@hasna/skills 0.5.2 → 0.5.4

package/dist/index.js

@@ -19,12 +19,14 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -1463,8 +1465,45 @@ function validateRegistryConsistency(registry, skillsDir) {
 import { createHash } from "crypto";
 import { existsSync as existsSync5, readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
 import { join as join5, sep } from "path";
+
+// src/lib/skill-entry-path.ts
+class SkillEntryPaths {
+  files = new Set;
+  directories = new Set;
+  add(path, maxBytes, invalid, limit) {
+    if (path.length > maxBytes)
+      limit();
+    const encoded = new TextEncoder().encode(path);
+    if (encoded.byteLength > maxBytes)
+      limit();
+    if (new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(encoded) !== path)
+      invalid("Invalid UTF-8 entry path");
+    if (!path || /[\\:\x00-\x1f\x7f]/u.test(path))
+      invalid("Unsafe entry path");
+    if (path.split("/").some((segment) => !segment || segment === "." || segment === ".."))
+      invalid("Unsafe entry path segment");
+    const key = path.normalize("NFC").toLowerCase().normalize("NFC");
+    if (this.files.has(key) || this.directories.has(key))
+      invalid("Duplicate or conflicting entry path");
+    const parents = key.split("/");
+    parents.pop();
+    while (parents.length) {
+      const parent = parents.join("/");
+      if (this.files.has(parent))
+        invalid("Conflicting entry file ancestor");
+      this.directories.add(parent);
+      parents.pop();
+    }
+    this.files.add(key);
+  }
+}
+
+// src/lib/skill-hash.ts
 var CONTENT_HASH_ALGORITHM = "sha256";
 var HASH_EXCLUDE_DIRS = new Set([".git", "node_modules", "dist", "build", ".turbo"]);
+function excludedHashEntry(name, directory) {
+  return name.startsWith(".") || directory && HASH_EXCLUDE_DIRS.has(name);
+}
 var HASH_COVERAGE = [
   "SKILL.md",
   "skill.json",
@@ -1546,7 +1585,7 @@ function collectDirectory(files, dir, rel) {
     if (stats.isSymbolicLink())
       continue;
     if (stats.isDirectory()) {
-      if (HASH_EXCLUDE_DIRS.has(entry))
+      if (excludedHashEntry(entry, true))
         continue;
       collectDirectory(files, absolute, childRel);
     } else if (stats.isFile()) {
@@ -1556,28 +1595,242 @@ function collectDirectory(files, dir, rel) {
 }
 function collectFile(files, absolute, rel) {
   const buffer = readFileSync4(absolute);
+  files.push(normalizeBundleFile(rel.split(sep).join("/"), buffer));
+}
+function normalizeBundleFile(rel, buffer) {
   if (rel === "skill.json") {
-    files.push({ rel: rel.split(sep).join("/"), content: new TextEncoder().encode(canonicalizeManifest(new TextDecoder().decode(buffer))) });
-    return;
+    return { rel, content: new TextEncoder().encode(canonicalizeManifest(new TextDecoder().decode(buffer))) };
   }
   if (looksLikeText(buffer)) {
     const normalized = normalizeLineEndings(new TextDecoder().decode(buffer));
-    files.push({ rel: rel.split(sep).join("/"), content: new TextEncoder().encode(normalized) });
-    return;
+    return { rel, content: new TextEncoder().encode(normalized) };
   }
-  files.push({ rel: rel.split(sep).join("/"), content: buffer });
+  return { rel, content: buffer };
 }
 function computeContentHash(skillPath) {
+  return hashBundleFiles(collectBundleFiles(skillPath));
+}
+function* bundleHashParts(files) {
+  for (const file of files) {
+    yield new TextEncoder().encode(file.rel);
+    yield new TextEncoder().encode(`\x00${file.content.length}\x00`);
+    yield file.content;
+    yield new TextEncoder().encode("\x00");
+  }
+  yield new TextEncoder().encode("\x00");
+}
+function hashBundleFiles(files) {
+  const hash = createHash(CONTENT_HASH_ALGORITHM);
+  for (const part of bundleHashParts(files))
+    hash.update(part);
+  return hash.digest("hex");
+}
+async function hashBundleFilesCooperatively(files, check) {
   const hash = createHash(CONTENT_HASH_ALGORITHM);
-  for (const file of collectBundleFiles(skillPath)) {
-    hash.update(new TextEncoder().encode(file.rel));
-    hash.update(new TextEncoder().encode(`\x00${file.content.length}\x00`));
-    hash.update(file.content);
-    hash.update(new TextEncoder().encode("\x00"));
+  let bytesSinceYield = 0;
+  for (const part of bundleHashParts(files)) {
+    for (let offset = 0;offset < part.byteLength; offset += 64 * 1024) {
+      check();
+      const chunk = part.subarray(offset, offset + 64 * 1024);
+      hash.update(chunk);
+      bytesSinceYield += chunk.byteLength;
+      if (bytesSinceYield >= 256 * 1024) {
+        await new Promise((resolve2) => setImmediate(resolve2));
+        bytesSinceYield = 0;
+      }
+    }
   }
-  hash.update(new TextEncoder().encode("\x00"));
+  check();
   return hash.digest("hex");
 }
+var CONTENT_HASH_LIMITS = Object.freeze({
+  entries: 1024,
+  rawBytes: 64 * 1024 * 1024,
+  normalizedBytes: 64 * 1024 * 1024,
+  fileBytes: 16 * 1024 * 1024,
+  normalizedFileBytes: 16 * 1024 * 1024,
+  pathBytes: 100,
+  manifestBytes: 16 * 1024,
+  manifestDepth: 64,
+  timeoutMs: 5000
+});
+
+class ContentHashInputError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "ContentHashInputError";
+  }
+}
+function invalidContent(message = "Invalid content hash input") {
+  throw new ContentHashInputError("CONTENT_HASH_INVALID", message);
+}
+function contentLimit(message) {
+  throw new ContentHashInputError("CONTENT_HASH_LIMIT", message);
+}
+function contentRecord(value, allowed) {
+  if (!value || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    invalidContent();
+  const result = Object.create(null);
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string" || !allowed.includes(key))
+      invalidContent();
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !("value" in descriptor))
+      invalidContent("Accessor content hash input is unsupported");
+    result[key] = descriptor.value;
+  }
+  return result;
+}
+function contentOptions(options) {
+  const record = contentRecord(options, ["limits", "signal"]);
+  const limits = { ...CONTENT_HASH_LIMITS };
+  if (record.limits !== undefined) {
+    const supplied = contentRecord(record.limits, Object.keys(limits));
+    for (const key of Object.keys(supplied)) {
+      const value = supplied[key];
+      if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0 || value > limits[key])
+        contentLimit("Invalid content hash limit");
+      limits[key] = value;
+    }
+  }
+  if (record.signal !== undefined && !(record.signal instanceof AbortSignal))
+    invalidContent("Invalid content hash signal");
+  return { limits, signal: record.signal };
+}
+var typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
+var byteLengthOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteLength").get;
+var bufferOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer").get;
+function snapshotContentEntries(entries, limits, check) {
+  if (!Array.isArray(entries))
+    invalidContent("Content hash entries must be an array");
+  if (entries.length > limits.entries)
+    contentLimit("Content hash entry limit exceeded");
+  if (Reflect.ownKeys(entries).length !== entries.length + 1)
+    invalidContent("Invalid content hash entry array");
+  const snapshot = [];
+  const paths = new SkillEntryPaths;
+  let rawBytes = 0;
+  for (let index = 0;index < entries.length; index++) {
+    check();
+    const descriptor = Object.getOwnPropertyDescriptor(entries, String(index));
+    if (!descriptor || !("value" in descriptor))
+      invalidContent("Invalid content hash entry array");
+    const entry = contentRecord(descriptor.value, ["path", "bytes", "mode"]);
+    if (typeof entry.path !== "string" || typeof entry.mode !== "number" || !Number.isInteger(entry.mode) || entry.mode < 0 || entry.mode > 511)
+      invalidContent("Invalid regular-file content hash entry");
+    paths.add(entry.path, limits.pathBytes, invalidContent, () => contentLimit("Content hash path limit exceeded"));
+    if (!(entry.bytes instanceof Uint8Array) || !ArrayBuffer.isView(entry.bytes))
+      invalidContent("Content hash entry requires bytes");
+    const size = byteLengthOf.call(entry.bytes);
+    if (!(bufferOf.call(entry.bytes) instanceof ArrayBuffer))
+      invalidContent("Shared content hash bytes are unsupported");
+    if (size > limits.fileBytes || rawBytes + size > limits.rawBytes)
+      contentLimit("Content hash raw byte limit exceeded");
+    if (entry.path === "skill.json" && size > limits.manifestBytes)
+      contentLimit("Content hash manifest byte limit exceeded");
+    rawBytes += size;
+    const bytes = new Uint8Array(new ArrayBuffer(size));
+    bytes.set(entry.bytes);
+    snapshot.push({ path: entry.path, bytes, mode: entry.mode });
+  }
+  check();
+  return snapshot;
+}
+function coveredContentPath(path) {
+  const segments = path.split("/");
+  if (!HASH_COVERAGE.includes(segments[0]))
+    return false;
+  return !segments.slice(1).some((segment, index) => excludedHashEntry(segment, index < segments.length - 2));
+}
+function boundedManifest(raw, maxDepth) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return;
+  }
+  const pending = [{ value: parsed, depth: 1 }];
+  while (pending.length) {
+    const { value, depth } = pending.pop();
+    if (!value || typeof value !== "object")
+      continue;
+    if (depth > maxDepth)
+      contentLimit("Content hash manifest depth limit exceeded");
+    for (const child of Object.values(value))
+      pending.push({ value: child, depth: depth + 1 });
+  }
+  return parsed;
+}
+async function hashContentEntries(entries, options) {
+  const { limits, signal } = contentOptions(options);
+  const deadline = performance.now() + limits.timeoutMs;
+  let terminal;
+  const abort = () => {
+    terminal ??= new ContentHashInputError("CONTENT_HASH_ABORTED", "Content hashing aborted");
+  };
+  const timer = setTimeout(() => {
+    terminal ??= new ContentHashInputError("CONTENT_HASH_TIMEOUT", "Content hashing deadline exceeded");
+  }, limits.timeoutMs);
+  const check = () => {
+    if (signal?.aborted)
+      abort();
+    if (terminal)
+      throw terminal;
+    if (performance.now() >= deadline)
+      throw new ContentHashInputError("CONTENT_HASH_TIMEOUT", "Content hashing deadline exceeded");
+  };
+  try {
+    signal?.addEventListener("abort", abort, { once: true });
+    check();
+    const snapshot = snapshotContentEntries(entries, limits, check);
+    const normalized = [];
+    let normalizedBytes = 0;
+    let manifest;
+    await new Promise((resolve2) => setImmediate(resolve2));
+    for (const entry of snapshot) {
+      check();
+      if (!coveredContentPath(entry.path))
+        continue;
+      if (entry.path === "skill.json")
+        manifest = boundedManifest(new TextDecoder().decode(entry.bytes), limits.manifestDepth);
+      const file = normalizeBundleFile(entry.path, entry.bytes);
+      check();
+      if (file.content.byteLength > limits.normalizedFileBytes || normalizedBytes + file.content.byteLength > limits.normalizedBytes)
+        contentLimit("Content hash normalized byte limit exceeded");
+      normalizedBytes += file.content.byteLength;
+      normalized.push(file);
+      await new Promise((resolve2) => setImmediate(resolve2));
+    }
+    normalized.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
+    check();
+    return { hash: await hashBundleFilesCooperatively(normalized, check), manifest };
+  } catch (error) {
+    if (error instanceof ContentHashInputError)
+      throw error;
+    throw new ContentHashInputError("CONTENT_HASH_INVALID", "Invalid content hash input");
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", abort);
+  }
+}
+async function computeContentHashFromEntries(entries, options = {}) {
+  return (await hashContentEntries(entries, options)).hash;
+}
+async function verifyContentHashFromEntries(entries, options = {}) {
+  const { hash, manifest } = await hashContentEntries(entries, options);
+  const provenance = manifest && typeof manifest === "object" && !Array.isArray(manifest) ? manifest.provenance : undefined;
+  const value = provenance && typeof provenance === "object" && !Array.isArray(provenance) ? provenance.content_hash : undefined;
+  if (value !== undefined && typeof value !== "string")
+    invalidContent("Invalid content hash declaration");
+  const declaredHash = value?.trim() || undefined;
+  if (!declaredHash)
+    return { declared: false, valid: false };
+  if (!/^[a-f0-9]{64}$/.test(declaredHash))
+    return { declared: true, valid: false, declaredHash };
+  return { declared: true, valid: hash === declaredHash, declaredHash, computedHash: hash };
+}
 function verifyContentHash(skillPath, manifest) {
   const declaredHash = manifest?.provenance?.content_hash?.trim() || undefined;
   if (!declaredHash)
@@ -4478,207 +4731,207 @@ function readIfExists(path) {
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
-  void: () => voidType,
-  util: () => util,
-  unknown: () => unknownType,
-  union: () => unionType,
-  undefined: () => undefinedType,
-  tuple: () => tupleType,
