auth login --email " + email3 + " --code <CODE>" }));
       return;
     }
     const answer = await prompt(source_default.bold("Code: "));
@@ -78264,7 +78465,7 @@ async function doLogin(email2, code, json) {
   try {
     verifyRes = await apiRequest("/api/auth/verify", {
       method: "POST",
-      body: JSON.stringify({ email: email2, code })
+      body: JSON.stringify({ email: email3, code })
     }, origin);
   } catch (err) {
     writeCommandError(err, "Failed to verify login code", json);
@@ -78311,13 +78512,13 @@ async function doApiKeyLogin(apiKey, json) {
     return;
   }
   const identity2 = authIdentityPayload("stored", whoami);
-  const email2 = stringField2(identity2.email);
+  const email3 = stringField2(identity2.email);
   const orgId = stringField2(identity2.orgId);
   const orgSlug = stringField2(identity2.organization);
   const userId = stringField2(identity2.userId);
   saveAuthConfig({
     apiKey: trimmed,
-    ...email2 ? { email: email2 } : {},
+    ...email3 ? { email: email3 } : {},
     ...orgId ? { orgId } : {},
     ...orgSlug ? { orgSlug } : {},
     ...userId ? { userId } : {}
@@ -78487,8 +78688,8 @@ function registerAuth(parent) {
       await doDeviceLogin(options);
       return;
     }
-    let email2 = options.email;
-    if (!email2 && isTTY && !options.json) {
+    let email3 = options.email;
+    if (!email3 && isTTY && !options.json) {
       const existing = authForPrompt();
       if (existing) {
         console.log(source_default.dim(`Already signed in as ${existing.email}`));
@@ -78499,17 +78700,17 @@ function registerAuth(parent) {
       const answer = await prompt(source_default.bold("Email: "));
       if (answer === null)
         return;
-      email2 = answer;
+      email3 = answer;
     }
-    if (!email2) {
+    if (!email3) {
       writeCommandError(new Error("Email required. Use: skills auth login --email you@example.com"), "Email required", options.json);
       return;
     }
-    await doLogin(email2, options.code, options.json);
+    await doLogin(email3, options.code, options.json);
   });
   auth.command("signup").description("Create or sign in with your email (passwordless)").option("--email <email>", "Email address (non-interactive)").option("--code <code>", "Verification code (non-interactive)").option("--json", "Output result as JSON without prompting", false).action(async (options) => {
-    let email2 = options.email;
-    if (!email2 && isTTY && !options.json) {
+    let email3 = options.email;
+    if (!email3 && isTTY && !options.json) {
       const existing = authForPrompt();
       if (existing) {
         console.log(source_default.dim(`Already signed in as ${existing.email}`));
@@ -78520,9 +78721,9 @@ function registerAuth(parent) {
       const answer = await prompt(source_default.bold("Email: "));
       if (answer === null)
         return;
-      email2 = answer;
+      email3 = answer;
     }
-    if (!email2) {
+    if (!email3) {
       const error2 = "Email required. Use: skills auth signup --email you@example.com";
       if (options.json)
         console.log(JSON.stringify({ error: error2 }));
@@ -78531,7 +78732,7 @@ function registerAuth(parent) {
       process.exitCode = 1;
       return;
     }
-    await doLogin(email2, options.code, options.json);
+    await doLogin(email3, options.code, options.json);
   });
   auth.command("logout").description("Remove this profile's stored credentials; injected keys remain configured").option("--json", "Output as JSON", false).action((options) => {
     const { stillResolves } = clearAuthConfig();
@@ -78597,6 +78798,285 @@ var init_auth = __esm(() => {
   CONFIG_HINT_STATUSES = new Set([401, 403, 404, 405, 501]);
 });
 
+// src/lib/invitation-recovery-target.ts
+function prepareInvitationRecoveryTarget(source = process.env) {
+  const env3 = { ...source }, names = ["HASNA_SKILLS_API_URL", "SKILLS_API_URL"];
+  const urls = names.map((name) => env3[name]?.trim()).filter((value) => !!value);
