@hasna/skills 0.5.4 → 0.5.5

package/bin/mcp.js

@@ -20,14 +20,12 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  if (mod && typeof mod === "object" || typeof mod === "function") {
-    for (let key of __getOwnPropNames(mod))
-      if (!__hasOwnProp.call(to, key))
-        __defProp(to, key, {
-          get: __accessProp.bind(mod, key),
-          enumerable: true
-        });
-  }
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -114,55 +112,55 @@ var init_core = __esm(() => {
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v4/core/util.js
 var exports_util = {};
 __export(exports_util, {
-  BIGINT_FORMAT_RANGES: () => BIGINT_FORMAT_RANGES,
-  Class: () => Class,
-  NUMBER_FORMAT_RANGES: () => NUMBER_FORMAT_RANGES,
-  aborted: () => aborted,
-  allowsEval: () => allowsEval,
-  assert: () => assert,
-  assertEqual: () => assertEqual,
-  assertIs: () => assertIs,
-  assertNever: () => assertNever,
-  assertNotEqual: () => assertNotEqual,
-  assignProp: () => assignProp,
-  cached: () => cached,
-  captureStackTrace: () => captureStackTrace,
-  cleanEnum: () => cleanEnum,
-  cleanRegex: () => cleanRegex,
-  clone: () => clone,
-  createTransparentProxy: () => createTransparentProxy,
-  defineLazy: () => defineLazy,
-  esc: () => esc,
-  escapeRegex: () => escapeRegex,
-  extend: () => extend,
-  finalizeIssue: () => finalizeIssue,
-  floatSafeRemainder: () => floatSafeRemainder,
-  getElementAtPath: () => getElementAtPath,
-  getEnumValues: () => getEnumValues,
-  getLengthableOrigin: () => getLengthableOrigin,
-  getParsedType: () => getParsedType,
-  getSizableOrigin: () => getSizableOrigin,
-  isObject: () => isObject,
-  isPlainObject: () => isPlainObject,
-  issue: () => issue,
-  joinValues: () => joinValues,
-  jsonStringifyReplacer: () => jsonStringifyReplacer,
-  merge: () => merge,
-  normalizeParams: () => normalizeParams,
-  nullish: () => nullish,
-  numKeys: () => numKeys,
-  omit: () => omit,
-  optionalKeys: () => optionalKeys,
-  partial: () => partial,
-  pick: () => pick,
-  prefixIssues: () => prefixIssues,
-  primitiveTypes: () => primitiveTypes,
-  promiseAllObject: () => promiseAllObject,
-  propertyKeyTypes: () => propertyKeyTypes,
-  randomString: () => randomString,
-  required: () => required,
+  unwrapMessage: () => unwrapMessage,
   stringifyPrimitive: () => stringifyPrimitive,
-  unwrapMessage: () => unwrapMessage
+  required: () => required,
+  randomString: () => randomString,
+  propertyKeyTypes: () => propertyKeyTypes,
+  promiseAllObject: () => promiseAllObject,
+  primitiveTypes: () => primitiveTypes,
+  prefixIssues: () => prefixIssues,
+  pick: () => pick,
+  partial: () => partial,
+  optionalKeys: () => optionalKeys,
+  omit: () => omit,
+  numKeys: () => numKeys,
+  nullish: () => nullish,
+  normalizeParams: () => normalizeParams,
+  merge: () => merge,
+  jsonStringifyReplacer: () => jsonStringifyReplacer,
+  joinValues: () => joinValues,
+  issue: () => issue,
+  isPlainObject: () => isPlainObject,
+  isObject: () => isObject,
+  getSizableOrigin: () => getSizableOrigin,
+  getParsedType: () => getParsedType,
+  getLengthableOrigin: () => getLengthableOrigin,
+  getEnumValues: () => getEnumValues,
+  getElementAtPath: () => getElementAtPath,
+  floatSafeRemainder: () => floatSafeRemainder,
+  finalizeIssue: () => finalizeIssue,
+  extend: () => extend,
+  escapeRegex: () => escapeRegex,
+  esc: () => esc,
+  defineLazy: () => defineLazy,
+  createTransparentProxy: () => createTransparentProxy,
+  clone: () => clone,
+  cleanRegex: () => cleanRegex,
+  cleanEnum: () => cleanEnum,
