@hasna/skills 0.5.2 → 0.5.4

package/dist/sdk/index.js

@@ -19,12 +19,14 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -47,7 +49,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
 // ../../node_modules/.bun/@smithy+types@4.18.0/node_modules/@smithy/types/dist-cjs/index.js
-var require_dist_cjs = __commonJS((exports) => {
+var require_dist_cjs = __commonJS(function(exports) {
   var HttpAuthLocation;
   (function(HttpAuthLocation2) {
     HttpAuthLocation2["HEADER"] = "header";
@@ -138,7 +140,7 @@ var require_dist_cjs = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/transport/index.js
-var require_transport = __commonJS((exports) => {
+var require_transport = __commonJS(function(exports) {
   var { SMITHY_CONTEXT_KEY } = require_dist_cjs();
   var getSmithyContext = (context) => context[SMITHY_CONTEXT_KEY] || (context[SMITHY_CONTEXT_KEY] = {});
   function hasOwn2(o, k) {
@@ -311,7 +313,7 @@ var require_transport = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/schema/index.js
-var require_schema = __commonJS((exports) => {
+var require_schema = __commonJS(function(exports) {
   var { getSmithyContext, HttpResponse, toEndpointV1 } = require_transport();
   var deref = (schemaRef) => {
     if (typeof schemaRef === "function") {
@@ -980,7 +982,7 @@ var require_schema = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/client/index.js
-var require_client = __commonJS((exports) => {
+var require_client = __commonJS(function(exports) {
   var { hasOwn: hasOwn2 } = require_transport();
   var { getSmithyContext, normalizeProvider } = require_transport();
   exports.getSmithyContext = getSmithyContext;
@@ -2060,7 +2062,7 @@ var require_client = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/config/index.js
-var require_config = __commonJS((exports) => {
+var require_config = __commonJS(function(exports) {
   var { homedir } = __require("os");
   var { sep, join: join3 } = __require("path");
   var { createHash: createHash2 } = __require("crypto");
@@ -2755,7 +2757,7 @@ var require_config = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/endpoints/index.js
-var require_endpoints = __commonJS((exports) => {
+var require_endpoints = __commonJS(function(exports) {
   var { CONFIG_PREFIX_SEPARATOR, booleanSelector, SelectorType, loadConfig } = require_config();
   var { toEndpointV1, getSmithyContext, normalizeProvider, isValidHostLabel, hasOwn: hasOwn2 } = require_transport();
   exports.isValidHostLabel = isValidHostLabel;
@@ -3569,7 +3571,7 @@ var require_endpoints = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/serde/index.js
-var require_serde = __commonJS((exports) => {
+var require_serde = __commonJS(function(exports) {
   var { createHmac: createHmac2, createHash: createHash2, getRandomValues } = __require("crypto");
   var { hasOwn: hasOwn2, HttpResponse } = require_transport();
   exports.hasOwn = hasOwn2;
@@ -5210,7 +5212,7 @@ ${value}\r
 });
 
 // ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/checksum/index.js
-var require_checksum = __commonJS((exports) => {
+var require_checksum = __commonJS(function(exports) {
   var { createReadStream } = __require("fs");
   var { Writable } = __require("stream");
   var { toUint8Array, concatBytes } = require_serde();
@@ -5826,7 +5828,7 @@ var require_checksum = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/event-streams/index.js
-var require_event_streams = __commonJS((exports) => {
+var require_event_streams = __commonJS(function(exports) {
   var { Crc32 } = require_checksum();
   var { hasOwn: hasOwn2 } = require_transport();
   var { toHex, fromHex, toUtf8, fromUtf8 } = require_serde();
@@ -6718,7 +6720,7 @@ var require_event_streams = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/protocols/index.js
-var require_protocols = __commonJS((exports) => {
+var require_protocols = __commonJS(function(exports) {
   var { Uint8ArrayBlobAdapter, sdkStreamMixin, splitEvery, splitHeader, fromBase64, _parseEpochTimestamp, _parseRfc7231DateTime, _parseRfc3339DateTimeWithOffset, LazyJsonString, NumericValue, toUtf8, fromUtf8, generateIdempotencyToken, toBase64, dateToUtcString, quoteHeader } = require_serde();
   var { HttpRequest, HttpResponse, hasOwn: hasOwn2, isValidHostname } = require_transport();
   var { parseQueryString, parseUrl } = require_transport();
@@ -7722,7 +7724,7 @@ var require_protocols = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/retry/index.js
-var require_retry = __commonJS((exports) => {
+var require_retry = __commonJS(function(exports) {
   var { Readable } = __require("stream");
   var { NoOpLogger, normalizeProvider } = require_client();
   var { HttpResponse, HttpRequest } = require_protocols();
@@ -8522,7 +8524,7 @@ var require_retry = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@aws+lambda-invoke-store@0.3.0/node_modules/@aws/lambda-invoke-store/dist-cjs/invoke-store.js
-var require_invoke_store = __commonJS((exports) => {
+var require_invoke_store = __commonJS(function(exports) {
   var PROTECTED_KEYS = {
     REQUEST_ID: Symbol.for("_AWS_LAMBDA_REQUEST_ID"),
     X_RAY_TRACE_ID: Symbol.for("_AWS_LAMBDA_X_RAY_TRACE_ID"),
@@ -8651,7 +8653,7 @@ var require_invoke_store = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/index.js
-var require_dist_cjs2 = __commonJS((exports) => {
+var require_dist_cjs2 = __commonJS(function(exports) {
   var { getSmithyContext, hasOwn: hasOwn2 } = require_transport();
   exports.getSmithyContext = getSmithyContext;
   var { HttpRequest } = require_protocols();
@@ -8979,7 +8981,7 @@ var require_dist_cjs2 = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/bowser@2.14.1/node_modules/bowser/es5.js
-var require_es5 = __commonJS((exports, module) => {
+var require_es5 = __commonJS(function(exports, module) {
   (function(e, t) {
     typeof exports == "object" && typeof module == "object" ? module.exports = t() : typeof define == "function" && define.amd ? define([], t) : typeof exports == "object" ? exports.bowser = t() : e.bowser = t();
   })(exports, function() {
@@ -9819,7 +9821,7 @@ var require_es5 = __commonJS((exports, module) => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+core@3.977.9/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.js
-var require_client2 = __commonJS((exports) => {
+var require_client2 = __commonJS(function(exports) {
   var { Retry, RETRY_MODES } = require_retry();
   var { HttpRequest, parseUrl } = require_protocols();
   var { InvokeStore } = require_invoke_store();
@@ -10757,7 +10759,7 @@ More information can be found at: https://a.co/c895JFp`);
 });
 
 // ../../node_modules/.bun/@aws-sdk+checksums@3.1000.29/node_modules/@aws-sdk/checksums/dist-cjs/submodules/crc/index.js
-var require_crc = __commonJS((exports) => {
+var require_crc = __commonJS(function(exports) {
   var { Crc32, Crc32Js, Crc32Node } = require_checksum();
   exports.Crc32 = Crc32;
   exports.Crc32Js = Crc32Js;
@@ -10914,7 +10916,7 @@ var require_crc = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@smithy+signature-v4@5.7.3/node_modules/@smithy/signature-v4/dist-cjs/index.js
-var require_dist_cjs3 = __commonJS((exports) => {
+var require_dist_cjs3 = __commonJS(function(exports) {
   var { hasOwn: hasOwn2, fromUtf8, fromHex, toHex, toUint8Array: toUint8Array2, isArrayBuffer: isArrayBuffer2 } = require_serde();
   var { normalizeProvider: normalizeProvider2 } = require_client();
   var { escapeUri, HttpRequest: HttpRequest2 } = require_protocols();
@@ -11466,7 +11468,7 @@ ${toHex(hashedRequest)}`;
 });
 
 // ../../node_modules/.bun/@aws-sdk+signature-v4-multi-region@3.996.46/node_modules/@aws-sdk/signature-v4-multi-region/dist-cjs/index.js
-var require_dist_cjs4 = __commonJS((exports) => {
+var require_dist_cjs4 = __commonJS(function(exports) {
   var { SignatureV4, signatureV4aContainer } = require_dist_cjs3();
   var signatureV4CrtContainer = {
     CrtSignerV4: null
@@ -11598,7 +11600,7 @@ var require_dist_cjs4 = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+core@3.977.9/node_modules/@aws-sdk/core/dist-cjs/submodules/util/index.js
-var require_util = __commonJS((exports) => {
+var require_util = __commonJS(function(exports) {
   var { buildQueryString } = require_protocols();
   var validate = (str) => typeof str === "string" && str.indexOf("arn:") === 0 && str.split(":").length >= 6;
   var parse = (arn) => {
@@ -11656,7 +11658,7 @@ var require_util = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/cbor/index.js
-var require_cbor = __commonJS((exports) => {
+var require_cbor = __commonJS(function(exports) {
   var { nv, NumericValue, calculateBodyLength, generateIdempotencyToken, fromBase64, _parseEpochTimestamp } = require_serde();
   var { hasOwn: hasOwn2, getSmithyContext } = require_transport();
   var { HttpRequest: HttpRequest2, collectBody, SerdeContext, RpcProtocol } = require_protocols();
@@ -14106,7 +14108,7 @@ var require_cbor = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+xml-builder@3.972.40/node_modules/@aws-sdk/xml-builder/dist-cjs/index.js
-var require_dist_cjs5 = __commonJS((exports) => {
+var require_dist_cjs5 = __commonJS(function(exports) {
   var ATTR_ESCAPE_RE = /[&<>"]/g;
   var ATTR_ESCAPE_MAP = {
     "&": "&amp;",
@@ -14474,7 +14476,7 @@ var require_dist_cjs5 = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+core@3.977.9/node_modules/@aws-sdk/core/dist-cjs/submodules/protocols/index.js
-var require_protocols2 = __commonJS((exports) => {
+var require_protocols2 = __commonJS(function(exports) {
   var { SmithyRpcV2CborProtocol, loadSmithyRpcV2CborErrorCode } = require_cbor();
   var { TypeRegistry, NormalizedSchema, deref } = require_schema();
   var { decorateServiceException, getValueFromTextNode } = require_client();
@@ -17315,7 +17317,7 @@ var require_protocols2 = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+core@3.977.9/node_modules/@aws-sdk/core/dist-cjs/submodules/httpAuthSchemes/index.js
-var require_httpAuthSchemes = __commonJS((exports) => {
+var require_httpAuthSchemes = __commonJS(function(exports) {
   var { ProviderError, booleanSelector: booleanSelector2, SelectorType: SelectorType3, loadConfig } = require_config();
   var { setCredentialFeature } = require_client2();
   var { normalizeProvider: normalizeProvider2, memoizeIdentityProvider, isIdentityExpired, doesIdentityRequireRefresh } = require_dist_cjs2();
@@ -17675,13 +17677,13 @@ var init_fromEnv = __esm(() => {
 // ../../node_modules/.bun/@aws-sdk+credential-provider-env@3.972.70/node_modules/@aws-sdk/credential-provider-env/dist-es/index.js
 var exports_dist_es = {};
 __export(exports_dist_es, {
-  fromEnv: () => fromEnv,
-  ENV_SESSION: () => ENV_SESSION,
-  ENV_SECRET: () => ENV_SECRET,
-  ENV_KEY: () => ENV_KEY,
-  ENV_EXPIRATION: () => ENV_EXPIRATION,
+  ENV_ACCOUNT_ID: () => ENV_ACCOUNT_ID,
   ENV_CREDENTIAL_SCOPE: () => ENV_CREDENTIAL_SCOPE,
-  ENV_ACCOUNT_ID: () => ENV_ACCOUNT_ID
+  ENV_EXPIRATION: () => ENV_EXPIRATION,
+  ENV_KEY: () => ENV_KEY,
+  ENV_SECRET: () => ENV_SECRET,
+  ENV_SESSION: () => ENV_SESSION,
+  fromEnv: () => fromEnv
 });
 var init_dist_es = __esm(() => {
   init_fromEnv();
@@ -18065,17 +18067,17 @@ var init_fromInstanceMetadata = __esm(() => {
 // ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/index.js
 var exports_dist_es2 = {};
 __export(exports_dist_es2, {
-  providerConfigFromInit: () => providerConfigFromInit,
-  httpRequest: () => httpRequest,
-  getInstanceMetadataEndpoint: () => getInstanceMetadataEndpoint,
-  fromInstanceMetadata: () => fromInstanceMetadata,
-  fromContainerMetadata: () => fromContainerMetadata,
-  Endpoint: () => Endpoint,
-  ENV_CMDS_RELATIVE_URI: () => ENV_CMDS_RELATIVE_URI,
-  ENV_CMDS_FULL_URI: () => ENV_CMDS_FULL_URI,
-  ENV_CMDS_AUTH_TOKEN: () => ENV_CMDS_AUTH_TOKEN,
+  DEFAULT_MAX_RETRIES: () => DEFAULT_MAX_RETRIES,
   DEFAULT_TIMEOUT: () => DEFAULT_TIMEOUT,
-  DEFAULT_MAX_RETRIES: () => DEFAULT_MAX_RETRIES
+  ENV_CMDS_AUTH_TOKEN: () => ENV_CMDS_AUTH_TOKEN,
+  ENV_CMDS_FULL_URI: () => ENV_CMDS_FULL_URI,
+  ENV_CMDS_RELATIVE_URI: () => ENV_CMDS_RELATIVE_URI,
+  Endpoint: () => Endpoint,
+  fromContainerMetadata: () => fromContainerMetadata,
+  fromInstanceMetadata: () => fromInstanceMetadata,
+  getInstanceMetadataEndpoint: () => getInstanceMetadataEndpoint,
+  httpRequest: () => httpRequest,
+  providerConfigFromInit: () => providerConfigFromInit
 });
 var init_dist_es2 = __esm(() => {
   init_fromContainerMetadata();
@@ -18086,7 +18088,7 @@ var init_dist_es2 = __esm(() => {
 });
 
 // ../../node_modules/.bun/@smithy+node-http-handler@4.12.1/node_modules/@smithy/node-http-handler/dist-cjs/index.js
-var require_dist_cjs6 = __commonJS((exports) => {
+var require_dist_cjs6 = __commonJS(function(exports) {
   var { hasOwn: hasOwn2 } = require_serde();
   var { streamCollector } = require_serde();
   exports.streamCollector = streamCollector;
@@ -19093,7 +19095,7 @@ var init_constants = __esm(() => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+nested-clients@3.997.44/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sso-oidc/index.js
-var require_sso_oidc = __commonJS((exports) => {
+var require_sso_oidc = __commonJS(function(exports) {
   var { awsEndpointFunctions: awsEndpointFunctions2, emitWarningIfUnsupportedVersion: emitWarningIfUnsupportedVersion$1, createDefaultUserAgentProvider, NODE_APP_ID_CONFIG_OPTIONS, getAwsRegionExtensionConfiguration, resolveAwsRegionExtensionConfiguration, resolveUserAgentConfig, resolveHostHeaderConfig, getUserAgentPlugin, getHostHeaderPlugin, getLoggerPlugin, getRecursionDetectionPlugin } = require_client2();
   var { NoAuthSigner, getHttpAuthSchemeEndpointRuleSetPlugin, DefaultIdentityProviderConfig, getHttpSigningPlugin } = require_dist_cjs2();
   var { normalizeProvider: normalizeProvider3, getSmithyContext: getSmithyContext3, ServiceException, NoOpLogger: NoOpLogger2, emitWarningIfUnsupportedVersion, loadConfigsForDefaultMode, getDefaultExtensionConfiguration, resolveDefaultRuntimeConfig, Client, makeBuilder: makeBuilder2, createAggregatedClient } = require_client();
@@ -20445,8 +20447,8 @@ var init_sso = __esm(() => {
 // ../../node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/loadSso.js
 var exports_loadSso = {};
 __export(exports_loadSso, {
-  SSOClient: () => $SSOClient,
-  GetRoleCredentialsCommand: () => $GetRoleCredentialsCommand
+  GetRoleCredentialsCommand: () => $GetRoleCredentialsCommand,
+  SSOClient: () => $SSOClient
 });
 var init_loadSso = __esm(() => {
   init_sso();
@@ -20639,9 +20641,9 @@ var init_fromSSO = __esm(() => {
 // ../../node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/index.js
 var exports_dist_es4 = {};
 __export(exports_dist_es4, {
-  validateSsoProfile: () => validateSsoProfile,
+  fromSSO: () => fromSSO,
   isSsoProfile: () => isSsoProfile,
-  fromSSO: () => fromSSO
+  validateSsoProfile: () => validateSsoProfile
 });
 var init_dist_es5 = __esm(() => {
   init_fromSSO();
@@ -20680,7 +20682,7 @@ var init_resolveCredentialSource = __esm(() => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+nested-clients@3.997.44/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sts/index.js
-var require_sts = __commonJS((exports) => {
+var require_sts = __commonJS(function(exports) {
   var { awsEndpointFunctions: awsEndpointFunctions3, emitWarningIfUnsupportedVersion: emitWarningIfUnsupportedVersion$12, createDefaultUserAgentProvider: createDefaultUserAgentProvider2, NODE_APP_ID_CONFIG_OPTIONS: NODE_APP_ID_CONFIG_OPTIONS2, getAwsRegionExtensionConfiguration: getAwsRegionExtensionConfiguration2, resolveAwsRegionExtensionConfiguration: resolveAwsRegionExtensionConfiguration2, resolveUserAgentConfig: resolveUserAgentConfig2, resolveHostHeaderConfig: resolveHostHeaderConfig2, getUserAgentPlugin: getUserAgentPlugin2, getHostHeaderPlugin: getHostHeaderPlugin2, getLoggerPlugin: getLoggerPlugin2, getRecursionDetectionPlugin: getRecursionDetectionPlugin2, setCredentialFeature: setCredentialFeature5, stsRegionDefaultResolver } = require_client2();
   var { NoAuthSigner: NoAuthSigner2, getHttpAuthSchemeEndpointRuleSetPlugin: getHttpAuthSchemeEndpointRuleSetPlugin2, DefaultIdentityProviderConfig: DefaultIdentityProviderConfig2, getHttpSigningPlugin: getHttpSigningPlugin2 } = require_dist_cjs2();
   var { normalizeProvider: normalizeProvider4, getSmithyContext: getSmithyContext4, ServiceException: ServiceException2, NoOpLogger: NoOpLogger3, emitWarningIfUnsupportedVersion: emitWarningIfUnsupportedVersion2, loadConfigsForDefaultMode: loadConfigsForDefaultMode2, getDefaultExtensionConfiguration: getDefaultExtensionConfiguration2, resolveDefaultRuntimeConfig: resolveDefaultRuntimeConfig2, Client: Client2, makeBuilder: makeBuilder3, createAggregatedClient: createAggregatedClient2 } = require_client();
@@ -21770,7 +21772,7 @@ var init_resolveAssumeRoleCredentials = __esm(() => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+nested-clients@3.997.44/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/signin/index.js
-var require_signin = __commonJS((exports) => {
+var require_signin = __commonJS(function(exports) {
   var { awsEndpointFunctions: awsEndpointFunctions3, emitWarningIfUnsupportedVersion: emitWarningIfUnsupportedVersion$12, createDefaultUserAgentProvider: createDefaultUserAgentProvider2, NODE_APP_ID_CONFIG_OPTIONS: NODE_APP_ID_CONFIG_OPTIONS2, getAwsRegionExtensionConfiguration: getAwsRegionExtensionConfiguration2, resolveAwsRegionExtensionConfiguration: resolveAwsRegionExtensionConfiguration2, resolveUserAgentConfig: resolveUserAgentConfig2, resolveHostHeaderConfig: resolveHostHeaderConfig2, getUserAgentPlugin: getUserAgentPlugin2, getHostHeaderPlugin: getHostHeaderPlugin2, getLoggerPlugin: getLoggerPlugin2, getRecursionDetectionPlugin: getRecursionDetectionPlugin2 } = require_client2();
   var { NoAuthSigner: NoAuthSigner2, getHttpAuthSchemeEndpointRuleSetPlugin: getHttpAuthSchemeEndpointRuleSetPlugin2, DefaultIdentityProviderConfig: DefaultIdentityProviderConfig2, getHttpSigningPlugin: getHttpSigningPlugin2 } = require_dist_cjs2();
   var { normalizeProvider: normalizeProvider4, getSmithyContext: getSmithyContext4, ServiceException: ServiceException2, NoOpLogger: NoOpLogger3, emitWarningIfUnsupportedVersion: emitWarningIfUnsupportedVersion2, loadConfigsForDefaultMode: loadConfigsForDefaultMode2, getDefaultExtensionConfiguration: getDefaultExtensionConfiguration2, resolveDefaultRuntimeConfig: resolveDefaultRuntimeConfig2, Client: Client2, makeBuilder: makeBuilder3, createAggregatedClient: createAggregatedClient2 } = require_client();
@@ -23013,8 +23015,8 @@ var init_fromTokenFile = __esm(() => {
 // ../../node_modules/.bun/@aws-sdk+credential-provider-web-identity@3.972.76/node_modules/@aws-sdk/credential-provider-web-identity/dist-es/index.js
 var exports_dist_es7 = {};
 __export(exports_dist_es7, {
-  fromWebToken: () => fromWebToken,
-  fromTokenFile: () => fromTokenFile
+  fromTokenFile: () => fromTokenFile,
+  fromWebToken: () => fromWebToken
 });
 var init_dist_es8 = __esm(() => {
   init_fromTokenFile();
@@ -23115,6 +23117,7 @@ import { spawn } from "child_process";
 import { request as nodeHttpRequest } from "http";
 import { request as nodeHttpsRequest } from "https";
 import { randomUUID as randomUUID22 } from "crypto";
+import { createRequire as createRequire2 } from "module";
 function getPathValue(input, path) {
   return path.split(".").reduce((value, part) => {
     if (value && typeof value === "object" && part in value) {
@@ -24330,7 +24333,7 @@ function normalizeRetryPolicy(policy) {
 }
 var PATHS_RESOLVER_KIND_ENV, PATHS_RESOLVER_APP_SLUG_RE2, HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", EVENTS_STORE_SENTINEL_FILE = "events.json", LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:", DEFAULT_EVENT_PAGE_LIMIT = 100, MAX_EVENT_PAGE_LIMIT = 1000, DEFAULT_SIGNATURE_TOLERANCE_MS, DEFAULT_MAX_REDIRECTS = 5, IPV4_PRIVATE_RANGES, IPV6_SPECIAL_PREFIXES, defaultTargetLookup = async (hostname) => {
   return dnsLookup(hostname, { all: true, verbatim: false });
-}, EventValidationError, defaultEventTypeCatalog, APP_EVENT_V1_MAX_DATA_BYTES;
+}, EventValidationError, defaultEventTypeCatalog, APP_EVENT_V1_MAX_DATA_BYTES, MAX_CREDENTIAL_FILE_BYTES2, INSPECT_CUSTOM2, CREDENTIAL_SEAL2, AMBIENT_ENVIRONMENT2, SECRETS_PACKAGE_SPECIFIER2, requireSecretsSdk2, IDEMPOTENT_METHODS2, AUTHORITY_OVERRIDE_HEADERS2, MAX_ENVELOPE_BYTES, MAX_REQUEST_BYTES;
 var init_dist = __esm(() => {
   PATHS_RESOLVER_KIND_ENV = {
     config: "HASNA_CONFIG_HOME",
@@ -24386,6 +24389,22 @@ var init_dist = __esm(() => {
   };
   defaultEventTypeCatalog = new EventTypeCatalog;
   APP_EVENT_V1_MAX_DATA_BYTES = 32 * 1024;
+  MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
+  INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
+  CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
+  AMBIENT_ENVIRONMENT2 = Symbol.for("hasna:contracts:ambientClientEnvironment");
+  SECRETS_PACKAGE_SPECIFIER2 = "@hasna/" + "secrets";
+  requireSecretsSdk2 = createRequire2(import.meta.url);
+  IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+  AUTHORITY_OVERRIDE_HEADERS2 = new Set([
+    "host",
+    ":authority",
+    "forwarded",
+    "x-forwarded-host",
+    "x-original-host"
+  ]);
+  MAX_ENVELOPE_BYTES = 256 * 1024;
+  MAX_REQUEST_BYTES = MAX_ENVELOPE_BYTES * 2 + 8192;
 });
 
 // src/sdk/event-sink.ts
@@ -25462,7 +25481,7 @@ class MissingSkillsFleetError extends Error {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.5.2",
+  version: "0.5.4",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -25635,6 +25654,41 @@ import { createHmac, timingSafeEqual } from "crypto";
 import { createHash } from "crypto";
 import { readFileSync as readFileSync2, readdirSync, statSync } from "fs";
 import { join as join2, relative } from "path";
+import { createGunzip } from "zlib";
+
+// src/lib/skill-entry-path.ts
+class SkillEntryPaths {
+  files = new Set;
+  directories = new Set;
+  add(path, maxBytes, invalid, limit) {
+    if (path.length > maxBytes)
+      limit();
+    const encoded = new TextEncoder().encode(path);
+    if (encoded.byteLength > maxBytes)
+      limit();
+    if (new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(encoded) !== path)
+      invalid("Invalid UTF-8 entry path");
+    if (!path || /[\\:\x00-\x1f\x7f]/u.test(path))
+      invalid("Unsafe entry path");
+    if (path.split("/").some((segment) => !segment || segment === "." || segment === ".."))