+  if (!urls.length)
+    throw new InvitationEmailInputError;
+  let origin;
+  try {
+    const normalized = urls.map(normalizeSkillsApiOrigin);
+    if (normalized.some((value) => value !== normalized[0]))
+      throw new InvitationEmailInputError;
+    origin = normalized[0];
+  } catch {
+    throw new InvitationEmailInputError;
+  }
+  const unchangedFiles = captureSkillsCredentialFiles(skillsProfileCredentialFiles(env3));
+  return { origin, unchanged() {
+    unchangedFiles();
+    if ([...names, "HASNA_PROFILE", "HASNA_HOME", "HOME"].some((name) => source[name] !== env3[name]))
+      throw new InvitationEmailInputError;
+  } };
+}
+var init_invitation_recovery_target = __esm(() => {
+  init_fleet_credentials();
+  init_instance_credentials();
+  init_remote_invitation_recovery();
+});
+
+// src/cli/commands/invitation-verification.ts
+import { emitKeypressEvents as emitKeypressEvents2 } from "readline";
+async function readInvitationSecrets() {
+  if (process.stdin.isTTY)
+    throw new NameInputError("Pipe the six-digit code and invitation token on two separate lines with --secrets-stdin.");
+  let text2 = "";
+  for await (const chunk2 of process.stdin) {
+    text2 += chunk2.toString();
+    if (text2.length > 64)
+      throw new NameInputError("Supply only the code and invitation token on two separate lines.");
+  }
+  const matched = /^(\d{6})\r?\n([A-Za-z0-9_-]{43})(?:\r?\n)?$/.exec(text2);
+  if (!matched)
+    throw new NameInputError("Supply only the code and invitation token on two separate lines.");
+  return { code: matched[1], token: matched[2] };
+}
+function promptInvitationToken() {
+  return promptInvitationProof("token");
+}
+function promptInvitationRecoveryCode() {
+  return promptInvitationProof("code");
+}
+function promptInvitationProof(kind) {
+  const length = kind === "token" ? 43 : 6;
+  const label = kind === "token" ? "invitation token" : "recovery code";
+  const character = kind === "token" ? /^[A-Za-z0-9_-]$/ : /^\d$/;
+  const { stdin, stderr: output } = process, wasRaw = stdin.isRaw, wasFlowing = stdin.readableFlowing;
+  return new Promise((resolve5) => {
+    let value = "", settled = false, overflow = false;
+    const finish = (answer) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      stdin.off("keypress", keypress);
+      stdin.off("end", cancel);
+      process.off("SIGINT", cancel);
+      stdin.setRawMode(wasRaw);
+      if (wasFlowing !== true)
+        stdin.pause();
+      output.write(`
+`);
+      if (answer === null)
+        process.exitCode = 130;
+      resolve5(answer);
+    };
+    const cancel = () => finish(null);
+    const keypress = (text2, key) => {
+      if (key.ctrl && ["c", "d"].includes(key.name ?? "") || key.name === "escape")
+        return cancel();
+      if (key.name === "return" || key.name === "enter") {
+        if (overflow) {
+          value = "";
+          overflow = false;
+          output.write(`
+Enter exactly ${length} ${label} characters: `);
+          return;
+        }
+        if (value.length === length)
+          return finish(value);
+        output.write(`
+Enter the complete ${label}: `);
+        value = "";
+        return;
+      }
+      if (overflow)
+        return;
+      if (key.name === "backspace") {
+        if (value) {
+          value = value.slice(0, -1);
+          output.write("\b \b");
+        }
+      } else if (character.test(text2)) {
+        if (value.length === length) {
+          overflow = true;
+          output.write(`
+The ${label} is too long. Press Enter to start again.`);
+        } else {
+          value += text2;
+          output.write("*");
+        }
+      } else if (text2 && !key.ctrl && !key.meta) {
+        overflow = true;
+        output.write(`
+The ${label} contains invalid characters. Press Enter to start again.`);
+      }
+    };
+    const timer = setTimeout(cancel, 5 * 60 * 1000);
+    emitKeypressEvents2(stdin);
+    stdin.setRawMode(true);
+    stdin.on("keypress", keypress);
