@hasna/skills 0.5.4 → 0.5.5

package/bin/index.js

@@ -20,14 +20,12 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  if (mod && typeof mod === "object" || typeof mod === "function") {
-    for (let key of __getOwnPropNames(mod))
-      if (!__hasOwnProp.call(to, key))
-        __defProp(to, key, {
-          get: __accessProp.bind(mod, key),
-          enumerable: true
-        });
-  }
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -50,7 +48,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
 // ../../node_modules/.bun/react@18.3.1/node_modules/react/cjs/react.development.js
-var require_react_development = __commonJS(function(exports, module) {
+var require_react_development = __commonJS((exports, module) => {
   if (true) {
     (function() {
       if (typeof __REACT_DEVTOOLS_GLOBAL_HOOK__ !== "undefined" && typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.registerInternalModuleStart === "function") {
@@ -1853,7 +1851,7 @@ Check the top-level render call using <` + parentName + ">.";
 });
 
 // ../../node_modules/.bun/react@18.3.1/node_modules/react/index.js
-var require_react = __commonJS(function(exports, module) {
+var require_react = __commonJS((exports, module) => {
   var react_development = __toESM(require_react_development());
   if (false) {} else {
     module.exports = react_development;
@@ -1861,7 +1859,7 @@ var require_react = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/signal-exit@3.0.7/node_modules/signal-exit/signals.js
-var require_signals = __commonJS(function(exports, module) {
+var require_signals = __commonJS((exports, module) => {
   module.exports = [
     "SIGABRT",
     "SIGALRM",
@@ -1878,7 +1876,7 @@ var require_signals = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/signal-exit@3.0.7/node_modules/signal-exit/index.js
-var require_signal_exit = __commonJS(function(exports, module) {
+var require_signal_exit = __commonJS((exports, module) => {
   var process3 = global.process;
   var processOk = function(process4) {
     return process4 && typeof process4 === "object" && typeof process4.removeListener === "function" && typeof process4.emit === "function" && typeof process4.reallyExit === "function" && typeof process4.listeners === "function" && typeof process4.kill === "function" && typeof process4.pid === "number" && typeof process4.on === "function";
@@ -2031,7 +2029,7 @@ var require_signal_exit = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/scheduler@0.23.2/node_modules/scheduler/cjs/scheduler.development.js
-var require_scheduler_development = __commonJS(function(exports) {
+var require_scheduler_development = __commonJS((exports) => {
   if (true) {
     (function() {
       if (typeof __REACT_DEVTOOLS_GLOBAL_HOOK__ !== "undefined" && typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.registerInternalModuleStart === "function") {
@@ -2474,7 +2472,7 @@ var require_scheduler_development = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/scheduler@0.23.2/node_modules/scheduler/index.js
-var require_scheduler = __commonJS(function(exports, module) {
+var require_scheduler = __commonJS((exports, module) => {
   var scheduler_development = __toESM(require_scheduler_development());
   if (false) {} else {
     module.exports = scheduler_development;
@@ -2482,7 +2480,7 @@ var require_scheduler = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/react-reconciler@0.29.2+f4eacebf2041cd4f/node_modules/react-reconciler/cjs/react-reconciler.development.js
-var require_react_reconciler_development = __commonJS(function(exports, module) {
+var require_react_reconciler_development = __commonJS((exports, module) => {
   var React = __toESM(require_react());
   var Scheduler = __toESM(require_scheduler());
   if (true) {
@@ -17228,14 +17226,14 @@ Check the render method of \`` + ownerName + "`.";
 });
 
 // ../../node_modules/.bun/react-reconciler@0.29.2+f4eacebf2041cd4f/node_modules/react-reconciler/index.js
-var require_react_reconciler = __commonJS(function(exports, module) {
+var require_react_reconciler = __commonJS((exports, module) => {
   if (false) {} else {
     module.exports = require_react_reconciler_development();
   }
 });
 
 // ../../node_modules/.bun/react-reconciler@0.29.2+f4eacebf2041cd4f/node_modules/react-reconciler/cjs/react-reconciler-constants.development.js
-var require_react_reconciler_constants_development = __commonJS(function(exports) {
+var require_react_reconciler_constants_development = __commonJS((exports) => {
   if (true) {
     (function() {
       var SyncLane = 1;
@@ -17259,7 +17257,7 @@ var require_react_reconciler_constants_development = __commonJS(function(exports
 });
 
 // ../../node_modules/.bun/react-reconciler@0.29.2+f4eacebf2041cd4f/node_modules/react-reconciler/constants.js
-var require_constants = __commonJS(function(exports, module) {
+var require_constants = __commonJS((exports, module) => {
   if (false) {} else {
     module.exports = require_react_reconciler_constants_development();
   }
@@ -17319,7 +17317,7 @@ var init_devtools_window_polyfill = __esm(() => {
 });
 
 // ../../node_modules/.bun/react-devtools-core@7.0.1/node_modules/react-devtools-core/dist/backend.js
-var require_backend = __commonJS(function(exports, module) {
+var require_backend = __commonJS((exports, module) => {
   (function webpackUniversalModuleDefinition(root, factory) {
     if (typeof exports === "object" && typeof module === "object")
       module.exports = factory();
@@ -34122,7 +34120,7 @@ var init_devtools = __esm(() => {
 });
 
 // ../../node_modules/.bun/cli-boxes@3.0.0/node_modules/cli-boxes/boxes.json
-var require_boxes = __commonJS(function(exports, module) {
+var require_boxes = __commonJS((exports, module) => {
   module.exports = {
     single: {
       topLeft: "\u250C",
@@ -34208,7 +34206,7 @@ var require_boxes = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/cli-boxes@3.0.0/node_modules/cli-boxes/index.js
-var require_cli_boxes = __commonJS(function(exports, module) {
+var require_cli_boxes = __commonJS((exports, module) => {
   var cliBoxes = require_boxes();
   module.exports = cliBoxes;
   module.exports.default = cliBoxes;
@@ -34704,7 +34702,7 @@ var init_source = __esm(() => {
 });
 
 // ../../node_modules/.bun/mimic-fn@2.1.0/node_modules/mimic-fn/index.js
-var require_mimic_fn = __commonJS(function(exports, module) {
+var require_mimic_fn = __commonJS((exports, module) => {
   var mimicFn = (to, from) => {
     for (const prop of Reflect.ownKeys(from)) {
       Object.defineProperty(to, prop, Object.getOwnPropertyDescriptor(from, prop));
@@ -34716,7 +34714,7 @@ var require_mimic_fn = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/onetime@5.1.2/node_modules/onetime/index.js
-var require_onetime = __commonJS(function(exports, module) {
+var require_onetime = __commonJS((exports, module) => {
   var mimicFn = require_mimic_fn();
   var calledFunctions = new WeakMap;
   var onetime = (function_, options = {}) => {
@@ -34751,7 +34749,7 @@ var require_onetime = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/escape-string-regexp@2.0.0/node_modules/escape-string-regexp/index.js
-var require_escape_string_regexp = __commonJS(function(exports, module) {
+var require_escape_string_regexp = __commonJS((exports, module) => {
   var matchOperatorsRegex = /[|\\{}()[\]^$+*?.-]/g;
   module.exports = (string) => {
     if (typeof string !== "string") {
@@ -34762,7 +34760,7 @@ var require_escape_string_regexp = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/stack-utils@2.0.6/node_modules/stack-utils/index.js
-var require_stack_utils = __commonJS(function(exports, module) {
+var require_stack_utils = __commonJS((exports, module) => {
   var escapeStringRegexp = require_escape_string_regexp();
   var cwd = typeof process === "object" && process && typeof process.cwd === "function" ? process.cwd() : ".";
   var natives = [].concat(__require("module").builtinModules, "bootstrap_node", "node").map((n) => new RegExp(`(?:\\((?:node:)?${n}(?:\\.js)?:\\d+:\\d+\\)$|^\\s*at (?:node:)?${n}(?:\\.js)?:\\d+:\\d+$)`));
@@ -35000,7 +34998,7 @@ var require_stack_utils = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/error.js
-var require_error = __commonJS(function(exports) {
+var require_error = __commonJS((exports) => {
   class CommanderError extends Error {
     constructor(exitCode, code, message) {
       super(message);
@@ -35024,7 +35022,7 @@ var require_error = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/argument.js
-var require_argument = __commonJS(function(exports) {
+var require_argument = __commonJS((exports) => {
   var { InvalidArgumentError } = require_error();
 
   class Argument {
@@ -35103,7 +35101,7 @@ var require_argument = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/help.js
-var require_help = __commonJS(function(exports) {
+var require_help = __commonJS((exports) => {
   var { humanReadableArgName } = require_argument();
 
   class Help {
@@ -35352,7 +35350,7 @@ var require_help = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/option.js
-var require_option = __commonJS(function(exports) {
+var require_option = __commonJS((exports) => {
   var { InvalidArgumentError } = require_error();
 
   class Option {
@@ -35503,7 +35501,7 @@ var require_option = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/suggestSimilar.js
-var require_suggestSimilar = __commonJS(function(exports) {
+var require_suggestSimilar = __commonJS((exports) => {
   var maxDistance = 3;
   function editDistance(a, b) {
     if (Math.abs(a.length - b.length) > maxDistance)
@@ -35576,7 +35574,7 @@ var require_suggestSimilar = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/command.js
-var require_command = __commonJS(function(exports) {
+var require_command = __commonJS((exports) => {
   var EventEmitter3 = __require("events").EventEmitter;
   var childProcess = __require("child_process");
   var path = __require("path");
@@ -36819,7 +36817,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
 });
 
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/index.js
-var require_commander = __commonJS(function(exports) {
+var require_commander = __commonJS((exports) => {
   var { Argument } = require_argument();
   var { Command } = require_command();
   var { CommanderError, InvalidArgumentError } = require_error();
@@ -36862,7 +36860,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.5.4",
+    version: "0.5.5",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -36986,7 +36984,7 @@ var init_package = __esm(() => {
 });
 
 // ../../node_modules/.bun/react@18.3.1/node_modules/react/cjs/react-jsx-dev-runtime.development.js
-var require_react_jsx_dev_runtime_development = __commonJS(function(exports) {
+var require_react_jsx_dev_runtime_development = __commonJS((exports) => {
   var React13 = __toESM(require_react());
   if (true) {
     (function() {
@@ -37867,7 +37865,7 @@ Check the top-level render call using <` + parentName + ">.";
 });
 
 // ../../node_modules/.bun/react@18.3.1/node_modules/react/jsx-dev-runtime.js
-var require_jsx_dev_runtime = __commonJS(function(exports, module) {
+var require_jsx_dev_runtime = __commonJS((exports, module) => {
   var react_jsx_dev_runtime_development = __toESM(require_react_jsx_dev_runtime_development());
   if (false) {} else {
     module.exports = react_jsx_dev_runtime_development;
@@ -39324,6 +39322,39 @@ var init_skill_validation = __esm(() => {
   VALID_PROVENANCE_SOURCES = new Set(["official", "custom", "remote", "private", "private-hosted", "upstream", "extension"]);
   VALID_BIN_COMMAND = /^[a-z0-9][a-z0-9._-]*$/;
 });
+
+// src/lib/skill-entry-path.ts
+class SkillEntryPaths {
+  files = new Set;
+  directories = new Set;
+  add(path, maxBytes, invalid, limit) {
+    if (path.length > maxBytes)
+      limit();
+    const encoded = new TextEncoder().encode(path);
+    if (encoded.byteLength > maxBytes)
+      limit();
+    if (new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(encoded) !== path)
+      invalid("Invalid UTF-8 entry path");
+    if (!path || /[\\:\x00-\x1f\x7f]/u.test(path))
+      invalid("Unsafe entry path");
+    if (path.split("/").some((segment) => !segment || segment === "." || segment === ".."))
+      invalid("Unsafe entry path segment");
+    const key = path.normalize("NFC").toLowerCase().normalize("NFC");
+    if (this.files.has(key) || this.directories.has(key))
+      invalid("Duplicate or conflicting entry path");
+    const parents = key.split("/");
+    parents.pop();
+    while (parents.length) {
+      const parent = parents.join("/");
+      if (this.files.has(parent))
+        invalid("Conflicting entry file ancestor");
+      this.directories.add(parent);
+      parents.pop();
+    }
+    this.files.add(key);
+  }
+}
+
 // src/lib/skill-hash.ts
 import { createHash } from "crypto";
 import { existsSync as existsSync9, readdirSync as readdirSync4, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
@@ -39441,6 +39472,186 @@ function hashBundleFiles(files) {
     hash.update(part);
   return hash.digest("hex");
 }
+async function hashBundleFilesCooperatively(files, check) {
+  const hash = createHash(CONTENT_HASH_ALGORITHM);
+  let bytesSinceYield = 0;
+  for (const part of bundleHashParts(files)) {
+    for (let offset = 0;offset < part.byteLength; offset += 64 * 1024) {
+      check();
+      const chunk2 = part.subarray(offset, offset + 64 * 1024);
+      hash.update(chunk2);
+      bytesSinceYield += chunk2.byteLength;
+      if (bytesSinceYield >= 256 * 1024) {
+        await new Promise((resolve3) => setImmediate(resolve3));
+        bytesSinceYield = 0;
+      }
+    }
+  }
+  check();
+  return hash.digest("hex");
+}
+function invalidContent(message = "Invalid content hash input") {
+  throw new ContentHashInputError("CONTENT_HASH_INVALID", message);
+}
+function contentLimit(message) {
+  throw new ContentHashInputError("CONTENT_HASH_LIMIT", message);
+}
+function contentRecord(value, allowed) {
+  if (!value || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    invalidContent();
+  const result2 = Object.create(null);
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string" || !allowed.includes(key))
+      invalidContent();
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !("value" in descriptor))
+      invalidContent("Accessor content hash input is unsupported");
+    result2[key] = descriptor.value;
+  }
+  return result2;
+}
+function contentOptions(options) {
+  const record = contentRecord(options, ["limits", "signal"]);
+  const limits = { ...CONTENT_HASH_LIMITS };
+  if (record.limits !== undefined) {
+    const supplied = contentRecord(record.limits, Object.keys(limits));
+    for (const key of Object.keys(supplied)) {
+      const value = supplied[key];
+      if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0 || value > limits[key])
+        contentLimit("Invalid content hash limit");
+      limits[key] = value;
+    }
+  }
+  if (record.signal !== undefined && !(record.signal instanceof AbortSignal))
+    invalidContent("Invalid content hash signal");
+  return { limits, signal: record.signal };
+}
+function snapshotContentEntries(entries, limits, check) {
+  if (!Array.isArray(entries))
+    invalidContent("Content hash entries must be an array");
+  if (entries.length > limits.entries)
+    contentLimit("Content hash entry limit exceeded");
+  if (Reflect.ownKeys(entries).length !== entries.length + 1)
+    invalidContent("Invalid content hash entry array");
+  const snapshot = [];
+  const paths = new SkillEntryPaths;
+  let rawBytes = 0;
+  for (let index = 0;index < entries.length; index++) {
+    check();
+    const descriptor = Object.getOwnPropertyDescriptor(entries, String(index));
+    if (!descriptor || !("value" in descriptor))
+      invalidContent("Invalid content hash entry array");
+    const entry = contentRecord(descriptor.value, ["path", "bytes", "mode"]);
+    if (typeof entry.path !== "string" || typeof entry.mode !== "number" || !Number.isInteger(entry.mode) || entry.mode < 0 || entry.mode > 511)
+      invalidContent("Invalid regular-file content hash entry");
+    paths.add(entry.path, limits.pathBytes, invalidContent, () => contentLimit("Content hash path limit exceeded"));
+    if (!(entry.bytes instanceof Uint8Array) || !ArrayBuffer.isView(entry.bytes))
+      invalidContent("Content hash entry requires bytes");
+    const size2 = byteLengthOf.call(entry.bytes);
+    if (!(bufferOf.call(entry.bytes) instanceof ArrayBuffer))
+      invalidContent("Shared content hash bytes are unsupported");
+    if (size2 > limits.fileBytes || rawBytes + size2 > limits.rawBytes)
+      contentLimit("Content hash raw byte limit exceeded");
+    if (entry.path === "skill.json" && size2 > limits.manifestBytes)
+      contentLimit("Content hash manifest byte limit exceeded");
+    rawBytes += size2;
+    const bytes = new Uint8Array(new ArrayBuffer(size2));
+    bytes.set(entry.bytes);
+    snapshot.push({ path: entry.path, bytes, mode: entry.mode });
+  }
+  check();
+  return snapshot;
+}
+function coveredContentPath(path) {
+  const segments = path.split("/");
+  if (!HASH_COVERAGE.includes(segments[0]))
+    return false;
+  return !segments.slice(1).some((segment, index) => excludedHashEntry(segment, index < segments.length - 2));
+}
+function boundedManifest(raw, maxDepth) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return;
+  }
+  const pending = [{ value: parsed, depth: 1 }];
+  while (pending.length) {
+    const { value, depth } = pending.pop();
+    if (!value || typeof value !== "object")
+      continue;
+    if (depth > maxDepth)
+      contentLimit("Content hash manifest depth limit exceeded");
+    for (const child of Object.values(value))
+      pending.push({ value: child, depth: depth + 1 });
+  }
+  return parsed;
+}
+async function hashContentEntries(entries, options) {
+  const { limits, signal } = contentOptions(options);
+  const deadline = performance.now() + limits.timeoutMs;
+  let terminal;
+  const abort = () => {
+    terminal ??= new ContentHashInputError("CONTENT_HASH_ABORTED", "Content hashing aborted");
+  };
+  const timer = setTimeout(() => {
+    terminal ??= new ContentHashInputError("CONTENT_HASH_TIMEOUT", "Content hashing deadline exceeded");
+  }, limits.timeoutMs);
+  const check = () => {
+    if (signal?.aborted)
+      abort();
+    if (terminal)
+      throw terminal;
+    if (performance.now() >= deadline)
+      throw new ContentHashInputError("CONTENT_HASH_TIMEOUT", "Content hashing deadline exceeded");
+  };
+  try {
+    signal?.addEventListener("abort", abort, { once: true });
+    check();
+    const snapshot = snapshotContentEntries(entries, limits, check);
+    const normalized = [];
+    let normalizedBytes = 0;
+    let manifest;
+    await new Promise((resolve3) => setImmediate(resolve3));
+    for (const entry of snapshot) {
+      check();
+      if (!coveredContentPath(entry.path))
+        continue;
+      if (entry.path === "skill.json")
+        manifest = boundedManifest(new TextDecoder().decode(entry.bytes), limits.manifestDepth);
+      const file = normalizeBundleFile(entry.path, entry.bytes);
+      check();
+      if (file.content.byteLength > limits.normalizedFileBytes || normalizedBytes + file.content.byteLength > limits.normalizedBytes)
+        contentLimit("Content hash normalized byte limit exceeded");
+      normalizedBytes += file.content.byteLength;
+      normalized.push(file);
+      await new Promise((resolve3) => setImmediate(resolve3));
+    }
+    normalized.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
+    check();
+    return { hash: await hashBundleFilesCooperatively(normalized, check), manifest };
+  } catch (error) {
+    if (error instanceof ContentHashInputError)
+      throw error;
+    throw new ContentHashInputError("CONTENT_HASH_INVALID", "Invalid content hash input");
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", abort);
+  }
+}
+async function verifyContentHashFromEntries(entries, options = {}) {
+  const { hash, manifest } = await hashContentEntries(entries, options);
+  const provenance = manifest && typeof manifest === "object" && !Array.isArray(manifest) ? manifest.provenance : undefined;
+  const value = provenance && typeof provenance === "object" && !Array.isArray(provenance) ? provenance.content_hash : undefined;
+  if (value !== undefined && typeof value !== "string")
+    invalidContent("Invalid content hash declaration");
+  const declaredHash = value?.trim() || undefined;
+  if (!declaredHash)
+    return { declared: false, valid: false };
+  if (!/^[a-f0-9]{64}$/.test(declaredHash))
+    return { declared: true, valid: false, declaredHash };
+  return { declared: true, valid: hash === declaredHash, declaredHash, computedHash: hash };
+}
 function verifyContentHash(skillPath, manifest) {
   const declaredHash = manifest?.provenance?.content_hash?.trim() || undefined;
   if (!declaredHash)
@@ -39475,7 +39686,7 @@ function hashSkillMarkdown(content) {
 function hashSkillMarkdownFile(path) {
   return hashSkillMarkdown(readFileSync5(path, "utf-8"));
 }
-var CONTENT_HASH_ALGORITHM = "sha256", HASH_EXCLUDE_DIRS, HASH_COVERAGE, CONTENT_HASH_LIMITS, typedArrayPrototype, byteLengthOf, bufferOf;
+var CONTENT_HASH_ALGORITHM = "sha256", HASH_EXCLUDE_DIRS, HASH_COVERAGE, CONTENT_HASH_LIMITS, ContentHashInputError, typedArrayPrototype, byteLengthOf, bufferOf;
 var init_skill_hash = __esm(() => {
   HASH_EXCLUDE_DIRS = new Set([".git", "node_modules", "dist", "build", ".turbo"]);
   HASH_COVERAGE = [
@@ -39500,6 +39711,14 @@ var init_skill_hash = __esm(() => {
     manifestDepth: 64,
     timeoutMs: 5000
   });
+  ContentHashInputError = class ContentHashInputError extends Error {
+    code;
+    constructor(code, message) {
+      super(message);
+      this.code = code;
+      this.name = "ContentHashInputError";
+    }
+  };
   typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
   byteLengthOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteLength").get;
   bufferOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer").get;
@@ -40917,21 +41136,21 @@ var init_search = __esm(() => {
 // src/lib/registry.ts
 var exports_registry = {};
 __export(exports_registry, {
-  BASIC_SKILL_NAMES: () => BASIC_SKILL_NAMES,
-  CATEGORIES: () => CATEGORIES,
-  SKILLS: () => SKILLS,
-  clearRegistryCache: () => clearRegistryCache,
-  findExtensionSkillPath: () => findExtensionSkillPath,
-  findSimilarSkills: () => findSimilarSkills,
-  getAllTags: () => getAllTags,
-  getSkill: () => getSkill,
-  getSkillsByCategory: () => getSkillsByCategory,
-  getSkillsByTag: () => getSkillsByTag,
-  isBasicSkillName: () => isBasicSkillName,
-  loadBasicRegistry: () => loadBasicRegistry,
-  loadRegistry: () => loadRegistry,
+  searchSkills: () => searchSkills,
   loadRegistryProfile: () => loadRegistryProfile,
-  searchSkills: () => searchSkills
+  loadRegistry: () => loadRegistry,
+  loadBasicRegistry: () => loadBasicRegistry,
+  isBasicSkillName: () => isBasicSkillName,
+  getSkillsByTag: () => getSkillsByTag,
+  getSkillsByCategory: () => getSkillsByCategory,
+  getSkill: () => getSkill,
+  getAllTags: () => getAllTags,
+  findSimilarSkills: () => findSimilarSkills,
+  findExtensionSkillPath: () => findExtensionSkillPath,
+  clearRegistryCache: () => clearRegistryCache,
+  SKILLS: () => SKILLS,
+  CATEGORIES: () => CATEGORIES,
+  BASIC_SKILL_NAMES: () => BASIC_SKILL_NAMES
 });
 import { existsSync as existsSync12, readFileSync as readFileSync7, readdirSync as readdirSync6 } from "fs";
 import { join as join12 } from "path";
@@ -41108,7 +41327,7 @@ var init_registry = __esm(() => {
 });
 