+      invalid("Unsafe entry path segment");
+    const key = path.normalize("NFC").toLowerCase().normalize("NFC");
+    if (this.files.has(key) || this.directories.has(key))
+      invalid("Duplicate or conflicting entry path");
+    const parents = key.split("/");
+    parents.pop();
+    while (parents.length) {
+      const parent = parents.join("/");
+      if (this.files.has(parent))
+        invalid("Conflicting entry file ancestor");
+      this.directories.add(parent);
+      parents.pop();
+    }
+    this.files.add(key);
+  }
+}
+
+// src/lib/skill-bundle.ts
 var BLOCK = 512;
 var ANY_SEGMENT_EXCLUDES = new Set([
   ".git",
@@ -25957,6 +26011,227 @@ function concat(chunks) {
   }
   return merged;
 }
+var SKILL_BUNDLE_INSPECTION_LIMITS = Object.freeze({
+  compressedBytes: 16 * 1024 * 1024,
+  decompressedBytes: 64 * 1024 * 1024,
+  entries: 1024,
+  fileBytes: 16 * 1024 * 1024,
+  pathBytes: 100,
+  timeoutMs: 5000
+});
+
+class SkillBundleInspectionError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SkillBundleInspectionError";
+  }
+}
+function invalidBundle(message) {
+  throw new SkillBundleInspectionError("BUNDLE_INVALID", message);
+}
+function inspectionLimits(options) {
+  const limits = { ...SKILL_BUNDLE_INSPECTION_LIMITS };
+  for (const key of Object.keys(options.limits ?? {})) {
+    if (!Object.hasOwn(limits, key))
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Unknown bundle limit");
+    const field = key;
+    const value = options.limits[field];
+    if (!Number.isSafeInteger(value) || value <= 0 || value > limits[field]) {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle limits must be positive integers within the hard ceilings");
+    }
+    limits[field] = value;
+  }
+  return limits;
+}
+async function inspectSkillBundle(bundle, options = {}) {
+  const signal = options.signal;
+  const limits = inspectionLimits(options);
+  const deadline = performance.now() + limits.timeoutMs;
+  const check = () => {
+    if (signal?.aborted)
+      throw new SkillBundleInspectionError("BUNDLE_ABORTED", "Bundle inspection aborted");
+    if (performance.now() >= deadline)
+      throw new SkillBundleInspectionError("BUNDLE_TIMEOUT", "Bundle inspection deadline exceeded");
+  };
+  check();
+  if (bundle.byteLength > limits.compressedBytes)
+    throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Compressed bundle exceeds byte limit");
+  const snapshot = ownBytes(bundle);
+  check();
+  const sha256 = sha256Hex(snapshot);
+  check();
+  const parser = new BoundedTarReader(limits, check);
+  const streamOptions = { chunkSize: 16 * 1024, highWaterMark: 16 * 1024 };
+  const decoder = createGunzip(streamOptions);
+  let terminalError;
+  const stop = (code) => {
+    terminalError ??= new SkillBundleInspectionError(code, code === "BUNDLE_ABORTED" ? "Bundle inspection aborted" : "Bundle inspection deadline exceeded");
+    decoder.destroy(terminalError);
+  };
+  const onAbort = () => stop("BUNDLE_ABORTED");
+  const timer = setTimeout(() => stop("BUNDLE_TIMEOUT"), Math.max(1, deadline - performance.now()));
+  signal?.addEventListener("abort", onAbort, { once: true });
+  let decompressedByteSize = 0;
+  let bytesSinceYield = 0;
+  try {
+    check();
+    decoder.end(snapshot);
+    for await (const chunk of decoder) {
+      check();
+      decompressedByteSize += chunk.byteLength;
+      if (decompressedByteSize > limits.decompressedBytes)
+        throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Decompressed bundle exceeds byte limit");
+      parser.push(chunk);
+      bytesSinceYield += chunk.byteLength;
+      if (bytesSinceYield >= 256 * 1024) {
+        await new Promise((resolve) => setTimeout(resolve, 0));
+        bytesSinceYield = 0;
+        check();
+      }
+    }
+    check();
+    const entries = parser.finish();
+    return {
+      entries,
+      sha256,
+      compressedByteSize: snapshot.byteLength,
+      decompressedByteSize,
+      unpackedByteSize: parser.fileBytes,
+      fileCount: entries.length
+    };
+  } catch (error) {
+    if (terminalError)
+      throw terminalError;
+    if (error instanceof SkillBundleInspectionError)
+      throw error;
+    throw new SkillBundleInspectionError("BUNDLE_INVALID", "Invalid or truncated gzip bundle");
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", onAbort);
+    decoder.destroy();
+  }
+}
+
+class BoundedTarReader {
+  limits;
+  check;
+  header = new Uint8Array(BLOCK);
+  headerOffset = 0;
+  pending;
+  bodyOffset = 0;
+  padding = 0;
+  zeroBlocks = 0;
+  entries = [];
+  paths = new SkillEntryPaths;
+  fileBytes = 0;
+  constructor(limits, check) {
+    this.limits = limits;
+    this.check = check;
+  }
+  push(chunk) {
+    let offset = 0;
+    while (offset < chunk.byteLength) {
+      this.check();
+      if (this.pending) {
+        const count = Math.min(this.pending.bytes.byteLength - this.bodyOffset, chunk.byteLength - offset);
+        this.pending.bytes.set(chunk.subarray(offset, offset + count), this.bodyOffset);
+        offset += count;
+        this.bodyOffset += count;
+        if (this.bodyOffset === this.pending.bytes.byteLength) {
+          this.entries.push(this.pending);
+          this.pending = undefined;
+        }
+      } else if (this.padding) {
+        const count = Math.min(this.padding, chunk.byteLength - offset);
+        if (chunk.subarray(offset, offset + count).some((byte) => byte !== 0))
+          invalidBundle("Nonzero tar body padding");
+        offset += count;
+        this.padding -= count;
+      } else {
+        const count = Math.min(BLOCK - this.headerOffset, chunk.byteLength - offset);
+        this.header.set(chunk.subarray(offset, offset + count), this.headerOffset);
+        offset += count;
+        this.headerOffset += count;
+        if (this.headerOffset === BLOCK) {
+          this.readHeader();
+          this.headerOffset = 0;
+        }
+      }
+    }
+  }
+  finish() {
+    this.check();
+    if (this.pending || this.padding || this.headerOffset || this.zeroBlocks < 2)
+      invalidBundle("Truncated tar bundle");
+    return this.entries;
+  }
+  readHeader() {
+    this.check();
+    const h = this.header;
+    if (h.every((byte) => byte === 0)) {
+      this.zeroBlocks++;
+      return;
+    }
+    if (this.zeroBlocks)
+      invalidBundle("Nonzero tar data after terminator");
+    if (this.entries.length >= this.limits.entries)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle entry limit exceeded");
+    let checksum = 0;
+    for (let i = 0;i < BLOCK; i++)
+      checksum += i >= 148 && i < 156 ? 32 : h[i];
+    if (tarOctal(h.subarray(148, 156)) !== checksum)
+      invalidBundle("Invalid tar header checksum");
+    if (new TextDecoder().decode(h.subarray(257, 265)) !== "ustar\x00" + "00")
+      invalidBundle("Unsupported tar format");
+    if (h[156] !== 48 && h[156] !== 0 || h.subarray(157, 257).some((b) => b !== 0) || h.subarray(345).some((b) => b !== 0))
+      invalidBundle("Unsupported tar entry or path prefix");
+    const mode = tarOctal(h.subarray(100, 108));
+    if (mode > 511)
+      invalidBundle("Unsupported tar permission bits");
+    tarOctal(h.subarray(108, 116));
+    tarOctal(h.subarray(116, 124));
+    tarOctal(h.subarray(136, 148));
+    const size = tarOctal(h.subarray(124, 136));
+    if (size > this.limits.fileBytes || this.fileBytes + size > this.limits.decompressedBytes) {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle file byte limit exceeded");
+    }
+    const name = h.subarray(0, 100);
+    const end = name.indexOf(0);
+    if (end !== -1 && name.subarray(end).some((b) => b !== 0))
+      invalidBundle("Invalid tar path padding");
+    const raw = end === -1 ? name : name.subarray(0, end);
+    if (raw.byteLength > this.limits.pathBytes)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    let path;
+    try {
+      path = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw);
+    } catch {
+      return invalidBundle("Invalid UTF-8 bundle path");
+    }
+    this.paths.add(path, this.limits.pathBytes, invalidBundle, () => {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    });
+    this.fileBytes += size;
+    this.pending = { path, mode, bytes: new Uint8Array(new ArrayBuffer(size)) };
+    this.bodyOffset = 0;
+    this.padding = (BLOCK - size % BLOCK) % BLOCK;
+    if (!size) {
+      this.entries.push(this.pending);
+      this.pending = undefined;
+    }
+  }
+}
+function tarOctal(field) {
+  const text = new TextDecoder().decode(field);
+  if (!/^[0-7]+[\0 ]*$/.test(text))
+    invalidBundle("Invalid tar octal field");
+  const value = Number.parseInt(text, 8);
+  if (!Number.isSafeInteger(value))
+    invalidBundle("Tar integer is out of range");
+  return value;
+}
 
 // src/lib/skill-bundles.ts
 var SKILLS_SIGNING_KEY_ENV = "SKILLS_SIGNING_KEY";
@@ -38659,6 +38934,9 @@ import { existsSync as existsSync6, readdirSync as readdirSync6, readFileSync as
 import { join as join11, sep } from "path";
 var CONTENT_HASH_ALGORITHM = "sha256";
 var HASH_EXCLUDE_DIRS = new Set([".git", "node_modules", "dist", "build", ".turbo"]);
+function excludedHashEntry(name, directory) {
+  return name.startsWith(".") || directory && HASH_EXCLUDE_DIRS.has(name);
+}
 var HASH_COVERAGE = [
   "SKILL.md",
   "skill.json",
@@ -38740,7 +39018,7 @@ function collectDirectory(files, dir, rel) {
     if (stats.isSymbolicLink())
       continue;
     if (stats.isDirectory()) {
-      if (HASH_EXCLUDE_DIRS.has(entry))
+      if (excludedHashEntry(entry, true))
         continue;
       collectDirectory(files, absolute, childRel);
     } else if (stats.isFile()) {
@@ -38750,28 +39028,242 @@ function collectDirectory(files, dir, rel) {
 }
 function collectFile(files, absolute, rel) {
   const buffer = readFileSync8(absolute);
+  files.push(normalizeBundleFile(rel.split(sep).join("/"), buffer));
+}
+function normalizeBundleFile(rel, buffer) {
   if (rel === "skill.json") {
-    files.push({ rel: rel.split(sep).join("/"), content: new TextEncoder().encode(canonicalizeManifest(new TextDecoder().decode(buffer))) });
-    return;
+    return { rel, content: new TextEncoder().encode(canonicalizeManifest(new TextDecoder().decode(buffer))) };
   }
   if (looksLikeText(buffer)) {
     const normalized = normalizeLineEndings(new TextDecoder().decode(buffer));
-    files.push({ rel: rel.split(sep).join("/"), content: new TextEncoder().encode(normalized) });
-    return;
+    return { rel, content: new TextEncoder().encode(normalized) };
   }
-  files.push({ rel: rel.split(sep).join("/"), content: buffer });
+  return { rel, content: buffer };
 }
 function computeContentHash(skillPath) {
+  return hashBundleFiles(collectBundleFiles(skillPath));
+}
+function* bundleHashParts(files) {
+  for (const file of files) {
+    yield new TextEncoder().encode(file.rel);
+    yield new TextEncoder().encode(`\x00${file.content.length}\x00`);
+    yield file.content;
+    yield new TextEncoder().encode("\x00");
+  }
+  yield new TextEncoder().encode("\x00");
+}
+function hashBundleFiles(files) {
+  const hash = createHash6(CONTENT_HASH_ALGORITHM);
+  for (const part of bundleHashParts(files))
+    hash.update(part);
+  return hash.digest("hex");
+}
+async function hashBundleFilesCooperatively(files, check) {
   const hash = createHash6(CONTENT_HASH_ALGORITHM);
-  for (const file of collectBundleFiles(skillPath)) {
-    hash.update(new TextEncoder().encode(file.rel));
-    hash.update(new TextEncoder().encode(`\x00${file.content.length}\x00`));
-    hash.update(file.content);
-    hash.update(new TextEncoder().encode("\x00"));
+  let bytesSinceYield = 0;
+  for (const part of bundleHashParts(files)) {
+    for (let offset = 0;offset < part.byteLength; offset += 64 * 1024) {
+      check();
+      const chunk = part.subarray(offset, offset + 64 * 1024);
+      hash.update(chunk);
+      bytesSinceYield += chunk.byteLength;
+      if (bytesSinceYield >= 256 * 1024) {
+        await new Promise((resolve2) => setImmediate(resolve2));
+        bytesSinceYield = 0;
+      }
+    }
   }
-  hash.update(new TextEncoder().encode("\x00"));
+  check();
   return hash.digest("hex");
 }
+var CONTENT_HASH_LIMITS = Object.freeze({
+  entries: 1024,
+  rawBytes: 64 * 1024 * 1024,
+  normalizedBytes: 64 * 1024 * 1024,
+  fileBytes: 16 * 1024 * 1024,
+  normalizedFileBytes: 16 * 1024 * 1024,
+  pathBytes: 100,
+  manifestBytes: 16 * 1024,
+  manifestDepth: 64,
+  timeoutMs: 5000
+});
+
+class ContentHashInputError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "ContentHashInputError";
+  }
+}
+function invalidContent(message = "Invalid content hash input") {
+  throw new ContentHashInputError("CONTENT_HASH_INVALID", message);
+}
+function contentLimit(message) {
+  throw new ContentHashInputError("CONTENT_HASH_LIMIT", message);
+}
+function contentRecord(value, allowed) {
+  if (!value || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    invalidContent();
+  const result = Object.create(null);
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string" || !allowed.includes(key))
+      invalidContent();
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !("value" in descriptor))
+      invalidContent("Accessor content hash input is unsupported");
+    result[key] = descriptor.value;
+  }
+  return result;
+}
+function contentOptions(options) {
+  const record = contentRecord(options, ["limits", "signal"]);
+  const limits = { ...CONTENT_HASH_LIMITS };
+  if (record.limits !== undefined) {