-  transformer: () => effectsType,
-  symbol: () => symbolType,
-  string: () => stringType,
-  strictObject: () => strictObjectType,
-  setErrorMap: () => setErrorMap,
-  set: () => setType,
-  record: () => recordType,
-  quotelessJson: () => quotelessJson,
-  promise: () => promiseType,
-  preprocess: () => preprocessType,
-  pipeline: () => pipelineType,
-  ostring: () => ostring,
-  optional: () => optionalType,
-  onumber: () => onumber,
-  oboolean: () => oboolean,
-  objectUtil: () => objectUtil,
-  object: () => objectType,
-  number: () => numberType,
-  nullable: () => nullableType,
-  null: () => nullType,
-  never: () => neverType,
-  nativeEnum: () => nativeEnumType,
-  nan: () => nanType,
-  map: () => mapType,
-  makeIssue: () => makeIssue,
-  literal: () => literalType,
-  lazy: () => lazyType,
-  late: () => late,
-  isValid: () => isValid,
-  isDirty: () => isDirty,
-  isAsync: () => isAsync,
-  isAborted: () => isAborted,
-  intersection: () => intersectionType,
-  instanceof: () => instanceOfType,
-  getParsedType: () => getParsedType,
-  getErrorMap: () => getErrorMap,
-  function: () => functionType,
-  enum: () => enumType,
-  effect: () => effectsType,
-  discriminatedUnion: () => discriminatedUnionType,
-  defaultErrorMap: () => en_default,
-  datetimeRegex: () => datetimeRegex,
-  date: () => dateType,
-  custom: () => custom,
-  coerce: () => coerce,
-  boolean: () => booleanType,
-  bigint: () => bigIntType,
-  array: () => arrayType,
-  any: () => anyType,
-  addIssueToContext: () => addIssueToContext,
-  ZodVoid: () => ZodVoid,
-  ZodUnknown: () => ZodUnknown,
-  ZodUnion: () => ZodUnion,
-  ZodUndefined: () => ZodUndefined,
-  ZodType: () => ZodType,
-  ZodTuple: () => ZodTuple,
-  ZodTransformer: () => ZodEffects,
-  ZodSymbol: () => ZodSymbol,
-  ZodString: () => ZodString,
-  ZodSet: () => ZodSet,
-  ZodSchema: () => ZodType,
-  ZodRecord: () => ZodRecord,
-  ZodReadonly: () => ZodReadonly,
-  ZodPromise: () => ZodPromise,
-  ZodPipeline: () => ZodPipeline,
-  ZodParsedType: () => ZodParsedType,
-  ZodOptional: () => ZodOptional,
-  ZodObject: () => ZodObject,
-  ZodNumber: () => ZodNumber,
-  ZodNullable: () => ZodNullable,
-  ZodNull: () => ZodNull,
-  ZodNever: () => ZodNever,
-  ZodNativeEnum: () => ZodNativeEnum,
-  ZodNaN: () => ZodNaN,
-  ZodMap: () => ZodMap,
-  ZodLiteral: () => ZodLiteral,
-  ZodLazy: () => ZodLazy,
-  ZodIssueCode: () => ZodIssueCode,
-  ZodIntersection: () => ZodIntersection,
-  ZodFunction: () => ZodFunction,
-  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
-  ZodError: () => ZodError,
-  ZodEnum: () => ZodEnum,
-  ZodEffects: () => ZodEffects,
-  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
-  ZodDefault: () => ZodDefault,
-  ZodDate: () => ZodDate,
-  ZodCatch: () => ZodCatch,
-  ZodBranded: () => ZodBranded,
-  ZodBoolean: () => ZodBoolean,
-  ZodBigInt: () => ZodBigInt,
-  ZodArray: () => ZodArray,
-  ZodAny: () => ZodAny,
-  Schema: () => ZodType,
-  ParseStatus: () => ParseStatus,
-  OK: () => OK,
-  NEVER: () => NEVER,
-  INVALID: () => INVALID,
-  EMPTY_PATH: () => EMPTY_PATH,
+  BRAND: () => BRAND,
   DIRTY: () => DIRTY,
-  BRAND: () => BRAND
-});
-
-// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
-var util;
-(function(util2) {
-  util2.assertEqual = (_) => {};
-  function assertIs(_arg) {}
-  util2.assertIs = assertIs;
-  function assertNever(_x) {
-    throw new Error;
-  }
-  util2.assertNever = assertNever;
-  util2.arrayToEnum = (items) => {
-    const obj = {};
-    for (const item of items) {
-      obj[item] = item;
-    }
-    return obj;
-  };
-  util2.getValidEnumValues = (obj) => {
-    const validKeys2 = util2.objectKeys(obj).filter((k) => typeof obj[obj[k]] !== "number");
-    const filtered = {};
-    for (const k of validKeys2) {
-      filtered[k] = obj[k];
-    }
-    return util2.objectValues(filtered);
-  };
-  util2.objectValues = (obj) => {
-    return util2.objectKeys(obj).map(function(e) {
-      return obj[e];
-    });
-  };
-  util2.objectKeys = typeof Object.keys === "function" ? (obj) => Object.keys(obj) : (object) => {
-    const keys = [];
-    for (const key in object) {
-      if (Object.prototype.hasOwnProperty.call(object, key)) {
-        keys.push(key);
-      }
-    }
-    return keys;
-  };
-  util2.find = (arr, checker) => {
-    for (const item of arr) {
-      if (checker(item))
-        return item;
-    }
-    return;
-  };
-  util2.isInteger = typeof Number.isInteger === "function" ? (val) => Number.isInteger(val) : (val) => typeof val === "number" && Number.isFinite(val) && Math.floor(val) === val;
-  function joinValues(array, separator = " | ") {
-    return array.map((val) => typeof val === "string" ? `'${val}'` : val).join(separator);
-  }
-  util2.joinValues = joinValues;
-  util2.jsonStringifyReplacer = (_, value) => {
-    if (typeof value === "bigint") {
-      return value.toString();
-    }
-    return value;
-  };
-})(util || (util = {}));
-var objectUtil;
-(function(objectUtil2) {
-  objectUtil2.mergeShapes = (first, second) => {
-    return {
-      ...first,
-      ...second
-    };
-  };
-})(objectUtil || (objectUtil = {}));
-var ZodParsedType = util.arrayToEnum([
-  "string",
-  "nan",
-  "number",
-  "integer",
-  "float",
-  "boolean",
-  "date",
-  "bigint",
-  "symbol",
-  "function",
-  "undefined",
-  "null",
-  "array",
-  "object",
-  "unknown",
-  "promise",
-  "void",
-  "never",
-  "map",
-  "set"
-]);
-var getParsedType = (data) => {
-  const t = typeof data;
-  switch (t) {
+  EMPTY_PATH: () => EMPTY_PATH,
+  INVALID: () => INVALID,
+  NEVER: () => NEVER,
+  OK: () => OK,
+  ParseStatus: () => ParseStatus,
+  Schema: () => ZodType,
+  ZodAny: () => ZodAny,
+  ZodArray: () => ZodArray,
+  ZodBigInt: () => ZodBigInt,
+  ZodBoolean: () => ZodBoolean,
+  ZodBranded: () => ZodBranded,
+  ZodCatch: () => ZodCatch,
+  ZodDate: () => ZodDate,
+  ZodDefault: () => ZodDefault,
+  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
+  ZodEffects: () => ZodEffects,
+  ZodEnum: () => ZodEnum,
+  ZodError: () => ZodError,
+  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
+  ZodFunction: () => ZodFunction,
+  ZodIntersection: () => ZodIntersection,
+  ZodIssueCode: () => ZodIssueCode,
+  ZodLazy: () => ZodLazy,
+  ZodLiteral: () => ZodLiteral,
+  ZodMap: () => ZodMap,
+  ZodNaN: () => ZodNaN,
+  ZodNativeEnum: () => ZodNativeEnum,
+  ZodNever: () => ZodNever,
+  ZodNull: () => ZodNull,
+  ZodNullable: () => ZodNullable,
+  ZodNumber: () => ZodNumber,
+  ZodObject: () => ZodObject,
+  ZodOptional: () => ZodOptional,
+  ZodParsedType: () => ZodParsedType,
+  ZodPipeline: () => ZodPipeline,
+  ZodPromise: () => ZodPromise,
+  ZodReadonly: () => ZodReadonly,
+  ZodRecord: () => ZodRecord,
+  ZodSchema: () => ZodType,
+  ZodSet: () => ZodSet,
+  ZodString: () => ZodString,
+  ZodSymbol: () => ZodSymbol,
+  ZodTransformer: () => ZodEffects,
+  ZodTuple: () => ZodTuple,
+  ZodType: () => ZodType,
+  ZodUndefined: () => ZodUndefined,
+  ZodUnion: () => ZodUnion,
+  ZodUnknown: () => ZodUnknown,
+  ZodVoid: () => ZodVoid,
+  addIssueToContext: () => addIssueToContext,
+  any: () => anyType,
+  array: () => arrayType,
+  bigint: () => bigIntType,
+  boolean: () => booleanType,
+  coerce: () => coerce,
+  custom: () => custom,
+  date: () => dateType,
+  datetimeRegex: () => datetimeRegex,
+  defaultErrorMap: () => en_default,
+  discriminatedUnion: () => discriminatedUnionType,
+  effect: () => effectsType,
+  enum: () => enumType,
+  function: () => functionType,
+  getErrorMap: () => getErrorMap,
+  getParsedType: () => getParsedType,
+  instanceof: () => instanceOfType,
+  intersection: () => intersectionType,
+  isAborted: () => isAborted,
+  isAsync: () => isAsync,
+  isDirty: () => isDirty,
+  isValid: () => isValid,
+  late: () => late,
+  lazy: () => lazyType,
+  literal: () => literalType,
+  makeIssue: () => makeIssue,
+  map: () => mapType,
+  nan: () => nanType,
+  nativeEnum: () => nativeEnumType,
+  never: () => neverType,
+  null: () => nullType,
+  nullable: () => nullableType,
+  number: () => numberType,
+  object: () => objectType,
+  objectUtil: () => objectUtil,
+  oboolean: () => oboolean,
+  onumber: () => onumber,
+  optional: () => optionalType,
+  ostring: () => ostring,
+  pipeline: () => pipelineType,
+  preprocess: () => preprocessType,
+  promise: () => promiseType,
+  quotelessJson: () => quotelessJson,
+  record: () => recordType,
+  set: () => setType,
+  setErrorMap: () => setErrorMap,
+  strictObject: () => strictObjectType,
+  string: () => stringType,
+  symbol: () => symbolType,
+  transformer: () => effectsType,
+  tuple: () => tupleType,
+  undefined: () => undefinedType,
+  union: () => unionType,
+  unknown: () => unknownType,
+  util: () => util,
+  void: () => voidType
+});
+
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+var util;
+(function(util2) {
+  util2.assertEqual = (_) => {};
+  function assertIs(_arg) {}
+  util2.assertIs = assertIs;
+  function assertNever(_x) {
+    throw new Error;
+  }
+  util2.assertNever = assertNever;
+  util2.arrayToEnum = (items) => {
+    const obj = {};
+    for (const item of items) {
+      obj[item] = item;
+    }
+    return obj;
+  };
+  util2.getValidEnumValues = (obj) => {
+    const validKeys2 = util2.objectKeys(obj).filter((k) => typeof obj[obj[k]] !== "number");
+    const filtered = {};
+    for (const k of validKeys2) {
+      filtered[k] = obj[k];
+    }
+    return util2.objectValues(filtered);
+  };
+  util2.objectValues = (obj) => {
+    return util2.objectKeys(obj).map(function(e) {
+      return obj[e];
+    });
+  };
+  util2.objectKeys = typeof Object.keys === "function" ? (obj) => Object.keys(obj) : (object) => {
+    const keys = [];
+    for (const key in object) {
+      if (Object.prototype.hasOwnProperty.call(object, key)) {
+        keys.push(key);
+      }
+    }
+    return keys;
+  };
+  util2.find = (arr, checker) => {
+    for (const item of arr) {
+      if (checker(item))
+        return item;
+    }
+    return;
+  };
+  util2.isInteger = typeof Number.isInteger === "function" ? (val) => Number.isInteger(val) : (val) => typeof val === "number" && Number.isFinite(val) && Math.floor(val) === val;
+  function joinValues(array, separator = " | ") {
+    return array.map((val) => typeof val === "string" ? `'${val}'` : val).join(separator);
+  }
+  util2.joinValues = joinValues;
+  util2.jsonStringifyReplacer = (_, value) => {
+    if (typeof value === "bigint") {
+      return value.toString();
+    }
+    return value;
+  };
+})(util || (util = {}));
+var objectUtil;
+(function(objectUtil2) {
+  objectUtil2.mergeShapes = (first, second) => {
+    return {
+      ...first,
+      ...second
+    };
+  };
+})(objectUtil || (objectUtil = {}));
+var ZodParsedType = util.arrayToEnum([
+  "string",
+  "nan",
+  "number",
+  "integer",
+  "float",
+  "boolean",
+  "date",
+  "bigint",
+  "symbol",
+  "function",
+  "undefined",
+  "null",
+  "array",
+  "object",
+  "unknown",
+  "promise",
+  "void",
+  "never",
+  "map",
+  "set"
+]);
+var getParsedType = (data) => {
+  const t = typeof data;
+  switch (t) {
     case "undefined":
       return ZodParsedType.undefined;
     case "string":
@@ -10254,11 +10507,174 @@ function primitiveHaystack(primitive) {
 function clone(value) {
   return value === undefined ? undefined : JSON.parse(JSON.stringify(value));
 }
-// src/lib/remote-workspace-selection.ts
+// src/lib/remote-invitations.ts
+class WorkspaceInvitationInputError extends Error {
+  code = "INVITATION_INPUT_INVALID";
+  constructor() {
+    super("Provide only the documented invitation fields, exact lowercase IDs, expected generation and explicit confirmation. Issue and resend require your stable idempotency key.");
+    this.name = "WorkspaceInvitationInputError";
+  }
+}
+var invitationFailures = {
+  INVALID_REQUEST: [400, "Invitation parameters were refused."],
+  ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+  INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required."],
+  WORKSPACE_ADMIN_REQUIRED: [403, "A current workspace owner or admin is required."],
+  INVITATION_FORBIDDEN: [403, "Your current role cannot manage this invitation."],
+  INVITATION_UNAVAILABLE: [404, "Invitation is unavailable for this account."],
+  INVITATION_CHANGED: [409, "Invitation changed. Read its current generation before another action."],
+  INVITATION_EXISTS: [409, "A pending invitation already exists. Read current invitations."],
+  ALREADY_MEMBER: [409, "An active membership already exists. An invitation cannot change its role."],
+  IDEMPOTENCY_CONFLICT: [409, "This request key was used for different invitation parameters. Reconcile the original request."],
+  INVITATION_LIMIT: [429, "Invitation limit reached. Wait before issuing or resending."],
+  INVITATION_BUSY: [503, "Invitation is busy. Read its state before another action."],
+  INVITATION_DELIVERY_UNAVAILABLE: [503, "Invitation email delivery is unavailable."]