 // ../../node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/spinners.json
-var require_spinners = __commonJS(function(exports, module) {
+var require_spinners = __commonJS((exports, module) => {
   module.exports = {
     dots: {
       interval: 80,
@@ -42734,7 +42953,7 @@ var require_spinners = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/index.js
-var require_cli_spinners = __commonJS(function(exports, module) {
+var require_cli_spinners = __commonJS((exports, module) => {
   var spinners = Object.assign({}, require_spinners());
   var spinnersList = Object.keys(spinners);
   Object.defineProperty(spinners, "random", {
@@ -43364,30 +43583,30 @@ var init_project_state = __esm(() => {
 // src/lib/installer.ts
 var exports_installer = {};
 __export(exports_installer, {
-  AGENT_LABELS: () => AGENT_LABELS,
-  AGENT_TARGETS: () => AGENT_TARGETS,
-  createLocalSkillManifest: () => createLocalSkillManifest,
-  disableSkill: () => disableSkill,
-  enableSkill: () => enableSkill,
-  getAgentSkillPath: () => getAgentSkillPath,
-  getAgentSkillsDir: () => getAgentSkillsDir,
-  getDisabledSkills: () => getDisabledSkills,
-  getInstallMeta: () => getInstallMeta,
-  getInstalledSkills: () => getInstalledSkills,
-  getPinnedSkills: () => getPinnedSkills,
-  getSkillPath: () => getSkillPath,
-  installRemoteSkill: () => installRemoteSkill,
-  installSkill: () => installSkill,
-  installSkillForAgent: () => installSkillForAgent,
-  installSkillManifest: () => installSkillManifest,
-  installSkillSource: () => installSkillSource,
-  installSkills: () => installSkills,
-  pinSkill: () => pinSkill,
-  removeSkill: () => removeSkill,
-  removeSkillForAgent: () => removeSkillForAgent,
-  resolveAgents: () => resolveAgents,
+  unpinSkill: () => unpinSkill,
   skillExists: () => skillExists,
-  unpinSkill: () => unpinSkill
+  resolveAgents: () => resolveAgents,
+  removeSkillForAgent: () => removeSkillForAgent,
+  removeSkill: () => removeSkill,
+  pinSkill: () => pinSkill,
+  installSkills: () => installSkills,
+  installSkillSource: () => installSkillSource,
+  installSkillManifest: () => installSkillManifest,
+  installSkillForAgent: () => installSkillForAgent,
+  installSkill: () => installSkill,
+  installRemoteSkill: () => installRemoteSkill,
+  getSkillPath: () => getSkillPath,
+  getPinnedSkills: () => getPinnedSkills,
+  getInstalledSkills: () => getInstalledSkills,
+  getInstallMeta: () => getInstallMeta,
+  getDisabledSkills: () => getDisabledSkills,
+  getAgentSkillsDir: () => getAgentSkillsDir,
+  getAgentSkillPath: () => getAgentSkillPath,
+  enableSkill: () => enableSkill,
+  disableSkill: () => disableSkill,
+  createLocalSkillManifest: () => createLocalSkillManifest,
+  AGENT_TARGETS: () => AGENT_TARGETS,
+  AGENT_LABELS: () => AGENT_LABELS
 });
 import { existsSync as existsSync16, readFileSync as readFileSync10, rmSync as rmSync4 } from "fs";
 import { dirname as dirname5, join as join16 } from "path";
@@ -44600,31 +44819,32 @@ var init_local_opt_in = __esm(() => {
 // src/lib/fleet-credentials.ts
 var exports_fleet_credentials = {};
 __export(exports_fleet_credentials, {
-  MissingSkillsFleetError: () => MissingSkillsFleetError,
-  SKILLS_API_KEY_ENV: () => SKILLS_API_KEY_ENV,
-  SKILLS_API_KEY_ENV_KEYS: () => SKILLS_API_KEY_ENV_KEYS,
-  SKILLS_API_URL_ENV: () => SKILLS_API_URL_ENV,
-  SKILLS_API_URL_ENV_KEYS: () => SKILLS_API_URL_ENV_KEYS,
-  SKILLS_APP: () => SKILLS_APP,
-  SKILLS_LOCAL_OPT_IN_ENV_KEYS: () => SKILLS_LOCAL_OPT_IN_ENV_KEYS,
-  SkillsFleetCredentialError: () => SkillsFleetCredentialError,
-  configuredSkillsApiUrl: () => configuredSkillsApiUrl,
-  isSkillsFleetCredentialError: () => isSkillsFleetCredentialError,
-  isSkillsLocalOptIn: () => isSkillsLocalOptIn,
-  normalizeSkillsApiOrigin: () => normalizeSkillsApiOrigin,
-  noticeLocalSkillsMode: () => noticeLocalSkillsMode,
-  requireSkillsApiKey: () => requireSkillsApiKey,
-  requireSkillsApiOrigin: () => requireSkillsApiOrigin,
-  requireSkillsFleet: () => requireSkillsFleet,
-  resetLocalSkillsModeNotice: () => resetLocalSkillsModeNotice,
-  resolveSkillsApiKey: () => resolveSkillsApiKey,
-  resolveSkillsApiOrigin: () => resolveSkillsApiOrigin,
-  resolveSkillsConnection: () => resolveSkillsConnection,
-  resolveSkillsFleet: () => resolveSkillsFleet,
-  selectsSkillsLocalMode: () => selectsSkillsLocalMode,
-  skillsCredentialFilePath: () => skillsCredentialFilePath,
+  skillsCredentialOrReason: () => skillsCredentialOrReason,
   skillsCredentialFiles: () => skillsCredentialFiles,
-  skillsCredentialOrReason: () => skillsCredentialOrReason
+  skillsCredentialFilePath: () => skillsCredentialFilePath,
+  skillsApiRequestUrl: () => skillsApiRequestUrl,
+  selectsSkillsLocalMode: () => selectsSkillsLocalMode,
+  resolveSkillsFleet: () => resolveSkillsFleet,
+  resolveSkillsConnection: () => resolveSkillsConnection,
+  resolveSkillsApiOrigin: () => resolveSkillsApiOrigin,
+  resolveSkillsApiKey: () => resolveSkillsApiKey,
+  resetLocalSkillsModeNotice: () => resetLocalSkillsModeNotice,
+  requireSkillsFleet: () => requireSkillsFleet,
+  requireSkillsApiOrigin: () => requireSkillsApiOrigin,
+  requireSkillsApiKey: () => requireSkillsApiKey,
+  noticeLocalSkillsMode: () => noticeLocalSkillsMode,
+  normalizeSkillsApiOrigin: () => normalizeSkillsApiOrigin,
+  isSkillsLocalOptIn: () => isSkillsLocalOptIn,
+  isSkillsFleetCredentialError: () => isSkillsFleetCredentialError,
+  configuredSkillsApiUrl: () => configuredSkillsApiUrl,
+  SkillsFleetCredentialError: () => SkillsFleetCredentialError,
+  SKILLS_LOCAL_OPT_IN_ENV_KEYS: () => SKILLS_LOCAL_OPT_IN_ENV_KEYS,
+  SKILLS_APP: () => SKILLS_APP,
+  SKILLS_API_URL_ENV_KEYS: () => SKILLS_API_URL_ENV_KEYS,
+  SKILLS_API_URL_ENV: () => SKILLS_API_URL_ENV,
+  SKILLS_API_KEY_ENV_KEYS: () => SKILLS_API_KEY_ENV_KEYS,
+  SKILLS_API_KEY_ENV: () => SKILLS_API_KEY_ENV,
+  MissingSkillsFleetError: () => MissingSkillsFleetError
 });
 function isCredentialResolutionError(error) {
   return error instanceof CredentialResolutionError || typeof error === "object" && error !== null && error.name === "CredentialResolutionError";
@@ -44643,7 +44863,9 @@ function normalizeSkillsApiOrigin(apiUrl) {
     throw new SkillsFleetCredentialError("A Skills API URL must use HTTPS (or loopback HTTP), without credentials, query or fragment", "INVALID_API_URL");
   }
   const pathname = url.pathname.replace(/\/+$/, "");
-  if (pathname === "/api" || pathname === "/api/v1") {
+  if (url.origin === "https://api.hasna.com" && pathname === "/skills/v1") {
+    url.pathname = "/skills";
+  } else if (pathname === "/api" || pathname === "/api/v1") {
     url.pathname = "/";
   } else if (pathname.endsWith("/api/v1")) {
     url.pathname = pathname.slice(0, -"/api/v1".length) || "/";
@@ -44652,6 +44874,21 @@ function normalizeSkillsApiOrigin(apiUrl) {
   }
   return url.toString().replace(/\/+$/, "");
 }
+function skillsApiRequestUrl(apiUrl, route) {
+  const origin = normalizeSkillsApiOrigin(apiUrl);
+  if (!route.startsWith("/api/") || route.includes("#") || route.includes("\\")) {
+    throw new SkillsFleetCredentialError("Invalid Skills API route", "INVALID_API_URL");
+  }
+  if (origin === "https://api.hasna.com/skills") {
+    if (route === "/api/auth/whoami")
+      return `${origin}/v1/auth/whoami`;
+    if (!route.startsWith("/api/v1/")) {
+      throw new SkillsFleetCredentialError("The internal Skills gateway has no established login contract yet. Select an explicitly configured instance with supported authentication.", "GATEWAY_AUTH_UNAVAILABLE");
+    }
+    return `${origin}${route.slice("/api".length)}`;
+  }
+  return `${origin}${route}`;
+}
 function configuredSkillsApiUrl(env3 = process.env, keychain, profile) {
   const declared = SKILLS_API_URL_ENV_KEYS.filter((key) => env3[key] !== undefined).map((key) => ({ key, value: env3[key] }));
   for (const entry of declared) {
@@ -48730,113 +48967,113 @@ var init_types = __esm(() => {
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
-  BRAND: () => BRAND,
-  DIRTY: () => DIRTY,
-  EMPTY_PATH: () => EMPTY_PATH,
-  INVALID: () => INVALID,
-  NEVER: () => NEVER,
-  OK: () => OK,
-  ParseStatus: () => ParseStatus,
-  Schema: () => ZodType,
-  ZodAny: () => ZodAny,
-  ZodArray: () => ZodArray,
-  ZodBigInt: () => ZodBigInt,
-  ZodBoolean: () => ZodBoolean,
-  ZodBranded: () => ZodBranded,
-  ZodCatch: () => ZodCatch,
-  ZodDate: () => ZodDate,
-  ZodDefault: () => ZodDefault,
-  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
-  ZodEffects: () => ZodEffects,
-  ZodEnum: () => ZodEnum,
-  ZodError: () => ZodError,
-  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
-  ZodFunction: () => ZodFunction,
-  ZodIntersection: () => ZodIntersection,
-  ZodIssueCode: () => ZodIssueCode,
-  ZodLazy: () => ZodLazy,
-  ZodLiteral: () => ZodLiteral,
-  ZodMap: () => ZodMap,
-  ZodNaN: () => ZodNaN,
-  ZodNativeEnum: () => ZodNativeEnum,
-  ZodNever: () => ZodNever,
-  ZodNull: () => ZodNull,
-  ZodNullable: () => ZodNullable,
-  ZodNumber: () => ZodNumber,
-  ZodObject: () => ZodObject,
-  ZodOptional: () => ZodOptional,
-  ZodParsedType: () => ZodParsedType,
-  ZodPipeline: () => ZodPipeline,
-  ZodPromise: () => ZodPromise,
-  ZodReadonly: () => ZodReadonly,
-  ZodRecord: () => ZodRecord,
-  ZodSchema: () => ZodType,
-  ZodSet: () => ZodSet,
-  ZodString: () => ZodString,
-  ZodSymbol: () => ZodSymbol,
-  ZodTransformer: () => ZodEffects,
-  ZodTuple: () => ZodTuple,
-  ZodType: () => ZodType,
-  ZodUndefined: () => ZodUndefined,
-  ZodUnion: () => ZodUnion,
-  ZodUnknown: () => ZodUnknown,
-  ZodVoid: () => ZodVoid,
-  addIssueToContext: () => addIssueToContext,
-  any: () => anyType,
-  array: () => arrayType,
-  bigint: () => bigIntType,
-  boolean: () => booleanType,
-  coerce: () => coerce,
-  custom: () => custom,
-  date: () => dateType,
-  datetimeRegex: () => datetimeRegex,
-  defaultErrorMap: () => en_default,
-  discriminatedUnion: () => discriminatedUnionType,
-  effect: () => effectsType,
-  enum: () => enumType,
-  function: () => functionType,
-  getErrorMap: () => getErrorMap,
-  getParsedType: () => getParsedType,
-  instanceof: () => instanceOfType,
-  intersection: () => intersectionType,
-  isAborted: () => isAborted,
-  isAsync: () => isAsync,
-  isDirty: () => isDirty,
-  isValid: () => isValid,
-  late: () => late,
-  lazy: () => lazyType,
-  literal: () => literalType,
-  makeIssue: () => makeIssue,
-  map: () => mapType,
-  nan: () => nanType,
-  nativeEnum: () => nativeEnumType,
-  never: () => neverType,
-  null: () => nullType,
-  nullable: () => nullableType,
-  number: () => numberType,
-  object: () => objectType,
-  objectUtil: () => objectUtil,
-  oboolean: () => oboolean,
-  onumber: () => onumber,
-  optional: () => optionalType,
-  ostring: () => ostring,
-  pipeline: () => pipelineType,
-  preprocess: () => preprocessType,
-  promise: () => promiseType,
-  quotelessJson: () => quotelessJson,
-  record: () => recordType,
-  set: () => setType,
-  setErrorMap: () => setErrorMap,
-  strictObject: () => strictObjectType,
-  string: () => stringType,
-  symbol: () => symbolType,
-  transformer: () => effectsType,
-  tuple: () => tupleType,
-  undefined: () => undefinedType,
-  union: () => unionType,
-  unknown: () => unknownType,
+  void: () => voidType,
   util: () => util,
-  void: () => voidType
+  unknown: () => unknownType,
+  union: () => unionType,
+  undefined: () => undefinedType,
+  tuple: () => tupleType,
+  transformer: () => effectsType,
+  symbol: () => symbolType,
+  string: () => stringType,
+  strictObject: () => strictObjectType,
+  setErrorMap: () => setErrorMap,
+  set: () => setType,
+  record: () => recordType,
+  quotelessJson: () => quotelessJson,
+  promise: () => promiseType,
+  preprocess: () => preprocessType,
+  pipeline: () => pipelineType,
+  ostring: () => ostring,
+  optional: () => optionalType,
+  onumber: () => onumber,
+  oboolean: () => oboolean,
+  objectUtil: () => objectUtil,
+  object: () => objectType,
+  number: () => numberType,
+  nullable: () => nullableType,
+  null: () => nullType,
+  never: () => neverType,
+  nativeEnum: () => nativeEnumType,
+  nan: () => nanType,
+  map: () => mapType,
+  makeIssue: () => makeIssue,
+  literal: () => literalType,
+  lazy: () => lazyType,
+  late: () => late,
+  isValid: () => isValid,
+  isDirty: () => isDirty,
+  isAsync: () => isAsync,
+  isAborted: () => isAborted,
+  intersection: () => intersectionType,
+  instanceof: () => instanceOfType,
+  getParsedType: () => getParsedType,
+  getErrorMap: () => getErrorMap,
+  function: () => functionType,
+  enum: () => enumType,
+  effect: () => effectsType,
+  discriminatedUnion: () => discriminatedUnionType,
+  defaultErrorMap: () => en_default,
+  datetimeRegex: () => datetimeRegex,
+  date: () => dateType,
+  custom: () => custom,
+  coerce: () => coerce,
+  boolean: () => booleanType,
+  bigint: () => bigIntType,
+  array: () => arrayType,
+  any: () => anyType,
+  addIssueToContext: () => addIssueToContext,
+  ZodVoid: () => ZodVoid,
+  ZodUnknown: () => ZodUnknown,
+  ZodUnion: () => ZodUnion,
+  ZodUndefined: () => ZodUndefined,
+  ZodType: () => ZodType,
+  ZodTuple: () => ZodTuple,
+  ZodTransformer: () => ZodEffects,
+  ZodSymbol: () => ZodSymbol,
+  ZodString: () => ZodString,
+  ZodSet: () => ZodSet,
+  ZodSchema: () => ZodType,
+  ZodRecord: () => ZodRecord,
+  ZodReadonly: () => ZodReadonly,
+  ZodPromise: () => ZodPromise,
+  ZodPipeline: () => ZodPipeline,
+  ZodParsedType: () => ZodParsedType,
+  ZodOptional: () => ZodOptional,
+  ZodObject: () => ZodObject,
+  ZodNumber: () => ZodNumber,
+  ZodNullable: () => ZodNullable,
+  ZodNull: () => ZodNull,
+  ZodNever: () => ZodNever,
+  ZodNativeEnum: () => ZodNativeEnum,
+  ZodNaN: () => ZodNaN,
+  ZodMap: () => ZodMap,
+  ZodLiteral: () => ZodLiteral,
+  ZodLazy: () => ZodLazy,
+  ZodIssueCode: () => ZodIssueCode,
+  ZodIntersection: () => ZodIntersection,
+  ZodFunction: () => ZodFunction,
+  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
+  ZodError: () => ZodError,
+  ZodEnum: () => ZodEnum,
+  ZodEffects: () => ZodEffects,
+  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
+  ZodDefault: () => ZodDefault,
+  ZodDate: () => ZodDate,
+  ZodCatch: () => ZodCatch,
+  ZodBranded: () => ZodBranded,
+  ZodBoolean: () => ZodBoolean,
+  ZodBigInt: () => ZodBigInt,
+  ZodArray: () => ZodArray,
+  ZodAny: () => ZodAny,
+  Schema: () => ZodType,
+  ParseStatus: () => ParseStatus,
+  OK: () => OK,
+  NEVER: () => NEVER,
+  INVALID: () => INVALID,
+  EMPTY_PATH: () => EMPTY_PATH,
+  DIRTY: () => DIRTY,
+  BRAND: () => BRAND
 });
 var init_external = __esm(() => {
   init_errors();
@@ -48872,7 +49109,14 @@ function getConfiguredApiUrl(env3 = process.env) {
 }
 function buildSkillsApiUrl(apiUrl, endpoint = "/skills") {
   const url = new URL(apiUrl);
+  if (url.origin === "https://api.hasna.com" && /^\/skills\/(?:api\/)?v1\/skills\/?$/.test(url.pathname)) {
+    url.pathname = "/skills";
+    apiUrl = url.toString();
+  }
   const cleanEndpoint = endpoint.startsWith("/") ? endpoint : `/${endpoint}`;
+  if (normalizeSkillsApiOrigin(apiUrl) === "https://api.hasna.com/skills") {
+    return skillsApiRequestUrl(apiUrl, `/api/v1${cleanEndpoint}`);
+  }
   const pathname = url.pathname.replace(/\/+$/, "");
   const apiBase = /\/api(?:\/v1)?\/skills$/.test(pathname) ? pathname.slice(0, -"/skills".length) : pathname;
   if (/\/api(?:\/v1)?$/.test(apiBase)) {
@@ -49713,8 +49957,17 @@ function creditCount(value) {
   }
   return value;
 }
+function runQuoteReceipt(value) {
+  if (value === undefined)
+    return;
+  if (typeof value !== "string" || !value.length || Buffer.byteLength(value, "utf8") > 4096) {
+    throw new Error("Invalid quote receipt");
+  }
+  return value;
+}
 function parseRemoteRunQuote(value) {
   const quote = object(value);
+  runQuoteReceipt(quote.quoteReceipt);
   const pricing = object(quote.pricing);
   if (typeof quote.skill !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(quote.skill))
     throw new Error("Invalid quoted skill");
@@ -49788,11 +50041,11 @@ var init_remote_account = __esm(() => {
 // src/lib/remote-files.ts
 var exports_remote_files = {};
 __export(exports_remote_files, {
-  MAX_REMOTE_FILE_BYTES: () => MAX_REMOTE_FILE_BYTES,
-  decodeRemoteFiles: () => decodeRemoteFiles,
-  describeRemoteFiles: () => describeRemoteFiles,
+  sha256: () => sha256,
   readBoundedResponse: () => readBoundedResponse,
-  sha256: () => sha256
+  describeRemoteFiles: () => describeRemoteFiles,
+  decodeRemoteFiles: () => decodeRemoteFiles,
+  MAX_REMOTE_FILE_BYTES: () => MAX_REMOTE_FILE_BYTES
 });
 import { createHash as createHash2 } from "crypto";
 function describeRemoteFiles(files) {
@@ -49969,15 +50222,15 @@ var init_remote_quote_errors = __esm(() => {
 // src/lib/remote-client.ts
 var exports_remote_client = {};
 __export(exports_remote_client, {
-  RemoteCapabilityUnavailableError: () => RemoteCapabilityUnavailableError,
-  RemoteQuoteUnavailableError: () => RemoteQuoteUnavailableError,
-  RemoteRequestError: () => RemoteRequestError,
-  RemoteRouteUnsupportedError: () => RemoteRouteUnsupportedError,
-  RemoteSkillsClient: () => RemoteSkillsClient,
-  RemoteWorkspaceMemberError: () => RemoteWorkspaceMemberError,
-  RemoteWorkspaceSelectionError: () => RemoteWorkspaceSelectionError,
+  createRemoteSkillsClientReadOnly: () => createRemoteSkillsClientReadOnly,
   createRemoteSkillsClient: () => createRemoteSkillsClient,
-  createRemoteSkillsClientReadOnly: () => createRemoteSkillsClientReadOnly
+  RemoteWorkspaceSelectionError: () => RemoteWorkspaceSelectionError,
+  RemoteWorkspaceMemberError: () => RemoteWorkspaceMemberError,
+  RemoteSkillsClient: () => RemoteSkillsClient,
+  RemoteRouteUnsupportedError: () => RemoteRouteUnsupportedError,
+  RemoteRequestError: () => RemoteRequestError,
+  RemoteQuoteUnavailableError: () => RemoteQuoteUnavailableError,
+  RemoteCapabilityUnavailableError: () => RemoteCapabilityUnavailableError
 });
 