+    const supplied = contentRecord(record.limits, Object.keys(limits));
+    for (const key of Object.keys(supplied)) {
+      const value = supplied[key];
+      if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0 || value > limits[key])
+        contentLimit("Invalid content hash limit");
+      limits[key] = value;
+    }
+  }
+  if (record.signal !== undefined && !(record.signal instanceof AbortSignal))
+    invalidContent("Invalid content hash signal");
+  return { limits, signal: record.signal };
+}
+var typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
+var byteLengthOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteLength").get;
+var bufferOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer").get;
+function snapshotContentEntries(entries, limits, check) {
+  if (!Array.isArray(entries))
+    invalidContent("Content hash entries must be an array");
+  if (entries.length > limits.entries)
+    contentLimit("Content hash entry limit exceeded");
+  if (Reflect.ownKeys(entries).length !== entries.length + 1)
+    invalidContent("Invalid content hash entry array");
+  const snapshot = [];
+  const paths = new SkillEntryPaths;
+  let rawBytes = 0;
+  for (let index = 0;index < entries.length; index++) {
+    check();
+    const descriptor = Object.getOwnPropertyDescriptor(entries, String(index));
+    if (!descriptor || !("value" in descriptor))
+      invalidContent("Invalid content hash entry array");
+    const entry = contentRecord(descriptor.value, ["path", "bytes", "mode"]);
+    if (typeof entry.path !== "string" || typeof entry.mode !== "number" || !Number.isInteger(entry.mode) || entry.mode < 0 || entry.mode > 511)
+      invalidContent("Invalid regular-file content hash entry");
+    paths.add(entry.path, limits.pathBytes, invalidContent, () => contentLimit("Content hash path limit exceeded"));
+    if (!(entry.bytes instanceof Uint8Array) || !ArrayBuffer.isView(entry.bytes))
+      invalidContent("Content hash entry requires bytes");
+    const size = byteLengthOf.call(entry.bytes);
+    if (!(bufferOf.call(entry.bytes) instanceof ArrayBuffer))
+      invalidContent("Shared content hash bytes are unsupported");
+    if (size > limits.fileBytes || rawBytes + size > limits.rawBytes)
+      contentLimit("Content hash raw byte limit exceeded");
+    if (entry.path === "skill.json" && size > limits.manifestBytes)
+      contentLimit("Content hash manifest byte limit exceeded");
+    rawBytes += size;
+    const bytes = new Uint8Array(new ArrayBuffer(size));
+    bytes.set(entry.bytes);
+    snapshot.push({ path: entry.path, bytes, mode: entry.mode });
+  }
+  check();
+  return snapshot;
+}
+function coveredContentPath(path) {
+  const segments = path.split("/");
+  if (!HASH_COVERAGE.includes(segments[0]))
+    return false;
+  return !segments.slice(1).some((segment, index) => excludedHashEntry(segment, index < segments.length - 2));
+}
+function boundedManifest(raw, maxDepth) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return;
+  }
+  const pending = [{ value: parsed, depth: 1 }];
+  while (pending.length) {
+    const { value, depth } = pending.pop();
+    if (!value || typeof value !== "object")
+      continue;
+    if (depth > maxDepth)
+      contentLimit("Content hash manifest depth limit exceeded");
+    for (const child of Object.values(value))
+      pending.push({ value: child, depth: depth + 1 });
+  }
+  return parsed;
+}
+async function hashContentEntries(entries, options) {
+  const { limits, signal } = contentOptions(options);
+  const deadline = performance.now() + limits.timeoutMs;
+  let terminal;
+  const abort = () => {
+    terminal ??= new ContentHashInputError("CONTENT_HASH_ABORTED", "Content hashing aborted");
+  };
+  const timer = setTimeout(() => {
+    terminal ??= new ContentHashInputError("CONTENT_HASH_TIMEOUT", "Content hashing deadline exceeded");
+  }, limits.timeoutMs);
+  const check = () => {
+    if (signal?.aborted)
+      abort();
+    if (terminal)
+      throw terminal;
+    if (performance.now() >= deadline)
+      throw new ContentHashInputError("CONTENT_HASH_TIMEOUT", "Content hashing deadline exceeded");
+  };
+  try {
+    signal?.addEventListener("abort", abort, { once: true });
+    check();
+    const snapshot = snapshotContentEntries(entries, limits, check);
+    const normalized = [];
+    let normalizedBytes = 0;
+    let manifest;
+    await new Promise((resolve2) => setImmediate(resolve2));
+    for (const entry of snapshot) {
+      check();
+      if (!coveredContentPath(entry.path))
+        continue;
+      if (entry.path === "skill.json")
+        manifest = boundedManifest(new TextDecoder().decode(entry.bytes), limits.manifestDepth);
+      const file = normalizeBundleFile(entry.path, entry.bytes);
+      check();
+      if (file.content.byteLength > limits.normalizedFileBytes || normalizedBytes + file.content.byteLength > limits.normalizedBytes)
+        contentLimit("Content hash normalized byte limit exceeded");
+      normalizedBytes += file.content.byteLength;
+      normalized.push(file);
+      await new Promise((resolve2) => setImmediate(resolve2));
+    }
+    normalized.sort((a3, b3) => a3.rel < b3.rel ? -1 : a3.rel > b3.rel ? 1 : 0);
+    check();
+    return { hash: await hashBundleFilesCooperatively(normalized, check), manifest };
+  } catch (error) {
+    if (error instanceof ContentHashInputError)
+      throw error;
+    throw new ContentHashInputError("CONTENT_HASH_INVALID", "Invalid content hash input");
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", abort);
+  }
+}
+async function computeContentHashFromEntries(entries, options = {}) {
+  return (await hashContentEntries(entries, options)).hash;
+}
+async function verifyContentHashFromEntries(entries, options = {}) {
+  const { hash, manifest } = await hashContentEntries(entries, options);
+  const provenance = manifest && typeof manifest === "object" && !Array.isArray(manifest) ? manifest.provenance : undefined;
+  const value = provenance && typeof provenance === "object" && !Array.isArray(provenance) ? provenance.content_hash : undefined;
+  if (value !== undefined && typeof value !== "string")
+    invalidContent("Invalid content hash declaration");
+  const declaredHash = value?.trim() || undefined;
+  if (!declaredHash)
+    return { declared: false, valid: false };
+  if (!/^[a-f0-9]{64}$/.test(declaredHash))
+    return { declared: true, valid: false, declaredHash };
+  return { declared: true, valid: hash === declaredHash, declaredHash, computedHash: hash };
+}
 function verifyContentHash(skillPath, manifest) {
   const declaredHash = manifest?.provenance?.content_hash?.trim() || undefined;
   if (!declaredHash)
@@ -43566,113 +44058,113 @@ var currentVersionService = {
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
-  void: () => voidType,
-  util: () => util,
-  unknown: () => unknownType,
-  union: () => unionType,
-  undefined: () => undefinedType,
-  tuple: () => tupleType,
-  transformer: () => effectsType,
-  symbol: () => symbolType,
-  string: () => stringType,
-  strictObject: () => strictObjectType,
-  setErrorMap: () => setErrorMap,
-  set: () => setType,
-  record: () => recordType,
-  quotelessJson: () => quotelessJson,
-  promise: () => promiseType,
-  preprocess: () => preprocessType,
-  pipeline: () => pipelineType,
-  ostring: () => ostring,
-  optional: () => optionalType,
-  onumber: () => onumber,
-  oboolean: () => oboolean,
-  objectUtil: () => objectUtil,
-  object: () => objectType,
-  number: () => numberType,
-  nullable: () => nullableType,
-  null: () => nullType,
-  never: () => neverType,
-  nativeEnum: () => nativeEnumType,
-  nan: () => nanType,
-  map: () => mapType,
-  makeIssue: () => makeIssue,
-  literal: () => literalType,
-  lazy: () => lazyType,
-  late: () => late,
-  isValid: () => isValid,
-  isDirty: () => isDirty,
-  isAsync: () => isAsync,
-  isAborted: () => isAborted,
-  intersection: () => intersectionType,
-  instanceof: () => instanceOfType,
-  getParsedType: () => getParsedType,
-  getErrorMap: () => getErrorMap,
-  function: () => functionType,
-  enum: () => enumType,
-  effect: () => effectsType,
-  discriminatedUnion: () => discriminatedUnionType,
-  defaultErrorMap: () => en_default,
-  datetimeRegex: () => datetimeRegex,
-  date: () => dateType,
-  custom: () => custom,
-  coerce: () => coerce,
-  boolean: () => booleanType,
-  bigint: () => bigIntType,
-  array: () => arrayType,
-  any: () => anyType,
-  addIssueToContext: () => addIssueToContext,
-  ZodVoid: () => ZodVoid,
-  ZodUnknown: () => ZodUnknown,
-  ZodUnion: () => ZodUnion,
-  ZodUndefined: () => ZodUndefined,
-  ZodType: () => ZodType,
-  ZodTuple: () => ZodTuple,
-  ZodTransformer: () => ZodEffects,
-  ZodSymbol: () => ZodSymbol,
-  ZodString: () => ZodString,
-  ZodSet: () => ZodSet,
-  ZodSchema: () => ZodType,
-  ZodRecord: () => ZodRecord,
-  ZodReadonly: () => ZodReadonly,
-  ZodPromise: () => ZodPromise,
-  ZodPipeline: () => ZodPipeline,
-  ZodParsedType: () => ZodParsedType,
-  ZodOptional: () => ZodOptional,
-  ZodObject: () => ZodObject,
-  ZodNumber: () => ZodNumber,
-  ZodNullable: () => ZodNullable,
-  ZodNull: () => ZodNull,
-  ZodNever: () => ZodNever,
-  ZodNativeEnum: () => ZodNativeEnum,
-  ZodNaN: () => ZodNaN,
-  ZodMap: () => ZodMap,
-  ZodLiteral: () => ZodLiteral,
-  ZodLazy: () => ZodLazy,
-  ZodIssueCode: () => ZodIssueCode,
-  ZodIntersection: () => ZodIntersection,
-  ZodFunction: () => ZodFunction,
-  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
-  ZodError: () => ZodError,
-  ZodEnum: () => ZodEnum,
-  ZodEffects: () => ZodEffects,
-  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
-  ZodDefault: () => ZodDefault,
-  ZodDate: () => ZodDate,
-  ZodCatch: () => ZodCatch,
-  ZodBranded: () => ZodBranded,
-  ZodBoolean: () => ZodBoolean,
-  ZodBigInt: () => ZodBigInt,
-  ZodArray: () => ZodArray,
-  ZodAny: () => ZodAny,
-  Schema: () => ZodType,
-  ParseStatus: () => ParseStatus,
-  OK: () => OK,
-  NEVER: () => NEVER,
-  INVALID: () => INVALID,
-  EMPTY_PATH: () => EMPTY_PATH,
+  BRAND: () => BRAND,
   DIRTY: () => DIRTY,
-  BRAND: () => BRAND
+  EMPTY_PATH: () => EMPTY_PATH,
+  INVALID: () => INVALID,
+  NEVER: () => NEVER,
+  OK: () => OK,
+  ParseStatus: () => ParseStatus,
+  Schema: () => ZodType,
+  ZodAny: () => ZodAny,
+  ZodArray: () => ZodArray,
+  ZodBigInt: () => ZodBigInt,
+  ZodBoolean: () => ZodBoolean,
+  ZodBranded: () => ZodBranded,
+  ZodCatch: () => ZodCatch,
+  ZodDate: () => ZodDate,
+  ZodDefault: () => ZodDefault,
+  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
+  ZodEffects: () => ZodEffects,
+  ZodEnum: () => ZodEnum,
+  ZodError: () => ZodError,
+  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
+  ZodFunction: () => ZodFunction,
+  ZodIntersection: () => ZodIntersection,
+  ZodIssueCode: () => ZodIssueCode,
+  ZodLazy: () => ZodLazy,
+  ZodLiteral: () => ZodLiteral,
+  ZodMap: () => ZodMap,
+  ZodNaN: () => ZodNaN,
+  ZodNativeEnum: () => ZodNativeEnum,
+  ZodNever: () => ZodNever,
+  ZodNull: () => ZodNull,
+  ZodNullable: () => ZodNullable,
+  ZodNumber: () => ZodNumber,
+  ZodObject: () => ZodObject,
+  ZodOptional: () => ZodOptional,
+  ZodParsedType: () => ZodParsedType,
+  ZodPipeline: () => ZodPipeline,
+  ZodPromise: () => ZodPromise,
+  ZodReadonly: () => ZodReadonly,
+  ZodRecord: () => ZodRecord,
+  ZodSchema: () => ZodType,
+  ZodSet: () => ZodSet,
+  ZodString: () => ZodString,
+  ZodSymbol: () => ZodSymbol,
+  ZodTransformer: () => ZodEffects,
+  ZodTuple: () => ZodTuple,
+  ZodType: () => ZodType,
+  ZodUndefined: () => ZodUndefined,
+  ZodUnion: () => ZodUnion,
+  ZodUnknown: () => ZodUnknown,
+  ZodVoid: () => ZodVoid,
+  addIssueToContext: () => addIssueToContext,
+  any: () => anyType,
+  array: () => arrayType,
+  bigint: () => bigIntType,
+  boolean: () => booleanType,
+  coerce: () => coerce,
+  custom: () => custom,
+  date: () => dateType,
+  datetimeRegex: () => datetimeRegex,
+  defaultErrorMap: () => en_default,
+  discriminatedUnion: () => discriminatedUnionType,
+  effect: () => effectsType,
+  enum: () => enumType,
+  function: () => functionType,
+  getErrorMap: () => getErrorMap,
+  getParsedType: () => getParsedType,
+  instanceof: () => instanceOfType,
+  intersection: () => intersectionType,
+  isAborted: () => isAborted,
+  isAsync: () => isAsync,
+  isDirty: () => isDirty,
+  isValid: () => isValid,
+  late: () => late,
+  lazy: () => lazyType,
+  literal: () => literalType,
+  makeIssue: () => makeIssue,
+  map: () => mapType,
+  nan: () => nanType,
+  nativeEnum: () => nativeEnumType,
+  never: () => neverType,
+  null: () => nullType,
+  nullable: () => nullableType,
+  number: () => numberType,
+  object: () => objectType,
+  objectUtil: () => objectUtil,
+  oboolean: () => oboolean,
+  onumber: () => onumber,
+  optional: () => optionalType,
+  ostring: () => ostring,
+  pipeline: () => pipelineType,
+  preprocess: () => preprocessType,
+  promise: () => promiseType,
+  quotelessJson: () => quotelessJson,
+  record: () => recordType,
+  set: () => setType,
+  setErrorMap: () => setErrorMap,
+  strictObject: () => strictObjectType,
+  string: () => stringType,
+  symbol: () => symbolType,
+  transformer: () => effectsType,
+  tuple: () => tupleType,
+  undefined: () => undefinedType,
+  union: () => unionType,
+  unknown: () => unknownType,
+  util: () => util,
+  void: () => voidType
 });
 
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
@@ -52164,11 +52656,174 @@ function createOfflineGate(options) {