+    stdin.once("end", cancel);
+    process.once("SIGINT", cancel);
+    output.write(kind === "token" ? "Enter the invitation token from your email: " : "Enter the six-digit recovery code from your email: ");
+    stdin.resume();
+  });
+}
+var init_invitation_verification = __esm(() => {
+  init_customer_verification();
+});
+
+// src/cli/commands/invitation-recovery.ts
+async function readToken() {
+  if (process.stdin.isTTY)
+    throw new InvitationEmailInputError;
+  let value = "";
+  for await (const chunk2 of process.stdin) {
+    value += chunk2.toString();
+    if (value.length > 45)
+      throw new InvitationEmailInputError;
+  }
+  const matched = /^([A-Za-z0-9_-]{43})(?:\r?\n)?$/.exec(value);
+  if (!matched)
+    throw new InvitationEmailInputError;
+  return matched[1];
+}
+function registerInvitationRecoveryCommands(invitations) {
+  for (const action of ["challenge", "accept"]) {
+    const command = invitations.createCommand(`email-${action}`).argument("<invitation-id>").allowExcessArguments(false).enablePositionalOptions().configureOutput({ writeErr: () => {
+      process.stderr.write(`Invitation recovery arguments were refused. Supply proof only through masked input or the documented stdin flags.
+`);
+    } }).description(action === "challenge" ? "Request an eligibility-neutral recovery code; does not confirm delivery" : "Accept with invitation proof; requires ordinary sign-in afterward").requiredOption("--challenge-id <id>", "Your retained challenge UUID; generate it before the request and keep the same exact context").requiredOption("--confirm", "Confirm this exact invitation recovery action").option(action === "challenge" ? "--token-stdin" : "--secrets-stdin", action === "challenge" ? "Read the invitation token from one stdin line" : "Read the recovery code then invitation token from two stdin lines").option("--json", "Output only validated results").action(async (invitationId2, options) => {
+      try {
+        if (options.confirm !== true)
+          throw new InvitationEmailInputError;
+        const ids = invitationEmailIds(invitationId2, options.challengeId), target = prepareInvitationRecoveryTarget();
+        const piped = action === "challenge" ? options.tokenStdin : options.secretsStdin;
+        if (!piped && (options.json || !process.stdin.isTTY || !process.stderr.isTTY))
+          throw new InvitationEmailInputError;
+        let token, code = null;
+        if (piped && action === "accept")
+          ({ token, code } = await readInvitationSecrets());
+        else if (piped)
+          token = await readToken();
+        else {
+          token = await promptInvitationToken();
+          if (token === null)
+            return;
+          if (action === "accept") {
+            code = await promptInvitationRecoveryCode();
+            if (code === null)
+              return;
+          }
+        }
+        target.unchanged();
+        const client = new RemoteSkillsAuthClient(target.origin);
+        const result2 = action === "challenge" ? await client.requestInvitationEmailChallenge({ ...ids, token, confirm: true }) : await client.acceptInvitationEmailChallenge({ ...ids, token, code, confirm: true });
+        console.log(JSON.stringify(result2, null, options.json ? undefined : 2));
+      } catch (error2) {
+        const result2 = invitationEmailCustomerError(error2);
+        if (options.json)
+          console.log(JSON.stringify(result2));
+        else
+          console.error(result2.error);
+        process.exitCode = 1;
+      }
+    });
+    invitations.addCommand(command);
+  }
+}
+var init_invitation_recovery = __esm(() => {
+  init_remote_auth();
+  init_invitation_recovery_target();
+  init_remote_invitation_recovery();
+  init_invitation_verification();
+});
+
+// src/cli/commands/workspace-invitations.ts
+function registerWorkspaceInvitationCommands(workspace) {
+  const invitations = workspace.command("invitations").description("Manage workspace invitations with fresh verification and unchanged saved credentials");