+};
+
+class RemoteWorkspaceInvitationError extends Error {
+  code;
+  status;
+  constructor(code) {
+    super(invitationFailures[code][1]);
+    this.code = code;
+    this.name = "RemoteWorkspaceInvitationError";
+    this.status = invitationFailures[code][0];
+  }
+}
+
+class RemoteWorkspaceInvitationUnconfirmedError extends Error {
+  code = "INVITATION_UNCONFIRMED";
+  constructor() {
+    super("The invitation outcome is unconfirmed. Read current invitations or memberships. Reconcile issue/resend only with the same request key, parameters, server and membership; never generate a new key or retry automatically. Saved credentials are unchanged.");
+    this.name = "RemoteWorkspaceInvitationUnconfirmedError";
+  }
+}
+
+class RemoteWorkspaceInvitationReadError extends Error {
+  code = "INVITATION_READ_FAILED";
+  constructor() {
+    super("Unable to read a valid invitation result. Check the selected server, account, current membership and permissions.");
+    this.name = "RemoteWorkspaceInvitationReadError";
+  }
+}
+function invitationFailure(value, status) {
+  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(invitationFailures, value.code))
+    return null;
+  const code = value.code;
+  return invitationFailures[code][0] === status ? code : null;
+}
 var record = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var uuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
-var text = (v, max = 1024) => typeof v === "string" && !!v.trim() && v.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v);
 var role = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v);
+var email = (v) => typeof v === "string" && v.length <= 254 && !/[\p{Cc}\p{Cs}\u2028\u2029\s]/u.test(v) && /^[^@]+@[^@]+\.[^@]+$/.test(v);
+var timestamp = (v) => typeof v === "string" && v.length <= 40 && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d{1,6})?(?:Z|[+-]\d\d:\d\d)$/.test(v) && Number.isFinite(Date.parse(v));
+var inputFailure = () => {
+  throw new WorkspaceInvitationInputError;
+};
+function invitationInput(action, input) {
+  if (!record(input))
+    return inputFailure();
+  const keys = {
+    list: ["after"],
+    get: ["invitationId"],
+    issue: ["email", "role", "idempotencyKey", "confirm"],
+    resend: ["invitationId", "expectedGeneration", "idempotencyKey", "confirm"],
+    revoke: ["invitationId", "expectedGeneration", "confirm"],
+    accept: ["invitationId", "token", "confirm"]
+  };
+  if (Object.keys(input).some((key) => !keys[action].includes(key)) || action !== "list" && keys[action].some((key) => !Object.hasOwn(input, key)))
+    return inputFailure();
+  const value = { ...input };
+  if (action === "list") {
+    if (value.after !== undefined && !uuid(value.after))
+      return inputFailure();
+  }
+  if (["get", "resend", "revoke", "accept"].includes(action) && !uuid(value.invitationId))
+    return inputFailure();
+  if (!["list", "get"].includes(action) && value.confirm !== true)
+    return inputFailure();
+  if (["issue", "resend"].includes(action) && !uuid(value.idempotencyKey))
+    return inputFailure();
+  if (action === "issue") {
+    if (typeof value.email !== "string")
+      return inputFailure();
+    value.email = value.email.trim().toLowerCase();
+    if (!email(value.email) || !role(value.role))
+      return inputFailure();
+  }
+  if (["resend", "revoke"].includes(action) && (!Number.isInteger(value.expectedGeneration) || Number(value.expectedGeneration) < 1 || Number(value.expectedGeneration) > 10))
+    return inputFailure();
+  if (action === "accept" && (typeof value.token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value.token)))
+    return inputFailure();
+  return value;
+}
+function invitationRequest(action, input) {
+  const base = "/api/v1/workspace/invitations", value = input;
+  const { confirm: _confirm, invitationId: id, ...body } = value;
+  if (action === "list")
+    return { path: base + (value.after ? `?after=${value.after}` : ""), method: "GET" };
+  if (action === "get")
+    return { path: `${base}/${id}`, method: "GET" };
+  if (action === "accept")
+    return { path: "/api/v1/account/invitations/accept", method: "POST", body: JSON.stringify({ invitationId: id, token: value.token }) };
+  return { path: action === "issue" ? base : `${base}/${id}${action === "resend" ? "/resend" : ""}`, method: action === "revoke" ? "DELETE" : "POST", body: JSON.stringify(body) };
+}
+function invalid() {
+  throw new RemoteWorkspaceInvitationReadError;
+}
+function projection(v, organizationId) {
+  if (!record(v) || !uuid(v.id) || v.organizationId !== organizationId || !email(v.email) || v.email !== v.email.trim().toLowerCase() || !role(v.role) || !Number.isInteger(v.generation) || Number(v.generation) < 1 || Number(v.generation) > 10 || typeof v.status !== "string" || !["pending", "expired", "accepted", "revoked"].includes(v.status) || !timestamp(v.expiresAt) || !timestamp(v.createdAt) || !record(v.delivery) || typeof v.delivery.state !== "string" || !["queued", "sending", "uncertain", "provider_accepted", "failed", "cancelled"].includes(v.delivery.state) || !Number.isInteger(v.delivery.attempts) || Number(v.delivery.attempts) < 0 || Number(v.delivery.attempts) > 5)
+    return invalid();
+  return {
+    id: v.id,
+    organizationId,
+    email: v.email,
+    role: v.role,
+    generation: Number(v.generation),
+    status: v.status,
+    expiresAt: v.expiresAt,
+    createdAt: v.createdAt,
+    delivery: { state: v.delivery.state, attempts: Number(v.delivery.attempts) }
+  };
+}
+function parseInvitationResult(action, value, input, organizationId) {
+  if (!record(value))
+    return invalid();
+  const request = input;
+  if (action === "accept") {
+    if (!uuid(value.organizationId) || !uuid(value.membershipId) || value.accepted !== true || typeof value.changed !== "boolean")
+      return invalid();
+    return { organizationId: value.organizationId, membershipId: value.membershipId, accepted: true, changed: value.changed };
+  }
+  if (action === "list") {
+    if (value.organizationId !== organizationId || !Array.isArray(value.invitations) || value.invitations.length > 50 || value.nextCursor !== null && !uuid(value.nextCursor))
+      return invalid();
+    const invitations = value.invitations.map((v) => projection(v, organizationId));
+    if (invitations.some((v, n) => v.id <= String(n ? invitations[n - 1].id : request.after ?? "")) || value.nextCursor !== null && (invitations.length !== 50 || value.nextCursor !== invitations.at(-1)?.id))
+      return invalid();
+    return { organizationId, invitations, nextCursor: value.nextCursor };
+  }
+  const invitation = projection(value.invitation, organizationId);
+  if (action !== "issue" && invitation.id !== request.invitationId)
+    return invalid();
+  if (action === "get")
+    return { invitation };
+  if (typeof value.changed !== "boolean")
+    return invalid();
+  if (action === "issue" && (invitation.email !== request.email || invitation.role !== request.role || value.changed && invitation.generation !== 1))
+    return invalid();
+  if (action === "resend" && (value.changed ? invitation.generation !== Number(request.expectedGeneration) + 1 : invitation.generation <= Number(request.expectedGeneration)))
+    return invalid();
+  if (action === "revoke" && (invitation.status !== "revoked" || invitation.generation < Number(request.expectedGeneration) || value.changed && invitation.generation !== request.expectedGeneration))
+    return invalid();
+  return { invitation, changed: value.changed };
+}
+
+// src/lib/remote-workspace-selection.ts
+var record2 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var uuid2 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
+var text = (v, max = 1024) => typeof v === "string" && !!v.trim() && v.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v);
+var role2 = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v);
 var invalidWorkspaceResult = "The server returned an invalid workspace selection result.";
 
 class WorkspaceContextInputError extends Error {
@@ -10275,48 +10691,48 @@ class WorkspaceIdentityMismatchError extends Error {
   }
 }
 function workspaceExpectedUserId(value) {
-  if (!uuid(value))
+  if (!uuid2(value))
     throw new WorkspaceContextInputError;
   return value;
 }
 function workspaceContext(value) {
-  if (!record(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid(value.userId) || !uuid(value.membershipId))
+  if (!record2(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid2(value.userId) || !uuid2(value.membershipId))
     throw new WorkspaceContextInputError;
   return { userId: value.userId, membershipId: value.membershipId };
 }
-function invalid() {
+function invalid2() {
   throw new Error(invalidWorkspaceResult);
 }
 function organization(v) {
-  if (!record(v) || !uuid(v.id) || !text(v.slug) || !text(v.name))
-    return invalid();
+  if (!record2(v) || !uuid2(v.id) || !text(v.slug) || !text(v.name))
+    return invalid2();
   return { id: v.id, slug: v.slug, name: v.name };
 }
 function parseAccountWorkspaces(value) {
-  if (!record(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
-    return invalid();
+  if (!record2(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
+    return invalid2();
   const workspaces = value.workspaces.map((v) => {
-    if (!record(v) || !uuid(v.membershipId) || !role(v.role) || typeof v.current !== "boolean")
-      return invalid();
+    if (!record2(v) || !uuid2(v.membershipId) || !role2(v.role) || typeof v.current !== "boolean")
+      return invalid2();
     return { membershipId: v.membershipId, organization: organization(v.organization), role: v.role, current: v.current };
   });
   if (workspaces.filter((w) => w.current).length !== 1 || new Set(workspaces.map((w) => w.membershipId)).size !== workspaces.length || new Set(workspaces.map((w) => w.organization.id)).size !== workspaces.length)
-    return invalid();
+    return invalid2();
   return { workspaces };
 }
 function parseWorkspaceIdentity(value, expectedUserId) {
-  if (!record(value))
-    return invalid();
+  if (!record2(value))
+    return invalid2();
   const user = value.user;
-  if (!record(user) || !uuid(user.id) || !uuid(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role(user.role))
-    return invalid();
+  if (!record2(user) || !uuid2(user.id) || !uuid2(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role2(user.role))
+    return invalid2();
   if (user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
   return { user: { id: user.id, membershipId: user.membershipId, email: user.email, displayName: user.displayName, role: user.role }, organization: organization(value.organization) };
 }
 function sessionToken(value) {
   if (typeof value !== "string" || !value || value.length > 8192 || /[^\x21-\x7e]/.test(value) || value.startsWith("sk_"))
-    return invalid();
+    return invalid2();
   return value;
 }
 function parseWorkspaceSession(value, expected) {
@@ -10326,9 +10742,9 @@ function parseWorkspaceSession(value, expected) {
   return { token: sessionToken(value.token), ...identity };
 }
 function parseWorkspaceLogin(value, expectedUserId) {
-  const user = record(value) && value.user;
-  if (!record(value) || !record(user) || !uuid(user.id))
-    return invalid();
+  const user = record2(value) && value.user;
+  if (!record2(value) || !record2(user) || !uuid2(user.id))
+    return invalid2();
   if (expectedUserId !== undefined && user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
   return { token: sessionToken(value.token), userId: user.id };
@@ -10342,18 +10758,18 @@ var workspaceSelectionFailures = {
   WORKSPACE_BUSY: [503, "Workspace is busy. Refresh before retrying."]