     }
   };
 }
-// src/lib/remote-workspace-selection.ts
+// src/lib/remote-invitations.ts
+class WorkspaceInvitationInputError extends Error {
+  code = "INVITATION_INPUT_INVALID";
+  constructor() {
+    super("Provide only the documented invitation fields, exact lowercase IDs, expected generation and explicit confirmation. Issue and resend require your stable idempotency key.");
+    this.name = "WorkspaceInvitationInputError";
+  }
+}
+var invitationFailures = {
+  INVALID_REQUEST: [400, "Invitation parameters were refused."],
+  ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+  INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required."],
+  WORKSPACE_ADMIN_REQUIRED: [403, "A current workspace owner or admin is required."],
+  INVITATION_FORBIDDEN: [403, "Your current role cannot manage this invitation."],
+  INVITATION_UNAVAILABLE: [404, "Invitation is unavailable for this account."],
+  INVITATION_CHANGED: [409, "Invitation changed. Read its current generation before another action."],
+  INVITATION_EXISTS: [409, "A pending invitation already exists. Read current invitations."],
+  ALREADY_MEMBER: [409, "An active membership already exists. An invitation cannot change its role."],
+  IDEMPOTENCY_CONFLICT: [409, "This request key was used for different invitation parameters. Reconcile the original request."],
+  INVITATION_LIMIT: [429, "Invitation limit reached. Wait before issuing or resending."],
+  INVITATION_BUSY: [503, "Invitation is busy. Read its state before another action."],
+  INVITATION_DELIVERY_UNAVAILABLE: [503, "Invitation email delivery is unavailable."]
+};
+
+class RemoteWorkspaceInvitationError extends Error {
+  code;
+  status;
+  constructor(code) {
+    super(invitationFailures[code][1]);
+    this.code = code;
+    this.name = "RemoteWorkspaceInvitationError";
+    this.status = invitationFailures[code][0];
+  }
+}
+
+class RemoteWorkspaceInvitationUnconfirmedError extends Error {
+  code = "INVITATION_UNCONFIRMED";
+  constructor() {
+    super("The invitation outcome is unconfirmed. Read current invitations or memberships. Reconcile issue/resend only with the same request key, parameters, server and membership; never generate a new key or retry automatically. Saved credentials are unchanged.");
+    this.name = "RemoteWorkspaceInvitationUnconfirmedError";
+  }
+}
+
+class RemoteWorkspaceInvitationReadError extends Error {
+  code = "INVITATION_READ_FAILED";
+  constructor() {
+    super("Unable to read a valid invitation result. Check the selected server, account, current membership and permissions.");
+    this.name = "RemoteWorkspaceInvitationReadError";
+  }
+}
+function invitationFailure(value, status) {
+  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(invitationFailures, value.code))
+    return null;
+  const code = value.code;
+  return invitationFailures[code][0] === status ? code : null;
+}
 var record = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
 var uuid = (v2) => typeof v2 === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v2);
-var text = (v2, max = 1024) => typeof v2 === "string" && !!v2.trim() && v2.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v2);
 var role = (v2) => typeof v2 === "string" && ["owner", "admin", "member", "viewer"].includes(v2);
+var email = (v2) => typeof v2 === "string" && v2.length <= 254 && !/[\p{Cc}\p{Cs}\u2028\u2029\s]/u.test(v2) && /^[^@]+@[^@]+\.[^@]+$/.test(v2);
+var timestamp = (v2) => typeof v2 === "string" && v2.length <= 40 && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d{1,6})?(?:Z|[+-]\d\d:\d\d)$/.test(v2) && Number.isFinite(Date.parse(v2));
+var inputFailure = () => {
+  throw new WorkspaceInvitationInputError;
+};
+function invitationInput(action, input) {
+  if (!record(input))
+    return inputFailure();
+  const keys = {
+    list: ["after"],
+    get: ["invitationId"],
+    issue: ["email", "role", "idempotencyKey", "confirm"],
+    resend: ["invitationId", "expectedGeneration", "idempotencyKey", "confirm"],
+    revoke: ["invitationId", "expectedGeneration", "confirm"],
+    accept: ["invitationId", "token", "confirm"]
+  };
+  if (Object.keys(input).some((key) => !keys[action].includes(key)) || action !== "list" && keys[action].some((key) => !Object.hasOwn(input, key)))
+    return inputFailure();
+  const value = { ...input };
+  if (action === "list") {
+    if (value.after !== undefined && !uuid(value.after))
+      return inputFailure();
+  }
+  if (["get", "resend", "revoke", "accept"].includes(action) && !uuid(value.invitationId))
+    return inputFailure();
+  if (!["list", "get"].includes(action) && value.confirm !== true)
+    return inputFailure();
+  if (["issue", "resend"].includes(action) && !uuid(value.idempotencyKey))
+    return inputFailure();
+  if (action === "issue") {
+    if (typeof value.email !== "string")
+      return inputFailure();
+    value.email = value.email.trim().toLowerCase();
+    if (!email(value.email) || !role(value.role))
+      return inputFailure();
+  }
+  if (["resend", "revoke"].includes(action) && (!Number.isInteger(value.expectedGeneration) || Number(value.expectedGeneration) < 1 || Number(value.expectedGeneration) > 10))
+    return inputFailure();
+  if (action === "accept" && (typeof value.token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value.token)))
+    return inputFailure();
+  return value;
+}
+function invitationRequest(action, input) {
+  const base = "/api/v1/workspace/invitations", value = input;
+  const { confirm: _confirm, invitationId: id, ...body } = value;
+  if (action === "list")
+    return { path: base + (value.after ? `?after=${value.after}` : ""), method: "GET" };
+  if (action === "get")
+    return { path: `${base}/${id}`, method: "GET" };
+  if (action === "accept")
+    return { path: "/api/v1/account/invitations/accept", method: "POST", body: JSON.stringify({ invitationId: id, token: value.token }) };
+  return { path: action === "issue" ? base : `${base}/${id}${action === "resend" ? "/resend" : ""}`, method: action === "revoke" ? "DELETE" : "POST", body: JSON.stringify(body) };
+}
+function invalid() {
+  throw new RemoteWorkspaceInvitationReadError;
+}
+function projection(v2, organizationId) {
+  if (!record(v2) || !uuid(v2.id) || v2.organizationId !== organizationId || !email(v2.email) || v2.email !== v2.email.trim().toLowerCase() || !role(v2.role) || !Number.isInteger(v2.generation) || Number(v2.generation) < 1 || Number(v2.generation) > 10 || typeof v2.status !== "string" || !["pending", "expired", "accepted", "revoked"].includes(v2.status) || !timestamp(v2.expiresAt) || !timestamp(v2.createdAt) || !record(v2.delivery) || typeof v2.delivery.state !== "string" || !["queued", "sending", "uncertain", "provider_accepted", "failed", "cancelled"].includes(v2.delivery.state) || !Number.isInteger(v2.delivery.attempts) || Number(v2.delivery.attempts) < 0 || Number(v2.delivery.attempts) > 5)
+    return invalid();
+  return {
+    id: v2.id,
+    organizationId,
+    email: v2.email,
+    role: v2.role,
+    generation: Number(v2.generation),
+    status: v2.status,
+    expiresAt: v2.expiresAt,
+    createdAt: v2.createdAt,
+    delivery: { state: v2.delivery.state, attempts: Number(v2.delivery.attempts) }
+  };
+}
+function parseInvitationResult(action, value, input, organizationId) {
+  if (!record(value))
+    return invalid();
+  const request = input;
+  if (action === "accept") {
+    if (!uuid(value.organizationId) || !uuid(value.membershipId) || value.accepted !== true || typeof value.changed !== "boolean")
+      return invalid();
+    return { organizationId: value.organizationId, membershipId: value.membershipId, accepted: true, changed: value.changed };
+  }
+  if (action === "list") {
+    if (value.organizationId !== organizationId || !Array.isArray(value.invitations) || value.invitations.length > 50 || value.nextCursor !== null && !uuid(value.nextCursor))
+      return invalid();
+    const invitations = value.invitations.map((v2) => projection(v2, organizationId));
+    if (invitations.some((v2, n2) => v2.id <= String(n2 ? invitations[n2 - 1].id : request.after ?? "")) || value.nextCursor !== null && (invitations.length !== 50 || value.nextCursor !== invitations.at(-1)?.id))
+      return invalid();
+    return { organizationId, invitations, nextCursor: value.nextCursor };
+  }
+  const invitation = projection(value.invitation, organizationId);
+  if (action !== "issue" && invitation.id !== request.invitationId)
+    return invalid();
+  if (action === "get")
+    return { invitation };
+  if (typeof value.changed !== "boolean")
+    return invalid();
+  if (action === "issue" && (invitation.email !== request.email || invitation.role !== request.role || value.changed && invitation.generation !== 1))
+    return invalid();
+  if (action === "resend" && (value.changed ? invitation.generation !== Number(request.expectedGeneration) + 1 : invitation.generation <= Number(request.expectedGeneration)))
+    return invalid();
+  if (action === "revoke" && (invitation.status !== "revoked" || invitation.generation < Number(request.expectedGeneration) || value.changed && invitation.generation !== request.expectedGeneration))
+    return invalid();
+  return { invitation, changed: value.changed };
+}
+
+// src/lib/remote-workspace-selection.ts
+var record2 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
+var uuid2 = (v2) => typeof v2 === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v2);
+var text = (v2, max = 1024) => typeof v2 === "string" && !!v2.trim() && v2.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v2);
+var role2 = (v2) => typeof v2 === "string" && ["owner", "admin", "member", "viewer"].includes(v2);
 var invalidWorkspaceResult = "The server returned an invalid workspace selection result.";
 
 class WorkspaceContextInputError extends Error {
@@ -52185,48 +52840,48 @@ class WorkspaceIdentityMismatchError extends Error {
   }
 }
 function workspaceExpectedUserId(value) {
-  if (!uuid(value))
+  if (!uuid2(value))
     throw new WorkspaceContextInputError;
   return value;
 }
 function workspaceContext(value) {
-  if (!record(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid(value.userId) || !uuid(value.membershipId))
+  if (!record2(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid2(value.userId) || !uuid2(value.membershipId))
     throw new WorkspaceContextInputError;
   return { userId: value.userId, membershipId: value.membershipId };
 }
-function invalid() {
+function invalid2() {
   throw new Error(invalidWorkspaceResult);
 }
 function organization(v2) {
-  if (!record(v2) || !uuid(v2.id) || !text(v2.slug) || !text(v2.name))
-    return invalid();
+  if (!record2(v2) || !uuid2(v2.id) || !text(v2.slug) || !text(v2.name))
+    return invalid2();
   return { id: v2.id, slug: v2.slug, name: v2.name };
 }
 function parseAccountWorkspaces(value) {
-  if (!record(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
-    return invalid();
+  if (!record2(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
+    return invalid2();
   const workspaces = value.workspaces.map((v2) => {
-    if (!record(v2) || !uuid(v2.membershipId) || !role(v2.role) || typeof v2.current !== "boolean")
-      return invalid();
+    if (!record2(v2) || !uuid2(v2.membershipId) || !role2(v2.role) || typeof v2.current !== "boolean")
+      return invalid2();
     return { membershipId: v2.membershipId, organization: organization(v2.organization), role: v2.role, current: v2.current };
   });
   if (workspaces.filter((w2) => w2.current).length !== 1 || new Set(workspaces.map((w2) => w2.membershipId)).size !== workspaces.length || new Set(workspaces.map((w2) => w2.organization.id)).size !== workspaces.length)
-    return invalid();
+    return invalid2();
   return { workspaces };
 }
 function parseWorkspaceIdentity(value, expectedUserId) {
-  if (!record(value))
-    return invalid();
+  if (!record2(value))
+    return invalid2();
   const user = value.user;
-  if (!record(user) || !uuid(user.id) || !uuid(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role(user.role))
-    return invalid();
+  if (!record2(user) || !uuid2(user.id) || !uuid2(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role2(user.role))
+    return invalid2();
   if (user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
   return { user: { id: user.id, membershipId: user.membershipId, email: user.email, displayName: user.displayName, role: user.role }, organization: organization(value.organization) };
 }
 function sessionToken(value) {
   if (typeof value !== "string" || !value || value.length > 8192 || /[^\x21-\x7e]/.test(value) || value.startsWith("sk_"))
-    return invalid();
+    return invalid2();
   return value;
 }
 function parseWorkspaceSession(value, expected) {
@@ -52236,9 +52891,9 @@ function parseWorkspaceSession(value, expected) {
   return { token: sessionToken(value.token), ...identity };
 }
 function parseWorkspaceLogin(value, expectedUserId) {
-  const user = record(value) && value.user;
-  if (!record(value) || !record(user) || !uuid(user.id))
-    return invalid();
+  const user = record2(value) && value.user;
+  if (!record2(value) || !record2(user) || !uuid2(user.id))
+    return invalid2();
   if (expectedUserId !== undefined && user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
   return { token: sessionToken(value.token), userId: user.id };
@@ -52252,18 +52907,18 @@ var workspaceSelectionFailures = {
   WORKSPACE_BUSY: [503, "Workspace is busy. Refresh before retrying."]