 class RemoteSkillsClient {
@@ -49989,7 +50242,7 @@ class RemoteSkillsClient {
     this.apiUrl = normalizeSkillsApiOrigin(apiUrl);
   }
   async request(path, options) {
-    return fetch(`${this.apiUrl}${path}`, {
+    return fetch(skillsApiRequestUrl(this.apiUrl, path), {
       ...options,
       redirect: "error",
       credentials: "omit",
@@ -50049,6 +50302,7 @@ class RemoteSkillsClient {
     return { status: res.status, body };
   }
   async submitRun(slug, input, args, approval = {}) {
+    const quoteReceipt = runQuoteReceipt(approval.quoteReceipt);
     if (approval.idempotencyKey !== undefined && !/^[A-Za-z0-9._:-]{1,128}$/.test(approval.idempotencyKey))
       throw new Error("Idempotency key must be 1-128 URL-safe characters");
     if (approval.maxCostCents !== undefined)
@@ -50065,15 +50319,20 @@ class RemoteSkillsClient {
         ...approval.maxCredits !== undefined ? { maxCredits: approval.maxCredits } : {},
         ...approval.maxCostCents !== undefined ? { maxCostCents: approval.maxCostCents } : {},
         ...approval.idempotencyKey !== undefined ? { idempotencyKey: approval.idempotencyKey } : {},
-        ...approval.inputFiles !== undefined ? { files: approval.inputFiles } : {}
+        ...approval.inputFiles !== undefined ? { files: approval.inputFiles } : {},
+        ...quoteReceipt !== undefined ? { quoteReceipt } : {}
       })
     });
+    if (!res.ok) {
+      res.body?.cancel().catch(() => {});
+      throw new RemoteRequestError(`/api/v1/runs/${encodeURIComponent(slug)}`, res.status);
+    }
     return normalizeRemoteSkillRunContract(await res.json(), slug);
   }
-  async quoteRun(slug, input = {}, args = []) {
+  async quoteRun(slug, input = {}, args = [], files) {
     const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/quote`, {
       method: "POST",
-      body: JSON.stringify({ input, args })
+      body: JSON.stringify({ input, args, ...files === undefined ? {} : { files } })
     }, { quoteRefusal: true });
     return parseRemoteRunQuote(await response.json());
   }
@@ -50089,17 +50348,24 @@ class RemoteSkillsClient {
     return this.capabilities;
   }
   async submitQuotedRun(slug, input = {}, args = [], approval = {}) {
+    runQuoteReceipt(approval.quoteReceipt);
+    ({ input, args, approval } = JSON.parse(JSON.stringify({ input, args, approval })));
     const maximum = creditCount(approval.maxCredits ?? approval.maxCostCents ?? 0);
     if (approval.maxCostCents !== undefined && approval.maxCostCents !== maximum)
       throw new Error("Credit approval fields disagree");
-    const quote = await this.quoteRun(slug, input, args);
-    if (quote.pricing.costCents > maximum)
+    const quote = approval.quoteReceipt === undefined ? await this.quoteRun(slug, input, args, approval.inputFiles?.length ? approval.inputFiles : undefined) : undefined;
+    if (quote && quote.pricing.costCents > maximum)
       throw new RemoteCreditApprovalError(quote.pricing.costCents, maximum);
     const capabilities = await this.getCapabilities();
     if (!capabilities.capabilities.includes("runs.submit") || capabilities.billing?.boundedRunApproval !== true || capabilities.billing.unit !== "credits") {
       throw new Error("The configured server does not support bounded credit approval; refusing remote submission");
     }
-    return this.submitRun(quote.skill, input, args, { ...approval, maxCredits: maximum, maxCostCents: maximum });
+    return this.submitRun(quote?.skill ?? slug, input, args, {
+      ...approval,
+      maxCredits: maximum,
+      maxCostCents: maximum,
+      ...(quote?.quoteReceipt ?? approval.quoteReceipt) === undefined ? {} : { quoteReceipt: quote?.quoteReceipt ?? approval.quoteReceipt }
+    });
   }
   async getIdentity() {
     return (await this.requestNewRoute("/api/auth/whoami")).json();
@@ -50387,6 +50653,10 @@ class RemoteSkillsClient {
     return { id: artifactId, fileName: String(artifact.fileName ?? artifactId), bytes, byteSize: bytes.byteLength, sha256: artifact.sha256 };
   }
   async submitQuotedRunWithFiles(slug, input, args, files, approval = {}) {
+    runQuoteReceipt(approval.quoteReceipt);
+    ({ input, args, approval } = JSON.parse(JSON.stringify({ input, args, approval })));
+    describeRemoteFiles(files);
+    files = files.map((file) => ({ name: file.name, contentType: file.contentType, bytes: new Uint8Array(file.bytes) }));
     const inputFiles = describeRemoteFiles(files);
     if (files.length && !(await this.getCapabilities()).capabilities.includes("runs.uploads"))
       throw new Error("The configured server does not support input uploads");
@@ -50450,7 +50720,7 @@ class RemoteSkillsClient {
     const headers = { Authorization: `Bearer ${this.apiKey}` };
     if (ifMatch)
       headers["If-Match"] = ifMatch;
-    return fetch(`${this.apiUrl}/api/v1/skills`, {
+    return fetch(skillsApiRequestUrl(this.apiUrl, "/api/v1/skills"), {
       method: "POST",
       headers,
       body: form,
@@ -50773,6 +51043,7 @@ var init_revision = __esm(() => {
 import { createHash as createHash4 } from "crypto";
 import { readFileSync as readFileSync13, readdirSync as readdirSync9, statSync as statSync10 } from "fs";
 import { join as join19, relative as relative2 } from "path";
+import { createGunzip } from "zlib";
 function isDotenvFile(lower) {
   if (lower === ".env" || lower.startsWith(".env."))
     return true;
@@ -50972,7 +51243,211 @@ function concat2(chunks) {
   }
   return merged;
 }
-var BLOCK = 512, ANY_SEGMENT_EXCLUDES, ROOT_EXCLUDES, TOOL_SIDECAR_FILENAMES, CREDENTIAL_FILENAMES, CREDENTIAL_EXTENSIONS, ENV_TEMPLATE_NAMES, NON_DOTENV_EXTENSIONS, SKILL_BUNDLE_INSPECTION_LIMITS;
+function invalidBundle(message) {
+  throw new SkillBundleInspectionError("BUNDLE_INVALID", message);
+}
+function inspectionLimits(options) {
+  const limits = { ...SKILL_BUNDLE_INSPECTION_LIMITS };
+  for (const key of Object.keys(options.limits ?? {})) {
+    if (!Object.hasOwn(limits, key))
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Unknown bundle limit");
+    const field = key;
+    const value = options.limits[field];
+    if (!Number.isSafeInteger(value) || value <= 0 || value > limits[field]) {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle limits must be positive integers within the hard ceilings");
+    }
+    limits[field] = value;
+  }
+  return limits;
+}
+async function inspectSkillBundle(bundle, options = {}) {
+  const signal = options.signal;
+  const limits = inspectionLimits(options);
+  const deadline = performance.now() + limits.timeoutMs;
+  const check = () => {
+    if (signal?.aborted)
+      throw new SkillBundleInspectionError("BUNDLE_ABORTED", "Bundle inspection aborted");
+    if (performance.now() >= deadline)
+      throw new SkillBundleInspectionError("BUNDLE_TIMEOUT", "Bundle inspection deadline exceeded");
+  };
+  check();
+  if (bundle.byteLength > limits.compressedBytes)
+    throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Compressed bundle exceeds byte limit");
+  const snapshot = ownBytes(bundle);
+  check();
+  const sha2562 = sha256Hex(snapshot);
+  check();
+  const parser = new BoundedTarReader(limits, check);
+  const streamOptions = { chunkSize: 16 * 1024, highWaterMark: 16 * 1024 };
+  const decoder = createGunzip(streamOptions);
+  let terminalError;
+  const stop = (code) => {
+    terminalError ??= new SkillBundleInspectionError(code, code === "BUNDLE_ABORTED" ? "Bundle inspection aborted" : "Bundle inspection deadline exceeded");
+    decoder.destroy(terminalError);
+  };
+  const onAbort = () => stop("BUNDLE_ABORTED");
+  const timer = setTimeout(() => stop("BUNDLE_TIMEOUT"), Math.max(1, deadline - performance.now()));
+  signal?.addEventListener("abort", onAbort, { once: true });
+  let decompressedByteSize = 0;
+  let bytesSinceYield = 0;
+  try {
+    check();
+    decoder.end(snapshot);
+    for await (const chunk2 of decoder) {
+      check();
+      decompressedByteSize += chunk2.byteLength;
+      if (decompressedByteSize > limits.decompressedBytes)
+        throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Decompressed bundle exceeds byte limit");
+      parser.push(chunk2);
+      bytesSinceYield += chunk2.byteLength;
+      if (bytesSinceYield >= 256 * 1024) {
+        await new Promise((resolve3) => setTimeout(resolve3, 0));
+        bytesSinceYield = 0;
+        check();
+      }
+    }
+    check();
+    const entries = parser.finish();
+    return {
+      entries,
+      sha256: sha2562,
+      compressedByteSize: snapshot.byteLength,
+      decompressedByteSize,
+      unpackedByteSize: parser.fileBytes,
+      fileCount: entries.length
+    };
+  } catch (error) {
+    if (terminalError)
+      throw terminalError;
+    if (error instanceof SkillBundleInspectionError)
+      throw error;
+    throw new SkillBundleInspectionError("BUNDLE_INVALID", "Invalid or truncated gzip bundle");
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", onAbort);
+    decoder.destroy();
+  }
+}
+
+class BoundedTarReader {
+  limits;
+  check;
+  header = new Uint8Array(BLOCK);
+  headerOffset = 0;
+  pending;
+  bodyOffset = 0;
+  padding = 0;
+  zeroBlocks = 0;
+  entries = [];
+  paths = new SkillEntryPaths;
+  fileBytes = 0;
+  constructor(limits, check) {
+    this.limits = limits;
+    this.check = check;
+  }
+  push(chunk2) {
+    let offset = 0;
+    while (offset < chunk2.byteLength) {
+      this.check();
+      if (this.pending) {
+        const count = Math.min(this.pending.bytes.byteLength - this.bodyOffset, chunk2.byteLength - offset);
+        this.pending.bytes.set(chunk2.subarray(offset, offset + count), this.bodyOffset);
+        offset += count;
+        this.bodyOffset += count;
+        if (this.bodyOffset === this.pending.bytes.byteLength) {
+          this.entries.push(this.pending);
+          this.pending = undefined;
+        }
+      } else if (this.padding) {
+        const count = Math.min(this.padding, chunk2.byteLength - offset);
+        if (chunk2.subarray(offset, offset + count).some((byte) => byte !== 0))
+          invalidBundle("Nonzero tar body padding");
+        offset += count;
+        this.padding -= count;
+      } else {
+        const count = Math.min(BLOCK - this.headerOffset, chunk2.byteLength - offset);
+        this.header.set(chunk2.subarray(offset, offset + count), this.headerOffset);
+        offset += count;
+        this.headerOffset += count;
+        if (this.headerOffset === BLOCK) {
+          this.readHeader();
+          this.headerOffset = 0;
+        }
+      }
+    }
+  }
+  finish() {
+    this.check();
+    if (this.pending || this.padding || this.headerOffset || this.zeroBlocks < 2)
+      invalidBundle("Truncated tar bundle");
+    return this.entries;
+  }
+  readHeader() {
+    this.check();
+    const h = this.header;
+    if (h.every((byte) => byte === 0)) {
+      this.zeroBlocks++;
+      return;
+    }
+    if (this.zeroBlocks)
+      invalidBundle("Nonzero tar data after terminator");
+    if (this.entries.length >= this.limits.entries)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle entry limit exceeded");
+    let checksum = 0;
+    for (let i = 0;i < BLOCK; i++)
+      checksum += i >= 148 && i < 156 ? 32 : h[i];
+    if (tarOctal(h.subarray(148, 156)) !== checksum)
+      invalidBundle("Invalid tar header checksum");
+    if (new TextDecoder().decode(h.subarray(257, 265)) !== "ustar\x00" + "00")
+      invalidBundle("Unsupported tar format");
+    if (h[156] !== 48 && h[156] !== 0 || h.subarray(157, 257).some((b) => b !== 0) || h.subarray(345).some((b) => b !== 0))
+      invalidBundle("Unsupported tar entry or path prefix");
+    const mode = tarOctal(h.subarray(100, 108));
+    if (mode > 511)
+      invalidBundle("Unsupported tar permission bits");
+    tarOctal(h.subarray(108, 116));
+    tarOctal(h.subarray(116, 124));
+    tarOctal(h.subarray(136, 148));
+    const size2 = tarOctal(h.subarray(124, 136));
+    if (size2 > this.limits.fileBytes || this.fileBytes + size2 > this.limits.decompressedBytes) {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle file byte limit exceeded");
+    }
+    const name = h.subarray(0, 100);
+    const end = name.indexOf(0);
+    if (end !== -1 && name.subarray(end).some((b) => b !== 0))
+      invalidBundle("Invalid tar path padding");
+    const raw = end === -1 ? name : name.subarray(0, end);
+    if (raw.byteLength > this.limits.pathBytes)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    let path;
+    try {
+      path = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw);
+    } catch {
+      return invalidBundle("Invalid UTF-8 bundle path");
+    }
+    this.paths.add(path, this.limits.pathBytes, invalidBundle, () => {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    });
+    this.fileBytes += size2;
+    this.pending = { path, mode, bytes: new Uint8Array(new ArrayBuffer(size2)) };
+    this.bodyOffset = 0;
+    this.padding = (BLOCK - size2 % BLOCK) % BLOCK;
+    if (!size2) {
+      this.entries.push(this.pending);
+      this.pending = undefined;
+    }
+  }
+}
+function tarOctal(field) {
+  const text2 = new TextDecoder().decode(field);
+  if (!/^[0-7]+[\0 ]*$/.test(text2))
+    invalidBundle("Invalid tar octal field");
+  const value = Number.parseInt(text2, 8);
+  if (!Number.isSafeInteger(value))
+    invalidBundle("Tar integer is out of range");
+  return value;
+}
+var BLOCK = 512, ANY_SEGMENT_EXCLUDES, ROOT_EXCLUDES, TOOL_SIDECAR_FILENAMES, CREDENTIAL_FILENAMES, CREDENTIAL_EXTENSIONS, ENV_TEMPLATE_NAMES, NON_DOTENV_EXTENSIONS, SKILL_BUNDLE_INSPECTION_LIMITS, SkillBundleInspectionError;
 var init_skill_bundle = __esm(() => {
   ANY_SEGMENT_EXCLUDES = new Set([
     ".git",
@@ -51104,6 +51579,14 @@ var init_skill_bundle = __esm(() => {
     pathBytes: 100,
     timeoutMs: 5000
   });
+  SkillBundleInspectionError = class SkillBundleInspectionError extends Error {
+    code;
+    constructor(code, message) {
+      super(message);
+      this.code = code;
+      this.name = "SkillBundleInspectionError";
+    }
+  };
 });
 
 // src/lib/skill-version.ts
@@ -51559,8 +52042,8 @@ var init_pull = __esm(() => {
 // src/cli/commands/install.ts
 var exports_install = {};
 __export(exports_install, {
-  pinExactVersion: () => pinExactVersion,
-  registerInstall: () => registerInstall
+  registerInstall: () => registerInstall,
+  pinExactVersion: () => pinExactVersion
 });
 function registerInstall(parent) {
   parent.command("install").argument("[args...]", "Deprecated. Use 'skills pin <name>' for project skill pins.").option("--json", "Output result as JSON", false).description("Deprecated. Render skills into native agent folders with 'skills render'.").action((args, options) => handleDeprecatedInstall(args, options));
@@ -52239,14 +52722,14 @@ var init_list = __esm(() => {
 // src/lib/skillinfo.ts
 var exports_skillinfo = {};
 __export(exports_skillinfo, {
-  detectProjectSkills: () => detectProjectSkills,
-  generateEnvExample: () => generateEnvExample,
-  generateSkillMd: () => generateSkillMd,
-  getSkillBestDoc: () => getSkillBestDoc,
-  getSkillDependencyStatus: () => getSkillDependencyStatus,
-  getSkillDocs: () => getSkillDocs,
+  runSkill: () => runSkill,
   getSkillRequirements: () => getSkillRequirements,
-  runSkill: () => runSkill
+  getSkillDocs: () => getSkillDocs,
+  getSkillDependencyStatus: () => getSkillDependencyStatus,
+  getSkillBestDoc: () => getSkillBestDoc,
+  generateSkillMd: () => generateSkillMd,
+  generateEnvExample: () => generateEnvExample,
+  detectProjectSkills: () => detectProjectSkills
 });
 import { existsSync as existsSync19, readFileSync as readFileSync15 } from "fs";
 import { join as join21 } from "path";
@@ -53718,7 +54201,7 @@ var init_init = __esm(() => {
 });
 
 // src/lib/home-adoption.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync9, readdirSync as readdirSync10, readFileSync as readFileSync18, rmSync as rmSync6, statSync as statSync11, writeFileSync as writeFileSync10 } from "fs";
+import { constants as constants3, closeSync as closeSync3, fstatSync as fstatSync3, lstatSync as lstatSync5, openSync as openSync3, readSync as readSync2, existsSync as existsSync22, mkdirSync as mkdirSync9, readdirSync as readdirSync10, readFileSync as readFileSync18, rmSync as rmSync6, statSync as statSync11, writeFileSync as writeFileSync10 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join24 } from "path";
 function indexCanonicalCorpus(corpusRoot) {
@@ -53870,6 +54353,41 @@ function adoptUnmarkedHomes(options = {}) {
   }
   return { ...scan, applied: true, rollbackFile };
 }
+function pruneOwnership(dir) {
+  let descriptor;
+  try {
+    const directory = lstatSync5(dir);
+    if (!directory.isDirectory())
+      return;
+    const markerPath = join24(dir, SYNC_MARKER_FILE), markerPathBefore = lstatSync5(markerPath);
+    if (!markerPathBefore.isFile())
+      return;
+    descriptor = openSync3(markerPath, constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
+    const before2 = fstatSync3(descriptor);
+    if (!before2.isFile() || before2.dev !== markerPathBefore.dev || before2.ino !== markerPathBefore.ino || before2.size !== markerPathBefore.size || before2.mtimeMs !== markerPathBefore.mtimeMs || before2.ctimeMs !== markerPathBefore.ctimeMs || before2.size < 1 || before2.size > 65536)
+      return;
+    const bytes = Buffer.alloc(before2.size + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const count = readSync2(descriptor, bytes, length, bytes.length - length, length);
+      if (!count)
+        break;
+      length += count;
+    }
+    const after2 = fstatSync3(descriptor), current = lstatSync5(dir), markerPathAfter = lstatSync5(markerPath);
+    if (!markerPathAfter.isFile() || markerPathAfter.dev !== before2.dev || markerPathAfter.ino !== before2.ino || markerPathAfter.size !== before2.size || markerPathAfter.mtimeMs !== before2.mtimeMs || markerPathAfter.ctimeMs !== before2.ctimeMs || length !== before2.size || after2.size !== before2.size || after2.mtimeMs !== before2.mtimeMs || after2.ctimeMs !== before2.ctimeMs || !current.isDirectory() || current.dev !== directory.dev || current.ino !== directory.ino)
+      return;
+    const text2 = bytes.subarray(0, length).toString("utf8"), marker = JSON.parse(text2);
+    if (!isSkillsOwnershipMarker(marker))
+      return;
+    return { marker, identity: JSON.stringify([directory.dev, directory.ino, before2.dev, before2.ino, before2.mtimeMs, before2.ctimeMs, text2]) };
+  } catch {
+    return;
+  } finally {
+    if (descriptor !== undefined)
+      closeSync3(descriptor);
+  }
+}
 function pruneStrayHomes(options = {}) {
   const homeDir2 = options.homeDir ?? homedir5();
   const corpusRoot = resolveCorpusRoot(options);
@@ -53877,6 +54395,7 @@ function pruneStrayHomes(options = {}) {
   const agents = options.agents?.length ? options.agents : [...SYNC_AGENTS];
   const names = selectedHomeNames(options, index, homeDir2, agents);
   const candidates = [];
+  const ownership = new Map;
   for (const agent of agents) {
     const home = agentGlobalSkillsDir(agent, homeDir2);
     if (!existsSync22(home))
@@ -53899,20 +54418,13 @@ function pruneStrayHomes(options = {}) {
       } catch {
         continue;
       }
-      const markerPath = join24(dir, SYNC_MARKER_FILE);
-      if (!existsSync22(markerPath))
-        continue;
       if (index.has(skill))
         continue;
-      let marker;
-      try {
-        const parsed = JSON.parse(readFileSync18(markerPath, "utf-8"));
-        if (!parsed || typeof parsed !== "object" || parsed.managedBy !== SYNC_MARKER_MANAGED_BY)
-          continue;
-        marker = parsed;
-      } catch {
+      const owned = pruneOwnership(dir);
+      if (!owned)
         continue;
-      }
+      const marker = owned.marker;
+      ownership.set(dir, owned.identity);
       const skillMdPath = join24(dir, "SKILL.md");
       const hash = existsSync22(skillMdPath) ? hashSkillMarkdownFile(skillMdPath) : "";
       candidates.push({ agent, skill, home, path: dir, hash, marker });
@@ -53923,10 +54435,14 @@ function pruneStrayHomes(options = {}) {
   }
   const appDir = options.homeDir ? join24(options.homeDir, ".hasna", "skills") : getDataDir();
   const rollbackFile = writeRollbackRecord("prune", candidates.map(({ agent, skill, path, hash, marker }) => ({ agent, skill, path, hash, marker })), appDir);
+  let pruned = 0;
   for (const candidate of candidates) {
+    if (pruneOwnership(candidate.path)?.identity !== ownership.get(candidate.path))
+      continue;
     rmSync6(candidate.path, { recursive: true, force: true });
+    pruned++;
   }
-  return { candidates, pruned: candidates.length, dryRun: false, rollbackFile };
+  return { candidates, pruned, dryRun: false, rollbackFile };
 }
 var CONFLICTS_LEDGER_FILE = "conflicts.json", ROLLBACK_DIRNAME = "rollback";
 var init_home_adoption = __esm(() => {
@@ -54054,7 +54570,7 @@ var init_home_census = __esm(() => {
 });
 
 // src/cli/env-assignment.ts
-import { closeSync as closeSync3, constants as constants3, fstatSync as fstatSync3, ftruncateSync, lstatSync as lstatSync5, openSync as openSync3, readFileSync as readFileSync20, writeSync } from "fs";
+import { closeSync as closeSync4, constants as constants4, fstatSync as fstatSync4, ftruncateSync, lstatSync as lstatSync6, openSync as openSync4, readFileSync as readFileSync20, writeSync } from "fs";
 function serializeValue(value) {
   if (controls.test(value))
     throw new EnvAssignmentError("Environment values cannot contain control characters or newlines.");
@@ -54133,7 +54649,7 @@ function setEnvAssignment(path, assignment) {
   try {
     const previous = (() => {
       try {
-        return lstatSync5(path);
+        return lstatSync6(path);
       } catch (error) {
         if (error.code === "ENOENT")
           return;
@@ -54142,8 +54658,8 @@ function setEnvAssignment(path, assignment) {
     })();
     if (previous && !previous.isFile())
       throw new EnvAssignmentError("The project .env must be a regular file, not a symlink or special file.");
-    descriptor = openSync3(path, previous ? constants3.O_RDWR | constants3.O_NOFOLLOW | constants3.O_NONBLOCK : constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
-    const opened = fstatSync3(descriptor);
+    descriptor = openSync4(path, previous ? constants4.O_RDWR | constants4.O_NOFOLLOW | constants4.O_NONBLOCK : constants4.O_WRONLY | constants4.O_CREAT | constants4.O_EXCL | constants4.O_NOFOLLOW, 384);
+    const opened = fstatSync4(descriptor);
     if (!opened.isFile() || previous && (opened.ino !== previous.ino || opened.dev !== previous.dev)) {
       throw new EnvAssignmentError("The project .env changed while opening it; retry with a regular file.");
     }
@@ -54170,7 +54686,7 @@ function setEnvAssignment(path, assignment) {
     throw new EnvAssignmentError("Cannot safely read or write the project .env file.");
   } finally {
     if (descriptor !== undefined)
-      closeSync3(descriptor);
+      closeSync4(descriptor);
   }
 }
 var INVALID_LAYOUT = "Cannot safely update .env with multiline or unsupported assignments. Use single-line KEY=VALUE entries or edit the file manually.", controls, EnvAssignmentError;
@@ -54533,10 +55049,10 @@ var init_diagnostic = __esm(() => {
 // src/lib/blog-article.ts
 var exports_blog_article = {};
 __export(exports_blog_article, {
-  ARTICLE_COUNT_ERROR: () => ARTICLE_COUNT_ERROR,
-  ARTICLE_GENERATION_SLUG: () => ARTICLE_GENERATION_SLUG,
+  validateBlogArticleRunOptions: () => validateBlogArticleRunOptions,
   ARTICLE_MAX_COUNT: () => ARTICLE_MAX_COUNT,
-  validateBlogArticleRunOptions: () => validateBlogArticleRunOptions
+  ARTICLE_GENERATION_SLUG: () => ARTICLE_GENERATION_SLUG,
+  ARTICLE_COUNT_ERROR: () => ARTICLE_COUNT_ERROR
 });
 function validateBlogArticleRunOptions(input, args = [], validation = {}) {
   const options = collectRunOptions(input, args);
@@ -54976,55 +55492,55 @@ var init_core = __esm(() => {
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v4/core/util.js
 var exports_util = {};
 __export(exports_util, {
-  BIGINT_FORMAT_RANGES: () => BIGINT_FORMAT_RANGES,
-  Class: () => Class,
-  NUMBER_FORMAT_RANGES: () => NUMBER_FORMAT_RANGES,
-  aborted: () => aborted,
-  allowsEval: () => allowsEval,
-  assert: () => assert,
-  assertEqual: () => assertEqual,
-  assertIs: () => assertIs,
-  assertNever: () => assertNever,
-  assertNotEqual: () => assertNotEqual,
-  assignProp: () => assignProp,
-  cached: () => cached,
-  captureStackTrace: () => captureStackTrace,
-  cleanEnum: () => cleanEnum,
-  cleanRegex: () => cleanRegex,
-  clone: () => clone3,
-  createTransparentProxy: () => createTransparentProxy,
-  defineLazy: () => defineLazy,
-  esc: () => esc,
-  escapeRegex: () => escapeRegex,
-  extend: () => extend,
-  finalizeIssue: () => finalizeIssue,
-  floatSafeRemainder: () => floatSafeRemainder2,
-  getElementAtPath: () => getElementAtPath,
-  getEnumValues: () => getEnumValues,
-  getLengthableOrigin: () => getLengthableOrigin,
-  getParsedType: () => getParsedType2,
-  getSizableOrigin: () => getSizableOrigin,
-  isObject: () => isObject2,
-  isPlainObject: () => isPlainObject2,
-  issue: () => issue,
-  joinValues: () => joinValues,
-  jsonStringifyReplacer: () => jsonStringifyReplacer,
-  merge: () => merge2,
-  normalizeParams: () => normalizeParams,
-  nullish: () => nullish,
-  numKeys: () => numKeys,
-  omit: () => omit2,
-  optionalKeys: () => optionalKeys,
-  partial: () => partial2,
-  pick: () => pick2,
-  prefixIssues: () => prefixIssues,
-  primitiveTypes: () => primitiveTypes,
-  promiseAllObject: () => promiseAllObject,
-  propertyKeyTypes: () => propertyKeyTypes,
-  randomString: () => randomString,
-  required: () => required,
+  unwrapMessage: () => unwrapMessage,
   stringifyPrimitive: () => stringifyPrimitive,
-  unwrapMessage: () => unwrapMessage
+  required: () => required,
+  randomString: () => randomString,
+  propertyKeyTypes: () => propertyKeyTypes,
+  promiseAllObject: () => promiseAllObject,
+  primitiveTypes: () => primitiveTypes,
+  prefixIssues: () => prefixIssues,
+  pick: () => pick2,
+  partial: () => partial2,
+  optionalKeys: () => optionalKeys,
+  omit: () => omit2,
+  numKeys: () => numKeys,
+  nullish: () => nullish,
+  normalizeParams: () => normalizeParams,
+  merge: () => merge2,
+  jsonStringifyReplacer: () => jsonStringifyReplacer,
+  joinValues: () => joinValues,
+  issue: () => issue,
+  isPlainObject: () => isPlainObject2,
+  isObject: () => isObject2,
+  getSizableOrigin: () => getSizableOrigin,
+  getParsedType: () => getParsedType2,
+  getLengthableOrigin: () => getLengthableOrigin,
+  getEnumValues: () => getEnumValues,
+  getElementAtPath: () => getElementAtPath,
+  floatSafeRemainder: () => floatSafeRemainder2,
+  finalizeIssue: () => finalizeIssue,
+  extend: () => extend,
+  escapeRegex: () => escapeRegex,
+  esc: () => esc,
+  defineLazy: () => defineLazy,
+  createTransparentProxy: () => createTransparentProxy,
+  clone: () => clone3,
+  cleanRegex: () => cleanRegex,
+  cleanEnum: () => cleanEnum,
+  captureStackTrace: () => captureStackTrace,
+  cached: () => cached,
+  assignProp: () => assignProp,
+  assertNotEqual: () => assertNotEqual,
+  assertNever: () => assertNever,
+  assertIs: () => assertIs,
+  assertEqual: () => assertEqual,
+  assert: () => assert,
+  allowsEval: () => allowsEval,
+  aborted: () => aborted,
+  NUMBER_FORMAT_RANGES: () => NUMBER_FORMAT_RANGES,
+  Class: () => Class,
+  BIGINT_FORMAT_RANGES: () => BIGINT_FORMAT_RANGES
 });
 function assertEqual(val) {
   return val;
@@ -58763,14 +59279,14 @@ var init_checks2 = __esm(() => {
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v4/classic/iso.js
 var exports_iso = {};
 __export(exports_iso, {
-  ZodISODate: () => ZodISODate,
-  ZodISODateTime: () => ZodISODateTime,
-  ZodISODuration: () => ZodISODuration,
-  ZodISOTime: () => ZodISOTime,
-  date: () => date2,
-  datetime: () => datetime2,
+  time: () => time2,
   duration: () => duration2,
-  time: () => time2
+  datetime: () => datetime2,
+  date: () => date2,
+  ZodISOTime: () => ZodISOTime,
+  ZodISODuration: () => ZodISODuration,
+  ZodISODateTime: () => ZodISODateTime,
+  ZodISODate: () => ZodISODate
 });
 function datetime2(params) {
   return _isoDateTime(ZodISODateTime, params);
@@ -62992,7 +63508,7 @@ var init_protocol = __esm(() => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
-var require_code = __commonJS(function(exports) {
+var require_code = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.regexpCode = exports.getEsmExportName = exports.getProperty = exports.safeStringify = exports.stringify = exports.strConcat = exports.addCodeArg = exports.str = exports._ = exports.nil = exports._Code = exports.Name = exports.IDENTIFIER = exports._CodeOrName = undefined;
 