 };
 function workspaceSelectionFailure(value, status) {
-  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
+  if (!record2(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
     return null;
   const code = value.code;
   return workspaceSelectionFailures[code][0] === status ? code : null;
 }
 
 // src/lib/remote-workspace.ts
-var record2 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+var record3 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
 var cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value);
-var uuid2 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value);
+var uuid3 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value);
 function workspaceMembersQuery(options = {}) {
-  if (!record2(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+  if (!record3(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
     throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
   const query = new URLSearchParams;
   if (options.limit !== undefined)
@@ -10362,14 +10778,14 @@ function workspaceMembersQuery(options = {}) {
     query.set("cursor", options.cursor);
   return query.size ? `?${query}` : "";
 }
-function timestamp(value) {
+function timestamp2(value) {
   if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}Z$/.test(value))
     return false;
   const time = Date.parse(value);
   return Number.isFinite(time) && new Date(time).toISOString().slice(0, 23) === value.slice(0, 23);
 }
 function parseMember(row, fail) {
-  if (!record2(row) || !uuid2(row.membershipId) || !uuid2(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp(row.createdAt))
+  if (!record3(row) || !uuid3(row.membershipId) || !uuid3(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp2(row.createdAt))
     return fail();
   return {
     membershipId: row.membershipId,
@@ -10389,12 +10805,12 @@ class WorkspaceMemberInputError extends Error {
   }
 }
 function mutationInput(membershipId, input, roleChange) {
-  if (typeof membershipId !== "string" || !uuid2(membershipId) || membershipId !== membershipId.toLowerCase() || !record2(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+  if (typeof membershipId !== "string" || !uuid3(membershipId) || membershipId !== membershipId.toLowerCase() || !record3(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
     throw new WorkspaceMemberInputError;
-  const expectedRole = input.expectedRole, role2 = roleChange ? input.role : undefined;
-  if (!isRole(expectedRole) || roleChange && !isRole(role2))
+  const expectedRole = input.expectedRole, role3 = roleChange ? input.role : undefined;
+  if (!isRole(expectedRole) || roleChange && !isRole(role3))
     throw new WorkspaceMemberInputError;
-  return { membershipId, role: role2, expectedRole };
+  return { membershipId, role: role3, expectedRole };
 }
 function workspaceMemberRoleInput(membershipId, input) {
   const value = mutationInput(membershipId, input, true);
@@ -10405,19 +10821,19 @@ function workspaceMemberRemovalInput(membershipId, input) {
   return { membershipId: value.membershipId, body: { expectedRole: value.expectedRole } };
 }
 var invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.";
-function parseWorkspaceMemberRoleResult(value, membershipId, role2) {
+function parseWorkspaceMemberRoleResult(value, membershipId, role3) {
   const fail = () => {
     throw new Error(invalidMemberResult);
   };
-  if (!record2(value) || !uuid2(value.organizationId) || typeof value.changed !== "boolean")
+  if (!record3(value) || !uuid3(value.organizationId) || typeof value.changed !== "boolean")
     return fail();
   const member = parseMember(value.member, fail);
-  if (member.membershipId !== membershipId || member.role !== role2)
+  if (member.membershipId !== membershipId || member.role !== role3)
     return fail();
   return { organizationId: value.organizationId, member, changed: value.changed };
 }
 function parseWorkspaceMemberRemovalResult(value, membershipId) {
-  if (!record2(value) || !uuid2(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+  if (!record3(value) || !uuid3(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
     throw new Error(invalidMemberResult);
   return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
 }
@@ -10434,7 +10850,7 @@ var workspaceMemberFailures = {
   MEMBERSHIP_BUSY: [503, "Membership is busy. Refresh the roster before another action."]
 };
 function workspaceMemberFailure(value, status) {
-  if (!record2(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+  if (!record3(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
     return null;
   const code = value.code;
   return workspaceMemberFailures[code][0] === status ? code : null;
@@ -10443,7 +10859,7 @@ function parseWorkspaceMembersPage(value) {
   const fail = () => {
     throw new Error("The server returned an invalid workspace roster.");
   };
-  if (!record2(value) || !uuid2(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+  if (!record3(value) || !uuid3(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
     return fail();
   const members = value.members.map((row) => parseMember(row, fail));
   if (new Set(members.map((row) => row.membershipId)).size !== members.length)
@@ -10517,44 +10933,44 @@ function getApiUrl(action, env = process.env, options = {}) {
 // src/lib/remote-run-contract.ts
 var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
 function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
-  const record3 = isRecord3(payload) ? payload : {};
+  const record4 = isRecord3(payload) ? payload : {};
   return {
     contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
-    ...pickString(record3, "id"),
-    skill: pickStringValue(record3, "skill") ?? fallbackSkill,
-    ...pickString(record3, "requestedSlug"),
-    ...pickString(record3, "status"),
-    ...pickNumber(record3, "exitCode"),
-    ...pickString(record3, "correlationId"),
-    ...pickString(record3, "createdAt"),
-    ...pickString(record3, "startedAt"),
-    ...pickString(record3, "completedAt"),
-    ...pickNumber(record3, "durationMs"),
-    ...pickString(record3, "outputType"),
-    ...hasOwn(record3, "outputPreview") ? { outputPreview: record3.outputPreview } : {},
-    ...pickString(record3, "errorCode"),
-    ...pickString(record3, "errorMessage"),
-    ...pickString(record3, "error"),
-    ...pickString(record3, "code"),
-    ...hasOwn(record3, "details") ? { details: record3.details } : {}
+    ...pickString(record4, "id"),
+    skill: pickStringValue(record4, "skill") ?? fallbackSkill,
+    ...pickString(record4, "requestedSlug"),
+    ...pickString(record4, "status"),
+    ...pickNumber(record4, "exitCode"),
+    ...pickString(record4, "correlationId"),
+    ...pickString(record4, "createdAt"),
+    ...pickString(record4, "startedAt"),
+    ...pickString(record4, "completedAt"),
+    ...pickNumber(record4, "durationMs"),
+    ...pickString(record4, "outputType"),
+    ...hasOwn(record4, "outputPreview") ? { outputPreview: record4.outputPreview } : {},
+    ...pickString(record4, "errorCode"),
+    ...pickString(record4, "errorMessage"),
+    ...pickString(record4, "error"),
+    ...pickString(record4, "code"),
+    ...hasOwn(record4, "details") ? { details: record4.details } : {}
   };
 }
 function isRecord3(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function hasOwn(record3, key) {
-  return Object.prototype.hasOwnProperty.call(record3, key);
+function hasOwn(record4, key) {
+  return Object.prototype.hasOwnProperty.call(record4, key);
 }
-function pickString(record3, key) {
-  const value = pickStringValue(record3, key);
+function pickString(record4, key) {
+  const value = pickStringValue(record4, key);
   return value === undefined ? {} : { [key]: value };
 }
-function pickStringValue(record3, key) {
-  const value = record3[key];
+function pickStringValue(record4, key) {
+  const value = record4[key];
   return typeof value === "string" ? value : undefined;
 }
-function pickNumber(record3, key) {
-  const value = record3[key];
+function pickNumber(record4, key) {
+  const value = record4[key];
   return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
 }
 
@@ -10724,6 +11140,69 @@ function parseUpdatedWorkspace(value) {
   return { organization: { id: organization2.id, slug: organization2.slug, name: organization2.name } };
 }
 
+// src/lib/remote-quote-errors.ts
+var quoteUnavailableMessages = Object.freeze({
+  HOSTED_PROVIDER_UNAVAILABLE: "Hosted execution is temporarily unavailable on this Skills instance.",
+  HOSTED_CONNECTORS_UNAVAILABLE: "Hosted connector execution is unavailable on this Skills instance.",
+  SKILL_IMPLEMENTATION_UNAVAILABLE: "This skill has no hosted execution implementation.",
+  HOSTED_PRICING_UNAVAILABLE: "Hosted execution is unavailable while this skill's pricing is reviewed.",
+  RUNTIME_ALLOWLIST_REQUIRED: "Hosted execution is unavailable until this Skills instance enables its skill catalog.",
+  RUNTIME_SKILL_NOT_ALLOWED: "This skill is not enabled for hosted execution on this Skills instance."