 };
 function workspaceSelectionFailure(value, status) {
-  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
+  if (!record2(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
     return null;
   const code = value.code;
   return workspaceSelectionFailures[code][0] === status ? code : null;
 }
 
 // src/lib/remote-workspace.ts
-var record2 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+var record3 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
 var cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value);
-var uuid2 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value);
+var uuid3 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value);
 function workspaceMembersQuery(options = {}) {
-  if (!record2(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+  if (!record3(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
     throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
   const query = new URLSearchParams;
   if (options.limit !== undefined)
@@ -52272,14 +52927,14 @@ function workspaceMembersQuery(options = {}) {
     query.set("cursor", options.cursor);
   return query.size ? `?${query}` : "";
 }
-function timestamp(value) {
+function timestamp2(value) {
   if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}Z$/.test(value))
     return false;
   const time = Date.parse(value);
   return Number.isFinite(time) && new Date(time).toISOString().slice(0, 23) === value.slice(0, 23);
 }
 function parseMember(row, fail) {
-  if (!record2(row) || !uuid2(row.membershipId) || !uuid2(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp(row.createdAt))
+  if (!record3(row) || !uuid3(row.membershipId) || !uuid3(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp2(row.createdAt))
     return fail();
   return {
     membershipId: row.membershipId,
@@ -52299,12 +52954,12 @@ class WorkspaceMemberInputError extends Error {
   }
 }
 function mutationInput(membershipId, input, roleChange) {
-  if (typeof membershipId !== "string" || !uuid2(membershipId) || membershipId !== membershipId.toLowerCase() || !record2(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+  if (typeof membershipId !== "string" || !uuid3(membershipId) || membershipId !== membershipId.toLowerCase() || !record3(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
     throw new WorkspaceMemberInputError;
-  const expectedRole = input.expectedRole, role2 = roleChange ? input.role : undefined;
-  if (!isRole(expectedRole) || roleChange && !isRole(role2))
+  const expectedRole = input.expectedRole, role3 = roleChange ? input.role : undefined;
+  if (!isRole(expectedRole) || roleChange && !isRole(role3))
     throw new WorkspaceMemberInputError;
-  return { membershipId, role: role2, expectedRole };
+  return { membershipId, role: role3, expectedRole };
 }
 function workspaceMemberRoleInput(membershipId, input) {
   const value = mutationInput(membershipId, input, true);
@@ -52315,19 +52970,19 @@ function workspaceMemberRemovalInput(membershipId, input) {
   return { membershipId: value.membershipId, body: { expectedRole: value.expectedRole } };
 }
 var invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.";
-function parseWorkspaceMemberRoleResult(value, membershipId, role2) {
+function parseWorkspaceMemberRoleResult(value, membershipId, role3) {
   const fail = () => {
     throw new Error(invalidMemberResult);
   };
-  if (!record2(value) || !uuid2(value.organizationId) || typeof value.changed !== "boolean")
+  if (!record3(value) || !uuid3(value.organizationId) || typeof value.changed !== "boolean")
     return fail();
   const member = parseMember(value.member, fail);
-  if (member.membershipId !== membershipId || member.role !== role2)
+  if (member.membershipId !== membershipId || member.role !== role3)
     return fail();
   return { organizationId: value.organizationId, member, changed: value.changed };
 }
 function parseWorkspaceMemberRemovalResult(value, membershipId) {
-  if (!record2(value) || !uuid2(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+  if (!record3(value) || !uuid3(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
     throw new Error(invalidMemberResult);
   return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
 }
@@ -52344,7 +52999,7 @@ var workspaceMemberFailures = {
   MEMBERSHIP_BUSY: [503, "Membership is busy. Refresh the roster before another action."]
 };
 function workspaceMemberFailure(value, status) {
-  if (!record2(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+  if (!record3(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
     return null;
   const code = value.code;
   return workspaceMemberFailures[code][0] === status ? code : null;
@@ -52353,7 +53008,7 @@ function parseWorkspaceMembersPage(value) {
   const fail = () => {
     throw new Error("The server returned an invalid workspace roster.");
   };
-  if (!record2(value) || !uuid2(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+  if (!record3(value) || !uuid3(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
     return fail();
   const members = value.members.map((row) => parseMember(row, fail));
   if (new Set(members.map((row) => row.membershipId)).size !== members.length)
@@ -52590,6 +53245,69 @@ function parseUpdatedWorkspace(value) {
   return { organization: { id: organization2.id, slug: organization2.slug, name: organization2.name } };
 }
 
+// src/lib/remote-quote-errors.ts
+var quoteUnavailableMessages = Object.freeze({
+  HOSTED_PROVIDER_UNAVAILABLE: "Hosted execution is temporarily unavailable on this Skills instance.",
+  HOSTED_CONNECTORS_UNAVAILABLE: "Hosted connector execution is unavailable on this Skills instance.",
+  SKILL_IMPLEMENTATION_UNAVAILABLE: "This skill has no hosted execution implementation.",
+  HOSTED_PRICING_UNAVAILABLE: "Hosted execution is unavailable while this skill's pricing is reviewed.",
+  RUNTIME_ALLOWLIST_REQUIRED: "Hosted execution is unavailable until this Skills instance enables its skill catalog.",
+  RUNTIME_SKILL_NOT_ALLOWED: "This skill is not enabled for hosted execution on this Skills instance."
+});
+async function readQuoteUnavailableCode(response) {
+  const maximum = 16 * 1024;
+  const length = response.headers.get("content-length");
+  if (response.status !== 503 || response.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > maximum)) {
+    response.body?.cancel().catch(() => {});
+    return null;
+  }
+  const reader = response.body?.getReader();
+  if (!reader)
+    return null;
+  let timer;
+  let deadlineExceeded = false;
+  const expired = Symbol("quote body deadline");
+  const deadline = new Promise((resolve4) => {
+    timer = setTimeout(() => {
+      deadlineExceeded = true;
+      resolve4(expired);
+      reader.cancel().catch(() => {});
+    }, 1500);
+  });
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const next = await Promise.race([reader.read(), deadline]);
+      if (next === expired || deadlineExceeded)
+        return null;
+      if (next.done)
+        break;
+      size += next.value.byteLength;
+      if (size > maximum)
+        return null;
+      chunks.push(next.value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      return null;
+    const code = value.code;
+    return typeof code === "string" && Object.hasOwn(quoteUnavailableMessages, code) ? code : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+    reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+}
+
 // src/lib/remote-client.ts
 class RemoteRouteUnsupportedError extends Error {
   path;
@@ -52615,6 +53333,18 @@ class RemoteRequestError extends Error {
   }
 }
 
+class RemoteQuoteUnavailableError extends RemoteRequestError {
+  code;
+  constructor(path, code) {
+    super(path, 503);
+    this.code = code;
+    if (!Object.hasOwn(quoteUnavailableMessages, code))
+      throw new Error("Unknown quote refusal code");
+    this.name = "RemoteQuoteUnavailableError";
+    this.message = quoteUnavailableMessages[code];
+  }
+}
+
 class RemoteWorkspaceMemberError extends RemoteRequestError {
   code;
   constructor(path, code) {
@@ -52676,6 +53406,11 @@ class RemoteSkillsClient {
       throw new RemoteRouteUnsupportedError(routePath, response.status, this.apiUrl);
     }
     if (!response.ok) {
+      if (opts.quoteRefusal && options?.method === "POST" && /^\/api\/v1\/skills\/[^/?#]+\/quote$/.test(routePath) && response.status === 503) {
+        const code = await readQuoteUnavailableCode(response);
+        if (code)
+          throw new RemoteQuoteUnavailableError(routePath, code);
+      }
       if (path === "/api/v1/billing/checkout" && options?.method === "POST" && response.status === 503 && await responseBodyCarriesCode(response, ["SUBSCRIPTION_CHECKOUT_UNAVAILABLE"])) {
         throw new RemoteCapabilityUnavailableError;
       }
@@ -52733,7 +53468,7 @@ class RemoteSkillsClient {
     const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/quote`, {
       method: "POST",
       body: JSON.stringify({ input, args })
-    });
+    }, { quoteRefusal: true });
     return parseRemoteRunQuote(await response.json());
   }
   getCapabilities() {
@@ -52898,6 +53633,53 @@ class RemoteSkillsClient {
     }
     return parseWorkspaceLeaveResult(body, captured.context.membershipId, identity.organization.id);
   }
+  listWorkspaceInvitations(context, options = {}) {
+    return this.requestWorkspaceInvitation(context, "list", options);
+  }
+  getWorkspaceInvitation(context, invitationId) {
+    return this.requestWorkspaceInvitation(context, "get", { invitationId });
+  }
+  issueWorkspaceInvitation(context, input) {
+    return this.requestWorkspaceInvitation(context, "issue", input);
+  }
+  resendWorkspaceInvitation(context, invitationId, input) {
+    return this.requestWorkspaceInvitation(context, "resend", { ...input, invitationId });
+  }
+  revokeWorkspaceInvitation(context, invitationId, input) {
+    return this.requestWorkspaceInvitation(context, "revoke", { ...input, invitationId });
+  }
+  acceptWorkspaceInvitation(context, invitationId, input) {
+    return this.requestWorkspaceInvitation(context, "accept", { ...input, invitationId });
+  }
+  async requestWorkspaceInvitation(context, action, input) {
+    const target = workspaceContext(context), captured = invitationInput(action, input);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const identityValue = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!identityValue || typeof identityValue !== "object" || identityValue.authMethod !== "jwt")
+      throw new RemoteWorkspaceInvitationError("INTERACTIVE_SESSION_REQUIRED");
+    const identity = parseWorkspaceIdentity(identityValue, target.userId);
+    if (identity.user.membershipId !== target.membershipId)
+      throw new WorkspaceIdentityMismatchError;
+    const request = invitationRequest(action, captured), read = action === "list" || action === "get";
+    let response, value;
+    try {
+      response = await connection.request(request.path, { method: request.method, ...request.body ? { body: request.body } : {}, credentials: "omit" });
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 64 * 1024 : 4096)));
+    } catch {
+      throw read ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+    }
+    if (!response.ok) {
+      const code = invitationFailure(value, response.status);
+      if (code)
+        throw new RemoteWorkspaceInvitationError(code);
+      throw read ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+    }
+    try {
+      return parseInvitationResult(action, value, captured, identity.organization.id);
+    } catch {
+      throw read ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+    }
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -53148,13 +53930,13 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record3, field) {
-  if (record3[field] === undefined)
+function requireOptionalString(record4, field) {
+  if (record4[field] === undefined)
     return;
-  if (typeof record3[field] !== "string") {
+  if (typeof record4[field] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field} must be a string when present)`);
   }
-  return record3[field];
+  return record4[field];
 }
 var INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 function isVersionRecord(value) {
@@ -53177,19 +53959,19 @@ function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record3 = entry;
-  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  const record4 = entry;
+  const slug = typeof record4.slug === "string" && record4.slug.trim() ? record4.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record3.metadata !== undefined) {
-    if (!record3.metadata || typeof record3.metadata !== "object" || Array.isArray(record3.metadata)) {
+  if (record4.metadata !== undefined) {
+    if (!record4.metadata || typeof record4.metadata !== "object" || Array.isArray(record4.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record3.metadata;
+    metadata = record4.metadata;
   }
-  const pinnedAt = requireOptionalString(record3, "pinnedAt");
+  const pinnedAt = requireOptionalString(record4, "pinnedAt");
   return {
     slug,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -53206,16 +53988,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record3 = entry;
-  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  const record4 = entry;
+  const slug = typeof record4.slug === "string" && record4.slug.trim() ? record4.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug,
-    ...requireOptionalString(record3, "name") !== undefined ? { name: requireOptionalString(record3, "name") } : {},
-    ...requireOptionalString(record3, "version") !== undefined ? { version: requireOptionalString(record3, "version") } : {},
-    ...requireOptionalString(record3, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record3, "updatedAt") } : {}
+    ...requireOptionalString(record4, "name") !== undefined ? { name: requireOptionalString(record4, "name") } : {},
+    ...requireOptionalString(record4, "version") !== undefined ? { version: requireOptionalString(record4, "version") } : {},
+    ...requireOptionalString(record4, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record4, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -53268,12 +54050,12 @@ function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record3 = payload;
-  if (!Array.isArray(record3.skills)) {
+  const record4 = payload;
+  if (!Array.isArray(record4.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record3.skills.map(normalizeSkillSummary);
-  const nextCursor = record3.nextCursor === undefined || record3.nextCursor === null ? null : record3.nextCursor;
+  const skills = record4.skills.map(normalizeSkillSummary);
+  const nextCursor = record4.nextCursor === undefined || record4.nextCursor === null ? null : record4.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -53283,6 +54065,101 @@ async function createRemoteSkillsClient(env = process.env) {
   const connection = await resolveSkillsConnection(env);
   return connection ? new RemoteSkillsClient(connection.apiKey, connection.apiOrigin) : null;
 }
+// src/lib/remote-invitation-recovery.ts
+class InvitationEmailInputError extends Error {
+  code = "INVITATION_EMAIL_INPUT_INVALID";
+  constructor() {
+    super("Use an explicit Skills API URL, exact invitation and retained challenge IDs, secret input, and deliberate confirmation.");
+    this.name = "InvitationEmailInputError";
+  }
+}
+var refusals = {
+  INVALID_REQUEST: [400, "Invitation recovery parameters were refused."],
+  ORIGIN_REQUIRED: [403, "Invitation recovery requires the configured site origin."],
+  INVITATION_PROOF_UNAVAILABLE: [401, "Invitation proof is unavailable. Sign in or explicitly request another recovery code."],
+  RATE_LIMITED: [429, "Invitation verification is rate limited. Wait before another deliberate action."],
+  INVITATION_BUSY: [503, "Invitation is busy. Sign in to check membership before another deliberate action."],
+  INVITATION_DELIVERY_UNAVAILABLE: [503, "Invitation recovery is unavailable on this service."]