@@ -63146,7 +63662,7 @@ var require_code = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/scope.js
-var require_scope = __commonJS(function(exports) {
+var require_scope = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.ValueScope = exports.ValueScopeName = exports.Scope = exports.varKinds = exports.UsedValueState = undefined;
   var code_1 = require_code();
@@ -63292,7 +63808,7 @@ var require_scope = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/index.js
-var require_codegen = __commonJS(function(exports) {
+var require_codegen = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.or = exports.and = exports.not = exports.CodeGen = exports.operators = exports.varKinds = exports.ValueScopeName = exports.ValueScope = exports.Scope = exports.Name = exports.regexpCode = exports.stringify = exports.getProperty = exports.nil = exports.strConcat = exports.str = exports._ = undefined;
   var code_1 = require_code();
@@ -63369,11 +63885,11 @@ var require_codegen = __commonJS(function(exports) {
       const rhs = this.rhs === undefined ? "" : ` = ${this.rhs}`;
       return `${varKind} ${this.name}${rhs};` + _n;
     }
-    optimizeNames(names, constants4) {
+    optimizeNames(names, constants5) {
       if (!names[this.name.str])
         return;
       if (this.rhs)
-        this.rhs = optimizeExpr(this.rhs, names, constants4);
+        this.rhs = optimizeExpr(this.rhs, names, constants5);
       return this;
     }
     get names() {
@@ -63391,10 +63907,10 @@ var require_codegen = __commonJS(function(exports) {
     render({ _n }) {
       return `${this.lhs} = ${this.rhs};` + _n;
     }
-    optimizeNames(names, constants4) {
+    optimizeNames(names, constants5) {
       if (this.lhs instanceof code_1.Name && !names[this.lhs.str] && !this.sideEffects)
         return;
-      this.rhs = optimizeExpr(this.rhs, names, constants4);
+      this.rhs = optimizeExpr(this.rhs, names, constants5);
       return this;
     }
     get names() {
@@ -63460,8 +63976,8 @@ var require_codegen = __commonJS(function(exports) {
     optimizeNodes() {
       return `${this.code}` ? this : undefined;
     }
-    optimizeNames(names, constants4) {
-      this.code = optimizeExpr(this.code, names, constants4);
+    optimizeNames(names, constants5) {
+      this.code = optimizeExpr(this.code, names, constants5);
       return this;
     }
     get names() {
@@ -63491,12 +64007,12 @@ var require_codegen = __commonJS(function(exports) {
       }
       return nodes.length > 0 ? this : undefined;
     }
-    optimizeNames(names, constants4) {
+    optimizeNames(names, constants5) {
       const { nodes } = this;
       let i = nodes.length;
       while (i--) {
         const n = nodes[i];
-        if (n.optimizeNames(names, constants4))
+        if (n.optimizeNames(names, constants5))
           continue;
         subtractNames(names, n.names);
         nodes.splice(i, 1);
@@ -63553,12 +64069,12 @@ var require_codegen = __commonJS(function(exports) {
         return;
       return this;
     }
-    optimizeNames(names, constants4) {
+    optimizeNames(names, constants5) {
       var _a;
-      this.else = (_a = this.else) === null || _a === undefined ? undefined : _a.optimizeNames(names, constants4);
-      if (!(super.optimizeNames(names, constants4) || this.else))
+      this.else = (_a = this.else) === null || _a === undefined ? undefined : _a.optimizeNames(names, constants5);
+      if (!(super.optimizeNames(names, constants5) || this.else))
         return;
-      this.condition = optimizeExpr(this.condition, names, constants4);
+      this.condition = optimizeExpr(this.condition, names, constants5);
       return this;
     }
     get names() {
@@ -63583,10 +64099,10 @@ var require_codegen = __commonJS(function(exports) {
     render(opts) {
       return `for(${this.iteration})` + super.render(opts);
     }
-    optimizeNames(names, constants4) {
-      if (!super.optimizeNames(names, constants4))
+    optimizeNames(names, constants5) {
+      if (!super.optimizeNames(names, constants5))
         return;
-      this.iteration = optimizeExpr(this.iteration, names, constants4);
+      this.iteration = optimizeExpr(this.iteration, names, constants5);
       return this;
     }
     get names() {
@@ -63624,10 +64140,10 @@ var require_codegen = __commonJS(function(exports) {
     render(opts) {
       return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
     }
-    optimizeNames(names, constants4) {
-      if (!super.optimizeNames(names, constants4))
+    optimizeNames(names, constants5) {
+      if (!super.optimizeNames(names, constants5))
         return;
-      this.iterable = optimizeExpr(this.iterable, names, constants4);
+      this.iterable = optimizeExpr(this.iterable, names, constants5);
       return this;
     }
     get names() {
@@ -63672,11 +64188,11 @@ var require_codegen = __commonJS(function(exports) {
       (_b = this.finally) === null || _b === undefined || _b.optimizeNodes();
       return this;
     }
-    optimizeNames(names, constants4) {
+    optimizeNames(names, constants5) {
       var _a, _b;
-      super.optimizeNames(names, constants4);
-      (_a = this.catch) === null || _a === undefined || _a.optimizeNames(names, constants4);
-      (_b = this.finally) === null || _b === undefined || _b.optimizeNames(names, constants4);
+      super.optimizeNames(names, constants5);
+      (_a = this.catch) === null || _a === undefined || _a.optimizeNames(names, constants5);
+      (_b = this.finally) === null || _b === undefined || _b.optimizeNames(names, constants5);
       return this;
     }
     get names() {
@@ -63950,7 +64466,7 @@ var require_codegen = __commonJS(function(exports) {
   function addExprNames(names, from) {
     return from instanceof code_1._CodeOrName ? addNames(names, from.names) : names;
   }
-  function optimizeExpr(expr, names, constants4) {
+  function optimizeExpr(expr, names, constants5) {
     if (expr instanceof code_1.Name)
       return replaceName(expr);
     if (!canOptimize(expr))
@@ -63965,14 +64481,14 @@ var require_codegen = __commonJS(function(exports) {
       return items;
     }, []));
     function replaceName(n) {
-      const c = constants4[n.str];
+      const c = constants5[n.str];
       if (c === undefined || names[n.str] !== 1)
         return n;
       delete names[n.str];
       return c;
     }
     function canOptimize(e) {
-      return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants4[c.str] !== undefined);
+      return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants5[c.str] !== undefined);
     }
   }
   function subtractNames(names, from) {
@@ -64002,7 +64518,7 @@ var require_codegen = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/util.js
-var require_util = __commonJS(function(exports) {
+var require_util = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.checkStrictMode = exports.getErrorPath = exports.Type = exports.useFunc = exports.setEvaluated = exports.evaluatedPropsToName = exports.mergeEvaluated = exports.eachItem = exports.unescapeJsonPointer = exports.escapeJsonPointer = exports.escapeFragment = exports.unescapeFragment = exports.schemaRefOrVal = exports.schemaHasRulesButRef = exports.schemaHasRules = exports.checkUnknownRules = exports.alwaysValidSchema = exports.toHash = undefined;
   var codegen_1 = require_codegen();
@@ -64166,7 +64682,7 @@ var require_util = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/names.js
-var require_names = __commonJS(function(exports) {
+var require_names = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var names = {
@@ -64191,7 +64707,7 @@ var require_names = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/errors.js
-var require_errors = __commonJS(function(exports) {
+var require_errors = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.extendErrors = exports.resetErrorsCount = exports.reportExtraError = exports.reportError = exports.keyword$DataError = exports.keywordError = undefined;
   var codegen_1 = require_codegen();
@@ -64309,7 +64825,7 @@ var require_errors = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/boolSchema.js
-var require_boolSchema = __commonJS(function(exports) {
+var require_boolSchema = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.boolOrEmptySchema = exports.topBoolOrEmptySchema = undefined;
   var errors_1 = require_errors();
@@ -64357,7 +64873,7 @@ var require_boolSchema = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/rules.js
-var require_rules = __commonJS(function(exports) {
+var require_rules = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getRules = exports.isJSONType = undefined;
   var _jsonTypes = ["string", "number", "integer", "boolean", "null", "object", "array"];
@@ -64385,7 +64901,7 @@ var require_rules = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/applicability.js
-var require_applicability = __commonJS(function(exports) {
+var require_applicability = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.shouldUseRule = exports.shouldUseGroup = exports.schemaHasRulesForType = undefined;
   function schemaHasRulesForType({ schema, self: self2 }, type) {
@@ -64405,7 +64921,7 @@ var require_applicability = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/dataType.js
-var require_dataType = __commonJS(function(exports) {
+var require_dataType = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.reportTypeError = exports.checkDataTypes = exports.checkDataType = exports.coerceAndCheckDataType = exports.getJSONTypes = exports.getSchemaTypes = exports.DataType = undefined;
   var rules_1 = require_rules();
@@ -64586,7 +65102,7 @@ var require_dataType = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/defaults.js
-var require_defaults = __commonJS(function(exports) {
+var require_defaults = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.assignDefaults = undefined;
   var codegen_1 = require_codegen();
@@ -64620,7 +65136,7 @@ var require_defaults = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/code.js
-var require_code2 = __commonJS(function(exports) {
+var require_code2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateUnion = exports.validateArray = exports.usePattern = exports.callValidateCode = exports.schemaProperties = exports.allSchemaProperties = exports.noPropertyInData = exports.propertyInData = exports.isOwnProperty = exports.hasPropFunc = exports.reportMissingProp = exports.checkMissingProp = exports.checkReportMissingProp = undefined;
   var codegen_1 = require_codegen();
@@ -64749,7 +65265,7 @@ var require_code2 = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/keyword.js
-var require_keyword = __commonJS(function(exports) {
+var require_keyword = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateKeywordUsage = exports.validSchemaType = exports.funcKeywordCode = exports.macroKeywordCode = undefined;
   var codegen_1 = require_codegen();
@@ -64864,7 +65380,7 @@ var require_keyword = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/subschema.js
-var require_subschema = __commonJS(function(exports) {
+var require_subschema = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.extendSubschemaMode = exports.extendSubschemaData = exports.getSubschema = undefined;
   var codegen_1 = require_codegen();
@@ -64944,7 +65460,7 @@ var require_subschema = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/fast-deep-equal@3.1.3/node_modules/fast-deep-equal/index.js
-var require_fast_deep_equal = __commonJS(function(exports, module) {
+var require_fast_deep_equal = __commonJS((exports, module) => {
   module.exports = function equal(a, b) {
     if (a === b)
       return true;
@@ -64986,7 +65502,7 @@ var require_fast_deep_equal = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/json-schema-traverse@1.0.0/node_modules/json-schema-traverse/index.js
-var require_json_schema_traverse = __commonJS(function(exports, module) {
+var require_json_schema_traverse = __commonJS((exports, module) => {
   var traverse = module.exports = function(schema, opts, cb) {
     if (typeof opts == "function") {
       cb = opts;
@@ -65069,7 +65585,7 @@ var require_json_schema_traverse = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/resolve.js
-var require_resolve = __commonJS(function(exports) {
+var require_resolve = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getSchemaRefs = exports.resolveUrl = exports.normalizeId = exports._getFullPath = exports.getFullPath = exports.inlineRef = undefined;
   var util_1 = require_util();
@@ -65222,7 +65738,7 @@ var require_resolve = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/index.js
-var require_validate = __commonJS(function(exports) {
+var require_validate = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getData = exports.KeywordCxt = exports.validateFunctionCode = undefined;
   var boolSchema_1 = require_boolSchema();
@@ -65727,7 +66243,7 @@ var require_validate = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/runtime/validation_error.js
-var require_validation_error = __commonJS(function(exports) {
+var require_validation_error = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
 
   class ValidationError extends Error {
@@ -65741,7 +66257,7 @@ var require_validation_error = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/ref_error.js
-var require_ref_error = __commonJS(function(exports) {
+var require_ref_error = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var resolve_1 = require_resolve();
 
@@ -65756,7 +66272,7 @@ var require_ref_error = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/index.js
-var require_compile = __commonJS(function(exports) {
+var require_compile = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.resolveSchema = exports.getCompilingSchema = exports.resolveRef = exports.compileSchema = exports.SchemaEnv = undefined;
   var codegen_1 = require_codegen();
@@ -65977,7 +66493,7 @@ var require_compile = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/refs/data.json
-var require_data = __commonJS(function(exports, module) {
+var require_data = __commonJS((exports, module) => {
   module.exports = {
     $id: "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#",
     description: "Meta-schema for $data reference (JSON AnySchema extension proposal)",
@@ -65994,7 +66510,7 @@ var require_data = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/lib/utils.js
-var require_utils = __commonJS(function(exports, module) {
+var require_utils = __commonJS((exports, module) => {
   var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
   var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
   var isPort = RegExp.prototype.test.bind(/^\d*$/u);
@@ -66511,7 +67027,7 @@ var require_utils = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/lib/schemes.js
-var require_schemes = __commonJS(function(exports, module) {
+var require_schemes = __commonJS((exports, module) => {
   var { isUUID } = require_utils();
   var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
   var supportedSchemeNames = [
@@ -66686,7 +67202,7 @@ var require_schemes = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/index.js
-var require_fast_uri = __commonJS(function(exports, module) {
+var require_fast_uri = __commonJS((exports, module) => {
   var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
   var { SCHEMES, getSchemeHandler } = require_schemes();
   var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
@@ -67088,7 +67604,7 @@ var require_fast_uri = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/runtime/uri.js
-var require_uri = __commonJS(function(exports) {
+var require_uri = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var uri = require_fast_uri();
   uri.code = 'require("ajv/dist/runtime/uri").default';
@@ -67096,7 +67612,7 @@ var require_uri = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/core.js
-var require_core = __commonJS(function(exports) {
+var require_core = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.CodeGen = exports.Name = exports.nil = exports.stringify = exports.str = exports._ = exports.KeywordCxt = undefined;
   var validate_1 = require_validate();
@@ -67689,7 +68205,7 @@ var require_core = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/core/id.js
-var require_id = __commonJS(function(exports) {
+var require_id = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var def = {
     keyword: "id",
@@ -67701,7 +68217,7 @@ var require_id = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/core/ref.js
-var require_ref = __commonJS(function(exports) {
+var require_ref = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.callRef = exports.getValidate = undefined;
   var ref_error_1 = require_ref_error();
@@ -67820,7 +68336,7 @@ var require_ref = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/core/index.js
-var require_core2 = __commonJS(function(exports) {
+var require_core2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var id_1 = require_id();
   var ref_1 = require_ref();
@@ -67838,7 +68354,7 @@ var require_core2 = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitNumber.js
-var require_limitNumber = __commonJS(function(exports) {
+var require_limitNumber = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var ops = codegen_1.operators;
@@ -67867,7 +68383,7 @@ var require_limitNumber = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/multipleOf.js
-var require_multipleOf = __commonJS(function(exports) {
+var require_multipleOf = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var error2 = {
@@ -67892,7 +68408,7 @@ var require_multipleOf = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/runtime/ucs2length.js
-var require_ucs2length = __commonJS(function(exports) {
+var require_ucs2length = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   function ucs2length(str2) {
     const len = str2.length;
@@ -67915,7 +68431,7 @@ var require_ucs2length = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitLength.js
-var require_limitLength = __commonJS(function(exports) {
+var require_limitLength = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -67944,7 +68460,7 @@ var require_limitLength = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/pattern.js
-var require_pattern = __commonJS(function(exports) {
+var require_pattern = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
   var util_1 = require_util();
@@ -67978,7 +68494,7 @@ var require_pattern = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitProperties.js
-var require_limitProperties = __commonJS(function(exports) {
+var require_limitProperties = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var error2 = {
@@ -68004,7 +68520,7 @@ var require_limitProperties = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/required.js
-var require_required = __commonJS(function(exports) {
+var require_required = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
   var codegen_1 = require_codegen();
@@ -68083,7 +68599,7 @@ var require_required = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitItems.js
-var require_limitItems = __commonJS(function(exports) {
+var require_limitItems = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var error2 = {
@@ -68109,7 +68625,7 @@ var require_limitItems = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/runtime/equal.js
-var require_equal = __commonJS(function(exports) {
+var require_equal = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var equal = require_fast_deep_equal();
   equal.code = 'require("ajv/dist/runtime/equal").default';
@@ -68117,7 +68633,7 @@ var require_equal = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/uniqueItems.js
-var require_uniqueItems = __commonJS(function(exports) {
+var require_uniqueItems = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var dataType_1 = require_dataType();
   var codegen_1 = require_codegen();
@@ -68181,7 +68697,7 @@ var require_uniqueItems = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/const.js
-var require_const = __commonJS(function(exports) {
+var require_const = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -68207,7 +68723,7 @@ var require_const = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/enum.js
-var require_enum = __commonJS(function(exports) {
+var require_enum = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -68253,7 +68769,7 @@ var require_enum = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/index.js
-var require_validation = __commonJS(function(exports) {
+var require_validation = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var limitNumber_1 = require_limitNumber();
   var multipleOf_1 = require_multipleOf();
@@ -68283,7 +68799,7 @@ var require_validation = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/additionalItems.js
-var require_additionalItems = __commonJS(function(exports) {
+var require_additionalItems = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateAdditionalItems = undefined;
   var codegen_1 = require_codegen();
@@ -68333,7 +68849,7 @@ var require_additionalItems = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/items.js
-var require_items = __commonJS(function(exports) {
+var require_items = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateTuple = undefined;
   var codegen_1 = require_codegen();
@@ -68387,7 +68903,7 @@ var require_items = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/prefixItems.js
-var require_prefixItems = __commonJS(function(exports) {
+var require_prefixItems = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var items_1 = require_items();
   var def = {
@@ -68401,7 +68917,7 @@ var require_prefixItems = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/items2020.js
-var require_items2020 = __commonJS(function(exports) {
+var require_items2020 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -68433,7 +68949,7 @@ var require_items2020 = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/contains.js
-var require_contains = __commonJS(function(exports) {
+var require_contains = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -68524,7 +69040,7 @@ var require_contains = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/dependencies.js
-var require_dependencies = __commonJS(function(exports) {
+var require_dependencies = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateSchemaDeps = exports.validatePropertyDeps = exports.error = undefined;
   var codegen_1 = require_codegen();
@@ -68609,7 +69125,7 @@ var require_dependencies = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/propertyNames.js
-var require_propertyNames = __commonJS(function(exports) {
+var require_propertyNames = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -68649,7 +69165,7 @@ var require_propertyNames = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/additionalProperties.js
-var require_additionalProperties = __commonJS(function(exports) {
+var require_additionalProperties = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
   var codegen_1 = require_codegen();
@@ -68752,7 +69268,7 @@ var require_additionalProperties = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/properties.js
-var require_properties = __commonJS(function(exports) {
+var require_properties = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var validate_1 = require_validate();
   var code_1 = require_code2();
@@ -68807,7 +69323,7 @@ var require_properties = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/patternProperties.js
-var require_patternProperties = __commonJS(function(exports) {
+var require_patternProperties = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
   var codegen_1 = require_codegen();
@@ -68878,7 +69394,7 @@ var require_patternProperties = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/not.js
-var require_not = __commonJS(function(exports) {
+var require_not = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var util_1 = require_util();
   var def = {
@@ -68906,7 +69422,7 @@ var require_not = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/anyOf.js
-var require_anyOf = __commonJS(function(exports) {
+var require_anyOf = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
   var def = {
@@ -68920,7 +69436,7 @@ var require_anyOf = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/oneOf.js
-var require_oneOf = __commonJS(function(exports) {
+var require_oneOf = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -68975,7 +69491,7 @@ var require_oneOf = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/allOf.js
-var require_allOf = __commonJS(function(exports) {
+var require_allOf = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var util_1 = require_util();
   var def = {
@@ -68999,7 +69515,7 @@ var require_allOf = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/if.js
-var require_if = __commonJS(function(exports) {
+var require_if = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -69065,7 +69581,7 @@ var require_if = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/thenElse.js
-var require_thenElse = __commonJS(function(exports) {
+var require_thenElse = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var util_1 = require_util();
   var def = {
@@ -69080,7 +69596,7 @@ var require_thenElse = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/index.js
-var require_applicator = __commonJS(function(exports) {
+var require_applicator = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var additionalItems_1 = require_additionalItems();
   var prefixItems_1 = require_prefixItems();
@@ -69123,7 +69639,7 @@ var require_applicator = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/format/format.js
-var require_format = __commonJS(function(exports) {
+var require_format = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var error2 = {
@@ -69210,7 +69726,7 @@ var require_format = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/format/index.js
-var require_format2 = __commonJS(function(exports) {
+var require_format2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var format_1 = require_format();
   var format = [format_1.default];
@@ -69218,7 +69734,7 @@ var require_format2 = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/metadata.js
-var require_metadata = __commonJS(function(exports) {
+var require_metadata = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.contentVocabulary = exports.metadataVocabulary = undefined;
   exports.metadataVocabulary = [
@@ -69238,7 +69754,7 @@ var require_metadata = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/draft7.js
-var require_draft7 = __commonJS(function(exports) {
+var require_draft7 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var core_1 = require_core2();
   var validation_1 = require_validation();
@@ -69257,7 +69773,7 @@ var require_draft7 = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/discriminator/types.js
-var require_types = __commonJS(function(exports) {
+var require_types = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.DiscrError = undefined;
   var DiscrError;
@@ -69268,7 +69784,7 @@ var require_types = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/discriminator/index.js
-var require_discriminator = __commonJS(function(exports) {
+var require_discriminator = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var types_1 = require_types();
@@ -69370,7 +69886,7 @@ var require_discriminator = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/refs/json-schema-draft-07.json
-var require_json_schema_draft_07 = __commonJS(function(exports, module) {
+var require_json_schema_draft_07 = __commonJS((exports, module) => {
   module.exports = {
     $schema: "http://json-schema.org/draft-07/schema#",
     $id: "http://json-schema.org/draft-07/schema#",
@@ -69525,7 +70041,7 @@ var require_json_schema_draft_07 = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/ajv.js
-var require_ajv = __commonJS(function(exports, module) {
+var require_ajv = __commonJS((exports, module) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.MissingRefError = exports.ValidationError = exports.CodeGen = exports.Name = exports.nil = exports.stringify = exports.str = exports._ = exports.KeywordCxt = exports.Ajv = undefined;
   var core_1 = require_core();
@@ -69593,7 +70109,7 @@ var require_ajv = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/ajv-formats@3.0.1/node_modules/ajv-formats/dist/formats.js
-var require_formats = __commonJS(function(exports) {
+var require_formats = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.formatNames = exports.fastFormats = exports.fullFormats = undefined;
   function fmtDef(validate2, compare) {
@@ -69770,7 +70286,7 @@ var require_formats = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv-formats@3.0.1/node_modules/ajv-formats/dist/limit.js
-var require_limit = __commonJS(function(exports) {
+var require_limit = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.formatLimitDefinition = undefined;
   var ajv_1 = require_ajv();
@@ -69839,7 +70355,7 @@ var require_limit = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv-formats@3.0.1/node_modules/ajv-formats/dist/index.js
-var require_dist = __commonJS(function(exports, module) {
+var require_dist = __commonJS((exports, module) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var formats_1 = require_formats();
   var limit_1 = require_limit();
@@ -71588,7 +72104,7 @@ var MCP_CONTRACT_SCHEMA_VERSION = 1, stringSchema = (description) => ({
   type: "array",
   items,
   ...description ? { description } : {}
-}), skillNameInput, optionalAgentInput, scopeInput, runInputSchema, runArgsSchema, errorSchema, skillSummarySchema, toolPrimitiveSummarySchema, skillToolDependencySchema, validationMessageSchema, validationOutputSchema, installOutputSchema, runOutputSchema, toolContracts, remoteCustomerContracts, contracts, resourceContracts;
+}), skillNameInput, optionalAgentInput, scopeInput, runInputSchema, runArgsSchema, errorSchema, skillSummarySchema, toolPrimitiveSummarySchema, skillToolDependencySchema, validationMessageSchema, validationOutputSchema, installOutputSchema, runOutputSchema, toolContracts, remoteCustomerContracts, publicationUuidSchema, publicationVerification, privatePublicationContracts, contracts, resourceContracts;
 var init_mcp_contracts = __esm(() => {
   init_remote_customer_operations();
   skillNameInput = stringSchema("skill name or alias.");
@@ -72094,7 +72610,7 @@ var init_mcp_contracts = __esm(() => {
       name: "run_skill",
       title: "Run Skill",
       description: "Run a skill locally or through a configured remote runner. Returns compact stdout/stderr previews and run summaries by default; pass detail:true for full records.",
-      params: ["name", "input?", "args?", "detail?", "remote?", "maxCredits?", "maxCostCents?", "idempotency_key?", "files?"],
+      params: ["name", "input?", "args?", "detail?", "remote?", "maxCredits?", "maxCostCents?", "quoteReceipt?", "idempotency_key?", "files?"],
       category: "execution",
       sideEffects: "local-process-or-remote-run",
       stable: true,
@@ -72106,6 +72622,7 @@ var init_mcp_contracts = __esm(() => {
         remote: { type: "boolean", description: "Use the configured server catalog." },
         maxCredits: { type: "integer", minimum: 0, description: "Maximum explicitly approved integer credits; omitted permits only free remote runs." },
         maxCostCents: { type: "integer", minimum: 0, description: "Legacy alias for maxCredits; both must agree." },
+        quoteReceipt: { type: "string", minLength: 1, maxLength: 4096, description: "Opaque approved quote receipt, at most 4096 UTF-8 bytes. Preserve it and the quoted input/args unchanged; never refresh after confirmation." },
         idempotency_key: { type: "string", pattern: "^[A-Za-z0-9._:-]{1,128}$", description: "Stable retry key for the same remote submission." },
         files: { type: "array", maxItems: 10, items: objectSchema({ name: stringSchema("Safe basename"), base64: { type: "string", maxLength: 1398104 }, contentType: stringSchema("MIME type") }, ["name", "base64"]), description: "Inline remote inputs, at most 1 MiB combined." }
       }, ["name"]),
@@ -72389,12 +72906,17 @@ var init_mcp_contracts = __esm(() => {
     name: "quote_skill",
     title: "Quote Remote Skill",
     description: "Get a server credit quote without submitting a run.",
-    params: ["name", "input?", "args?"],
+    params: ["name", "input?", "args?", "files?"],
     category: "execution",
     sideEffects: "none",
     stable: true,
-    inputSchema: objectSchema({ name: skillNameInput, input: runInputSchema, args: runArgsSchema }, ["name"]),
-    outputSchema: objectSchema({ skill: stringSchema("Canonical server skill."), pricing: objectSchema({}, [], "Quoted integer credits.", true) }, ["skill", "pricing"], undefined, true)
+    inputSchema: objectSchema({
+      name: skillNameInput,
+      input: runInputSchema,
+      args: runArgsSchema,
+      files: { type: "array", maxItems: 10, items: objectSchema({ name: stringSchema("Safe basename"), base64: { type: "string", maxLength: 1398104 }, contentType: stringSchema("MIME type") }, ["name", "base64"]), description: "Same inline files to submit after approval, at most 1 MiB combined." }
+    }, ["name"]),
+    outputSchema: objectSchema({ skill: stringSchema("Canonical server skill."), pricing: objectSchema({}, [], "Quoted integer credits.", true), quoteReceipt: { type: "string", minLength: 1, maxLength: 4096, description: "Opaque server quote binding, at most 4096 UTF-8 bytes; preserve verbatim for approval." } }, ["skill", "pricing"], undefined, true)
   });
   remoteCustomerContracts.push({
     name: "download_run_artifact",
@@ -72407,7 +72929,47 @@ var init_mcp_contracts = __esm(() => {
     inputSchema: objectSchema({ run_id: stringSchema("Run identifier."), artifact_id: stringSchema("Artifact identifier.") }, ["run_id", "artifact_id"]),
     outputSchema: objectSchema({ id: stringSchema("Artifact identifier."), fileName: stringSchema("Artifact file name."), base64: stringSchema("Verified bytes."), sha256: stringSchema("SHA256 digest."), byteSize: { type: "integer", minimum: 0 } }, ["id", "fileName", "base64", "sha256", "byteSize"])
   });
-  contracts = [...toolContracts, ...remoteCustomerContracts].sort((a, b) => a.name.localeCompare(b.name));
+  publicationUuidSchema = { type: "string", pattern: "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$" };
+  publicationVerification = {
+    email: { type: "string", format: "email", maxLength: 254 },
+    code: { type: "string", pattern: "^\\d{6}$" },
+    userId: publicationUuidSchema,
+    membershipId: publicationUuidSchema,
+    recoveryDirectory: { type: "string", maxLength: 4096, description: "Absolute host-local recovery directory without symbolic links." }
+  };
+  privatePublicationContracts = [
+    { name: "publish_private_skill", title: "Publish private skill", extras: {
+      directory: { type: "string", maxLength: 4096, description: "Absolute local skill source directory." },
+      skillId: publicationUuidSchema,
+      expectedCurrentVersionId: { oneOf: [publicationUuidSchema, { type: "null" }] },
+      idempotencyKey: publicationUuidSchema,
+      confirm: { const: true },
+      waitMs: { type: "integer", minimum: 0, maximum: 300000 }
+    }, required: ["directory", "skillId", "expectedCurrentVersionId", "confirm"] },
+    { name: "get_private_publication", title: "Get private publication", extras: {}, required: [] },
+    { name: "resume_private_publication", title: "Resume private publication", extras: { confirm: { const: true }, waitMs: { type: "integer", minimum: 0, maximum: 300000 } }, required: ["confirm"] },
+    { name: "cancel_private_publication", title: "Cancel private publication", extras: { confirm: { const: true } }, required: ["confirm"] }
+  ].map((operation) => ({
+    name: operation.name,
+    title: operation.title,
+    description: "Manage private source publication with fresh workspace verification and durable host-local recovery. Upload consent and current version comparison are explicit; private execution remains unavailable.",
+    params: [...Object.keys(publicationVerification), ...Object.keys(operation.extras)],
+    category: "storage",
+    sideEffects: "filesystem",
+    stable: true,
+    inputSchema: objectSchema({ ...publicationVerification, ...operation.extras }, [...Object.keys(publicationVerification), ...operation.required]),
+    outputSchema: objectSchema({
+      recoveryDirectory: { type: "string" },
+      skillId: publicationUuidSchema,
+      intentId: { oneOf: [publicationUuidSchema, { type: "null" }] },
+      state: { type: "string" },
+      versionId: { oneOf: [publicationUuidSchema, { type: "null" }] },
+      committed: { type: "boolean" },
+      executionEnabled: { const: false },
+      nextAction: { type: "string" }
+    }, ["recoveryDirectory", "skillId", "intentId", "state", "versionId", "committed", "executionEnabled", "nextAction"])
+  }));
+  contracts = [...toolContracts, ...remoteCustomerContracts, ...privatePublicationContracts].sort((a, b) => a.name.localeCompare(b.name));
   resourceContracts = [
     {
       uri: "skills://mcp/contracts",
@@ -72664,9 +73226,9 @@ var init_discovery_tools = __esm(() => {
 // src/lib/run-routing.ts
 var exports_run_routing = {};
 __export(exports_run_routing, {
-  isServerOwnedSkill: () => isServerOwnedSkill,
+  resolveRunRouting: () => resolveRunRouting,
   resolveConfiguredRunRouting: () => resolveConfiguredRunRouting,
-  resolveRunRouting: () => resolveRunRouting
+  isServerOwnedSkill: () => isServerOwnedSkill
 });
 function isServerOwnedSkill(skill) {
   return skill.serverOwned === true;
@@ -72922,11 +73484,12 @@ function registerOperationTools(server) {
       detail: exports_external.boolean().optional(),
       maxCostCents: exports_external.number().int().min(0).max(2147483647).optional().describe("Maximum integer credits explicitly approved by the user for a remote run; omitted permits only free runs"),
       maxCredits: exports_external.number().int().min(0).max(2147483647).optional(),
+      quoteReceipt: exports_external.string().min(1).max(4096).refine((value) => Buffer.byteLength(value, "utf8") <= 4096, "Quote receipt exceeds 4096 UTF-8 bytes").optional().describe("Opaque receipt from the approved quote; send unchanged with the same input, args and files. Never refresh after confirmation."),
       remote: exports_external.boolean().optional().describe("Use the configured server catalog, including skills not installed locally"),
       idempotency_key: exports_external.string().regex(/^[A-Za-z0-9._:-]{1,128}$/).optional().describe("Reuse for the same approved submission after an interrupted response"),
       files: exports_external.array(exports_external.object({ name: exports_external.string(), base64: exports_external.string().max(1398104), contentType: exports_external.string().optional() })).max(10).optional().describe("Inline remote inputs, at most 1 MiB combined; use CLI or SDK for larger files")
     }
-  }, async ({ name, input, args, detail, maxCostCents, maxCredits, remote, idempotency_key, files }) => {
+  }, async ({ name, input, args, detail, maxCostCents, maxCredits, quoteReceipt, remote, idempotency_key, files }) => {
     const skill = remote ? { name, serverOwned: true } : getSkill(name);
     if (!skill) {
       return mcpError("SKILL_NOT_FOUND", `Skill '${name}' not found`, findSimilarSkills(name));
@@ -72967,7 +73530,7 @@ function registerOperationTools(server) {
       try {
         const { RemoteSkillsClient: RemoteSkillsClient2 } = await Promise.resolve().then(() => (init_remote_client(), exports_remote_client));
         const client = new RemoteSkillsClient2(routing.apiKey, routing.apiOrigin);
-        const run = await client.submitQuotedRunWithFiles(skillName, runInput, runArgs, inputFiles, { maxCredits, maxCostCents, idempotencyKey: idempotency_key ?? runContext.record.id });
+        const run = await client.submitQuotedRunWithFiles(skillName, runInput, runArgs, inputFiles, { maxCredits, maxCostCents, quoteReceipt, idempotencyKey: idempotency_key ?? runContext.record.id });
         if (run.error) {
           writeRunLogs(runContext, "", String(run.error) + `
 `);
@@ -73988,7 +74551,7 @@ async function requestInvitationEmail(origin, action, input) {
   }
   const body = JSON.stringify({ invitationId: value.invitationId, token: value.token, challengeId: value.challengeId, ...action === "accept" ? { code: value.code } : {} });
   try {
-    const response = await fetch(`${target}/api/v1/account/invitations/email-${action}`, {
+    const response = await fetch(skillsApiRequestUrl(target, `/api/v1/account/invitations/email-${action}`), {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body,
@@ -74063,14 +74626,318 @@ var init_remote_invitation_recovery = __esm(() => {
   };
 });
 