+});
+async function readQuoteUnavailableCode(response) {
+  const maximum = 16 * 1024;
+  const length = response.headers.get("content-length");
+  if (response.status !== 503 || response.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > maximum)) {
+    response.body?.cancel().catch(() => {});
+    return null;
+  }
+  const reader = response.body?.getReader();
+  if (!reader)
+    return null;
+  let timer;
+  let deadlineExceeded = false;
+  const expired = Symbol("quote body deadline");
+  const deadline = new Promise((resolve2) => {
+    timer = setTimeout(() => {
+      deadlineExceeded = true;
+      resolve2(expired);
+      reader.cancel().catch(() => {});
+    }, 1500);
+  });
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const next = await Promise.race([reader.read(), deadline]);
+      if (next === expired || deadlineExceeded)
+        return null;
+      if (next.done)
+        break;
+      size += next.value.byteLength;
+      if (size > maximum)
+        return null;
+      chunks.push(next.value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      return null;
+    const code = value.code;
+    return typeof code === "string" && Object.hasOwn(quoteUnavailableMessages, code) ? code : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+    reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+}
+
 // src/lib/remote-client.ts
 class RemoteRouteUnsupportedError extends Error {
   path;
@@ -10749,6 +11228,18 @@ class RemoteRequestError extends Error {
   }
 }
 
+class RemoteQuoteUnavailableError extends RemoteRequestError {
+  code;
+  constructor(path, code) {
+    super(path, 503);
+    this.code = code;
+    if (!Object.hasOwn(quoteUnavailableMessages, code))
+      throw new Error("Unknown quote refusal code");
+    this.name = "RemoteQuoteUnavailableError";
+    this.message = quoteUnavailableMessages[code];
+  }
+}
+
 class RemoteWorkspaceMemberError extends RemoteRequestError {
   code;
   constructor(path, code) {
@@ -10810,6 +11301,11 @@ class RemoteSkillsClient {
       throw new RemoteRouteUnsupportedError(routePath, response.status, this.apiUrl);
     }
     if (!response.ok) {
+      if (opts.quoteRefusal && options?.method === "POST" && /^\/api\/v1\/skills\/[^/?#]+\/quote$/.test(routePath) && response.status === 503) {
+        const code = await readQuoteUnavailableCode(response);
+        if (code)
+          throw new RemoteQuoteUnavailableError(routePath, code);
+      }
       if (path === "/api/v1/billing/checkout" && options?.method === "POST" && response.status === 503 && await responseBodyCarriesCode(response, ["SUBSCRIPTION_CHECKOUT_UNAVAILABLE"])) {
         throw new RemoteCapabilityUnavailableError;
       }
@@ -10867,7 +11363,7 @@ class RemoteSkillsClient {
     const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/quote`, {
       method: "POST",
       body: JSON.stringify({ input, args })
-    });
+    }, { quoteRefusal: true });
     return parseRemoteRunQuote(await response.json());
   }
   getCapabilities() {
@@ -11032,6 +11528,53 @@ class RemoteSkillsClient {
     }
     return parseWorkspaceLeaveResult(body, captured.context.membershipId, identity.organization.id);
   }
+  listWorkspaceInvitations(context, options = {}) {
+    return this.requestWorkspaceInvitation(context, "list", options);
+  }
+  getWorkspaceInvitation(context, invitationId) {
+    return this.requestWorkspaceInvitation(context, "get", { invitationId });
+  }
+  issueWorkspaceInvitation(context, input) {
+    return this.requestWorkspaceInvitation(context, "issue", input);
+  }
+  resendWorkspaceInvitation(context, invitationId, input) {
+    return this.requestWorkspaceInvitation(context, "resend", { ...input, invitationId });
+  }
+  revokeWorkspaceInvitation(context, invitationId, input) {
+    return this.requestWorkspaceInvitation(context, "revoke", { ...input, invitationId });
+  }
+  acceptWorkspaceInvitation(context, invitationId, input) {
+    return this.requestWorkspaceInvitation(context, "accept", { ...input, invitationId });
+  }
+  async requestWorkspaceInvitation(context, action, input) {
+    const target = workspaceContext(context), captured = invitationInput(action, input);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const identityValue = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!identityValue || typeof identityValue !== "object" || identityValue.authMethod !== "jwt")
+      throw new RemoteWorkspaceInvitationError("INTERACTIVE_SESSION_REQUIRED");
+    const identity = parseWorkspaceIdentity(identityValue, target.userId);
+    if (identity.user.membershipId !== target.membershipId)
+      throw new WorkspaceIdentityMismatchError;
+    const request = invitationRequest(action, captured), read = action === "list" || action === "get";
+    let response, value;
+    try {
+      response = await connection.request(request.path, { method: request.method, ...request.body ? { body: request.body } : {}, credentials: "omit" });
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 64 * 1024 : 4096)));
+    } catch {
+      throw read ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+    }
+    if (!response.ok) {
+      const code = invitationFailure(value, response.status);
+      if (code)
+        throw new RemoteWorkspaceInvitationError(code);
+      throw read ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+    }
+    try {
+      return parseInvitationResult(action, value, captured, identity.organization.id);
+    } catch {
+      throw read ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+    }
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -11282,13 +11825,13 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record3, field) {
-  if (record3[field] === undefined)
+function requireOptionalString(record4, field) {
+  if (record4[field] === undefined)
     return;
-  if (typeof record3[field] !== "string") {
+  if (typeof record4[field] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field} must be a string when present)`);
   }
-  return record3[field];
+  return record4[field];
 }
 var INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 function isVersionRecord(value) {
@@ -11311,19 +11854,19 @@ function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record3 = entry;
-  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  const record4 = entry;
+  const slug = typeof record4.slug === "string" && record4.slug.trim() ? record4.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record3.metadata !== undefined) {
-    if (!record3.metadata || typeof record3.metadata !== "object" || Array.isArray(record3.metadata)) {
+  if (record4.metadata !== undefined) {
+    if (!record4.metadata || typeof record4.metadata !== "object" || Array.isArray(record4.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record3.metadata;
+    metadata = record4.metadata;
   }
-  const pinnedAt = requireOptionalString(record3, "pinnedAt");
+  const pinnedAt = requireOptionalString(record4, "pinnedAt");
   return {
     slug,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -11340,16 +11883,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record3 = entry;
-  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  const record4 = entry;
+  const slug = typeof record4.slug === "string" && record4.slug.trim() ? record4.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug,
-    ...requireOptionalString(record3, "name") !== undefined ? { name: requireOptionalString(record3, "name") } : {},
-    ...requireOptionalString(record3, "version") !== undefined ? { version: requireOptionalString(record3, "version") } : {},
-    ...requireOptionalString(record3, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record3, "updatedAt") } : {}
+    ...requireOptionalString(record4, "name") !== undefined ? { name: requireOptionalString(record4, "name") } : {},
+    ...requireOptionalString(record4, "version") !== undefined ? { version: requireOptionalString(record4, "version") } : {},
+    ...requireOptionalString(record4, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record4, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -11402,12 +11945,12 @@ function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record3 = payload;
-  if (!Array.isArray(record3.skills)) {
+  const record4 = payload;
+  if (!Array.isArray(record4.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record3.skills.map(normalizeSkillSummary);
-  const nextCursor = record3.nextCursor === undefined || record3.nextCursor === null ? null : record3.nextCursor;
+  const skills = record4.skills.map(normalizeSkillSummary);
+  const nextCursor = record4.nextCursor === undefined || record4.nextCursor === null ? null : record4.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -11621,10 +12164,6 @@ function recordScheduleRun(id, status, targetDir) {
   schedule.nextRun = getNextRun(schedule.cron, now)?.toISOString();
   saveSchedules(data, targetDir);
 }
-// src/lib/pull.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync3, readFileSync as readFileSync15, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname6, join as join17 } from "path";
-
 // src/lib/revision.ts
 import { createHash as createHash4 } from "crypto";
 var REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
@@ -11644,14 +12183,18 @@ function revisionIdOf(content) {
   });
   return createHash4("sha256").update(canonical).digest("hex");
 }
-function revisionIdOfRecord(record3) {
-  return revisionIdOf(record3);
+function revisionIdOfRecord(record4) {
+  return revisionIdOf(record4);
 }
+// src/lib/pull.ts
+import { existsSync as existsSync15, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync3, readFileSync as readFileSync15, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname6, join as join17 } from "path";
 
 // src/lib/skill-bundle.ts
 import { createHash as createHash5 } from "crypto";
 import { readFileSync as readFileSync14, readdirSync as readdirSync9, statSync as statSync9 } from "fs";
 import { join as join16, relative as relative3 } from "path";
+import { createGunzip } from "zlib";
 var BLOCK = 512;
 var ANY_SEGMENT_EXCLUDES = new Set([
   ".git",
@@ -11974,6 +12517,227 @@ function concat(chunks) {
   }
   return merged;
 }
+var SKILL_BUNDLE_INSPECTION_LIMITS = Object.freeze({
+  compressedBytes: 16 * 1024 * 1024,
+  decompressedBytes: 64 * 1024 * 1024,
+  entries: 1024,
+  fileBytes: 16 * 1024 * 1024,
+  pathBytes: 100,
+  timeoutMs: 5000
+});
+
+class SkillBundleInspectionError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SkillBundleInspectionError";
+  }
+}
+function invalidBundle(message) {
+  throw new SkillBundleInspectionError("BUNDLE_INVALID", message);
+}
+function inspectionLimits(options) {
+  const limits = { ...SKILL_BUNDLE_INSPECTION_LIMITS };
+  for (const key of Object.keys(options.limits ?? {})) {
+    if (!Object.hasOwn(limits, key))
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Unknown bundle limit");
+    const field = key;
+    const value = options.limits[field];
+    if (!Number.isSafeInteger(value) || value <= 0 || value > limits[field]) {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle limits must be positive integers within the hard ceilings");
+    }
+    limits[field] = value;
+  }
+  return limits;
+}
+async function inspectSkillBundle(bundle, options = {}) {
+  const signal = options.signal;
+  const limits = inspectionLimits(options);
+  const deadline = performance.now() + limits.timeoutMs;
+  const check = () => {
+    if (signal?.aborted)
+      throw new SkillBundleInspectionError("BUNDLE_ABORTED", "Bundle inspection aborted");
+    if (performance.now() >= deadline)
+      throw new SkillBundleInspectionError("BUNDLE_TIMEOUT", "Bundle inspection deadline exceeded");
+  };
+  check();
+  if (bundle.byteLength > limits.compressedBytes)
+    throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Compressed bundle exceeds byte limit");
+  const snapshot = ownBytes(bundle);
+  check();
+  const sha2562 = sha256Hex(snapshot);
+  check();
+  const parser = new BoundedTarReader(limits, check);
+  const streamOptions = { chunkSize: 16 * 1024, highWaterMark: 16 * 1024 };
+  const decoder = createGunzip(streamOptions);
+  let terminalError;
+  const stop = (code) => {
+    terminalError ??= new SkillBundleInspectionError(code, code === "BUNDLE_ABORTED" ? "Bundle inspection aborted" : "Bundle inspection deadline exceeded");
+    decoder.destroy(terminalError);
+  };
+  const onAbort = () => stop("BUNDLE_ABORTED");
+  const timer = setTimeout(() => stop("BUNDLE_TIMEOUT"), Math.max(1, deadline - performance.now()));
+  signal?.addEventListener("abort", onAbort, { once: true });
+  let decompressedByteSize = 0;