+  registerInvitationRecoveryCommands(invitations);
+  for (const action of ["list", "get", "issue", "resend", "revoke", "accept"]) {
+    const targeted = ["get", "resend", "revoke", "accept"].includes(action), mutation = !["list", "get"].includes(action);
+    const command = invitations.command(action + (targeted ? " <invitation-id>" : "")).allowExcessArguments(false).description(action === "accept" ? "Accept a received invitation; does not switch workspace or create credentials" : `${action} invitations in the exact observed workspace`).requiredOption("--user-id <id>", "Observed account ID from workspace list").requiredOption("--membership-id <id>", "Exact observed current membership; must match any selected profile").requiredOption("--email <email>", "Account email for fresh verification").option("--json", "Output the validated result as JSON");
+    if (mutation)
+      command.requiredOption("--confirm", "Confirm this exact invitation action");
+    if (action === "list")
+      command.option("--after <id>", "Exact nextCursor from the previous page");
+    if (action === "issue")
+      command.requiredOption("--recipient <email>", "Invitation recipient").requiredOption("--role <role>", "owner, admin, member or viewer");
+    if (action === "issue" || action === "resend")
+      command.requiredOption("--idempotency-key <id>", "Your stable request UUID; reuse only with the same original context and parameters");
+    if (action === "resend" || action === "revoke")
+      command.requiredOption("--expected-generation <number>", "Generation you observed before confirming");
+    if (action === "accept")
+      command.option("--secrets-stdin", "Read a fresh six-digit code and invitation token on two separate stdin lines");
+    else
+      command.option("--code-stdin", "Read a previously requested six-digit verification code from stdin");
+    command.action(async (...args2) => {
+      const id = targeted ? String(args2[0]) : undefined, options = args2[targeted ? 1 : 0];
+      try {
+        if (mutation && options.confirm !== true)
+          throw new WorkspaceInvitationInputError;
+        let input = action === "list" ? { ...options.after === undefined ? {} : { after: options.after } } : action === "get" ? { invitationId: id } : action === "issue" ? { email: options.recipient, role: options.role, idempotencyKey: options.idempotencyKey, confirm: true } : action === "resend" ? { invitationId: id, expectedGeneration: Number(options.expectedGeneration), idempotencyKey: options.idempotencyKey, confirm: true } : action === "revoke" ? { invitationId: id, expectedGeneration: Number(options.expectedGeneration), confirm: true } : { invitationId: id, token: "", confirm: true };
+        if (action === "accept")
+          invitationId(id);
+        else
+          input = invitationInput(action, input);
+        const context = invitationProfileContext(options.userId, options.membershipId);
+        if (!options.email.includes("@"))
+          throw new NameInputError("Provide the verified account email.");
+        const stdin = action === "accept" ? options.secretsStdin : options.codeStdin;
+        if (!stdin && (options.json || !process.stdin.isTTY || !process.stderr.isTTY))
+          throw new NameInputError(action === "accept" ? "Use --secrets-stdin with a fresh code and invitation token on two separate lines." : "Use --code-stdin with a fresh verification code.");
+        const target = await prepareProfileWorkspace("Manage invitations").resolve();
+        invitationProfileContext(context.userId, context.membershipId, target.context);
+        const client = new RemoteSkillsAuthClient(target.origin);
+        let code, token = null;
+        if (action === "accept" && stdin)
+          ({ code, token } = await readInvitationSecrets());
+        else {
+          if (action === "accept") {
+            token = await promptInvitationToken();