+// src/lib/remote-private-publications.ts
+import { createHash as createHash7 } from "crypto";
+function checkedPublicationDeclaration(value) {
+  if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
+    return bad();
+  try {
+    const manifest = JSON.parse(value.manifestText);
+    if (!record7(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash(manifest.provenance?.content_hash))
+      return bad();
+  } catch {
+    return bad();
+  }
+  return Object.freeze({ ...value });
+}
+function checkedPublicationView(value, skillId, intentId, declaration) {
+  if (!exact(value, ["id", "skillId", "version", "expectedCurrentVersionId", "archiveSha256", "archiveByteSize", "state", "expiresAt", "createdAt", "versionId"]) || !publicationUuid(value.id) || value.skillId !== skillId || intentId !== undefined && value.id !== intentId || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || !hash(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES || typeof value.state !== "string" || !["awaiting_upload", "queued", "verifying", "needs_attention", "committed", "rejected", "cancelled", "expired"].includes(value.state) || !date4(value.expiresAt) || !date4(value.createdAt) || !(value.versionId === null || publicationUuid(value.versionId)) || value.state === "committed" && value.versionId === null)
+    return invalid3();
+  if (declaration && ["version", "expectedCurrentVersionId", "archiveSha256", "archiveByteSize"].some((k) => value[k] !== declaration[k]))
+    return invalid3();
+  return Object.freeze({ ...value });
+}
+async function boundedJson(url, init, token, mutation, budget = 15000, signal) {
+  const controller = new AbortController;
+  let reader;
+  let response;
+  const timeout = new PrivatePublicationError("PUBLICATION_UNCONFIRMED", "No confirmed publication result. Inspect the saved intent before retrying.", mutation);
+  let timer;
+  let abort;
+  try {
+    return await Promise.race([(async () => {
+      if (signal?.aborted)
+        throw timeout;
+      response = await fetch(url, {
+        ...init,
+        redirect: "error",
+        credentials: "omit",
+        signal: controller.signal,
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` }
+      });
+      const length = response.headers.get("content-length");
+      if (length !== null && (!/^\d+$/.test(length) || Number(length) > 65536))
+        return invalid3();
+      reader = response.body?.getReader();
+      const chunks = [];
+      let size2 = 0;
+      if (reader)
+        while (true) {
+          const part = await reader.read();
+          if (part.done)
+            break;
+          size2 += part.value.byteLength;
+          if (size2 > 65536)
+            return invalid3();
+          chunks.push(part.value);
+        }
+      if (controller.signal.aborted)
+        throw timeout;
+      const bytes = Buffer.concat(chunks);
+      let body;
+      try {
+        body = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+      } catch {
+        return invalid3();
+      }
+      if (!response.ok) {
+        const code = record7(body) && typeof body.code === "string" && Object.hasOwn(failures, body.code) ? body.code : null;
+        if (code && failures[code][0] === response.status)
+          throw new PrivatePublicationError(code, failures[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
+        throw new PrivatePublicationError("PUBLICATION_REQUEST_FAILED", "The publication request was refused. Inspect its status before retrying.", mutation && response.status >= 500, response.status);
+      }
+      return body;
+    })(), new Promise((_, reject2) => {
+      abort = () => {
+        controller.abort();
+        reject2(timeout);
+      };
+      timer = setTimeout(abort, Math.max(1, Math.min(15000, budget)));
+      signal?.addEventListener("abort", abort, { once: true });
+    })]);
+  } catch (error2) {
+    if (error2 instanceof PrivatePublicationError) {
+      if (mutation && error2.code === "INVALID_PUBLICATION_RESPONSE")
+        throw timeout;
+      throw error2;
+    }
+    throw timeout;
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+    if (abort)
+      signal?.removeEventListener("abort", abort);
+    controller.abort();
+    if (reader)
+      reader.cancel().catch(() => {});
+    else
+      response?.body?.cancel().catch(() => {});
+  }
+}
+
+class RemotePrivatePublicationsClient {
+  apiOrigin;
+  organizationId;
+  userId;
+  membershipId;
+  #token;
+  constructor(apiUrl, session) {
+    const checked = parseWorkspaceSession(session, { userId: session?.user?.id, membershipId: session?.user?.membershipId });
+    if (checked.user.role === "viewer")
+      throw new PrivatePublicationError("PUBLICATION_FORBIDDEN", failures.PUBLICATION_FORBIDDEN[1]);
+    this.apiOrigin = normalizeSkillsApiOrigin(apiUrl);
+    this.#token = checked.token;
+    this.organizationId = checked.organization.id;
+    this.userId = checked.user.id;
+    this.membershipId = checked.user.membershipId;
+    Object.freeze(this);
+  }
+  async getCapability(options = {}) {
+    if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
+      return bad();
+    const response = await boundedJson(skillsApiRequestUrl(this.apiOrigin, "/api/v1/capabilities"), {}, this.#token, false, options.timeoutMs, options.signal);
+    const p = record7(response) && response.privatePublishing;
+    if (!record7(response) || response.contractVersion !== 1 || response.apiVersion !== 1 || !exact(p, ["contractVersion", "enabled", "authentication", "maxArchiveBytes", "uploadMaxTtlSeconds", "executionEnabled"]) || p.contractVersion !== 1 || typeof p.enabled !== "boolean" || p.authentication !== "interactive-session" || p.maxArchiveBytes !== PRIVATE_PUBLICATION_MAX_BYTES || p.uploadMaxTtlSeconds !== 300 || p.executionEnabled !== false)
+      throw new PrivatePublicationError("PUBLICATION_CONTRACT_UNAVAILABLE", "This server does not support the hosted private publication contract.");
+    return Object.freeze({ ...p });
+  }
+  async#gate(enabled, options = {}) {
+    if (!(await this.getCapability(options)).enabled && enabled)
+      throw new PrivatePublicationError("PUBLICATION_CAPABILITY_UNAVAILABLE", failures.PUBLICATION_CAPABILITY_UNAVAILABLE[1]);
+  }
+  #path(skillId, intentId) {
+    if (!publicationUuid(skillId) || intentId !== undefined && !publicationUuid(intentId))
+      return bad();
+    return skillsApiRequestUrl(this.apiOrigin, `/api/v1/skills/${skillId}/publication-uploads${intentId ? `/${intentId}` : ""}`);
+  }
+  async#view(path, method2, skillId, intentId, declaration, options = {}) {
+    const value = await boundedJson(path, { method: method2, ...method2 === "GET" ? {} : { body: JSON.stringify(declaration ?? {}) } }, this.#token, method2 !== "GET", options.timeoutMs, options.signal);
+    try {
+      if (!record7(value) || !Object.keys(value).every((k) => k === "upload" || k === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
+        return invalid3();
+      return checkedPublicationView(value.upload, skillId, intentId, declaration);
+    } catch (error2) {
+      if (method2 !== "GET")
+        throw new PrivatePublicationError("PUBLICATION_UNCONFIRMED", "The publication result could not be confirmed. Reconcile the saved intent before another action.", true);
+      throw error2;
+    }
+  }
+  async begin(skillId, input) {
+    const path = this.#path(skillId), declaration = checkedPublicationDeclaration(input);
+    await this.#gate(true);
+    return this.#view(path, "POST", skillId, undefined, declaration);
+  }
+  async get(skillId, intentId, options = {}) {
+    const path = this.#path(skillId, intentId), until = Date.now() + (options.timeoutMs ?? 15000);
+    await this.#gate(false, options);
+    return this.#view(path, "GET", skillId, intentId, undefined, { ...options, timeoutMs: Math.max(1, until - Date.now()) });
+  }
+  async finalize(skillId, intentId) {
+    const path = this.#path(skillId, intentId);
+    await this.#gate(true);
+    return this.#view(`${path}/finalize`, "POST", skillId, intentId);
+  }
+  async cancel(skillId, intentId) {
+    const path = this.#path(skillId, intentId);
+    await this.#gate(false);
+    return this.#view(path, "DELETE", skillId, intentId);
+  }
+  async upload(skillId, intent, bytes) {
+    const captured = checkedPublicationView(intent, skillId), path = this.#path(skillId, captured.id);
+    if (!(bytes instanceof Uint8Array) || bytes.byteLength !== captured.archiveByteSize)
+      return bad();
+    const owned = Buffer.from(bytes);
+    if (captured.state !== "awaiting_upload" || owned.byteLength !== captured.archiveByteSize || publicationSha256(owned) !== captured.archiveSha256)
+      return bad();
+    await this.#gate(true);
+    const value = await boundedJson(`${path}/upload-url`, { method: "POST", body: "{}" }, this.#token, false);
+    const upload = this.#upload(value, captured);
+    const controller = new AbortController;
+    let timer;
+    const uncertain = () => new PrivatePublicationError("PUBLICATION_UPLOAD_UNCONFIRMED", "Upload acceptance is uncertain. Resume this saved intent to finalize and inspect it; do not upload again.", true);
+    try {
+      await Promise.race([(async () => {
+        const response = await fetch(upload.uploadUrl, { method: "PUT", headers: upload.headers, body: owned, redirect: "error", credentials: "omit", signal: controller.signal });
+        response.body?.cancel().catch(() => {});
+        if (response.status !== 200 || controller.signal.aborted)
+          throw uncertain();
+      })(), new Promise((_, reject2) => {
+        timer = setTimeout(() => {
+          controller.abort();
+          reject2(uncertain());
+        }, 30000);
+      })]);
+    } catch {
+      throw uncertain();
+    } finally {
+      if (timer)
+        clearTimeout(timer);
+      controller.abort();
+    }
+  }
+  #upload(value, intent) {
+    if (!exact(value, ["upload"]) || !exact(value.upload, ["method", "uploadUrl", "headers", "expiresAt"]))
+      return invalid3();
+    const p = value.upload;
+    if (p.method !== "PUT" || typeof p.uploadUrl !== "string" || p.uploadUrl.length > 8192 || /[\x00-\x20\x7f]/.test(p.uploadUrl) || !date4(p.expiresAt) || Date.parse(p.expiresAt) - Date.now() < 1000 || Date.parse(p.expiresAt) - Date.now() > 300000 || Date.parse(p.expiresAt) > Date.parse(intent.expiresAt) || !exact(p.headers, ["content-type", "content-length", "x-amz-checksum-sha256", "x-amz-expected-bucket-owner"]) || p.headers["content-type"] !== "application/gzip" || p.headers["content-length"] !== String(intent.archiveByteSize) || p.headers["x-amz-checksum-sha256"] !== Buffer.from(intent.archiveSha256, "hex").toString("base64") || typeof p.headers["x-amz-expected-bucket-owner"] !== "string" || !/^\d{12}$/.test(p.headers["x-amz-expected-bucket-owner"]))
+      return invalid3();
+    let url;
+    try {
+      url = new URL(p.uploadUrl);
+    } catch {
+      return invalid3();
+    }
+    if (url.protocol !== "https:" || url.port || url.username || url.password || url.hash || !/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]\.s3\.[a-z]{2}(?:-[a-z]+)+-[1-9]\.amazonaws\.com$/.test(url.hostname) || url.pathname !== `/private-publication-staging/${this.organizationId}/${intent.id}/bundle.tgz` || !url.search || url.searchParams.get("X-Amz-Algorithm") !== "AWS4-HMAC-SHA256" || url.searchParams.get("X-Amz-SignedHeaders") !== "content-length;content-type;host;x-amz-checksum-sha256;x-amz-expected-bucket-owner" || !/^[a-f0-9]{64}$/.test(url.searchParams.get("X-Amz-Signature") ?? ""))
+      return invalid3();
+    const queryKeys = ["X-Amz-Algorithm", "X-Amz-Credential", "X-Amz-Date", "X-Amz-Expires", "X-Amz-Security-Token", "X-Amz-Signature", "X-Amz-SignedHeaders"];
+    if ([...url.searchParams.keys()].sort().join(",") !== queryKeys.sort().join(","))
+      return invalid3();
+    const issued = url.searchParams.get("X-Amz-Date"), ttl = url.searchParams.get("X-Amz-Expires"), credential = url.searchParams.get("X-Amz-Credential");
+    const timestamp3 = /^(\d{4})(\d\d)(\d\d)T(\d\d)(\d\d)(\d\d)Z$/.exec(issued);
+    const region = url.hostname.split(".s3.")[1].split(".amazonaws.com")[0];
+    if (!timestamp3 || !/^[1-9]\d{0,2}$/.test(ttl) || Number(ttl) > 300 || !/^[A-Z0-9]{16,128}\//.test(credential) || credential.split("/").slice(1).join("/") !== `${issued.slice(0, 8)}/${region}/s3/aws4_request` || !/^[\x21-\x7e]{1,4096}$/.test(url.searchParams.get("X-Amz-Security-Token")))
+      return invalid3();
+    const issuedAt = Date.parse(`${timestamp3[1]}-${timestamp3[2]}-${timestamp3[3]}T${timestamp3[4]}:${timestamp3[5]}:${timestamp3[6]}Z`);
+    if (!Number.isFinite(issuedAt) || issuedAt > Date.now() + 1000 || issuedAt + Number(ttl) * 1000 !== Date.parse(p.expiresAt))
+      return invalid3();
+    return { method: "PUT", uploadUrl: url.href, expiresAt: p.expiresAt, headers: Object.freeze({ ...p.headers }) };
+  }
+  async wait(skillId, intentId, options = {}) {
+    const timeout = options.timeoutMs ?? 60000;
+    if (!Number.isSafeInteger(timeout) || timeout < 0 || timeout > 300000)
+      return bad();
+    const until = Date.now() + timeout;
+    let previous;
+    while (true) {
+      if (options.signal?.aborted)
+        throw new PrivatePublicationError("PUBLICATION_WAIT_ABORTED", "Stopped waiting. The server publication continues; inspect the saved intent.");
+      let view;
+      try {
+        view = await this.get(skillId, intentId, { timeoutMs: timeout === 0 ? 15000 : Math.max(1, Math.min(15000, until - Date.now())), signal: options.signal });
+      } catch (error2) {
+        if (previous && Date.now() >= until && !options.signal?.aborted)
+          return previous;
+        throw error2;
+      }
+      previous = view;
+      if (!["queued", "verifying"].includes(view.state) || Date.now() >= until)
+        return view;
+      await new Promise((resolve3) => {
+        const timer = setTimeout(done, Math.min(1000, until - Date.now()));
+        function done() {
+          clearTimeout(timer);
+          options.signal?.removeEventListener("abort", done);
+          resolve3();
+        }
+        options.signal?.addEventListener("abort", done, { once: true });
+      });
+    }
+  }
+}
+var PRIVATE_PUBLICATION_MAX_BYTES, failures, PrivatePublicationError, bad = () => {
+  throw new PrivatePublicationError("INVALID_PUBLICATION_INPUT", "Invalid publication input or recovery data.");
+}, invalid3 = () => {
+  throw new PrivatePublicationError("INVALID_PUBLICATION_RESPONSE", "The server returned an invalid publication result.");
+}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record7 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys2) => record7(v) && Object.keys(v).sort().join(",") === keys2.sort().join(","), date4 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash7("sha256").update(bytes).digest("hex");
+var init_remote_private_publications = __esm(() => {
+  init_fleet_credentials();
+  init_remote_workspace_selection();
+  init_skill_contract();
+  PRIVATE_PUBLICATION_MAX_BYTES = 16 * 1024 * 1024;
+  failures = {
+    INVALID_REQUEST: [400, "The publication request is invalid."],
+    SESSION_EXPIRED: [401, "Sign in again to manage this publication."],
+    ACCOUNT_UNAVAILABLE: [403, "The account is unavailable."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "An interactive account session is required."],
+    PUBLICATION_FORBIDDEN: [403, "This session cannot manage the publication."],
+    PUBLICATION_ENTITLEMENT_REQUIRED: [403, "The workspace is not entitled to publish private skills."],
+    PUBLICATION_UNAVAILABLE: [404, "The publication is unavailable to this session."],
+    MANIFEST_NAME_MISMATCH: [409, "The manifest name does not match the selected skill."],
+    IDEMPOTENCY_CONFLICT: [409, "This request key already identifies different publication bytes. Use the saved recovery directory."],
+    CURRENT_VERSION_CHANGED: [409, "The current version changed. Inspect it before explicitly starting another publication."],
+    VERSION_EXISTS: [409, "This version already exists."],
+    VERSION_RESERVED: [409, "This version is reserved by another publication."],
+    PUBLICATION_COMMITTED: [409, "The publication is already committed."],
+    PUBLICATION_UPLOAD_UNAVAILABLE: [409, "This publication cannot receive another upload."],
+    PUBLICATION_LIMIT: [429, "The workspace publication limit has been reached."],
+    PUBLICATION_BUSY: [503, "The publication is busy. Reconcile the saved intent before retrying."],
+    PUBLICATION_UNCERTAIN: [503, "The publication outcome is uncertain. Reconcile the saved intent."],
+    PUBLICATION_CAPABILITY_UNAVAILABLE: [503, "Private publishing is not enabled on this server."],
+    PUBLICATION_SIGNING_UNAVAILABLE: [503, "Upload authorization is temporarily unavailable. Keep the same intent."]
+  };
+  PrivatePublicationError = class PrivatePublicationError extends Error {
+    code;
+    uncertain;
+    status;
+    constructor(code, message, uncertain = false, status) {
+      super(message);
+      this.code = code;
+      this.uncertain = uncertain;
+      this.status = status;
+      this.name = "PrivatePublicationError";
+    }
+  };
+});
+
 // src/lib/remote-auth.ts
 async function requestAuthApi(instance, path, options) {
   const url = normalizeSkillsApiOrigin(instance);
   const safeUrl = url;
-  const endpoint = `${(options?.method || "GET").toUpperCase()} ${safeUrl}${path}`;
+  const requestUrl = skillsApiRequestUrl(url, path);
+  const endpoint = `${(options?.method || "GET").toUpperCase()} ${requestUrl}`;
   let res;
   try {
-    res = await fetch(`${url}${path}`, {
+    res = await fetch(requestUrl, {
       ...options,
       redirect: "error",
       signal: options?.signal ?? AbortSignal.timeout(15000),
@@ -74085,10 +74952,10 @@ async function requestAuthApi(instance, path, options) {
   const text2 = await res.text();
   const body = text2 ? parseJsonBody(text2) : {};
   if (!res.ok) {
-    const record7 = isRecord5(body) ? body : {};
-    const detail = typeof record7.detail === "string" ? record7.detail : undefined;
-    const error2 = typeof record7.error === "string" ? record7.error : undefined;
-    const code = typeof record7.code === "string" ? record7.code : undefined;
+    const record8 = isRecord5(body) ? body : {};
+    const detail = typeof record8.detail === "string" ? record8.detail : undefined;
+    const error2 = typeof record8.error === "string" ? record8.error : undefined;
+    const code = typeof record8.code === "string" ? record8.code : undefined;
     throw new HostedApiError(detail || error2 || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -74122,6 +74989,10 @@ class RemoteSkillsAuthClient {
   constructor(apiUrl) {
     this.apiOrigin = normalizeSkillsApiOrigin(apiUrl);
   }
+  async openPrivatePublications(email3, code, context) {
+    const origin = this.apiOrigin, captured = workspaceContext(context);
+    return new RemotePrivatePublicationsClient(origin, await this.switchWorkspace(email3, code, captured));
+  }
   requestInvitationEmailChallenge(input) {
     return requestInvitationEmail(this.apiOrigin, "challenge", input);
   }
@@ -74169,9 +75040,10 @@ class RemoteSkillsAuthClient {
     const apiOrigin = this.apiOrigin;
     if (typeof email3 !== "string" || !email3.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
+    const requestUrl = skillsApiRequestUrl(apiOrigin, "/api/auth/verify");
     let response;
     try {
-      response = await fetch(`${apiOrigin}/api/auth/verify`, {
+      response = await fetch(requestUrl, {
         method: "POST",
         redirect: "error",
         credentials: "omit",
@@ -74265,6 +75137,7 @@ class RemoteSkillsAuthClient {
 var MAX_ERROR_DETAIL_LENGTH = 200, HostedApiError;
 var init_remote_auth = __esm(() => {
   init_remote_invitation_recovery();
+  init_remote_private_publications();
   init_remote_invitations();
   init_remote_workspace_leave();
   init_remote_workspace_selection();
@@ -74292,11 +75165,11 @@ var init_remote_auth = __esm(() => {
 });
 