+};
+
+class RemoteInvitationEmailError extends Error {
+  code;
+  status;
+  constructor(code) {
+    super(refusals[code][1]);
+    this.code = code;
+    this.name = "RemoteInvitationEmailError";
+    this.status = refusals[code][0];
+  }
+}
+
+class RemoteInvitationEmailUnconfirmedError extends Error {
+  action;
+  code = "INVITATION_EMAIL_UNCONFIRMED";
+  constructor(action) {
+    super(action === "challenge" ? "The recovery challenge outcome is unconfirmed. Retain the same invitation, challenge ID and server. Check your inbox; never rotate the challenge or retry automatically. No delivery is confirmed." : "Invitation acceptance is unconfirmed. Use fresh ordinary sign-in to inspect available memberships. Do not retry acceptance automatically; explicitly request another recovery code only if needed. Saved credentials are unchanged.");
+    this.action = action;
+    this.name = "RemoteInvitationEmailUnconfirmedError";
+  }
+}
+var record4 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
+var uuid4 = (v2) => typeof v2 === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v2);
+function invitationEmailIds(invitationId, challengeId) {
+  if (!uuid4(invitationId) || !uuid4(challengeId))
+    throw new InvitationEmailInputError;
+  return { invitationId, challengeId };
+}
+function invitationEmailInput(action, input) {
+  const keys = ["invitationId", "token", "challengeId", "confirm", ...action === "accept" ? ["code"] : []];
+  if (!record4(input) || Object.keys(input).length !== keys.length || keys.some((key) => !Object.hasOwn(input, key)))
+    throw new InvitationEmailInputError;
+  const value = { ...input };
+  const ids = invitationEmailIds(value.invitationId, value.challengeId);
+  if (value.confirm !== true || typeof value.token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value.token) || action === "accept" && (typeof value.code !== "string" || !/^\d{6}$/.test(value.code)))
+    throw new InvitationEmailInputError;
+  return { ...ids, token: value.token, confirm: true, ...action === "accept" ? { code: value.code } : {} };
+}
+async function requestInvitationEmail(origin, action, input) {
+  const value = invitationEmailInput(action, input);
+  let target;
+  try {
+    target = normalizeSkillsApiOrigin(origin);
+  } catch {
+    throw new InvitationEmailInputError;
+  }
+  const body = JSON.stringify({ invitationId: value.invitationId, token: value.token, challengeId: value.challengeId, ...action === "accept" ? { code: value.code } : {} });
+  try {
+    const response = await fetch(`${target}/api/v1/account/invitations/email-${action}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body,
+      credentials: "omit",
+      redirect: "error",
+      cache: "no-store",
+      referrerPolicy: "no-referrer",
+      signal: AbortSignal.timeout(15000)
+    });
+    const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 4096)));
+    if (!response.ok && record4(parsed) && typeof parsed.code === "string" && Object.hasOwn(refusals, parsed.code)) {
+      const code = parsed.code;
+      if (response.status === refusals[code][0])
+        throw new RemoteInvitationEmailError(code);
+    }
+    if (!record4(parsed))
+      throw new RemoteInvitationEmailUnconfirmedError(action);
+    if (action === "challenge" && response.status === 202 && parsed.challengeId === value.challengeId && parsed.expiresIn === 600 && typeof parsed.message === "string" && parsed.message.length <= 256) {
+      return { challengeId: value.challengeId, message: "If this invitation is eligible, a verification code will arrive. Delivery is not confirmed.", expiresIn: 600 };
+    }
+    if (action === "accept" && response.status === 200 && uuid4(parsed.organizationId) && uuid4(parsed.membershipId) && parsed.accepted === true && parsed.changed === true && parsed.signInRequired === true) {
+      return { organizationId: parsed.organizationId, membershipId: parsed.membershipId, accepted: true, changed: true, signInRequired: true };
+    }
+  } catch (error) {
+    if (error instanceof RemoteInvitationEmailError)
+      throw error;
+  }
+  throw new RemoteInvitationEmailUnconfirmedError(action);
+}
+
 // src/lib/remote-auth.ts
 var MAX_ERROR_DETAIL_LENGTH = 200;
 
@@ -53323,10 +54200,10 @@ async function requestAuthApi(instance, path, options) {
   const text2 = await res.text();
   const body = text2 ? parseJsonBody(text2) : {};
   if (!res.ok) {
-    const record3 = isRecord6(body) ? body : {};
-    const detail = typeof record3.detail === "string" ? record3.detail : undefined;
-    const error = typeof record3.error === "string" ? record3.error : undefined;
-    const code = typeof record3.code === "string" ? record3.code : undefined;
+    const record5 = isRecord6(body) ? body : {};
+    const detail = typeof record5.detail === "string" ? record5.detail : undefined;
+    const error = typeof record5.error === "string" ? record5.error : undefined;
+    const code = typeof record5.code === "string" ? record5.code : undefined;
     throw new HostedApiError(detail || error || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -53360,11 +54237,17 @@ class RemoteSkillsAuthClient {
   constructor(apiUrl) {
     this.apiOrigin = normalizeSkillsApiOrigin(apiUrl);
   }
-  requestCode(email) {
-    return this.request("/api/auth/login", { method: "POST", body: JSON.stringify({ email }) });
+  requestInvitationEmailChallenge(input) {
+    return requestInvitationEmail(this.apiOrigin, "challenge", input);
   }
-  verifyCode(email, code) {
-    return this.request("/api/auth/verify", { method: "POST", body: JSON.stringify({ email, code }) });
+  acceptInvitationEmailChallenge(input) {
+    return requestInvitationEmail(this.apiOrigin, "accept", input);
+  }
+  requestCode(email2) {
+    return this.request("/api/auth/login", { method: "POST", body: JSON.stringify({ email: email2 }) });
+  }
+  verifyCode(email2, code) {
+    return this.request("/api/auth/verify", { method: "POST", body: JSON.stringify({ email: email2, code }) });
   }
   startDevice() {
     return this.request("/api/auth/device/start", { method: "POST", body: JSON.stringify({ client: "skills-sdk" }) });
@@ -53372,34 +54255,34 @@ class RemoteSkillsAuthClient {
   pollDevice(deviceCode) {
     return this.request("/api/auth/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) });
   }
-  async sessionClient(email, code, context) {
+  async sessionClient(email2, code, context) {
     if (context !== undefined) {
       const target = workspaceContext(context), apiOrigin2 = this.apiOrigin;
-      const session = await this.switchWorkspace(email, code, target);
+      const session = await this.switchWorkspace(email2, code, target);
       return new RemoteSkillsClient(session.token, apiOrigin2);
     }
     const apiOrigin = this.apiOrigin;
-    if (!email.includes("@") || !/^\d{6}$/.test(code))
+    if (!email2.includes("@") || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
-    const login = await this.verifyCode(email, code);
+    const login = await this.verifyCode(email2, code);
     if (!login || typeof login.token !== "string" || !login.token)
       throw new Error("The server did not return an authorized account session");
     return new RemoteSkillsClient(login.token, apiOrigin);
   }
-  async listAccountWorkspaces(email, code, expectedUserId) {
-    const login = await this.workspaceLogin(email, code, expectedUserId);
+  async listAccountWorkspaces(email2, code, expectedUserId) {
+    const login = await this.workspaceLogin(email2, code, expectedUserId);
     const result = await new RemoteSkillsClient(login.token, login.apiOrigin).listAccountWorkspaces(login.userId);
     return { userId: login.userId, ...result };
   }
-  async switchWorkspace(email, code, context) {
+  async switchWorkspace(email2, code, context) {
     const target = workspaceContext(context);
-    const login = await this.workspaceLogin(email, code, target.userId);
+    const login = await this.workspaceLogin(email2, code, target.userId);
     return new RemoteSkillsClient(login.token, login.apiOrigin).switchWorkspace(target);
   }
-  async workspaceLogin(email, code, expectedUserId) {
+  async workspaceLogin(email2, code, expectedUserId) {
     const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
     const apiOrigin = this.apiOrigin;
-    if (typeof email !== "string" || !email.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
+    if (typeof email2 !== "string" || !email2.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
     let response;
     try {
@@ -53409,7 +54292,7 @@ class RemoteSkillsAuthClient {
         credentials: "omit",
         signal: AbortSignal.timeout(15000),
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ email, code })
+        body: JSON.stringify({ email: email2, code })
       });
     } catch {
       throw new HostedApiError("Unable to verify the Skills account.");
@@ -53426,40 +54309,67 @@ class RemoteSkillsAuthClient {
     }
     return { ...parseWorkspaceLogin(value, expected), apiOrigin };
   }
-  async createApiKey(email, code, name, scopes, context) {
+  async listWorkspaceInvitations(email2, code, context, options = {}) {
+    const target = workspaceContext(context), captured = invitationInput("list", options);
+    return (await this.sessionClient(email2, code, target)).listWorkspaceInvitations(target, captured);
+  }
+  async getWorkspaceInvitation(email2, code, context, invitationId) {
+    const target = workspaceContext(context), captured = invitationInput("get", { invitationId });
+    return (await this.sessionClient(email2, code, target)).getWorkspaceInvitation(target, captured.invitationId);
+  }
+  async issueWorkspaceInvitation(email2, code, context, input) {
+    const target = workspaceContext(context), captured = invitationInput("issue", input);
+    return (await this.sessionClient(email2, code, target)).issueWorkspaceInvitation(target, captured);
+  }
+  async resendWorkspaceInvitation(email2, code, context, invitationId, input) {
+    const target = workspaceContext(context), captured = invitationInput("resend", { ...input, invitationId });
+    const { invitationId: id, ...options } = captured;
+    return (await this.sessionClient(email2, code, target)).resendWorkspaceInvitation(target, id, options);
+  }
+  async revokeWorkspaceInvitation(email2, code, context, invitationId, input) {
+    const target = workspaceContext(context), captured = invitationInput("revoke", { ...input, invitationId });