+            if (token === null)
+              return;
+          }
+          if (stdin)
+            code = await readCode();
+          else {
+            await client.requestCode(options.email);
+            code = await promptCode();
+          }
+        }
+        if (code === null)
+          return;
+        if (action === "accept")
+          input = invitationInput("accept", { invitationId: id, token, confirm: true });
+        target.unchanged();
+        const result2 = await invokeFreshInvitation(client, options.email, code, context, action, input);
+        console.log(JSON.stringify(result2, null, options.json ? undefined : 2));
+      } catch (error2) {
+        const result2 = error2 instanceof NameInputError ? { code: "INVITATION_INPUT_INVALID", error: error2.message } : invitationCustomerError(error2);
+        if (options.json)
+          console.log(JSON.stringify(result2));
+        else
+          console.error(result2.error);
+        process.exitCode = 1;
+      }
+    });
+  }
+}
+var init_workspace_invitations = __esm(() => {
+  init_invitation_recovery();
+  init_workspace_profile();
+  init_remote_auth();
+  init_invitation_customer_action();
+  init_remote_invitations();
+  init_customer_verification();
+  init_invitation_verification();
+});
+
 // src/cli/commands/workspace-leave.ts
 function registerWorkspaceLeaveCommand(workspace) {
   workspace.command("leave <membership-id>").allowExcessArguments(false).description("Leave exactly this membership after fresh verification; saved profiles stay unchanged").requiredOption("--expected-role <role>", "Observed role: owner, admin, member or viewer").requiredOption("--email <email>", "Account email for fresh verification").requiredOption("--confirm", "Confirm losing access through this membership and signing in again").option("--user-id <id>", "Observed user ID; required without a named workspace profile").option("--code-stdin", "Read a previously requested six-digit verification code from stdin").option("--json", "Output the confirmed result as JSON").action(async (membershipId, options) => {
@@ -78769,6 +79249,7 @@ function registerCustomerProfileCommands(program2) {
   registerWorkspaceMembersCommand(workspace);
   registerWorkspaceMemberMutationCommands(workspace);
   registerWorkspaceLeaveCommand(workspace);
+  registerWorkspaceInvitationCommands(workspace);
   const commands = [
     { kind: "account", command: account.command("update") },
     { kind: "workspace", command: workspace.command("update") }
@@ -78811,6 +79292,7 @@ function registerCustomerProfileCommands(program2) {
   }
 }
 var init_customer_profile = __esm(() => {
+  init_workspace_invitations();
   init_workspace_profile();
   init_workspace_selection();
   init_remote_auth();
@@ -79012,14 +79494,14 @@ function resolveCorpusRootReadOnly(options) {
   }
   return { root: join39(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
 }
-function remoteRowToSkill(record5) {
-  const slug = typeof record5.slug === "string" ? record5.slug : typeof record5.name === "string" ? record5.name : undefined;
+function remoteRowToSkill(record7) {
+  const slug = typeof record7.slug === "string" ? record7.slug : typeof record7.name === "string" ? record7.name : undefined;
   if (!slug)
     return;
   return {
     slug,
-    version: typeof record5.version === "string" ? record5.version : undefined,
-    sha256: typeof record5.bundleSha256 === "string" && record5.bundleSha256 ? record5.bundleSha256 : undefined
+    version: typeof record7.version === "string" ? record7.version : undefined,
+    sha256: typeof record7.bundleSha256 === "string" && record7.bundleSha256 ? record7.bundleSha256 : undefined
   };
 }
 function recheckLocalSide(plannedLocal, localDir, ops = {
@@ -79504,43 +79986,43 @@ function throttle(func, throttleMs = 0, options = {}) {
 // ../../node_modules/.bun/ansi-escapes@7.3.0/node_modules/ansi-escapes/base.js
 var exports_base = {};
 __export(exports_base, {
-  synchronizedOutput: () => synchronizedOutput,