 // src/lib/workspace-profile.ts
-import { constants as constants4, closeSync as closeSync4, fstatSync as fstatSync4, lstatSync as lstatSync6, mkdirSync as mkdirSync14, mkdtempSync as mkdtempSync4, openSync as openSync4, readFileSync as readFileSync25, renameSync as renameSync6, rmSync as rmSync7, writeFileSync as writeFileSync14 } from "fs";
+import { constants as constants5, closeSync as closeSync5, fstatSync as fstatSync5, lstatSync as lstatSync7, mkdirSync as mkdirSync14, mkdtempSync as mkdtempSync4, openSync as openSync5, readFileSync as readFileSync25, renameSync as renameSync6, rmSync as rmSync7, writeFileSync as writeFileSync14 } from "fs";
 import { dirname as dirname10, join as join32 } from "path";
 function stat(path) {
   try {
-    return lstatSync6(path);
+    return lstatSync7(path);
   } catch (error2) {
     if (error2.code === "ENOENT")
       return null;
@@ -74306,14 +75179,14 @@ function stat(path) {
 function safeText(file) {
   if (stat(file) === null)
     return null;
-  const fd = openSync4(file, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
+  const fd = openSync5(file, constants5.O_RDONLY | constants5.O_NOFOLLOW | constants5.O_NONBLOCK);
   try {
-    const s = fstatSync4(fd);
+    const s = fstatSync5(fd);
     if (!s.isFile() || s.size > 65536 || ![256, 384].includes(s.mode & 4095) || process.getuid && s.uid !== process.getuid())
       return fail2("The selected profile must use bounded owner-only regular files.");
     return readFileSync25(fd, "utf8");
   } finally {
-    closeSync4(fd);
+    closeSync5(fd);
   }
 }
 function checkIdentityMetadata(file, identity2) {
@@ -74603,9 +75476,325 @@ var init_remote_invitation_tools = __esm(() => {
   init_helpers();
 });
 
+// src/lib/private-publication-customer.ts
+async function privatePublicationSession(email3, code, requested) {
+  const target = await captureProfileWorkspace("Manage private publications");
+  const context = requested ?? target.context;
+  if (!context || !publicationUuid(context.userId) || !publicationUuid(context.membershipId) || target.context && (context.userId !== target.context.userId || context.membershipId !== target.context.membershipId))
+    throw new PrivatePublicationError("PUBLICATION_CONTEXT_REQUIRED", "Provide the observed user and membership IDs, or select an enrolled workspace profile.");
+  target.unchanged();
+  const client = await new RemoteSkillsAuthClient(target.origin).openPrivatePublications(email3, code, context);
+  target.unchanged();
+  return client;
+}
+function privatePublicationCustomerError(error2) {
+  return error2 instanceof PrivatePublicationError ? { error: error2.message, code: error2.code, uncertain: error2.uncertain } : { error: "The publication action could not be confirmed. Preserve the recovery directory and inspect the same intent; credentials were not changed.", code: "PUBLICATION_ACTION_UNCONFIRMED", uncertain: true };
+}
+var init_private_publication_customer = __esm(() => {
+  init_remote_auth();
+  init_remote_private_publications();
+  init_workspace_profile();
+});
+
+// src/lib/private-publication-recovery.ts
+import { constants as constants6, closeSync as closeSync6, fsyncSync, fstatSync as fstatSync6, lstatSync as lstatSync8, mkdirSync as mkdirSync15, openSync as openSync6, readSync as readSync3, realpathSync as realpathSync2, renameSync as renameSync7, unlinkSync as unlinkSync2, writeFileSync as writeFileSync15 } from "fs";
+import { dirname as dirname11, isAbsolute as isAbsolute4, join as join33, resolve as resolve3 } from "path";
+import { randomUUID as randomUUID3 } from "crypto";
+function safeDirectory(directory) {
+  if (!isAbsolute4(directory) || directory !== resolve3(directory) || realpathSync2(directory) !== directory)
+    return fail3();
+  for (let path = directory;; path = dirname11(path)) {
+    const stat2 = lstatSync8(path);
+    if (!stat2.isDirectory() || stat2.isSymbolicLink())
+      return fail3();
+    if (path === dirname11(path))
+      break;
+  }
+  const own = lstatSync8(directory);
+  if ((own.mode & 63) !== 0 || process.getuid && own.uid !== process.getuid())
+    return fail3();
+  return { dev: own.dev, ino: own.ino };
+}
+function unchangedDirectory(directory, identity2) {
+  const now3 = safeDirectory(directory);
+  if (now3.dev !== identity2.dev || now3.ino !== identity2.ino)
+    return fail3();
+}
+function readOwned(directory, name, max2) {
+  const identity2 = safeDirectory(directory), file = join33(directory, name);
+  const fd = openSync6(file, constants6.O_RDONLY | constants6.O_NOFOLLOW);
+  try {
+    const stat2 = fstatSync6(fd);
+    if (!stat2.isFile() || stat2.nlink !== 1 || stat2.size > max2 || stat2.size < 1 || (stat2.mode & 63) !== 0 || process.getuid && stat2.uid !== process.getuid())
+      return fail3();
+    const buffer = Buffer.alloc(Math.min(max2, stat2.size) + 1);
+    let length = 0;
+    while (length < buffer.length) {
+      const count = readSync3(fd, buffer, length, buffer.length - length, length);
+      if (count === 0)
+        break;
+      length += count;
+    }
+    const bytes = buffer.subarray(0, length), after2 = fstatSync6(fd);
+    unchangedDirectory(directory, identity2);
+    if (bytes.length !== stat2.size || stat2.size !== after2.size || stat2.mtimeMs !== after2.mtimeMs || stat2.ctimeMs !== after2.ctimeMs)
+      return fail3();
+    return bytes;
+  } finally {
+    closeSync6(fd);
+  }
+}
+function writeOwned(directory, name, bytes) {
+  const fd = openSync6(join33(directory, name), constants6.O_WRONLY | constants6.O_CREAT | constants6.O_EXCL | constants6.O_NOFOLLOW, 384);
+  try {
+    writeFileSync15(fd, bytes);
+    fsyncSync(fd);
+  } finally {
+    closeSync6(fd);
+  }
+}
+function save(directory, value) {
+  const identity2 = safeDirectory(directory), temporary = `.receipt-${randomUUID3()}.json`;
+  writeOwned(directory, temporary, JSON.stringify(value) + `
+`);
+  unchangedDirectory(directory, identity2);
+  renameSync7(join33(directory, temporary), join33(directory, "receipt.json"));
+  const fd = openSync6(directory, constants6.O_RDONLY | constants6.O_NOFOLLOW);
+  try {
+    fsyncSync(fd);
+  } finally {
+    closeSync6(fd);
+  }
+}
+function bind2(client, receipt) {
+  if (["apiOrigin", "organizationId", "userId", "membershipId"].some((k) => client[k] !== receipt[k]))
+    throw new PrivatePublicationError("PUBLICATION_IDENTITY_CHANGED", "The fresh session does not match the recovery directory's server, account and membership.");
+}
+async function locked(directory, action) {
+  const identity2 = safeDirectory(directory), file = join33(directory, "operation.lock");
+  let fd;
+  try {
+    fd = openSync6(file, constants6.O_WRONLY | constants6.O_CREAT | constants6.O_EXCL | constants6.O_NOFOLLOW, 384);
+  } catch {
+    throw new PrivatePublicationError("PUBLICATION_RECOVERY_BUSY", "Another operation holds this recovery directory. If it crashed, confirm that process has stopped before explicitly removing operation.lock and resuming.");
+  }
+  const lock = fstatSync6(fd);
+  try {
+    writeFileSync15(fd, JSON.stringify({ pid: process.pid }) + `
+`);
+    fsyncSync(fd);
+    return await action();
+  } finally {
+    closeSync6(fd);
+    unchangedDirectory(directory, identity2);
+    const now3 = lstatSync8(file);
+    if (now3.dev !== lock.dev || now3.ino !== lock.ino || !now3.isFile() || now3.isSymbolicLink())
+      fail3();
+    unlinkSync2(file);
+  }
+}
+function readPrivatePublicationRecovery(directory) {
+  try {
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(readOwned(directory, "receipt.json", 65536)));
+    if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).sort().join(",") !== ["contractVersion", "apiOrigin", "organizationId", "userId", "membershipId", "skillId", "declaration", "phase", "intent"].sort().join(",") || value.contractVersion !== 1 || ![value.organizationId, value.userId, value.membershipId, value.skillId].every(publicationUuid) || typeof value.apiOrigin !== "string" || normalizeSkillsApiOrigin(value.apiOrigin) !== value.apiOrigin || !["prepared", "begin_uncertain", "awaiting_upload", "upload_uncertain", "uploaded", "finalize_uncertain", "observed"].includes(value.phase))
+      return fail3();
+    value.declaration = checkedPublicationDeclaration(value.declaration);
+    if (value.intent !== null)
+      value.intent = checkedPublicationView(value.intent, value.skillId, undefined, value.declaration);
+    if (value.intent === null && !["prepared", "begin_uncertain"].includes(value.phase))
+      return fail3();
+    const bytes = readOwned(directory, "bundle.tgz", PRIVATE_PUBLICATION_MAX_BYTES);
+    if (bytes.length !== value.declaration.archiveByteSize || publicationSha256(bytes) !== value.declaration.archiveSha256)
+      return fail3();
+    return { receipt: value, bytes };
+  } catch {
+    return fail3();
+  }
+}
+async function preparePrivatePublication(client, sourceDirectory, recoveryDirectory, input) {
+  if (!publicationUuid(input.skillId) || !(input.expectedCurrentVersionId === null || publicationUuid(input.expectedCurrentVersionId)) || input.idempotencyKey !== undefined && !publicationUuid(input.idempotencyKey))
+    return fail3();
+  const packed = packSkillBundle(sourceDirectory, { maxUnpackedBytes: 32 * 1024 * 1024 });
+  const inspected = await inspectSkillBundle(packed.bytes, { limits: { compressedBytes: PRIVATE_PUBLICATION_MAX_BYTES } });
+  const manifest = inspected.entries.find((entry) => entry.path === "skill.json");
+  if (!manifest || manifest.bytes.length > 16384 || !(await verifyContentHashFromEntries(inspected.entries)).valid)
+    throw new PrivatePublicationError("PUBLICATION_BUNDLE_INVALID", "The skill must have a valid skill.json with its current content hash. Validate the skill before publishing.");
+  const manifestText = new TextDecoder("utf-8", { fatal: true }).decode(manifest.bytes);
+  const declaration = checkedPublicationDeclaration({
+    idempotencyKey: input.idempotencyKey ?? randomUUID3(),
+    version: JSON.parse(manifestText).version,
+    expectedCurrentVersionId: input.expectedCurrentVersionId,
+    manifestText,
+    archiveSha256: inspected.sha256,
+    archiveByteSize: packed.bytes.length
+  });
+  const receipt = {
+    contractVersion: 1,
+    apiOrigin: client.apiOrigin,
+    organizationId: client.organizationId,
+    userId: client.userId,
+    membershipId: client.membershipId,
+    skillId: input.skillId,
+    declaration,
+    phase: "prepared",
+    intent: null
+  };
+  if (!isAbsolute4(recoveryDirectory) || resolve3(recoveryDirectory) !== recoveryDirectory || realpathSync2(dirname11(recoveryDirectory)) !== dirname11(recoveryDirectory))
+    return fail3();
+  mkdirSync15(recoveryDirectory, { mode: 448 });
+  safeDirectory(recoveryDirectory);
+  const parent = openSync6(dirname11(recoveryDirectory), constants6.O_RDONLY | constants6.O_NOFOLLOW);
+  try {
+    fsyncSync(parent);
+  } finally {
+    closeSync6(parent);
+  }
+  writeOwned(recoveryDirectory, "bundle.tgz", packed.bytes);
+  save(recoveryDirectory, receipt);
+  return receipt;
+}
+function privatePublicationResult(directory, receipt) {
+  const state = receipt.intent?.state ?? receipt.phase, committed = state === "committed";
+  const nextAction = committed ? "The version is published. Private execution remains unavailable." : ["rejected", "cancelled", "expired"].includes(state) ? "This intent is terminal. Inspect the result before explicitly preparing another version." : state === "needs_attention" ? "Keep this intent and contact the service operator; do not create a replacement or upload again." : receipt.phase === "upload_uncertain" ? "Run publication resume with this recovery directory to finalize the same intent without another upload." : receipt.intent ? "Run publication status or resume with this recovery directory; cancel explicitly if you want to stop." : "Run publication resume with this recovery directory to reconcile the identical request key and declaration.";
+  return {
+    recoveryDirectory: directory,
+    skillId: receipt.skillId,
+    intentId: receipt.intent?.id ?? null,
+    state,
+    versionId: receipt.intent?.versionId ?? null,
+    committed,
+    executionEnabled: false,
+    nextAction
+  };
+}
+async function continuePrivatePublication(client, directory, options) {
+  if (options.confirm !== true)
+    throw new PrivatePublicationError("PUBLICATION_CONFIRM_REQUIRED", "Explicit upload confirmation is required.");
+  if (options.waitMs !== undefined && (!Number.isSafeInteger(options.waitMs) || options.waitMs < 0 || options.waitMs > 300000))
+    return fail3();
+  return locked(directory, () => continueLocked(client, directory, options));
+}
+async function continueLocked(client, directory, options) {
+  const { receipt, bytes } = readPrivatePublicationRecovery(directory);
+  bind2(client, receipt);
+  if (!receipt.intent) {
+    receipt.phase = "begin_uncertain";
+    save(directory, receipt);
+    receipt.intent = await client.begin(receipt.skillId, receipt.declaration);
+    receipt.phase = "awaiting_upload";
+    save(directory, receipt);
+  } else {
+    receipt.intent = checkedPublicationView(await client.get(receipt.skillId, receipt.intent.id), receipt.skillId, receipt.intent.id, receipt.declaration);
+    save(directory, receipt);
+  }
+  if (receipt.intent.state === "awaiting_upload") {
+    if (receipt.phase === "awaiting_upload") {
+      receipt.phase = "upload_uncertain";
+      save(directory, receipt);
+      try {
+        await client.upload(receipt.skillId, receipt.intent, bytes);
+      } catch (error2) {
+        if (error2 instanceof PrivatePublicationError && !error2.uncertain) {
+          receipt.phase = "awaiting_upload";
+          save(directory, receipt);
+        }
+        throw error2;
+      }
+      receipt.phase = "uploaded";
+      save(directory, receipt);
+    }
+    receipt.phase = "finalize_uncertain";
+    save(directory, receipt);
+    receipt.intent = checkedPublicationView(await client.finalize(receipt.skillId, receipt.intent.id), receipt.skillId, receipt.intent.id, receipt.declaration);
+    receipt.phase = "observed";
+    save(directory, receipt);
+  }
+  if (options.waitMs !== undefined && options.waitMs > 0 && ["queued", "verifying"].includes(receipt.intent.state)) {
+    receipt.intent = checkedPublicationView(await client.wait(receipt.skillId, receipt.intent.id, { timeoutMs: options.waitMs }), receipt.skillId, receipt.intent.id, receipt.declaration);
+    receipt.phase = "observed";
+    save(directory, receipt);
+  }
+  return privatePublicationResult(directory, receipt);
+}
+async function inspectPrivatePublication(client, directory, cancel = false) {
+  return locked(directory, () => inspectLocked(client, directory, cancel));
+}
+async function inspectLocked(client, directory, cancel) {
+  const { receipt } = readPrivatePublicationRecovery(directory);
+  bind2(client, receipt);
+  if (receipt.intent) {
+    receipt.intent = checkedPublicationView(await (cancel ? client.cancel(receipt.skillId, receipt.intent.id) : client.get(receipt.skillId, receipt.intent.id)), receipt.skillId, receipt.intent.id, receipt.declaration);
+    save(directory, receipt);
+  } else if (cancel)
+    throw new PrivatePublicationError("PUBLICATION_INTENT_UNKNOWN", "Reconcile the saved begin request with publication resume before cancelling its intent.");
+  return privatePublicationResult(directory, receipt);
+}
+var fail3 = () => {
+  throw new PrivatePublicationError("PUBLICATION_RECOVERY_INVALID", "The recovery directory is invalid or changed. Preserve it and inspect the existing intent; do not start a replacement automatically.");
+};
+var init_private_publication_recovery = __esm(() => {
+  init_skill_bundle();
+  init_skill_hash();
+  init_remote_private_publications();
+  init_fleet_credentials();
+});
+
+// src/mcp/private-publication-tools.ts
+import { isAbsolute as isAbsolute5 } from "path";
+function registerPrivatePublicationTools(server) {
+  const uuid6 = exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/);
+  const directory = exports_external.string().max(4096).refine(isAbsolute5, "Use an absolute local directory");
+  const verification = { email: exports_external.string().email().max(254), code: exports_external.string().regex(/^\d{6}$/), userId: uuid6, membershipId: uuid6, recoveryDirectory: directory };
+  const description = "Manage a private source publication using fresh workspace-bound verification and a host-local recovery directory. Publishing requires explicit UUID current-version comparison and upload consent. Resume reuses immutable saved bytes and intent; an uncertain PUT is finalized for server verification, never uploaded twice. Sessions and signed URLs are not returned or persisted. Private execution is unavailable. Host request history may contain the supplied verification code.";
+  const handler = (action) => async (value) => {
+    try {
+      const client = await privatePublicationSession(String(value.email), String(value.code), { userId: String(value.userId), membershipId: String(value.membershipId) });
+      const recovery = String(value.recoveryDirectory);
+      if (action === "publish")
+        await preparePrivatePublication(client, String(value.directory), recovery, { skillId: String(value.skillId), expectedCurrentVersionId: value.expectedCurrentVersionId, idempotencyKey: value.idempotencyKey });
+      const result2 = action === "publish" || action === "resume" ? await continuePrivatePublication(client, recovery, { confirm: true, waitMs: value.waitMs }) : await inspectPrivatePublication(client, recovery, action === "cancel");
+      return mcpJson(result2);
+    } catch (error2) {
+      const result2 = privatePublicationCustomerError(error2);
+      return mcpError(result2.code, result2.error);
+    }
+  };
+  server.registerTool("publish_private_skill", {
+    title: "Publish private skill",
+    description,
+    annotations: { destructiveHint: true, readOnlyHint: false, idempotentHint: false },
+    inputSchema: exports_external.object({ ...verification, directory, skillId: uuid6, expectedCurrentVersionId: uuid6.nullable(), idempotencyKey: uuid6.optional(), confirm: exports_external.literal(true), waitMs: exports_external.number().int().min(0).max(300000).optional() }).strict()
+  }, handler("publish"));
+  server.registerTool("get_private_publication", {
+    title: "Get private publication",
+    description,
+    annotations: { destructiveHint: false, readOnlyHint: true, idempotentHint: true },
+    inputSchema: exports_external.object(verification).strict()
+  }, handler("get"));
+  server.registerTool("resume_private_publication", {
+    title: "Resume private publication",
+    description,
+    annotations: { destructiveHint: true, readOnlyHint: false, idempotentHint: true },
+    inputSchema: exports_external.object({ ...verification, confirm: exports_external.literal(true), waitMs: exports_external.number().int().min(0).max(300000).optional() }).strict()
+  }, handler("resume"));
+  server.registerTool("cancel_private_publication", {
+    title: "Cancel private publication",
+    description,
+    annotations: { destructiveHint: true, readOnlyHint: false, idempotentHint: true },
+    inputSchema: exports_external.object({ ...verification, confirm: exports_external.literal(true) }).strict()
+  }, handler("cancel"));
+}
+var init_private_publication_tools = __esm(() => {
+  init_zod();
+  init_private_publication_customer();
+  init_private_publication_recovery();
+  init_helpers();
+});
+
 // src/mcp/remote-customer-tools.ts
 function registerRemoteCustomerTools(server) {
   registerRemoteInvitationTools(server);
+  registerPrivatePublicationTools(server);
   const memberRole = exports_external.enum(["owner", "admin", "member", "viewer"]);
   const memberInput = {
     membershipId: exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/),
@@ -74723,8 +75912,16 @@ function registerRemoteCustomerTools(server) {
   server.registerTool("quote_skill", {
     title: "Quote Remote Skill",
     description: "Get the configured server's credit quote without submitting a run.",
-    inputSchema: { name: exports_external.string(), input: exports_external.record(exports_external.string(), exports_external.unknown()).optional(), args: exports_external.array(exports_external.string()).optional() }
-  }, ({ name, input, args }) => callRemote((client) => client.quoteRun(name, input, args)));
+    inputSchema: {
+      name: exports_external.string(),
+      input: exports_external.record(exports_external.string(), exports_external.unknown()).optional(),
+      args: exports_external.array(exports_external.string()).optional(),
+      files: exports_external.array(exports_external.object({ name: exports_external.string(), base64: exports_external.string().max(1398104), contentType: exports_external.string().optional() })).max(10).optional().describe("The same inline files to submit after approval; quoted descriptors bind their exact bytes, names and types.")
+    }
+  }, ({ name, input, args, files }) => callRemote((client) => {
+    const descriptors = describeRemoteFiles(decodeRemoteFiles(files ?? []));
+    return client.quoteRun(name, input, args, descriptors.length ? descriptors : undefined);
+  }));
   server.registerTool("download_run_artifact", {
     title: "Download Verified Run Artifact",
     description: "Return verified artifact bytes as base64 (at most 1 MiB); use the CLI for larger files.",
@@ -74758,6 +75955,7 @@ async function freshAccount(action, operation) {
 }
 var init_remote_customer_tools = __esm(() => {
   init_remote_invitation_tools();
+  init_private_publication_tools();
   init_zod();
   init_remote_auth();
   init_workspace_profile();
@@ -74765,13 +75963,14 @@ var init_remote_customer_tools = __esm(() => {
   init_remote_client();
   init_remote_workspace_leave();
   init_helpers();
+  init_remote_files();
 });
 
 // src/mcp/server.ts
 var exports_server = {};
 __export(exports_server, {
-  buildServer: () => buildServer,
-  server: () => server
+  server: () => server,
+  buildServer: () => buildServer
 });
 function buildServer() {
   const server = new McpServer({
@@ -74802,8 +76001,8 @@ var init_server3 = __esm(() => {
 // src/mcp/index.ts
 var exports_mcp = {};
 __export(exports_mcp, {
-  assertSkillsMcpConfigured: () => assertSkillsMcpConfigured,
-  startMcpStdio: () => startMcpStdio
+  startMcpStdio: () => startMcpStdio,
+  assertSkillsMcpConfigured: () => assertSkillsMcpConfigured
 });
 function printHelp() {
   console.log(`Usage: skills-mcp [options]
@@ -74852,9 +76051,9 @@ var init_mcp2 = __esm(() => {
 });
 