+  let bytesSinceYield = 0;
+  try {
+    check();
+    decoder.end(snapshot);
+    for await (const chunk of decoder) {
+      check();
+      decompressedByteSize += chunk.byteLength;
+      if (decompressedByteSize > limits.decompressedBytes)
+        throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Decompressed bundle exceeds byte limit");
+      parser.push(chunk);
+      bytesSinceYield += chunk.byteLength;
+      if (bytesSinceYield >= 256 * 1024) {
+        await new Promise((resolve2) => setTimeout(resolve2, 0));
+        bytesSinceYield = 0;
+        check();
+      }
+    }
+    check();
+    const entries = parser.finish();
+    return {
+      entries,
+      sha256: sha2562,
+      compressedByteSize: snapshot.byteLength,
+      decompressedByteSize,
+      unpackedByteSize: parser.fileBytes,
+      fileCount: entries.length
+    };
+  } catch (error) {
+    if (terminalError)
+      throw terminalError;
+    if (error instanceof SkillBundleInspectionError)
+      throw error;
+    throw new SkillBundleInspectionError("BUNDLE_INVALID", "Invalid or truncated gzip bundle");
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", onAbort);
+    decoder.destroy();
+  }
+}
+
+class BoundedTarReader {
+  limits;
+  check;
+  header = new Uint8Array(BLOCK);
+  headerOffset = 0;
+  pending;
+  bodyOffset = 0;
+  padding = 0;
+  zeroBlocks = 0;
+  entries = [];
+  paths = new SkillEntryPaths;
+  fileBytes = 0;
+  constructor(limits, check) {
+    this.limits = limits;
+    this.check = check;
+  }
+  push(chunk) {
+    let offset = 0;
+    while (offset < chunk.byteLength) {
+      this.check();
+      if (this.pending) {
+        const count = Math.min(this.pending.bytes.byteLength - this.bodyOffset, chunk.byteLength - offset);
+        this.pending.bytes.set(chunk.subarray(offset, offset + count), this.bodyOffset);
+        offset += count;
+        this.bodyOffset += count;
+        if (this.bodyOffset === this.pending.bytes.byteLength) {
+          this.entries.push(this.pending);
+          this.pending = undefined;
+        }
+      } else if (this.padding) {
+        const count = Math.min(this.padding, chunk.byteLength - offset);
+        if (chunk.subarray(offset, offset + count).some((byte) => byte !== 0))
+          invalidBundle("Nonzero tar body padding");
+        offset += count;
+        this.padding -= count;
+      } else {
+        const count = Math.min(BLOCK - this.headerOffset, chunk.byteLength - offset);
+        this.header.set(chunk.subarray(offset, offset + count), this.headerOffset);
+        offset += count;
+        this.headerOffset += count;
+        if (this.headerOffset === BLOCK) {
+          this.readHeader();
+          this.headerOffset = 0;
+        }
+      }
+    }
+  }
+  finish() {
+    this.check();
+    if (this.pending || this.padding || this.headerOffset || this.zeroBlocks < 2)
+      invalidBundle("Truncated tar bundle");
+    return this.entries;
+  }
+  readHeader() {
+    this.check();
+    const h = this.header;
+    if (h.every((byte) => byte === 0)) {
+      this.zeroBlocks++;
+      return;
+    }
+    if (this.zeroBlocks)
+      invalidBundle("Nonzero tar data after terminator");
+    if (this.entries.length >= this.limits.entries)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle entry limit exceeded");
+    let checksum = 0;
+    for (let i = 0;i < BLOCK; i++)
+      checksum += i >= 148 && i < 156 ? 32 : h[i];
+    if (tarOctal(h.subarray(148, 156)) !== checksum)
+      invalidBundle("Invalid tar header checksum");
+    if (new TextDecoder().decode(h.subarray(257, 265)) !== "ustar\x00" + "00")
+      invalidBundle("Unsupported tar format");
+    if (h[156] !== 48 && h[156] !== 0 || h.subarray(157, 257).some((b) => b !== 0) || h.subarray(345).some((b) => b !== 0))
+      invalidBundle("Unsupported tar entry or path prefix");
+    const mode = tarOctal(h.subarray(100, 108));
+    if (mode > 511)
+      invalidBundle("Unsupported tar permission bits");
+    tarOctal(h.subarray(108, 116));
+    tarOctal(h.subarray(116, 124));
+    tarOctal(h.subarray(136, 148));
+    const size = tarOctal(h.subarray(124, 136));
+    if (size > this.limits.fileBytes || this.fileBytes + size > this.limits.decompressedBytes) {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle file byte limit exceeded");
+    }
+    const name = h.subarray(0, 100);
+    const end = name.indexOf(0);
+    if (end !== -1 && name.subarray(end).some((b) => b !== 0))
+      invalidBundle("Invalid tar path padding");
+    const raw = end === -1 ? name : name.subarray(0, end);
+    if (raw.byteLength > this.limits.pathBytes)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    let path;
+    try {
+      path = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw);
+    } catch {
+      return invalidBundle("Invalid UTF-8 bundle path");
+    }
+    this.paths.add(path, this.limits.pathBytes, invalidBundle, () => {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    });
+    this.fileBytes += size;
+    this.pending = { path, mode, bytes: new Uint8Array(new ArrayBuffer(size)) };
+    this.bodyOffset = 0;
+    this.padding = (BLOCK - size % BLOCK) % BLOCK;
+    if (!size) {
+      this.entries.push(this.pending);
+      this.pending = undefined;
+    }
+  }
+}
+function tarOctal(field) {
+  const text2 = new TextDecoder().decode(field);
+  if (!/^[0-7]+[\0 ]*$/.test(text2))
+    invalidBundle("Invalid tar octal field");
+  const value = Number.parseInt(text2, 8);
+  if (!Number.isSafeInteger(value))
+    invalidBundle("Tar integer is out of range");
+  return value;
+}
 
 // src/lib/skill-version.ts
 var SKILL_VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
@@ -12352,16 +13116,16 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
   }
   return { path: target, created };
 }
-function writePullMarker(dir, record3) {
+function writePullMarker(dir, record4) {
   const marker = {
     managedBy: "@hasna/skills",
-    skill: record3.skill,
-    source: record3.source ?? "pull",
-    ...record3.version ? { version: record3.version } : {},
-    ...record3.contentHash ? { contentHash: record3.contentHash } : {},
-    ...record3.sourceCommit ? { sourceCommit: record3.sourceCommit } : {},
-    ...record3.signature ? { signature: record3.signature } : {},
-    ...record3.revisionId ? { revisionId: record3.revisionId } : {},
+    skill: record4.skill,
+    source: record4.source ?? "pull",
+    ...record4.version ? { version: record4.version } : {},
+    ...record4.contentHash ? { contentHash: record4.contentHash } : {},
+    ...record4.sourceCommit ? { sourceCommit: record4.sourceCommit } : {},
+    ...record4.signature ? { signature: record4.signature } : {},
+    ...record4.revisionId ? { revisionId: record4.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
   writeFileSync8(join17(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
@@ -12376,19 +13140,19 @@ async function safeMeta(client, slug) {
   }
   if (!raw || typeof raw !== "object")
     return null;
-  const record3 = raw;
-  const kind = record3.kind === "instruction" || record3.kind === "executable" ? record3.kind : undefined;
-  const tags = Array.isArray(record3.tags) ? record3.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
+  const record4 = raw;
+  const kind = record4.kind === "instruction" || record4.kind === "executable" ? record4.kind : undefined;
+  const tags = Array.isArray(record4.tags) ? record4.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
   return {
-    ...str(record3.displayName) ? { displayName: str(record3.displayName) } : {},
-    ...str(record3.description) ? { description: str(record3.description) } : {},
-    ...str(record3.category) ? { category: str(record3.category) } : {},
+    ...str(record4.displayName) ? { displayName: str(record4.displayName) } : {},
+    ...str(record4.description) ? { description: str(record4.description) } : {},
+    ...str(record4.category) ? { category: str(record4.category) } : {},
     ...tags && tags.length ? { tags } : {},
-    ...str(record3.version) ? { version: str(record3.version) } : {},
+    ...str(record4.version) ? { version: str(record4.version) } : {},
     ...kind ? { kind } : {},
-    ...REVISION_ID_PATTERN.test(str(record3.revisionId) ?? "") ? { revisionId: str(record3.revisionId) } : {},
-    ...typeof record3.skillMd === "string" && record3.skillMd.length > 0 ? { skillMd: record3.skillMd } : {},
-    ...str(record3.publishedSource) ? { publishedSource: str(record3.publishedSource) } : {}
+    ...REVISION_ID_PATTERN.test(str(record4.revisionId) ?? "") ? { revisionId: str(record4.revisionId) } : {},
+    ...typeof record4.skillMd === "string" && record4.skillMd.length > 0 ? { skillMd: record4.skillMd } : {},
+    ...str(record4.publishedSource) ? { publishedSource: str(record4.publishedSource) } : {}
   };
 }
 function pickCorpusOptions(options) {
@@ -12397,8 +13161,8 @@ function pickCorpusOptions(options) {
 function extractSlug(entry) {
   if (!entry || typeof entry !== "object")
     return;
-  const record3 = entry;
-  return str(record3.slug) ?? str(record3.name);
+  const record4 = entry;
+  return str(record4.slug) ?? str(record4.name);
 }
 function dedupe(values) {
   return [...new Set(values)];
@@ -12524,7 +13288,7 @@ import { dirname as dirname7, relative as relative4 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.5.2",
+  version: "0.5.4",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -14035,7 +14799,7 @@ class SkillsPostgresSyncStore {
   }
   async upsertRecords(records) {
     let count = 0;
-    for (const record3 of records) {
+    for (const record4 of records) {
       await this.client.query([
         "INSERT INTO skills_sync_records",
         "(scope, kind, id, updated_at, deleted_at, source, payload)",
@@ -14046,13 +14810,13 @@ class SkillsPostgresSyncStore {
         "source = EXCLUDED.source,",
         "payload = EXCLUDED.payload"
       ].join(" "), [
-        record3.scope,
-        record3.kind,
-        record3.id,
-        record3.updatedAt,
-        record3.deletedAt ?? null,
-        record3.source ?? null,
-        JSON.stringify(record3.payload)
+        record4.scope,
+        record4.kind,
+        record4.id,
+        record4.updatedAt,
+        record4.deletedAt ?? null,
+        record4.source ?? null,
+        JSON.stringify(record4.payload)
       ]);
       count += 1;
     }
@@ -14994,6 +15758,101 @@ function writeStationHydration(options) {
     manifestPath: hydrationManifestPath
   };
 }
+// src/lib/remote-invitation-recovery.ts
+class InvitationEmailInputError extends Error {
+  code = "INVITATION_EMAIL_INPUT_INVALID";
+  constructor() {
+    super("Use an explicit Skills API URL, exact invitation and retained challenge IDs, secret input, and deliberate confirmation.");
+    this.name = "InvitationEmailInputError";
+  }
+}
+var refusals = {
+  INVALID_REQUEST: [400, "Invitation recovery parameters were refused."],
+  ORIGIN_REQUIRED: [403, "Invitation recovery requires the configured site origin."],
+  INVITATION_PROOF_UNAVAILABLE: [401, "Invitation proof is unavailable. Sign in or explicitly request another recovery code."],
+  RATE_LIMITED: [429, "Invitation verification is rate limited. Wait before another deliberate action."],
+  INVITATION_BUSY: [503, "Invitation is busy. Sign in to check membership before another deliberate action."],
+  INVITATION_DELIVERY_UNAVAILABLE: [503, "Invitation recovery is unavailable on this service."]
+};
+
+class RemoteInvitationEmailError extends Error {
+  code;
+  status;
+  constructor(code) {
+    super(refusals[code][1]);
+    this.code = code;
+    this.name = "RemoteInvitationEmailError";
+    this.status = refusals[code][0];
+  }
+}
+
+class RemoteInvitationEmailUnconfirmedError extends Error {
+  action;
+  code = "INVITATION_EMAIL_UNCONFIRMED";
+  constructor(action) {
+    super(action === "challenge" ? "The recovery challenge outcome is unconfirmed. Retain the same invitation, challenge ID and server. Check your inbox; never rotate the challenge or retry automatically. No delivery is confirmed." : "Invitation acceptance is unconfirmed. Use fresh ordinary sign-in to inspect available memberships. Do not retry acceptance automatically; explicitly request another recovery code only if needed. Saved credentials are unchanged.");
+    this.action = action;
+    this.name = "RemoteInvitationEmailUnconfirmedError";
+  }
+}
+var record4 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var uuid4 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
+function invitationEmailIds(invitationId, challengeId) {
+  if (!uuid4(invitationId) || !uuid4(challengeId))
+    throw new InvitationEmailInputError;