+    const { invitationId: id, ...options } = captured;
+    return (await this.sessionClient(email2, code, target)).revokeWorkspaceInvitation(target, id, options);
+  }
+  async acceptWorkspaceInvitation(email2, code, context, invitationId, input) {
+    const target = workspaceContext(context), captured = invitationInput("accept", { ...input, invitationId });
+    const { invitationId: id, ...options } = captured;
+    return (await this.sessionClient(email2, code, target)).acceptWorkspaceInvitation(target, id, options);
+  }
+  async createApiKey(email2, code, name, scopes, context) {
     const capturedScopes = scopes === undefined ? undefined : [...scopes];
-    return (await this.sessionClient(email, code, context)).createApiKey(name, capturedScopes);
+    return (await this.sessionClient(email2, code, context)).createApiKey(name, capturedScopes);
   }
-  async listApiKeys(email, code, context) {
-    return (await this.sessionClient(email, code, context)).listApiKeys();
+  async listApiKeys(email2, code, context) {
+    return (await this.sessionClient(email2, code, context)).listApiKeys();
   }
-  async revokeApiKey(email, code, keyId, context) {
-    return (await this.sessionClient(email, code, context)).revokeApiKey(keyId);
+  async revokeApiKey(email2, code, keyId, context) {
+    return (await this.sessionClient(email2, code, context)).revokeApiKey(keyId);
   }
-  async updateProfile(email, code, input, context) {
+  async updateProfile(email2, code, input, context) {
     const body = customerNamePatch(input, "displayName");
-    return (await this.sessionClient(email, code, context)).updateProfile({ displayName: body.displayName });
+    return (await this.sessionClient(email2, code, context)).updateProfile({ displayName: body.displayName });
   }
-  async updateCurrentWorkspace(email, code, input, context) {
+  async updateCurrentWorkspace(email2, code, input, context) {
     const body = customerNamePatch(input, "name");
-    return (await this.sessionClient(email, code, context)).updateCurrentWorkspace({ name: body.name });
+    return (await this.sessionClient(email2, code, context)).updateCurrentWorkspace({ name: body.name });
   }
-  async listWorkspaceMembers(email, code, options = {}, context) {
+  async listWorkspaceMembers(email2, code, options = {}, context) {
     workspaceMembersQuery(options);
     const captured = { ...options };
-    return (await this.sessionClient(email, code, context)).listWorkspaceMembers(captured);
+    return (await this.sessionClient(email2, code, context)).listWorkspaceMembers(captured);
   }
-  async setWorkspaceMemberRole(email, code, membershipId, input, context) {
+  async setWorkspaceMemberRole(email2, code, membershipId, input, context) {
     const captured = workspaceMemberRoleInput(membershipId, input);
-    return (await this.sessionClient(email, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
+    return (await this.sessionClient(email2, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
   }
-  async leaveWorkspace(email, code, context, input) {
+  async leaveWorkspace(email2, code, context, input) {
     const captured = workspaceLeaveInput(context, input);
-    return (await this.sessionClient(email, code, captured.context)).leaveWorkspace(captured.context, captured.input);
+    return (await this.sessionClient(email2, code, captured.context)).leaveWorkspace(captured.context, captured.input);
   }
-  async removeWorkspaceMember(email, code, membershipId, input, context) {
+  async removeWorkspaceMember(email2, code, membershipId, input, context) {
     const captured = workspaceMemberRemovalInput(membershipId, input);
-    return (await this.sessionClient(email, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
+    return (await this.sessionClient(email2, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
   }
   request(path, options) {
     if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
@@ -53468,126 +54378,143 @@ class RemoteSkillsAuthClient {
   }
 }
 export {
-  validateRunLifecycleEvent,
-  startedByFor,
-  startSkillsServer,
-  skillsServeLimits,
-  skillsCredentialOrReason,
-  skillsCredentialFiles,
-  skillsCredentialFilePath,
-  settleRun,
-  selectsSkillsLocalMode,
-  runTerminalSchema,
-  runProtocolSchema,
-  runPointersOf,
-  runLeaseSchema,
-  runAdmissionSchema,
-  resolveSkillsFleet,
-  resolveSkillsApiOrigin,
-  resolveServerConfig,
-  resolveImageProfile,
-  resolveDatabaseTarget,
-  reservationId,
-  requireSkillsFleet,
-  requireSkillsApiOrigin,
-  requestDigestFor,
-  registerRoutes,
-  redactRunOutput,
-  receiptId,
-  protocolStateOf,
-  noticeLocalSkillsMode,
-  normalizeSkillsApiOrigin,
-  normalizeRemoteSkillRunContract,
-  newRunId,
-  localRunExecutor,
-  listServerSkills,
-  leaseGenerationOf,
-  isValidSkillSlug,
-  isTerminalStatus,
-  isSkillsLocalOptIn,
-  isActiveStatus,
-  getServerSkillMd,
-  getServerSkill,
-  expiresAtFor,
-  expireArtifacts,
-  executeRun,
-  digestInput,
-  dependencyLayerRule,
-  currentVersionService,
-  createSubmitRunService,
-  createStore,
-  createSpendService,
-  createSkillsFetchHandler,
-  createServer,
-  createRunStateMachine,
-  createRunService,
-  createRunEventEmitter,
-  createRemoteSkillsClient,
-  createReceiptService,
-  createOfflineGate,
-  createImageProfileRegistry,
-  createGovernedArtifactWriter,
-  createGovernanceStore,
-  createCancelService,
-  createAwsEcsClient,
-  configuredSkillsApiUrl,
-  clientTokenFor,
-  canonicalSystemDepsKey,
-  canonicalJson,
-  bundledRegistry,
-  buildRunLifecycleEvent,
-  attemptIdOf,
-  assertDurableTarget,
-  assertDurableStore,
-  artifactStorageSeam,
-  WorkspaceLeaveInputError,
-  WorkspaceIdentityMismatchError,
-  WorkspaceContextInputError,
-  SqliteSkillsStore,
-  SqliteRunExecutionStore,
-  SqliteGovernanceStore,
-  SkillsFleetCredentialError,
-  SKILLS_LOCAL_OPT_IN_ENV_KEYS,
-  SKILLS_APP,
-  SKILLS_API_URL_ENV,
-  SKILLS_API_KEY_ENV,
-  RemoteWorkspaceSelectionError,
-  RemoteWorkspaceMemberError,
-  RemoteWorkspaceLeaveUnconfirmedError,
-  RemoteWorkspaceLeaveError,
-  RemoteSkillsClient,
-  RemoteSkillsAuthClient,
-  RemoteRouteUnsupportedError,
-  RemoteRequestError,
-  RemoteCreditApprovalError,
-  RemoteCapabilityUnavailableError,
-  RUN_PROTOCOL_VERSION,
-  RUN_PROTOCOL_STATES,
-  RUN_LIFECYCLE_EVENT_TYPES,
-  RUN_LIFECYCLE_EVENT_FIELDS,
-  REMOTE_SKILL_RUN_CONTRACT_VERSION,
-  PostgresSkillsStore,
-  PostgresGovernanceStore,
-  MissingSkillsFleetError,
-  MemorySkillsStore,
-  MemoryRunExecutionStore,
-  MemoryGovernanceStore,
-  LEGAL_TRANSITIONS,
-  ImageProfileResolutionError,
-  HostedApiError,
-  GovernanceError,
-  GOVERNANCE_ERROR_CODES,
-  EcsDispatcher,
-  EXECUTION_PROTOCOL_VERSION,
-  E2bDispatcher,
-  E2B_LANE_STATUS,
-  DispatcherNotImplementedError,
-  DEFAULT_SPEND_CEILINGS,
-  DEFAULT_RUN_QUOTA,
-  DEFAULT_RUN_POLICY,
-  DEFAULT_RUN_LIMITS,
-  DEFAULT_OUTPUT_GOVERNANCE,
-  DEFAULT_IMAGE_PROFILES,
+  ArtifactStorage,
   CLIENT_TOKEN_BYTES,
-  ArtifactStorage
+  CONTENT_HASH_LIMITS,
+  ContentHashInputError,
+  DEFAULT_IMAGE_PROFILES,
+  DEFAULT_OUTPUT_GOVERNANCE,
+  DEFAULT_RUN_LIMITS,
+  DEFAULT_RUN_POLICY,
+  DEFAULT_RUN_QUOTA,
+  DEFAULT_SPEND_CEILINGS,
+  DispatcherNotImplementedError,
+  E2B_LANE_STATUS,
+  E2bDispatcher,
+  EXECUTION_PROTOCOL_VERSION,
+  EcsDispatcher,
+  GOVERNANCE_ERROR_CODES,
+  GovernanceError,
+  HostedApiError,
+  ImageProfileResolutionError,
+  InvitationEmailInputError,
+  LEGAL_TRANSITIONS,
+  MemoryGovernanceStore,
+  MemoryRunExecutionStore,
+  MemorySkillsStore,
+  MissingSkillsFleetError,
+  PostgresGovernanceStore,
+  PostgresSkillsStore,
+  REMOTE_SKILL_RUN_CONTRACT_VERSION,
+  RUN_LIFECYCLE_EVENT_FIELDS,
+  RUN_LIFECYCLE_EVENT_TYPES,
+  RUN_PROTOCOL_STATES,
+  RUN_PROTOCOL_VERSION,
+  RemoteCapabilityUnavailableError,
+  RemoteCreditApprovalError,
+  RemoteInvitationEmailError,
+  RemoteInvitationEmailUnconfirmedError,
+  RemoteQuoteUnavailableError,
+  RemoteRequestError,
+  RemoteRouteUnsupportedError,
+  RemoteSkillsAuthClient,
+  RemoteSkillsClient,
+  RemoteWorkspaceInvitationError,
+  RemoteWorkspaceInvitationReadError,
+  RemoteWorkspaceInvitationUnconfirmedError,
+  RemoteWorkspaceLeaveError,
+  RemoteWorkspaceLeaveUnconfirmedError,
+  RemoteWorkspaceMemberError,
+  RemoteWorkspaceSelectionError,
+  SKILLS_API_KEY_ENV,
+  SKILLS_API_URL_ENV,
+  SKILLS_APP,
+  SKILLS_LOCAL_OPT_IN_ENV_KEYS,
+  SKILL_BUNDLE_INSPECTION_LIMITS,
+  SkillBundleInspectionError,
+  SkillsFleetCredentialError,
+  SqliteGovernanceStore,
+  SqliteRunExecutionStore,
+  SqliteSkillsStore,
+  WorkspaceContextInputError,
+  WorkspaceIdentityMismatchError,
+  WorkspaceInvitationInputError,
+  WorkspaceLeaveInputError,
+  artifactStorageSeam,
+  assertDurableStore,
+  assertDurableTarget,
+  attemptIdOf,
+  buildRunLifecycleEvent,
+  bundledRegistry,
+  canonicalJson,
+  canonicalSystemDepsKey,
+  clientTokenFor,
+  computeContentHashFromEntries,
+  configuredSkillsApiUrl,
+  createAwsEcsClient,
+  createCancelService,
+  createGovernanceStore,
+  createGovernedArtifactWriter,
+  createImageProfileRegistry,
+  createOfflineGate,
+  createReceiptService,
+  createRemoteSkillsClient,
+  createRunEventEmitter,
+  createRunService,
+  createRunStateMachine,
+  createServer,
+  createSkillsFetchHandler,
+  createSpendService,
+  createStore,
+  createSubmitRunService,
+  currentVersionService,
+  dependencyLayerRule,
+  digestInput,
+  executeRun,
+  expireArtifacts,
+  expiresAtFor,
+  getServerSkill,
+  getServerSkillMd,
+  inspectSkillBundle,
+  isActiveStatus,
+  isSkillsLocalOptIn,
+  isTerminalStatus,
+  isValidSkillSlug,
+  leaseGenerationOf,
+  listServerSkills,
+  localRunExecutor,
+  newRunId,
+  normalizeRemoteSkillRunContract,
+  normalizeSkillsApiOrigin,
+  noticeLocalSkillsMode,
+  packSkillBundle,
+  protocolStateOf,
+  receiptId,
+  redactRunOutput,
+  registerRoutes,
+  requestDigestFor,
+  requireSkillsApiOrigin,
+  requireSkillsFleet,
+  reservationId,
+  resolveDatabaseTarget,
+  resolveImageProfile,
+  resolveServerConfig,
+  resolveSkillsApiOrigin,
+  resolveSkillsFleet,
+  revisionIdOf,
+  runAdmissionSchema,
+  runLeaseSchema,
+  runPointersOf,
+  runProtocolSchema,
+  runTerminalSchema,
+  selectsSkillsLocalMode,
+  settleRun,
+  skillsCredentialFilePath,
+  skillsCredentialFiles,
+  skillsCredentialOrReason,
+  skillsServeLimits,
+  startSkillsServer,
+  startedByFor,
+  validateRunLifecycleEvent,
+  verifyContentHashFromEntries
 };