 // src/cli/commands/runtime-mcp.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync15, readFileSync as readFileSync26, writeFileSync as writeFileSync15 } from "fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync16, readFileSync as readFileSync26, writeFileSync as writeFileSync16 } from "fs";
 import { homedir as homedir7 } from "os";
-import { dirname as dirname11, join as join33 } from "path";
+import { dirname as dirname12, join as join34 } from "path";
 async function handleMcp(options) {
   if (options.register) {
     let agents;
@@ -74897,24 +76096,24 @@ async function registerMcpForAgent(agent, command) {
     case "codex":
       return registerCodexMcp(command);
     case "gemini":
-      return registerJsonMcpServer(agent, join33(homedir7(), ".gemini", "settings.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join34(homedir7(), ".gemini", "settings.json"), "mcpServers", {
         command,
         args: []
       });
     case "pi":
-      return registerJsonMcpServer(agent, join33(homedir7(), ".pi", "agent", "mcp.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join34(homedir7(), ".pi", "agent", "mcp.json"), "mcpServers", {
         command,
         args: []
       });
     case "opencode":
       return registerOpenCodeMcp(command);
     case "cursor":
-      return registerJsonMcpServer(agent, join33(homedir7(), ".cursor", "mcp.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join34(homedir7(), ".cursor", "mcp.json"), "mcpServers", {
         command,
         args: []
       });
     case "windsurf":
-      return registerJsonMcpServer(agent, join33(homedir7(), ".windsurf", "mcp.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join34(homedir7(), ".windsurf", "mcp.json"), "mcpServers", {
         command,
         args: []
       });
@@ -74937,7 +76136,7 @@ async function registerClaudeMcp(command) {
     if (exitCode === 0) {
       return { agent: "claude", success: true, command: cliCommand };
     }
-    const fallback = registerJsonMcpServer("claude", join33(homedir7(), ".claude", ".mcp.json"), "mcpServers", {
+    const fallback = registerJsonMcpServer("claude", join34(homedir7(), ".claude", ".mcp.json"), "mcpServers", {
       command,
       args: []
     });
@@ -74947,7 +76146,7 @@ async function registerClaudeMcp(command) {
       error: fallback.success ? undefined : `claude exited with ${exitCode}: ${(stderr || stdout).trim()}`
     };
   } catch (err) {
-    const fallback = registerJsonMcpServer("claude", join33(homedir7(), ".claude", ".mcp.json"), "mcpServers", {
+    const fallback = registerJsonMcpServer("claude", join34(homedir7(), ".claude", ".mcp.json"), "mcpServers", {
       command,
       args: []
     });
@@ -74959,7 +76158,7 @@ async function registerClaudeMcp(command) {
   }
 }
 function registerCodexMcp(command) {
-  const path = join33(homedir7(), ".codex", "config.toml");
+  const path = join34(homedir7(), ".codex", "config.toml");
   const config2 = `[mcp_servers.${MCP_SERVER_NAME}]
 command = ${JSON.stringify(command)}`;
   try {
@@ -74971,7 +76170,7 @@ command = ${JSON.stringify(command)}`;
   }
 }
 function registerOpenCodeMcp(command) {
-  const path = join33(homedir7(), ".config", "opencode", "opencode.json");
+  const path = join34(homedir7(), ".config", "opencode", "opencode.json");
   const config2 = JSON.stringify({
     $schema: "https://opencode.ai/config.json",
     mcp: {
@@ -75028,8 +76227,8 @@ function writeJsonObject(path, data) {
 `);
 }
 function writeTextFile(path, content) {
-  mkdirSync15(dirname11(path), { recursive: true });
-  writeFileSync15(path, content.endsWith(`
+  mkdirSync16(dirname12(path), { recursive: true });
+  writeFileSync16(path, content.endsWith(`
 `) ? content : `${content}
 `);
 }
@@ -75059,7 +76258,7 @@ function findCommandOnPath(command) {
   for (const dir of pathValue.split(":")) {
     if (!dir)
       continue;
-    const candidate = join33(dir, command);
+    const candidate = join34(dir, command);
     if (existsSync30(candidate))
       return candidate;
   }
@@ -75077,8 +76276,8 @@ var init_runtime_mcp = __esm(() => {
 // src/cli/commands/remote-account.ts
 var exports_remote_account = {};
 __export(exports_remote_account, {
-  execute: () => execute,
-  registerRemoteAccount: () => registerRemoteAccount
+  registerRemoteAccount: () => registerRemoteAccount,
+  execute: () => execute
 });
 function registerRemoteAccount(parent) {
   parent.command("capabilities").option("--json", "Output as JSON", false).description("Inspect the selected server's supported API contract").action((options) => execute(options, (client) => client.getCapabilities()));
@@ -75121,8 +76320,8 @@ var exports_runtime = {};
 __export(exports_runtime, {
   registerRuntime: () => registerRuntime
 });
-import { lstatSync as lstatSync7, mkdirSync as mkdirSync16, readFileSync as readFileSync27, realpathSync as realpathSync2, writeFileSync as writeFileSync16 } from "fs";
-import { basename as basename5, isAbsolute as isAbsolute4, join as join34 } from "path";
+import { lstatSync as lstatSync9, mkdirSync as mkdirSync17, readFileSync as readFileSync27, realpathSync as realpathSync3, writeFileSync as writeFileSync17 } from "fs";
+import { basename as basename5, isAbsolute as isAbsolute6, join as join35 } from "path";
 import { createInterface } from "readline";
 function registerRuntime(parent) {
   parent.command("run").argument("<skill>", "Skill name").argument("[args...]", "Arguments to pass to the skill").allowUnknownOption(true).passThroughOptions(true).option("--json", "Output result as JSON", false).option("--remote", "Run on the configured server, using its catalog and quote", false).option("--yes", "Approve the server's quoted credit cost for this run", false).option("--idempotency-key <key>", "Reuse this key when retrying the same remote submission").option("--file <path>", "Attach a local input file to a remote run (repeatable)", (value, prior) => [...prior, value], []).option("--wait", "Poll remote runs until a terminal status", false).option("--poll-interval-ms <ms>", "Remote polling interval in milliseconds", "1000").option("--poll-timeout-ms <ms>", "Maximum time to wait for a remote run", "300000").description("Run a skill directly").action(async (name, args2, options) => handleRun(name, args2, options));
@@ -75205,14 +76404,14 @@ Updating ${name}...
 async function readUpdatedVersion(bunExecutable) {
   const output = await readUpdateCommand([bunExecutable, "pm", "bin", "-g"]);
   const globalBin = output.replace(/\r?\n$/, "");
-  if (!globalBin || !isAbsolute4(globalBin) || /[\r\n\0]/.test(globalBin))
+  if (!globalBin || !isAbsolute6(globalBin) || /[\r\n\0]/.test(globalBin))
     throw new Error("Update bin discovery failed");
   const installed = Bun.which("skills", { PATH: globalBin, cwd: globalBin });
   const selected = Bun.which("skills");
   if (!installed || !selected)
     throw new Error("Updated command is unavailable");
-  const selectedPath = realpathSync2(selected);
-  if (selectedPath !== realpathSync2(installed))
+  const selectedPath = realpathSync3(selected);
+  if (selectedPath !== realpathSync3(installed))
     throw new Error("Updated command is shadowed on PATH");
   const version2 = (await readUpdateCommand([selectedPath, "--version"])).trim();
   if (!new RegExp(SEMVER_PATTERN).test(version2))
@@ -75341,14 +76540,14 @@ function requireHttpUrl(value) {
 }
 function promptLine(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let settled = false;
     const finish = (answer) => {
       if (settled)
         return;
       settled = true;
       rl.close();
-      resolve3(answer);
+      resolve4(answer);
     };
     rl.once("SIGINT", () => finish(null));
     rl.once("close", () => finish(null));
@@ -75391,20 +76590,23 @@ async function handleRun(name, args2, options) {
   }
   let client;
   let approvedCredits = 0;
+  let quoteReceipt;
   let inputFiles = [];
   if (routing.route === "remote") {
     try {
       parsePollingOptions(options);
       inputFiles = (options.file ?? []).map((path) => {
-        const info = lstatSync7(path);
+        const info = lstatSync9(path);
         if (!info.isFile() || info.size > 20 * 1024 * 1024)
           throw new Error("Input must be a regular file no larger than 20 MiB");
         return { name: basename5(path), bytes: new Uint8Array(readFileSync27(path)) };
       });
       describeRemoteFiles(inputFiles);
       client = new RemoteSkillsClient(routing.apiKey, routing.apiOrigin);
-      const quote = await client.quoteRun(skill.name, {}, args2);
+      const descriptors = describeRemoteFiles(inputFiles);
+      const quote = await client.quoteRun(skill.name, {}, args2, descriptors.length ? descriptors : undefined);
       approvedCredits = quote.pricing.costCents;
+      quoteReceipt = quote.quoteReceipt;
       if (approvedCredits > 0 && !options.yes) {
         if (options.json || !process.stdin.isTTY || !process.stdout.isTTY) {
           throw new Error(`CREDIT_APPROVAL_REQUIRED: This run costs ${approvedCredits} credits. Review skills quote, then rerun with --yes before the skill name.`);
@@ -75453,6 +76655,7 @@ async function handleRun(name, args2, options) {
     try {
       const run = await client.submitQuotedRunWithFiles(skill.name, {}, args2, inputFiles, {
         maxCredits: approvedCredits,
+        quoteReceipt,
         idempotencyKey: options.idempotencyKey ?? runContext.record.id
       });
       if (run.error) {
@@ -75770,7 +76973,7 @@ async function handleExportsDownload(runId, options) {
     const canonicalSkill = typeof remoteRun.skill === "string" ? remoteRun.skill : "remote";
     const requestedSkill = typeof remoteRun.requestedSlug === "string" && remoteRun.requestedSlug.trim() ? remoteRun.requestedSlug : canonicalSkill;
     const exportDir = getRunExportDir(runId, requestedSkill);
-    mkdirSync16(exportDir, { recursive: true });
+    mkdirSync17(exportDir, { recursive: true });
     const downloaded = [];
     for (const artifact of artifacts) {
       const artifactId = String(artifact.id || "");
@@ -75778,9 +76981,9 @@ async function handleExportsDownload(runId, options) {
         continue;
       const verified = await client.getVerifiedRunArtifact(runId, artifactId);
       const relativePath = safeArtifactRelativePath(typeof artifact.relativePath === "string" ? artifact.relativePath : artifact.fileName, String(artifact.fileName || artifactId));
-      const outputPath = join34(exportDir, relativePath);
+      const outputPath = join35(exportDir, relativePath);
       ensureSafeExportParent(exportDir, relativePath);
-      writeFileSync16(outputPath, verified.bytes, { flag: "wx", mode: 384 });
+      writeFileSync17(outputPath, verified.bytes, { flag: "wx", mode: 384 });
       downloaded.push({ id: artifactId, path: outputPath, byteSize: verified.byteSize });
     }
     const payload = {
@@ -75817,14 +77020,14 @@ function ensureSafeExportParent(root, relativePath) {
   let parent = root;
   for (const part of ["", ...parts]) {
     if (part)
-      parent = join34(parent, part);
+      parent = join35(parent, part);
     try {
-      if (!lstatSync7(parent).isDirectory() || lstatSync7(parent).isSymbolicLink())
+      if (!lstatSync9(parent).isDirectory() || lstatSync9(parent).isSymbolicLink())
         throw new Error("Unsafe artifact directory");
     } catch (error2) {
       if (error2.code !== "ENOENT")
         throw error2;
-      mkdirSync16(parent, { mode: 448 });
+      mkdirSync17(parent, { mode: 448 });
     }
   }
 }
@@ -75852,7 +77055,7 @@ async function pollRemoteRun(client, runId, options) {
     const remaining = deadline - Date.now();
     if (remaining <= 0)
       break;
-    await new Promise((resolve3) => setTimeout(resolve3, Math.min(options.intervalMs, remaining)));
+    await new Promise((resolve4) => setTimeout(resolve4, Math.min(options.intervalMs, remaining)));
   }
   return {
     run: current ?? { id: runId, status: "queued" },
@@ -76162,7 +77365,7 @@ var init_completion = __esm(() => {
 // src/lib/portable-snapshot-filter.ts
 import { readdirSync as readdirSync16, statSync as statSync17 } from "fs";
 import { homedir as homedir8 } from "os";
-import { join as join35, sep as sep3 } from "path";
+import { join as join36, sep as sep3 } from "path";
 function isExcludedSkillFileName(fileName) {
   if (EXCLUDE_FILE_NAMES.has(fileName)) {
     return true;
@@ -76185,16 +77388,16 @@ function isPortableWithinSkill(relativeParts) {
 function homePathFor(definition, homesRoot) {
   const home = homesRoot ?? homedir8();
   if (definition.subClass === "skills" || definition.subClass === "custom") {
-    return join35(skillsDataRootForHome(home), definition.name);
+    return join36(skillsDataRootForHome(home), definition.name);
   }
   if (definition.agent === "opencode") {
-    return join35(home, ".config", "opencode", "skills");
+    return join36(home, ".config", "opencode", "skills");
   }
-  return join35(home, `.${definition.agent}`, "skills");
+  return join36(home, `.${definition.agent}`, "skills");
 }
 function destinationFor(definition, stationId, relativePath) {
-  const category = definition.subClass === "agent-homes" ? join35("agent-homes", definition.agent ?? "") : definition.name;
-  return join35("resources", stationId, "skills", category, ...relativePath.split(sep3));
+  const category = definition.subClass === "agent-homes" ? join36("agent-homes", definition.agent ?? "") : definition.name;
+  return join36("resources", stationId, "skills", category, ...relativePath.split(sep3));
 }
 function walkEntries(absoluteRoot) {
   let entries;
@@ -76205,7 +77408,7 @@ function walkEntries(absoluteRoot) {
   }
   const output = [];
   for (const entry of entries) {
-    const childFull = join35(absoluteRoot, entry.name);
+    const childFull = join36(absoluteRoot, entry.name);
     if (entry.isSymbolicLink()) {
       output.push({ kind: "symlink", relativePath: entry.name, fullPath: childFull });
       continue;
@@ -76216,7 +77419,7 @@ function walkEntries(absoluteRoot) {
       }
       const nested = walkEntries(childFull);
       for (const item of nested) {
-        output.push({ ...item, relativePath: join35(entry.name, item.relativePath) });
+        output.push({ ...item, relativePath: join36(entry.name, item.relativePath) });
       }
       continue;
     }
@@ -76309,22 +77512,22 @@ var init_portable_snapshot_filter = __esm(() => {
 });
 
 // src/lib/station-snapshot.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
-  mkdirSync as mkdirSync17,
+  mkdirSync as mkdirSync18,
   readFileSync as readFileSync28,
   statSync as statSync18,
-  writeFileSync as writeFileSync17
+  writeFileSync as writeFileSync18
 } from "fs";
-import { dirname as dirname13, isAbsolute as isAbsolute5, relative as relative5, resolve as resolve3, sep as sep4 } from "path";
+import { dirname as dirname14, isAbsolute as isAbsolute7, relative as relative5, resolve as resolve4, sep as sep4 } from "path";
 function validateStationId(stationId) {
   if (!/^[a-z0-9-]+$/.test(stationId)) {
     throw new StationSnapshotError("INVALID_STATION", `station id must be a slug, got: ${stationId}`);
   }
 }
 function sha256File(filePath) {
-  return createHash7("sha256").update(readFileSync28(filePath)).digest("hex");
+  return createHash8("sha256").update(readFileSync28(filePath)).digest("hex");
 }
 function scanHome(definition, homesRoot) {
   const homePath = homePathFor(definition, homesRoot);
@@ -76395,7 +77598,7 @@ function humanHomes(scanned) {
   }));
 }
 function writeStationSnapshot(options) {
-  const repoRoot = resolve3(options.repoRoot ?? process.cwd());
+  const repoRoot = resolve4(options.repoRoot ?? process.cwd());
   const { scanned, plans, totalBytes } = planStationSnapshot(options);
   const manifestFiles = plans.map((plan) => ({
     relativePath: plan.source.relativePath,
@@ -76421,9 +77624,9 @@ function writeStationSnapshot(options) {
   const conflicts = [];
   const untouched = [];
   for (const plan of plans) {
-    const destination = resolve3(repoRoot, plan.destination);
+    const destination = resolve4(repoRoot, plan.destination);
     const destinationRelative = relative5(repoRoot, destination);
-    if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep4) || isAbsolute5(destinationRelative)) {
+    if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep4) || isAbsolute7(destinationRelative)) {
       throw new StationSnapshotError("DESTINATION_ESCAPE", `destination escapes repo root: ${plan.destination}`);
     }
     let existingDigest = null;
@@ -76444,8 +77647,8 @@ function writeStationSnapshot(options) {
   }
   let written = 0;
   for (const plan of untouched) {
-    const destination = resolve3(repoRoot, plan.destination);
-    mkdirSync17(dirname13(destination), { recursive: true });
+    const destination = resolve4(repoRoot, plan.destination);
+    mkdirSync18(dirname14(destination), { recursive: true });
     copyFileSync2(plan.source.fullPath, destination);
     written += 1;
   }
@@ -76463,9 +77666,9 @@ function writeStationSnapshot(options) {
     },
     files: manifestFiles
   };
-  const manifestPath = resolve3(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
-  mkdirSync17(dirname13(manifestPath), { recursive: true });
-  writeFileSync17(manifestPath, `${JSON.stringify(manifest, null, 2)}
+  const manifestPath = resolve4(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
+  mkdirSync18(dirname14(manifestPath), { recursive: true });
+  writeFileSync18(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
   return {
     ...base2,
@@ -76497,7 +77700,7 @@ __export(exports_create_sync_config, {
   registerCreateSync: () => registerCreateSync
 });
 import { existsSync as existsSync31 } from "fs";
-import { join as join36 } from "path";
+import { join as join37 } from "path";
 function registerCreateSync(parent) {
   const configCmd = parent.command("config").description("Manage skills configuration");
   configCmd.command("show", { isDefault: true }).option("--json", "Output as JSON", false).description("Show current merged configuration").action((options) => {
@@ -76603,7 +77806,7 @@ function handleCreate(name, options) {
       console.log(source_default.green(`\u2713 Created custom skill '${result2.name}' at ${result2.path}`));
       console.log(source_default.dim(`  Category: ${result2.manifest.category}`));
       console.log(source_default.dim(`  Tags: ${result2.manifest.tags?.join(", ")}`));
-      console.log(`  ${source_default.cyan("Edit:")} ${join36(result2.path, "src", "index.ts")}`);
+      console.log(`  ${source_default.cyan("Edit:")} ${join37(result2.path, "src", "index.ts")}`);
       console.log(`  ${source_default.cyan("Run:")}  skills run ${result2.name} --help`);
     }
   } catch (error2) {
@@ -76879,30 +78082,30 @@ var init_create_sync_config = __esm(() => {
 });
 
 // src/lib/station-hydrate.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import {
   copyFileSync as copyFileSync3,
-  mkdirSync as mkdirSync18,
+  mkdirSync as mkdirSync19,
   readdirSync as readdirSync17,
   readFileSync as readFileSync29,
   statSync as statSync19,
-  writeFileSync as writeFileSync18
+  writeFileSync as writeFileSync19
 } from "fs";
-import { dirname as dirname14, join as join37, resolve as resolve4, sep as sep5 } from "path";
-function fail3(code, message, detail = []) {
+import { dirname as dirname15, join as join38, resolve as resolve5, sep as sep5 } from "path";
+function fail4(code, message, detail = []) {
   throw new StationSnapshotError(code, message, detail);
 }
 function snapshotRootFor(repoRoot, stationId) {
-  return join37(repoRoot, "resources", stationId, "skills");
+  return join38(repoRoot, "resources", stationId, "skills");
 }
 function readSnapshotManifest(repoRoot, stationId) {
   const snapshotRoot = snapshotRootFor(repoRoot, stationId);
-  const manifestPath = join37(snapshotRoot, "sync-manifest.json");
+  const manifestPath = join38(snapshotRoot, "sync-manifest.json");
   let manifest;
   try {
     manifest = JSON.parse(readFileSync29(manifestPath, "utf8"));
   } catch (error2) {
-    fail3("MANIFEST_UNREADABLE", `cannot read snapshot manifest: ${manifestPath}: ${error2.message}`);
+    fail4("MANIFEST_UNREADABLE", `cannot read snapshot manifest: ${manifestPath}: ${error2.message}`);
   }
   const sourceSnapshotSha = sha256File(manifestPath);
   return { manifest, manifestPath, sourceSnapshotSha };
@@ -76924,7 +78127,7 @@ function planStationHydration(stationId, repoRoot) {
   const hashMismatches = [];
   const skippedByRule = [];
   for (const agent of SYNC_AGENTS) {
-    const agentRoot = join37(snapshotRoot, "agent-homes", agent);
+    const agentRoot = join38(snapshotRoot, "agent-homes", agent);
     let identEntries;
     try {
       identEntries = readdirSync17(agentRoot, { withFileTypes: true });
@@ -76935,7 +78138,7 @@ function planStationHydration(stationId, repoRoot) {
       if (!identEntry.isDirectory() || identEntry.name.startsWith(".")) {
         continue;
       }
-      const identRoot = join37(agentRoot, identEntry.name);
+      const identRoot = join38(agentRoot, identEntry.name);
       const entries = walkEntries(identRoot);
       for (const entry of entries) {
         const relativeParts = [identEntry.name, ...entry.relativePath.split(sep5)];
@@ -77009,10 +78212,10 @@ function planStationHydration(stationId, repoRoot) {
     }
   }
   if (symlinks.length > 0) {
-    fail3("SYMLINKS_REFUSED", `${symlinks.length} symlink(s) inside the snapshot; symlinks are refused (fail closed)`);
+    fail4("SYMLINKS_REFUSED", `${symlinks.length} symlink(s) inside the snapshot; symlinks are refused (fail closed)`);
   }
   if (hashMismatches.length > 0) {
-    fail3("MANIFEST_HASH_MISMATCH", `${hashMismatches.length} snapshot file(s) no longer match their sync-manifest sha256; ` + "stale or tampered content is refused (fail closed), nothing written \u2014 re-run sync to refresh the manifest", hashMismatches.map((mismatch) => `agent-homes/${mismatch.agent}/${mismatch.ident}/${mismatch.relativePath}`));
+    fail4("MANIFEST_HASH_MISMATCH", `${hashMismatches.length} snapshot file(s) no longer match their sync-manifest sha256; ` + "stale or tampered content is refused (fail closed), nothing written \u2014 re-run sync to refresh the manifest", hashMismatches.map((mismatch) => `agent-homes/${mismatch.agent}/${mismatch.ident}/${mismatch.relativePath}`));
   }
   const byIdent = new Map;
   for (const candidate of candidates) {
@@ -77082,12 +78285,12 @@ function skillSha256(skill) {
     return sha256File(skill.files[0].winner.fullPath);
   }
   const joined = skill.files.map((file) => sha256File(file.winner.fullPath));
-  return createHash8("sha256").update(joined.sort().join(`
+  return createHash9("sha256").update(joined.sort().join(`
 `)).digest("hex");
 }
 function writeStationHydration(options) {
-  const repoRoot = resolve4(options.repoRoot ?? process.cwd());
-  const cacheRoot = resolve4(options.cacheRoot ?? resolveCorpusRoot());
+  const repoRoot = resolve5(options.repoRoot ?? process.cwd());
+  const cacheRoot = resolve5(options.cacheRoot ?? resolveCorpusRoot());
   const plan = planStationHydration(options.stationId, repoRoot);
   const resultSkills = plan.winners.map((skill) => ({
     ident: skill.ident,
@@ -77120,7 +78323,7 @@ function writeStationHydration(options) {
   const toWrite = [];
   for (const skill of plan.winners) {
     for (const file of skill.files) {
-      const destination = join37(cacheRoot, skill.ident, file.withinIdent);
+      const destination = join38(cacheRoot, skill.ident, file.withinIdent);
       const digest = sha256File(file.winner.fullPath);
       let existingDigest = null;
       try {
@@ -77137,11 +78340,11 @@ function writeStationHydration(options) {
     }
   }
   if (conflicts.length > 0) {
-    fail3("CONFLICT", `${conflicts.length} conflict(s); terminal non-acceptance, nothing written`, conflicts);
+    fail4("CONFLICT", `${conflicts.length} conflict(s); terminal non-acceptance, nothing written`, conflicts);
   }
   let written = 0;
   for (const entry of toWrite) {
-    mkdirSync18(dirname14(entry.destination), { recursive: true });
+    mkdirSync19(dirname15(entry.destination), { recursive: true });
     copyFileSync3(entry.fullPath, entry.destination);
     written += 1;
   }
@@ -77162,9 +78365,9 @@ function writeStationHydration(options) {
     },
     skills: resultSkills
   };
-  const hydrationManifestPath = join37(dirname14(cacheRoot), `hydration-${options.stationId}.json`);
-  mkdirSync18(dirname14(hydrationManifestPath), { recursive: true });
-  writeFileSync18(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
+  const hydrationManifestPath = join38(dirname15(cacheRoot), `hydration-${options.stationId}.json`);
+  mkdirSync19(dirname15(hydrationManifestPath), { recursive: true });
+  writeFileSync19(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
   return {
     ...base2,
@@ -77592,8 +78795,8 @@ var init_schedule = __esm(() => {
 });
 