+  return { invitationId, challengeId };
+}
+function invitationEmailInput(action, input) {
+  const keys = ["invitationId", "token", "challengeId", "confirm", ...action === "accept" ? ["code"] : []];
+  if (!record4(input) || Object.keys(input).length !== keys.length || keys.some((key) => !Object.hasOwn(input, key)))
+    throw new InvitationEmailInputError;
+  const value = { ...input };
+  const ids = invitationEmailIds(value.invitationId, value.challengeId);
+  if (value.confirm !== true || typeof value.token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value.token) || action === "accept" && (typeof value.code !== "string" || !/^\d{6}$/.test(value.code)))
+    throw new InvitationEmailInputError;
+  return { ...ids, token: value.token, confirm: true, ...action === "accept" ? { code: value.code } : {} };
+}
+async function requestInvitationEmail(origin, action, input) {
+  const value = invitationEmailInput(action, input);
+  let target;
+  try {
+    target = normalizeSkillsApiOrigin(origin);
+  } catch {
+    throw new InvitationEmailInputError;
+  }
+  const body = JSON.stringify({ invitationId: value.invitationId, token: value.token, challengeId: value.challengeId, ...action === "accept" ? { code: value.code } : {} });
+  try {
+    const response = await fetch(`${target}/api/v1/account/invitations/email-${action}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body,
+      credentials: "omit",
+      redirect: "error",
+      cache: "no-store",
+      referrerPolicy: "no-referrer",
+      signal: AbortSignal.timeout(15000)
+    });
+    const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 4096)));
+    if (!response.ok && record4(parsed) && typeof parsed.code === "string" && Object.hasOwn(refusals, parsed.code)) {
+      const code = parsed.code;
+      if (response.status === refusals[code][0])
+        throw new RemoteInvitationEmailError(code);
+    }
+    if (!record4(parsed))
+      throw new RemoteInvitationEmailUnconfirmedError(action);
+    if (action === "challenge" && response.status === 202 && parsed.challengeId === value.challengeId && parsed.expiresIn === 600 && typeof parsed.message === "string" && parsed.message.length <= 256) {
+      return { challengeId: value.challengeId, message: "If this invitation is eligible, a verification code will arrive. Delivery is not confirmed.", expiresIn: 600 };
+    }
+    if (action === "accept" && response.status === 200 && uuid4(parsed.organizationId) && uuid4(parsed.membershipId) && parsed.accepted === true && parsed.changed === true && parsed.signInRequired === true) {
+      return { organizationId: parsed.organizationId, membershipId: parsed.membershipId, accepted: true, changed: true, signInRequired: true };
+    }
+  } catch (error) {
+    if (error instanceof RemoteInvitationEmailError)
+      throw error;
+  }
+  throw new RemoteInvitationEmailUnconfirmedError(action);
+}
+
 // src/lib/remote-auth.ts
 var MAX_ERROR_DETAIL_LENGTH = 200;
 
@@ -15034,10 +15893,10 @@ async function requestAuthApi(instance, path, options) {
   const text2 = await res.text();
   const body = text2 ? parseJsonBody(text2) : {};
   if (!res.ok) {
-    const record3 = isRecord5(body) ? body : {};
-    const detail = typeof record3.detail === "string" ? record3.detail : undefined;
-    const error = typeof record3.error === "string" ? record3.error : undefined;
-    const code = typeof record3.code === "string" ? record3.code : undefined;
+    const record5 = isRecord5(body) ? body : {};
+    const detail = typeof record5.detail === "string" ? record5.detail : undefined;
+    const error = typeof record5.error === "string" ? record5.error : undefined;
+    const code = typeof record5.code === "string" ? record5.code : undefined;
     throw new HostedApiError(detail || error || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -15071,11 +15930,17 @@ class RemoteSkillsAuthClient {
   constructor(apiUrl) {
     this.apiOrigin = normalizeSkillsApiOrigin(apiUrl);
   }
-  requestCode(email) {
-    return this.request("/api/auth/login", { method: "POST", body: JSON.stringify({ email }) });
+  requestInvitationEmailChallenge(input) {
+    return requestInvitationEmail(this.apiOrigin, "challenge", input);
+  }
+  acceptInvitationEmailChallenge(input) {
+    return requestInvitationEmail(this.apiOrigin, "accept", input);
   }
-  verifyCode(email, code) {
-    return this.request("/api/auth/verify", { method: "POST", body: JSON.stringify({ email, code }) });
+  requestCode(email2) {
+    return this.request("/api/auth/login", { method: "POST", body: JSON.stringify({ email: email2 }) });
+  }
+  verifyCode(email2, code) {
+    return this.request("/api/auth/verify", { method: "POST", body: JSON.stringify({ email: email2, code }) });
   }
   startDevice() {
     return this.request("/api/auth/device/start", { method: "POST", body: JSON.stringify({ client: "skills-sdk" }) });
@@ -15083,34 +15948,34 @@ class RemoteSkillsAuthClient {
   pollDevice(deviceCode) {
     return this.request("/api/auth/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) });
   }
-  async sessionClient(email, code, context) {
+  async sessionClient(email2, code, context) {
     if (context !== undefined) {
       const target = workspaceContext(context), apiOrigin2 = this.apiOrigin;
-      const session = await this.switchWorkspace(email, code, target);
+      const session = await this.switchWorkspace(email2, code, target);
       return new RemoteSkillsClient(session.token, apiOrigin2);
     }
     const apiOrigin = this.apiOrigin;
-    if (!email.includes("@") || !/^\d{6}$/.test(code))
+    if (!email2.includes("@") || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
-    const login = await this.verifyCode(email, code);
+    const login = await this.verifyCode(email2, code);
     if (!login || typeof login.token !== "string" || !login.token)
       throw new Error("The server did not return an authorized account session");
     return new RemoteSkillsClient(login.token, apiOrigin);
   }
-  async listAccountWorkspaces(email, code, expectedUserId) {
-    const login = await this.workspaceLogin(email, code, expectedUserId);
+  async listAccountWorkspaces(email2, code, expectedUserId) {
+    const login = await this.workspaceLogin(email2, code, expectedUserId);
     const result = await new RemoteSkillsClient(login.token, login.apiOrigin).listAccountWorkspaces(login.userId);
     return { userId: login.userId, ...result };
   }
-  async switchWorkspace(email, code, context) {
+  async switchWorkspace(email2, code, context) {
     const target = workspaceContext(context);
-    const login = await this.workspaceLogin(email, code, target.userId);
+    const login = await this.workspaceLogin(email2, code, target.userId);
     return new RemoteSkillsClient(login.token, login.apiOrigin).switchWorkspace(target);
   }
-  async workspaceLogin(email, code, expectedUserId) {
+  async workspaceLogin(email2, code, expectedUserId) {
     const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
     const apiOrigin = this.apiOrigin;
-    if (typeof email !== "string" || !email.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
+    if (typeof email2 !== "string" || !email2.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
     let response;
     try {
@@ -15120,7 +15985,7 @@ class RemoteSkillsAuthClient {
         credentials: "omit",
         signal: AbortSignal.timeout(15000),
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ email, code })
+        body: JSON.stringify({ email: email2, code })
       });
     } catch {
       throw new HostedApiError("Unable to verify the Skills account.");
@@ -15137,40 +16002,67 @@ class RemoteSkillsAuthClient {
     }
     return { ...parseWorkspaceLogin(value, expected), apiOrigin };
   }
-  async createApiKey(email, code, name, scopes, context) {
+  async listWorkspaceInvitations(email2, code, context, options = {}) {
+    const target = workspaceContext(context), captured = invitationInput("list", options);
+    return (await this.sessionClient(email2, code, target)).listWorkspaceInvitations(target, captured);
+  }
+  async getWorkspaceInvitation(email2, code, context, invitationId) {
+    const target = workspaceContext(context), captured = invitationInput("get", { invitationId });
+    return (await this.sessionClient(email2, code, target)).getWorkspaceInvitation(target, captured.invitationId);
+  }
+  async issueWorkspaceInvitation(email2, code, context, input) {
+    const target = workspaceContext(context), captured = invitationInput("issue", input);
+    return (await this.sessionClient(email2, code, target)).issueWorkspaceInvitation(target, captured);
+  }
+  async resendWorkspaceInvitation(email2, code, context, invitationId, input) {
+    const target = workspaceContext(context), captured = invitationInput("resend", { ...input, invitationId });
+    const { invitationId: id, ...options } = captured;
+    return (await this.sessionClient(email2, code, target)).resendWorkspaceInvitation(target, id, options);
+  }
+  async revokeWorkspaceInvitation(email2, code, context, invitationId, input) {
+    const target = workspaceContext(context), captured = invitationInput("revoke", { ...input, invitationId });
+    const { invitationId: id, ...options } = captured;
+    return (await this.sessionClient(email2, code, target)).revokeWorkspaceInvitation(target, id, options);
+  }
+  async acceptWorkspaceInvitation(email2, code, context, invitationId, input) {
+    const target = workspaceContext(context), captured = invitationInput("accept", { ...input, invitationId });
+    const { invitationId: id, ...options } = captured;
+    return (await this.sessionClient(email2, code, target)).acceptWorkspaceInvitation(target, id, options);
+  }
+  async createApiKey(email2, code, name, scopes, context) {
     const capturedScopes = scopes === undefined ? undefined : [...scopes];
-    return (await this.sessionClient(email, code, context)).createApiKey(name, capturedScopes);
+    return (await this.sessionClient(email2, code, context)).createApiKey(name, capturedScopes);
   }
-  async listApiKeys(email, code, context) {
-    return (await this.sessionClient(email, code, context)).listApiKeys();
+  async listApiKeys(email2, code, context) {
+    return (await this.sessionClient(email2, code, context)).listApiKeys();
   }
-  async revokeApiKey(email, code, keyId, context) {
-    return (await this.sessionClient(email, code, context)).revokeApiKey(keyId);
+  async revokeApiKey(email2, code, keyId, context) {
+    return (await this.sessionClient(email2, code, context)).revokeApiKey(keyId);
   }
-  async updateProfile(email, code, input, context) {
+  async updateProfile(email2, code, input, context) {
     const body = customerNamePatch(input, "displayName");
-    return (await this.sessionClient(email, code, context)).updateProfile({ displayName: body.displayName });
+    return (await this.sessionClient(email2, code, context)).updateProfile({ displayName: body.displayName });
   }
-  async updateCurrentWorkspace(email, code, input, context) {
+  async updateCurrentWorkspace(email2, code, input, context) {
     const body = customerNamePatch(input, "name");
-    return (await this.sessionClient(email, code, context)).updateCurrentWorkspace({ name: body.name });
+    return (await this.sessionClient(email2, code, context)).updateCurrentWorkspace({ name: body.name });
   }
-  async listWorkspaceMembers(email, code, options = {}, context) {
+  async listWorkspaceMembers(email2, code, options = {}, context) {
     workspaceMembersQuery(options);
     const captured = { ...options };
-    return (await this.sessionClient(email, code, context)).listWorkspaceMembers(captured);
+    return (await this.sessionClient(email2, code, context)).listWorkspaceMembers(captured);
   }
-  async setWorkspaceMemberRole(email, code, membershipId, input, context) {
+  async setWorkspaceMemberRole(email2, code, membershipId, input, context) {
     const captured = workspaceMemberRoleInput(membershipId, input);
-    return (await this.sessionClient(email, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
+    return (await this.sessionClient(email2, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
   }
-  async leaveWorkspace(email, code, context, input) {
+  async leaveWorkspace(email2, code, context, input) {
     const captured = workspaceLeaveInput(context, input);
-    return (await this.sessionClient(email, code, captured.context)).leaveWorkspace(captured.context, captured.input);
+    return (await this.sessionClient(email2, code, captured.context)).leaveWorkspace(captured.context, captured.input);
   }
-  async removeWorkspaceMember(email, code, membershipId, input, context) {