-  setCwd: () => setCwd,
-  scrollUp: () => scrollUp,
-  scrollDown: () => scrollDown,
-  link: () => link,
-  image: () => image,
-  iTerm: () => iTerm,
-  exitAlternativeScreen: () => exitAlternativeScreen,
-  eraseUp: () => eraseUp,
-  eraseStartLine: () => eraseStartLine,
-  eraseScreen: () => eraseScreen,
-  eraseLines: () => eraseLines,
-  eraseLine: () => eraseLine,
-  eraseEndLine: () => eraseEndLine,
-  eraseDown: () => eraseDown,
-  enterAlternativeScreen: () => enterAlternativeScreen,
-  endSynchronizedOutput: () => endSynchronizedOutput,
-  cursorUp: () => cursorUp,
-  cursorTo: () => cursorTo,
-  cursorShow: () => cursorShow,
-  cursorSavePosition: () => cursorSavePosition,
-  cursorRestorePosition: () => cursorRestorePosition,
-  cursorPrevLine: () => cursorPrevLine,
-  cursorNextLine: () => cursorNextLine,
-  cursorMove: () => cursorMove,
-  cursorLeft: () => cursorLeft,
-  cursorHide: () => cursorHide,
-  cursorGetPosition: () => cursorGetPosition,
-  cursorForward: () => cursorForward,
-  cursorDown: () => cursorDown,
-  cursorBackward: () => cursorBackward,
-  clearViewport: () => clearViewport,
-  clearTerminal: () => clearTerminal,
-  clearScreen: () => clearScreen,
-  beginSynchronizedOutput: () => beginSynchronizedOutput,
+  ConEmu: () => ConEmu,
   beep: () => beep,
-  ConEmu: () => ConEmu
+  beginSynchronizedOutput: () => beginSynchronizedOutput,
+  clearScreen: () => clearScreen,
+  clearTerminal: () => clearTerminal,
+  clearViewport: () => clearViewport,
+  cursorBackward: () => cursorBackward,
+  cursorDown: () => cursorDown,
+  cursorForward: () => cursorForward,
+  cursorGetPosition: () => cursorGetPosition,
+  cursorHide: () => cursorHide,
+  cursorLeft: () => cursorLeft,
+  cursorMove: () => cursorMove,
+  cursorNextLine: () => cursorNextLine,
+  cursorPrevLine: () => cursorPrevLine,
+  cursorRestorePosition: () => cursorRestorePosition,
+  cursorSavePosition: () => cursorSavePosition,
+  cursorShow: () => cursorShow,
+  cursorTo: () => cursorTo,
+  cursorUp: () => cursorUp,
+  endSynchronizedOutput: () => endSynchronizedOutput,
+  enterAlternativeScreen: () => enterAlternativeScreen,
+  eraseDown: () => eraseDown,
+  eraseEndLine: () => eraseEndLine,
+  eraseLine: () => eraseLine,
+  eraseLines: () => eraseLines,
+  eraseScreen: () => eraseScreen,
+  eraseStartLine: () => eraseStartLine,
+  eraseUp: () => eraseUp,
+  exitAlternativeScreen: () => exitAlternativeScreen,
+  iTerm: () => iTerm,
+  image: () => image,
+  link: () => link,
+  scrollDown: () => scrollDown,
+  scrollUp: () => scrollUp,
+  setCwd: () => setCwd,
+  synchronizedOutput: () => synchronizedOutput
 });
 import process2 from "process";
 import os from "os";
@@ -84425,6 +84907,7 @@ import { spawn } from "child_process";
 import { request as nodeHttpRequest } from "http";
 import { request as nodeHttpsRequest } from "https";
 import { randomUUID as randomUUID2 } from "crypto";
+import { createRequire } from "module";
 function getPathValue(input, path) {
   return path.split(".").reduce((value, part) => {
     if (value && typeof value === "object" && part in value) {
@@ -85522,6 +86005,22 @@ function setPath(input, path, replacement) {
   if (last2 && last2 in cursor)
     cursor[last2] = replacement;
 }
+var MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
+var INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+var CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
+var AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+var SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+var requireSecretsSdk = createRequire(import.meta.url);
+var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+var AUTHORITY_OVERRIDE_HEADERS = new Set([
+  "host",
+  ":authority",
+  "forwarded",
+  "x-forwarded-host",
+  "x-original-host"
+]);
+var MAX_ENVELOPE_BYTES = 256 * 1024;
+var MAX_REQUEST_BYTES = MAX_ENVELOPE_BYTES * 2 + 8192;
 function createEvent(input) {
   return {
     id: input.id ?? randomUUID2(),