 // src/lib/registry-sync.ts
-import { mkdirSync as mkdirSync19, writeFileSync as writeFileSync19 } from "fs";
-import { dirname as dirname15, relative as relative6 } from "path";
+import { mkdirSync as mkdirSync20, writeFileSync as writeFileSync20 } from "fs";
+import { dirname as dirname16, relative as relative6 } from "path";
 function createRegistrySyncArtifact(options = {}) {
   const profile = options.profile ?? "all";
   const includeDocs = options.includeDocs ?? true;
@@ -77650,8 +78853,8 @@ function createRegistrySyncArtifact(options = {}) {
   };
 }
 function writeRegistrySyncArtifact(path, artifact) {
-  mkdirSync19(dirname15(path), { recursive: true });
-  writeFileSync19(path, `${JSON.stringify(artifact, null, 2)}
+  mkdirSync20(dirname16(path), { recursive: true });
+  writeFileSync20(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
 function buildDocs(name) {
@@ -77672,9 +78875,9 @@ var init_registry_sync = __esm(() => {
 // src/cli/commands/registry.ts
 var exports_registry2 = {};
 __export(exports_registry2, {
-  registerPull: () => registerPull,
+  registerVersions: () => registerVersions,
   registerRegistry: () => registerRegistry,
-  registerVersions: () => registerVersions
+  registerPull: () => registerPull
 });
 function registerRegistry(parent) {
   const registry2 = parent.command("registry").description("Generate registry artifacts for hosted skills services");
@@ -77683,12 +78886,12 @@ function registerRegistry(parent) {
 async function writeJson2(value, space) {
   const text2 = `${JSON.stringify(value, null, space)}
 `;
-  await new Promise((resolve5, reject2) => {
+  await new Promise((resolve6, reject2) => {
     process.stdout.write(text2, (error2) => {
       if (error2)
         reject2(error2);
       else
-        resolve5();
+        resolve6();
     });
   });
 }
@@ -77716,10 +78919,10 @@ async function handleRegistrySync(options) {
     await writeJson2(artifact, 2);
     return;
   }
-  const invalid3 = artifact.summary.invalidSkillCount ?? "not checked";
+  const invalid4 = artifact.summary.invalidSkillCount ?? "not checked";
   console.log(source_default.green(`Registry sync artifact written to ${options.output}`));
   console.log(source_default.dim(`  Skills: ${artifact.summary.skillCount}`));
-  console.log(source_default.dim(`  Invalid: ${invalid3}`));
+  console.log(source_default.dim(`  Invalid: ${invalid4}`));
 }
 function registerPull(parent) {
   parent.command("pull").argument("[names...]", "Skills to pull from the configured instance (name or name@version)").option("--all", "Pull every skill the instance serves", false).option("--for-machine", "Prepare this machine with the instance's full catalog (implies --all)", false).option("--json", "Output results as JSON", false).description("Fetch skills from the configured Skills instance into this machine's corpus").action(async (names, options) => {
@@ -77816,17 +79019,17 @@ var init_registry2 = __esm(() => {
 // src/cli/commands/publish.ts
 var exports_publish = {};
 __export(exports_publish, {
-  PushSkillError: () => PushSkillError,
-  buildVersionManifest: () => buildVersionManifest,
-  bumpPatch: () => bumpPatch,
-  pushSkill: () => pushSkill,
+  sanitizeGitRemote: () => sanitizeGitRemote,
   registerPublish: () => registerPublish,
-  sanitizeGitRemote: () => sanitizeGitRemote
+  pushSkill: () => pushSkill,
+  bumpPatch: () => bumpPatch,
+  buildVersionManifest: () => buildVersionManifest,
+  PushSkillError: () => PushSkillError
 });
 import { execFileSync } from "child_process";
 import { existsSync as existsSync32, readFileSync as readFileSync30 } from "fs";
 import { hostname as hostname2 } from "os";
-import { join as join38 } from "path";
+import { join as join39 } from "path";
 function registerPublish(parent) {
   parent.command("push").argument("<name>", "Name of a skill in the local corpus (~/.hasna/skills/installed or the migrated ~/.hasna/skills/skills)").option("--version <version>", "Override the version recorded on the instance").option("--force-new-version", "If name@version already exists with different content, publish as the next patch version", false).option("--dry-run", "Pack and validate without uploading", false).option("--json", "Output result as JSON", false).description("Publish a local skill to the configured skills instance").action(async (name, options) => {
     try {
@@ -77873,7 +79076,7 @@ async function pushSkill(name, options = {}) {
   }
   const packed = packSkillBundle(skill.path, { maxUnpackedBytes: MAX_UNPACKED_BYTES });
   const versionManifest = buildVersionManifest(skill.path, packed);
-  const skillMdPath = join38(skill.path, "SKILL.md");
+  const skillMdPath = join39(skill.path, "SKILL.md");
   const skillMd = existsSync32(skillMdPath) ? readFileSync30(skillMdPath, "utf-8") : undefined;
   const base2 = {
     slug: skill.name,
@@ -77939,21 +79142,21 @@ async function readPublishRevision(client, slug) {
     throw new PushSkillError("Publishing was refused because the current skill revision could not be verified.", ["Check the configured instance and connection, then retry the push. No upload was attempted."]);
   }
   const body = lookup.body;
-  const record7 = body !== null && typeof body === "object" && !Array.isArray(body) ? body : undefined;
-  const nestedError = record7?.error;
-  const code = typeof record7?.code === "string" ? record7.code : nestedError !== null && typeof nestedError === "object" && !Array.isArray(nestedError) ? nestedError.code : undefined;
+  const record8 = body !== null && typeof body === "object" && !Array.isArray(body) ? body : undefined;
+  const nestedError = record8?.error;
+  const code = typeof record8?.code === "string" ? record8.code : nestedError !== null && typeof nestedError === "object" && !Array.isArray(nestedError) ? nestedError.code : undefined;
   if (lookup.status === 404 && code === "SKILL_NOT_FOUND")
     return;
   if (lookup.status < 200 || lookup.status >= 300) {
     throw new PushSkillError(`Publishing was refused because the current skill lookup failed: HTTP ${lookup.status}.`, ["Only an explicit SKILL_NOT_FOUND response establishes an initial publish. Check access and server compatibility before retrying."]);
   }
-  const revision = record7?.revisionId;
-  if (record7?.publicationState === "catalogue-only") {
-    if (record7.name === slug && (record7.slug === undefined || record7.slug === slug) && revision === null)
+  const revision = record8?.revisionId;
+  if (record8?.publicationState === "catalogue-only") {
+    if (record8.name === slug && (record8.slug === undefined || record8.slug === slug) && revision === null)
       return;
     throw new PushSkillError("Publishing was refused because the catalogue-only response had contradictory identity or revision state.", ["Check the configured instance and server compatibility. No upload was attempted."]);
   }
-  if (record7?.slug !== slug || typeof revision !== "string" || revision.length === 0 || revision !== revision.trim() || !/^[\x21-\x7e]+$/.test(revision)) {
+  if (record8?.slug !== slug || typeof revision !== "string" || revision.length === 0 || revision !== revision.trim() || !/^[\x21-\x7e]+$/.test(revision)) {
     throw new PushSkillError("Publishing was refused because the current skill response did not contain a matching slug and valid revision.", ["Check the configured instance and server compatibility. No upload was attempted."]);
   }
   return revision;
@@ -78114,7 +79317,7 @@ async function readCode() {
 function promptCode() {
   const { stdin, stderr: output } = process;
   const { isRaw: wasRaw, readableFlowing: wasFlowing } = stdin;
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     let value = "", settled = false;
     const finish = (answer) => {
       if (settled)
@@ -78131,7 +79334,7 @@ function promptCode() {
 `);
       if (answer === null)
         process.exitCode = 130;
-      resolve5(answer);
+      resolve6(answer);
     };
     const cancel = () => finish(null);
     const keypress = (text2, key) => {
@@ -78171,6 +79374,81 @@ var init_customer_verification = __esm(() => {
   };
 });
 
+// src/cli/commands/private-publications.ts
+var exports_private_publications = {};
+__export(exports_private_publications, {
+  registerPrivatePublications: () => registerPrivatePublications
+});
+import { resolve as resolve6 } from "path";
+function verifyOptions(options, action) {
+  if (options.userId === undefined !== (options.membershipId === undefined) || options.userId !== undefined && (!publicationUuid(options.userId) || !publicationUuid(options.membershipId)))
+    throw new PrivatePublicationError("PUBLICATION_CONTEXT_REQUIRED", "Provide both observed --user-id and --membership-id UUIDs.");
+  if ((action === "publish" || action === "resume" || action === "cancel") && options.confirm !== true)
+    throw new PrivatePublicationError("PUBLICATION_CONFIRM_REQUIRED", "Use --confirm to approve this publication action.");
+  if (action === "publish" && (!publicationUuid(options.skillId) || Boolean(options.expectEmpty) === (options.expectedCurrentVersion !== undefined) || options.expectedCurrentVersion !== undefined && !publicationUuid(options.expectedCurrentVersion) || options.idempotencyKey !== undefined && !publicationUuid(options.idempotencyKey)))
+    throw new PrivatePublicationError("INVALID_PUBLICATION_INPUT", "Provide --skill-id and exactly one of --expect-empty or --expected-current-version; optional --idempotency-key must be a UUID.");
+  if (options.waitSeconds !== undefined && (!/^(?:0|[1-9]\d{0,2})$/.test(options.waitSeconds) || Number(options.waitSeconds) > 300))
+    throw new PrivatePublicationError("INVALID_PUBLICATION_INPUT", "Use --wait-seconds from 0 to 300.");
+  if (!options.codeStdin && (options.json || !process.stdin.isTTY || !process.stderr.isTTY))
+    throw new PrivatePublicationError("PUBLICATION_CODE_REQUIRED", "Use --code-stdin with a fresh code for noninteractive publishing.");
+}
+function print2(result2, json) {
+  if (json)
+    console.log(JSON.stringify(result2));
+  else {
+    console.log(`Publication: ${result2.state}`);
+    console.log(`Recovery: ${result2.recoveryDirectory}`);
+    console.log(result2.nextAction);
+  }
+  if (!result2.committed && !["cancelled", "expired"].includes(result2.state))
+    process.exitCode = 2;
+}
+function registerPrivatePublications(parent) {
+  const group = parent.command("publication").description("Publish and reconcile private source versions on a compatible hosted server; execution is separate");
+  const publishCommand = group.command("publish").allowExcessArguments(false).description("Publish private source with explicit current-version comparison").requiredOption("--recovery-dir <directory>", "New recovery directory for publish; existing directory for other actions").requiredOption("--email <email>", "Account email for fresh interactive verification").option("--user-id <uuid>", "Observed account UUID (required without an enrolled named profile)").option("--membership-id <uuid>", "Observed workspace membership UUID").option("--code-stdin", "Read a fresh six-digit verification code from stdin").option("--json", "Output a safe result without session credentials or upload URLs").option("--confirm", "Explicitly approve this action").argument("<directory>", "Validated local skill directory").requiredOption("--skill-id <uuid>", "Existing private/team skill UUID").option("--expected-current-version <uuid>", "Compare against the observed current version UUID").option("--expect-empty", "Require the skill to have no current version").option("--idempotency-key <uuid>", "Stable intent key; generated and saved before begin when omitted").option("--wait-seconds <seconds>", "Bounded status wait from 0 to 300", "60");
+  const statusCommand = group.command("status").allowExcessArguments(false).description("Inspect the exact saved publication").requiredOption("--recovery-dir <directory>", "New recovery directory for publish; existing directory for other actions").requiredOption("--email <email>", "Account email for fresh interactive verification").option("--user-id <uuid>", "Observed account UUID (required without an enrolled named profile)").option("--membership-id <uuid>", "Observed workspace membership UUID").option("--code-stdin", "Read a fresh six-digit verification code from stdin").option("--json", "Output a safe result without session credentials or upload URLs");
+  const resumeCommand = group.command("resume").allowExcessArguments(false).description("Reconcile the saved intent without creating a replacement").requiredOption("--recovery-dir <directory>", "New recovery directory for publish; existing directory for other actions").requiredOption("--email <email>", "Account email for fresh interactive verification").option("--user-id <uuid>", "Observed account UUID (required without an enrolled named profile)").option("--membership-id <uuid>", "Observed workspace membership UUID").option("--code-stdin", "Read a fresh six-digit verification code from stdin").option("--json", "Output a safe result without session credentials or upload URLs").option("--confirm", "Explicitly approve this action").option("--wait-seconds <seconds>", "Bounded status wait from 0 to 300", "60");
+  const cancelCommand = group.command("cancel").allowExcessArguments(false).description("Cancel the exact saved publication").requiredOption("--recovery-dir <directory>", "New recovery directory for publish; existing directory for other actions").requiredOption("--email <email>", "Account email for fresh interactive verification").option("--user-id <uuid>", "Observed account UUID (required without an enrolled named profile)").option("--membership-id <uuid>", "Observed workspace membership UUID").option("--code-stdin", "Read a fresh six-digit verification code from stdin").option("--json", "Output a safe result without session credentials or upload URLs").option("--confirm", "Explicitly approve this action");
+  for (const [action, command] of [["publish", publishCommand], ["status", statusCommand], ["resume", resumeCommand], ["cancel", cancelCommand]]) {
+    command.action(async (...args2) => {
+      const options = action === "publish" ? args2[1] : args2[0];
+      try {
+        verifyOptions(options, action);
+        let code;
+        if (options.codeStdin)
+          code = await readCode();
+        else {
+          await new RemoteSkillsAuthClient(getApiUrl("Publish private skills")).requestCode(options.email);
+          code = await promptCode();
+        }
+        if (code === null)
+          return;
+        const context = options.userId ? { userId: options.userId, membershipId: options.membershipId } : undefined;
+        const client = await privatePublicationSession(options.email, code, context), directory = resolve6(options.recoveryDir);
+        if (action === "publish")
+          await preparePrivatePublication(client, resolve6(args2[0]), directory, { skillId: options.skillId, expectedCurrentVersionId: options.expectedCurrentVersion ?? null, idempotencyKey: options.idempotencyKey });
+        const result2 = action === "publish" || action === "resume" ? await continuePrivatePublication(client, directory, { confirm: true, waitMs: Number(options.waitSeconds) * 1000 }) : await inspectPrivatePublication(client, directory, action === "cancel");
+        print2(result2, options.json);
+      } catch (error2) {
+        const result2 = privatePublicationCustomerError(error2);
+        if (options.json)
+          console.log(JSON.stringify(result2));
+        else
+          console.error(result2.error);
+        process.exitCode = 1;
+      }
+    });
+  }
+}
+var init_private_publications = __esm(() => {
+  init_remote_auth();
+  init_auth_store();
+  init_private_publication_customer();
+  init_private_publication_recovery();
+  init_remote_private_publications();
+  init_customer_verification();
+});
+
 // src/cli/commands/workspace-selection.ts
 async function codeFor(client, options) {
   if (!options.email?.includes("@"))
@@ -78249,7 +79527,7 @@ __export(exports_auth, {
 import { createInterface as createInterface2 } from "readline";
 function prompt(question) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve5) => {
+  return new Promise((resolve7) => {
     let settled = false;
     const finish = (answer) => {
       if (settled)
@@ -78258,7 +79536,7 @@ function prompt(question) {
       rl.close();
       if (answer === null)
         process.exitCode = 130;
-      resolve5(answer);
+      resolve7(answer);
     };
     rl.once("SIGINT", () => finish(null));
     rl.once("close", () => finish(null));
@@ -78360,7 +79638,7 @@ function printWhoami(payload) {
     console.log(source_default.dim("(offline \u2014 showing cached info)"));
 }
 function sleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 function browserCommand(url) {
   if (process.platform === "darwin")
@@ -78853,7 +80131,7 @@ function promptInvitationProof(kind) {
   const label = kind === "token" ? "invitation token" : "recovery code";
   const character = kind === "token" ? /^[A-Za-z0-9_-]$/ : /^\d$/;
   const { stdin, stderr: output } = process, wasRaw = stdin.isRaw, wasFlowing = stdin.readableFlowing;
-  return new Promise((resolve5) => {
+  return new Promise((resolve7) => {
     let value = "", settled = false, overflow = false;
     const finish = (answer) => {
       if (settled)
@@ -78870,7 +80148,7 @@ function promptInvitationProof(kind) {
 `);
       if (answer === null)
         process.exitCode = 130;
-      resolve5(answer);
+      resolve7(answer);
     };
     const cancel = () => finish(null);
     const keypress = (text2, key) => {
@@ -79442,8 +80720,8 @@ var init_storage = __esm(() => {
 });
 
 // src/lib/registry-reconcile.ts
-import { existsSync as existsSync33, readFileSync as readFileSync31, statSync as statSync20, writeFileSync as writeFileSync20 } from "fs";
-import { join as join39 } from "path";
+import { existsSync as existsSync33, readFileSync as readFileSync31, statSync as statSync20, writeFileSync as writeFileSync21 } from "fs";
+import { join as join40 } from "path";
 function isDirectory2(path) {
   try {
     return statSync20(path).isDirectory();
@@ -79454,11 +80732,11 @@ function isDirectory2(path) {
 function migrationNeeded(options) {
   if (options.rootDir)
     return false;
-  const appDir = options.homeDir ? join39(options.homeDir, ".hasna", "skills") : getDataDir();
-  return !(isOwnerLayoutMigrated(appDir) && isDirectory2(join39(appDir, SKILLS_CACHE_DIRNAME)));
+  const appDir = options.homeDir ? join40(options.homeDir, ".hasna", "skills") : getDataDir();
+  return !(isOwnerLayoutMigrated(appDir) && isDirectory2(join40(appDir, SKILLS_CACHE_DIRNAME)));
 }
 function readBaseline(skillDir) {
-  const markerPath = join39(skillDir, PULL_MARKER_FILE);
+  const markerPath = join40(skillDir, PULL_MARKER_FILE);
   if (!existsSync33(markerPath))
     return;
   try {
@@ -79474,7 +80752,7 @@ function readBaseline(skillDir) {
   }
 }
 function readCursor(root) {
-  const path = join39(root, SYNC_CURSOR_FILE);
+  const path = join40(root, SYNC_CURSOR_FILE);
   if (!existsSync33(path))
     return { runCount: 0 };
   try {
@@ -79487,21 +80765,21 @@ function readCursor(root) {
 function resolveCorpusRootReadOnly(options) {
   if (options.rootDir)
     return { root: options.rootDir, migrationPending: false };
-  const appDir = options.homeDir ? join39(options.homeDir, ".hasna", "skills") : getDataDirReadOnly();
-  const cache3 = join39(appDir, SKILLS_CACHE_DIRNAME);
+  const appDir = options.homeDir ? join40(options.homeDir, ".hasna", "skills") : getDataDirReadOnly();
+  const cache3 = join40(appDir, SKILLS_CACHE_DIRNAME);
   if (isOwnerLayoutMigrated(appDir) && isDirectory2(cache3)) {
     return { root: cache3, migrationPending: false };
   }
-  return { root: join39(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
+  return { root: join40(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
 }
-function remoteRowToSkill(record7) {
-  const slug = typeof record7.slug === "string" ? record7.slug : typeof record7.name === "string" ? record7.name : undefined;
+function remoteRowToSkill(record8) {
+  const slug = typeof record8.slug === "string" ? record8.slug : typeof record8.name === "string" ? record8.name : undefined;
   if (!slug)
     return;
   return {
     slug,
-    version: typeof record7.version === "string" ? record7.version : undefined,
-    sha256: typeof record7.bundleSha256 === "string" && record7.bundleSha256 ? record7.bundleSha256 : undefined
+    version: typeof record8.version === "string" ? record8.version : undefined,
+    sha256: typeof record8.bundleSha256 === "string" && record8.bundleSha256 ? record8.bundleSha256 : undefined
   };
 }
 function recheckLocalSide(plannedLocal, localDir, ops = {
@@ -79626,7 +80904,7 @@ async function reconcileRegistry(options = {}) {
   for (const slug of allSlugs) {
     const local = locals.get(slug);
     const remote = remotes.get(slug);
-    const baseline = local ? readBaseline(join39(root, slug)) : undefined;
+    const baseline = local ? readBaseline(join40(root, slug)) : undefined;
     const { state, reason } = classifySkill(local, remote, baseline);
     let { action, reason: actionReason } = resolveAction(state, direction, conflict);
     if (state === "remote-only" && isDigestless(remote)) {
@@ -79685,7 +80963,7 @@ async function reconcileRegistry(options = {}) {
       try {
         await pushSkill(slug, { rootDir: root, client });
         const pushed = locals.get(slug);
-        writePullMarker(join39(root, slug), {
+        writePullMarker(join40(root, slug), {
           skill: slug,
           ...pushed?.version ? { version: pushed.version } : {},
           ...pushed?.sha256 ? { contentHash: pushed.sha256 } : {},
@@ -79757,7 +81035,7 @@ async function reconcileRegistry(options = {}) {
         runCount: readCursor(root).runCount + 1,
         summary
       };
-      writeFileSync20(join39(root, SYNC_CURSOR_FILE), `${JSON.stringify(cursor2, null, 2)}
+      writeFileSync21(join40(root, SYNC_CURSOR_FILE), `${JSON.stringify(cursor2, null, 2)}
 `);
       return {
         corpusRoot: root,
@@ -79986,43 +81264,43 @@ function throttle(func, throttleMs = 0, options = {}) {
 // ../../node_modules/.bun/ansi-escapes@7.3.0/node_modules/ansi-escapes/base.js
 var exports_base = {};
 __export(exports_base, {
-  ConEmu: () => ConEmu,
-  beep: () => beep,
-  beginSynchronizedOutput: () => beginSynchronizedOutput,
-  clearScreen: () => clearScreen,
-  clearTerminal: () => clearTerminal,
-  clearViewport: () => clearViewport,
-  cursorBackward: () => cursorBackward,
-  cursorDown: () => cursorDown,
-  cursorForward: () => cursorForward,
-  cursorGetPosition: () => cursorGetPosition,
-  cursorHide: () => cursorHide,
-  cursorLeft: () => cursorLeft,
-  cursorMove: () => cursorMove,
-  cursorNextLine: () => cursorNextLine,
-  cursorPrevLine: () => cursorPrevLine,
-  cursorRestorePosition: () => cursorRestorePosition,
-  cursorSavePosition: () => cursorSavePosition,
-  cursorShow: () => cursorShow,
-  cursorTo: () => cursorTo,
-  cursorUp: () => cursorUp,
-  endSynchronizedOutput: () => endSynchronizedOutput,
-  enterAlternativeScreen: () => enterAlternativeScreen,
-  eraseDown: () => eraseDown,
-  eraseEndLine: () => eraseEndLine,
-  eraseLine: () => eraseLine,
-  eraseLines: () => eraseLines,
-  eraseScreen: () => eraseScreen,
-  eraseStartLine: () => eraseStartLine,
-  eraseUp: () => eraseUp,
-  exitAlternativeScreen: () => exitAlternativeScreen,
-  iTerm: () => iTerm,
-  image: () => image,
-  link: () => link,
-  scrollDown: () => scrollDown,
-  scrollUp: () => scrollUp,
+  synchronizedOutput: () => synchronizedOutput,
   setCwd: () => setCwd,
-  synchronizedOutput: () => synchronizedOutput
+  scrollUp: () => scrollUp,
+  scrollDown: () => scrollDown,
+  link: () => link,
+  image: () => image,
+  iTerm: () => iTerm,
+  exitAlternativeScreen: () => exitAlternativeScreen,
+  eraseUp: () => eraseUp,
+  eraseStartLine: () => eraseStartLine,
+  eraseScreen: () => eraseScreen,
+  eraseLines: () => eraseLines,
+  eraseLine: () => eraseLine,
+  eraseEndLine: () => eraseEndLine,
+  eraseDown: () => eraseDown,
+  enterAlternativeScreen: () => enterAlternativeScreen,
+  endSynchronizedOutput: () => endSynchronizedOutput,
+  cursorUp: () => cursorUp,
+  cursorTo: () => cursorTo,
+  cursorShow: () => cursorShow,
+  cursorSavePosition: () => cursorSavePosition,
+  cursorRestorePosition: () => cursorRestorePosition,
+  cursorPrevLine: () => cursorPrevLine,
+  cursorNextLine: () => cursorNextLine,
+  cursorMove: () => cursorMove,
+  cursorLeft: () => cursorLeft,
+  cursorHide: () => cursorHide,
+  cursorGetPosition: () => cursorGetPosition,
+  cursorForward: () => cursorForward,
+  cursorDown: () => cursorDown,
+  cursorBackward: () => cursorBackward,
+  clearViewport: () => clearViewport,
+  clearTerminal: () => clearTerminal,
+  clearScreen: () => clearScreen,
+  beginSynchronizedOutput: () => beginSynchronizedOutput,
+  beep: () => beep,
+  ConEmu: () => ConEmu
 });
 import process2 from "process";
 import os from "os";
@@ -87720,6 +88998,8 @@ registerPull2(program2);
 registerVersions2(program2);
 var { registerPublish: registerPublish2 } = await Promise.resolve().then(() => (init_publish(), exports_publish));
 registerPublish2(program2);
+var { registerPrivatePublications: registerPrivatePublications2 } = await Promise.resolve().then(() => (init_private_publications(), exports_private_publications));
+registerPrivatePublications2(program2);
 var { registerAuth: registerAuth2 } = await Promise.resolve().then(() => (init_auth(), exports_auth));
 registerAuth2(program2);
 var { registerCustomerProfileCommands: registerCustomerProfileCommands2 } = await Promise.resolve().then(() => (init_customer_profile(), exports_customer_profile));