+  async removeWorkspaceMember(email2, code, membershipId, input, context) {
     const captured = workspaceMemberRemovalInput(membershipId, input);
-    return (await this.sessionClient(email, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
+    return (await this.sessionClient(email2, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
   }
   request(path, options) {
     if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
@@ -15179,244 +16071,257 @@ class RemoteSkillsAuthClient {
   }
 }
 export {
-  writeStationSnapshot,
-  writeStationHydration,
-  writeRunLogs,
-  writeRegistrySyncArtifact,
-  writeManagedSkillDir,
-  writeManagedAgentSkill,
-  writeCorpusSkill,
-  walkEntries,
-  verifyContentHash,
-  validateToolPrimitiveCoverage,
-  validateStationId,
-  validateSkillsCliMcpParity,
-  validateSkillDirectory,
-  validateRegistryConsistency,
-  validatePortableSkillDirectory,
-  validatePortableManifestContract,
-  validateCron,
-  validateBlogArticleRunOptions,
-  uploadSkillsSnapshotFilesToS3,
-  updateSkillRun,
-  unsetConfig,
-  unpinSkill,
-  unpinProjectSkill,
-  syncSkillsToAgents,
-  summarizeMcpToolContract,
-  storageCapabilities,
-  skillsPostgresSyncSchemaSql,
-  skillsCredentialOrReason,
-  skillsCredentialFiles,
-  skillsCredentialFilePath,
-  skillExists,
-  signSkillsAwsV4Request,
-  sha256File,
-  setSkillDisabled,
-  setScheduleEnabled,
-  selectsSkillsLocalMode,
-  searchSkills,
-  scaffoldPortableSkill,
-  saveProjectConfig,
-  saveFeedback,
-  saveConfig,
-  sanitizePublicDiscoveryText,
-  runSkill,
-  runPortableSkill,
-  resolveSyncAgents,
-  resolveStorageConfig,
-  resolveSkillsNativeStorageConfig,
-  resolveSkillsFleet,
-  resolveSkillsApiOrigin,
-  resolveSkillsApiKey,
-  resolveSkillAlias,
-  requireSkillsFleet,
-  requireSkillsApiOrigin,
-  requireSkillsApiKey,
-  removeSkillForAgent,
-  removeSkill,
-  removeSchedule,
-  removeManagedAgentSkill,
-  recordScheduleRun,
-  readPortableSkillManifest,
-  pullSkills,
-  publicDiscoveryEnvVars,
-  publicDiscoveryDocumentation,
-  publicDiscoveryDependencies,
-  portPortableSkillDirectory,
-  portPortableSkill,
-  pointerSkillMd,
-  planStationSnapshot,
-  planStationHydration,
-  planSkillsS3SnapshotUpload,
-  pinSkill,
-  pinProjectSkill,
-  parseSkillFrontmatter,
-  parseRemoteSkillPayload,
-  parseRemoteRegistryPayload,
-  noticeLocalSkillsMode,
-  normalizeSkillsApiOrigin,
-  normalizeSkillSlug,
-  normalizeRemoteSkillRunContract,
-  normalizePortableSkillName,
-  normalizeLineEndings,
-  loadRemoteSkill,
-  loadRemoteRegistry,
-  loadRegistryProfile,
-  loadRegistry,
-  loadProjectConfig,
-  loadConfig,
-  loadBasicRegistry,
-  listToolPrimitives,
-  listSkillRuns,
-  listSchedules,
-  listPortableSkills,
-  listPortableSkillMetas,
-  listPinnedSkills,
-  listMcpToolContracts,
-  isSyncAgent,
-  isSkillsLocalOptIn,
-  isRegularFile,
-  isPortableWithinSkill,
-  isGatewayBackedSkill,
-  isExcludedSkillFileName,
-  isBasicSkillName,
-  installSkills,
-  installSkillSource,
-  installSkillManifest,
-  installSkillForAgent,
-  installSkill,
-  importSkillsLocalSnapshot,
-  homePathFor,
-  getToolPrimitive,
-  getStorageStatus,
-  getStorageDatabaseUrl,
-  getStorageDatabaseEnv,
-  getSkillsStorageStatus,
-  getSkillsStorageDatabaseUrl,
-  getSkillsStorageDatabaseEnv,
-  getSkillsNativeStorageStatus,
-  getSkillsByTag,
-  getSkillsByCategory,
-  getSkillToolDependencies,
-  getSkillRequirements,
-  getSkillPath,
-  getSkillDocs,
-  getSkillBestDoc,
-  getSkill,
-  getRunExportDir,
-  getPublicSkillDiscovery,
-  getProjectStateDir,
-  getProjectConfigPath,
-  getPortableSkillsRoot,
-  getPortableSkillPath,
-  getPinnedSkills,
-  getNextRun,
-  getMcpToolDescriptions,
-  getMcpResourceContracts,
-  getInstalledSkills,
-  getInstallMeta,
-  getFeedbackDbPath,
-  getDueSchedules,
-  getDisabledSkills,
-  getDisabledProjectSkills,
-  getConfiguredApiUrl,
-  getConfigPath,
-  getCompactSkillDiscovery,
-  getAllTags,
-  getAgentSkillsDir,
-  getAgentSkillPath,
-  generateSkillMd,
-  generateEnvExample,
-  findSkillsParityForMcpTool,
-  findSkillsParityForCliCommand,
-  findSkillRun,
-  findSimilarSkills,
-  findPortableSkill,
-  exportSkillsLocalSnapshot,
-  ensureProjectConfig,
-  enableSkill,
-  disableSkill,
-  destinationFor,
-  describeMcpToolContracts,
-  createSkillsSnapshotSyncRecord,
-  createSkillsS3ObjectStore,
-  createSkillsPostgresSyncStore,
-  createSkillToolDependencies,
-  createSkillRun,
-  createSkillMcpMetadata,
-  createRemoteSkillsClient,
-  createRegistrySyncArtifact,
-  createMcpContractManifest,
-  createLocalSkillManifest,
-  configuredSkillsApiUrl,
-  computeContentHash,
-  completeSkillRun,
-  clearRegistryCache,
-  canonicalizeManifest,
-  buildSkillsS3ObjectUrl,
-  buildSkillsApiUrl,
-  appendRunEvent,
-  agentGlobalSkillsDir,
-  addSchedule,
-  adaptSkillMdForAgent,
-  WorkspaceLeaveInputError,
-  WorkspaceIdentityMismatchError,
-  WorkspaceContextInputError,
-  TOOL_PRIMITIVE_SCHEMA_VERSION,
-  TOOL_PRIMITIVES,
-  StationSnapshotError,
-  SkillsS3ObjectStore,
-  SkillsPostgresSyncStore,
-  SkillsFleetCredentialError,
-  SYNC_MARKER_MANAGED_BY,
-  SYNC_MARKER_FILE,
-  SYNC_HOMES,
-  SYNC_AGENTS,
-  STORAGE_TABLES,
-  STATION_SYNC_MANIFEST_SCHEMA,
-  STATION_HYDRATION_MANIFEST_SCHEMA,
-  SKILL_SYSTEM_DEPS_ALLOWLIST,
-  SKILL_SANDBOX_MODES,
-  SKILL_RUNTIMES,
-  SKILL_ALIASES,
-  SKILLS_STORAGE_TABLES,
-  SKILLS_STORAGE_FALLBACK_ENV,
-  SKILLS_STORAGE_ENV,
-  SKILLS_PROJECT_DIR,
-  SKILLS_NATIVE_STORAGE_FALLBACK_ENV,
-  SKILLS_NATIVE_STORAGE_ENV,
-  SKILLS_LOCAL_OPT_IN_ENV_KEYS,
-  SKILLS_CLI_MCP_PARITY,
-  SKILLS_APP,
-  SKILLS_API_URL_ENV_KEYS,
-  SKILLS_API_URL_ENV,
-  SKILLS_API_KEY_ENV_KEYS,
-  SKILLS_API_KEY_ENV,
-  SKILLS,
-  RemoteWorkspaceSelectionError,
-  RemoteWorkspaceMemberError,
-  RemoteWorkspaceLeaveUnconfirmedError,
-  RemoteWorkspaceLeaveError,
-  RemoteSkillsClient,
-  RemoteSkillsAuthClient,
-  RemoteRouteUnsupportedError,
-  RemoteRequestError,
-  RemoteCreditApprovalError,
-  RemoteCapabilityUnavailableError,
-  REMOTE_SKILL_RUN_CONTRACT_VERSION,
-  REFUSED_SCANNER_FLAGGED,
-  PullSkillError,
-  PROJECT_CONFIG_FILE,
-  PORTABLE_SKILL_STANDARD,
-  PORTABLE_SKILL_SCHEMA,
-  PORTABLE_SKILL_DEFAULT_VERSION,
-  MissingSkillsFleetError,
-  MCP_CONTRACT_SCHEMA_VERSION,
-  HostedApiError,
-  DEFAULT_EXPORT_DIR,
-  CATEGORIES,
-  BASIC_SKILL_NAMES,
+  AGENT_TARGETS,
   ARTICLE_GENERATION_SLUG,
-  AGENT_TARGETS
+  BASIC_SKILL_NAMES,
+  CATEGORIES,
+  CONTENT_HASH_LIMITS,
+  ContentHashInputError,
+  DEFAULT_EXPORT_DIR,
+  HostedApiError,
+  InvitationEmailInputError,
+  MCP_CONTRACT_SCHEMA_VERSION,
+  MissingSkillsFleetError,
+  PORTABLE_SKILL_DEFAULT_VERSION,
+  PORTABLE_SKILL_SCHEMA,
+  PORTABLE_SKILL_STANDARD,
+  PROJECT_CONFIG_FILE,
+  PullSkillError,
+  REFUSED_SCANNER_FLAGGED,
+  REMOTE_SKILL_RUN_CONTRACT_VERSION,
+  RemoteCapabilityUnavailableError,
+  RemoteCreditApprovalError,
+  RemoteInvitationEmailError,
+  RemoteInvitationEmailUnconfirmedError,
+  RemoteQuoteUnavailableError,
+  RemoteRequestError,
+  RemoteRouteUnsupportedError,
+  RemoteSkillsAuthClient,
+  RemoteSkillsClient,
+  RemoteWorkspaceInvitationError,
+  RemoteWorkspaceInvitationReadError,
+  RemoteWorkspaceInvitationUnconfirmedError,
+  RemoteWorkspaceLeaveError,
+  RemoteWorkspaceLeaveUnconfirmedError,
+  RemoteWorkspaceMemberError,
+  RemoteWorkspaceSelectionError,
+  SKILLS,
+  SKILLS_API_KEY_ENV,
+  SKILLS_API_KEY_ENV_KEYS,
+  SKILLS_API_URL_ENV,
+  SKILLS_API_URL_ENV_KEYS,
+  SKILLS_APP,
+  SKILLS_CLI_MCP_PARITY,
+  SKILLS_LOCAL_OPT_IN_ENV_KEYS,
+  SKILLS_NATIVE_STORAGE_ENV,
+  SKILLS_NATIVE_STORAGE_FALLBACK_ENV,
+  SKILLS_PROJECT_DIR,
+  SKILLS_STORAGE_ENV,
+  SKILLS_STORAGE_FALLBACK_ENV,
+  SKILLS_STORAGE_TABLES,
+  SKILL_ALIASES,
+  SKILL_RUNTIMES,
+  SKILL_SANDBOX_MODES,
+  SKILL_SYSTEM_DEPS_ALLOWLIST,
+  STATION_HYDRATION_MANIFEST_SCHEMA,
+  STATION_SYNC_MANIFEST_SCHEMA,
+  STORAGE_TABLES,
+  SYNC_AGENTS,
+  SYNC_HOMES,
+  SYNC_MARKER_FILE,
+  SYNC_MARKER_MANAGED_BY,
+  SkillsFleetCredentialError,
+  SkillsPostgresSyncStore,
+  SkillsS3ObjectStore,
+  StationSnapshotError,
+  TOOL_PRIMITIVES,
+  TOOL_PRIMITIVE_SCHEMA_VERSION,
+  WorkspaceContextInputError,
+  WorkspaceIdentityMismatchError,
+  WorkspaceInvitationInputError,
+  WorkspaceLeaveInputError,
+  adaptSkillMdForAgent,
+  addSchedule,
+  agentGlobalSkillsDir,
+  appendRunEvent,
+  buildSkillsApiUrl,
+  buildSkillsS3ObjectUrl,
+  canonicalizeManifest,
+  clearRegistryCache,
+  completeSkillRun,
+  computeContentHash,
+  computeContentHashFromEntries,
+  configuredSkillsApiUrl,
+  createLocalSkillManifest,
+  createMcpContractManifest,
+  createRegistrySyncArtifact,
+  createRemoteSkillsClient,
+  createSkillMcpMetadata,
+  createSkillRun,
+  createSkillToolDependencies,
+  createSkillsPostgresSyncStore,
+  createSkillsS3ObjectStore,
+  createSkillsSnapshotSyncRecord,
+  describeMcpToolContracts,
+  destinationFor,
+  disableSkill,
+  enableSkill,
+  ensureProjectConfig,
+  exportSkillsLocalSnapshot,
+  findPortableSkill,
+  findSimilarSkills,
+  findSkillRun,
+  findSkillsParityForCliCommand,
+  findSkillsParityForMcpTool,
+  generateEnvExample,
+  generateSkillMd,
+  getAgentSkillPath,
+  getAgentSkillsDir,
+  getAllTags,
+  getCompactSkillDiscovery,
+  getConfigPath,
+  getConfiguredApiUrl,
+  getDisabledProjectSkills,
+  getDisabledSkills,
+  getDueSchedules,
+  getFeedbackDbPath,
+  getInstallMeta,
+  getInstalledSkills,
+  getMcpResourceContracts,
+  getMcpToolDescriptions,
+  getNextRun,
+  getPinnedSkills,
+  getPortableSkillPath,
+  getPortableSkillsRoot,
+  getProjectConfigPath,
+  getProjectStateDir,
+  getPublicSkillDiscovery,
+  getRunExportDir,
+  getSkill,
+  getSkillBestDoc,
+  getSkillDocs,
+  getSkillPath,
+  getSkillRequirements,
+  getSkillToolDependencies,
+  getSkillsByCategory,
+  getSkillsByTag,
+  getSkillsNativeStorageStatus,
+  getSkillsStorageDatabaseEnv,
+  getSkillsStorageDatabaseUrl,
+  getSkillsStorageStatus,
+  getStorageDatabaseEnv,
+  getStorageDatabaseUrl,
+  getStorageStatus,
+  getToolPrimitive,
+  homePathFor,
+  importSkillsLocalSnapshot,
+  installSkill,
+  installSkillForAgent,
+  installSkillManifest,
+  installSkillSource,
+  installSkills,
+  isBasicSkillName,
+  isExcludedSkillFileName,
+  isGatewayBackedSkill,
+  isPortableWithinSkill,
+  isRegularFile,
+  isSkillsLocalOptIn,
+  isSyncAgent,
+  listMcpToolContracts,
+  listPinnedSkills,
+  listPortableSkillMetas,
+  listPortableSkills,
+  listSchedules,
+  listSkillRuns,
+  listToolPrimitives,
+  loadBasicRegistry,
+  loadConfig,
+  loadProjectConfig,
+  loadRegistry,
+  loadRegistryProfile,
+  loadRemoteRegistry,
+  loadRemoteSkill,
+  normalizeLineEndings,
+  normalizePortableSkillName,
+  normalizeRemoteSkillRunContract,
+  normalizeSkillSlug,
+  normalizeSkillsApiOrigin,
+  noticeLocalSkillsMode,
+  parseRemoteRegistryPayload,
+  parseRemoteSkillPayload,
+  parseSkillFrontmatter,
+  pinProjectSkill,
+  pinSkill,
+  planSkillsS3SnapshotUpload,
+  planStationHydration,
+  planStationSnapshot,
+  pointerSkillMd,
+  portPortableSkill,
+  portPortableSkillDirectory,
+  publicDiscoveryDependencies,
+  publicDiscoveryDocumentation,
+  publicDiscoveryEnvVars,
+  pullSkills,
+  readPortableSkillManifest,
+  recordScheduleRun,
+  removeManagedAgentSkill,
+  removeSchedule,
+  removeSkill,
+  removeSkillForAgent,
+  requireSkillsApiKey,
+  requireSkillsApiOrigin,
+  requireSkillsFleet,
+  resolveSkillAlias,
+  resolveSkillsApiKey,
+  resolveSkillsApiOrigin,
+  resolveSkillsFleet,
+  resolveSkillsNativeStorageConfig,
+  resolveStorageConfig,
+  resolveSyncAgents,
+  revisionIdOf,
+  runPortableSkill,
+  runSkill,
+  sanitizePublicDiscoveryText,
+  saveConfig,
+  saveFeedback,
+  saveProjectConfig,
+  scaffoldPortableSkill,
+  searchSkills,
+  selectsSkillsLocalMode,
+  setScheduleEnabled,
+  setSkillDisabled,
+  sha256File,
+  signSkillsAwsV4Request,
+  skillExists,
+  skillsCredentialFilePath,
+  skillsCredentialFiles,
+  skillsCredentialOrReason,
+  skillsPostgresSyncSchemaSql,
+  storageCapabilities,
+  summarizeMcpToolContract,
+  syncSkillsToAgents,
+  unpinProjectSkill,
+  unpinSkill,
+  unsetConfig,
+  updateSkillRun,
+  uploadSkillsSnapshotFilesToS3,
+  validateBlogArticleRunOptions,
+  validateCron,
+  validatePortableManifestContract,
+  validatePortableSkillDirectory,
+  validateRegistryConsistency,
+  validateSkillDirectory,
+  validateSkillsCliMcpParity,
+  validateStationId,
+  validateToolPrimitiveCoverage,
+  verifyContentHash,
+  verifyContentHashFromEntries,
+  walkEntries,
+  writeCorpusSkill,
+  writeManagedAgentSkill,
+  writeManagedSkillDir,
+  writeRegistrySyncArtifact,
+  writeRunLogs,
+  writeStationHydration,
+  writeStationSnapshot
 };