+  captureStackTrace: () => captureStackTrace,
+  cached: () => cached,
+  assignProp: () => assignProp,
+  assertNotEqual: () => assertNotEqual,
+  assertNever: () => assertNever,
+  assertIs: () => assertIs,
+  assertEqual: () => assertEqual,
+  assert: () => assert,
+  allowsEval: () => allowsEval,
+  aborted: () => aborted,
+  NUMBER_FORMAT_RANGES: () => NUMBER_FORMAT_RANGES,
+  Class: () => Class,
+  BIGINT_FORMAT_RANGES: () => BIGINT_FORMAT_RANGES
 });
 function assertEqual(val) {
   return val;
@@ -3901,14 +3899,14 @@ var init_checks2 = __esm(() => {
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v4/classic/iso.js
 var exports_iso = {};
 __export(exports_iso, {
-  ZodISODate: () => ZodISODate,
-  ZodISODateTime: () => ZodISODateTime,
-  ZodISODuration: () => ZodISODuration,
-  ZodISOTime: () => ZodISOTime,
-  date: () => date2,
-  datetime: () => datetime2,
+  time: () => time2,
   duration: () => duration2,
-  time: () => time2
+  datetime: () => datetime2,
+  date: () => date2,
+  ZodISOTime: () => ZodISOTime,
+  ZodISODuration: () => ZodISODuration,
+  ZodISODateTime: () => ZodISODateTime,
+  ZodISODate: () => ZodISODate
 });
 function datetime2(params) {
   return _isoDateTime(ZodISODateTime, params);
@@ -5588,7 +5586,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.5.4",
+    version: "0.5.5",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -6506,31 +6504,32 @@ var init_local_opt_in = __esm(() => {
 // src/lib/fleet-credentials.ts
 var exports_fleet_credentials = {};
 __export(exports_fleet_credentials, {
-  MissingSkillsFleetError: () => MissingSkillsFleetError,
-  SKILLS_API_KEY_ENV: () => SKILLS_API_KEY_ENV,
-  SKILLS_API_KEY_ENV_KEYS: () => SKILLS_API_KEY_ENV_KEYS,
-  SKILLS_API_URL_ENV: () => SKILLS_API_URL_ENV,
-  SKILLS_API_URL_ENV_KEYS: () => SKILLS_API_URL_ENV_KEYS,
-  SKILLS_APP: () => SKILLS_APP,
-  SKILLS_LOCAL_OPT_IN_ENV_KEYS: () => SKILLS_LOCAL_OPT_IN_ENV_KEYS,
-  SkillsFleetCredentialError: () => SkillsFleetCredentialError,
-  configuredSkillsApiUrl: () => configuredSkillsApiUrl,
-  isSkillsFleetCredentialError: () => isSkillsFleetCredentialError,
-  isSkillsLocalOptIn: () => isSkillsLocalOptIn,
-  normalizeSkillsApiOrigin: () => normalizeSkillsApiOrigin,
-  noticeLocalSkillsMode: () => noticeLocalSkillsMode,
-  requireSkillsApiKey: () => requireSkillsApiKey,
-  requireSkillsApiOrigin: () => requireSkillsApiOrigin,
-  requireSkillsFleet: () => requireSkillsFleet,
-  resetLocalSkillsModeNotice: () => resetLocalSkillsModeNotice,
-  resolveSkillsApiKey: () => resolveSkillsApiKey,
-  resolveSkillsApiOrigin: () => resolveSkillsApiOrigin,
-  resolveSkillsConnection: () => resolveSkillsConnection,
-  resolveSkillsFleet: () => resolveSkillsFleet,
-  selectsSkillsLocalMode: () => selectsSkillsLocalMode,
-  skillsCredentialFilePath: () => skillsCredentialFilePath,
+  skillsCredentialOrReason: () => skillsCredentialOrReason,
   skillsCredentialFiles: () => skillsCredentialFiles,
-  skillsCredentialOrReason: () => skillsCredentialOrReason
+  skillsCredentialFilePath: () => skillsCredentialFilePath,
+  skillsApiRequestUrl: () => skillsApiRequestUrl,
+  selectsSkillsLocalMode: () => selectsSkillsLocalMode,
+  resolveSkillsFleet: () => resolveSkillsFleet,
+  resolveSkillsConnection: () => resolveSkillsConnection,
+  resolveSkillsApiOrigin: () => resolveSkillsApiOrigin,
+  resolveSkillsApiKey: () => resolveSkillsApiKey,
+  resetLocalSkillsModeNotice: () => resetLocalSkillsModeNotice,
+  requireSkillsFleet: () => requireSkillsFleet,
+  requireSkillsApiOrigin: () => requireSkillsApiOrigin,
+  requireSkillsApiKey: () => requireSkillsApiKey,
+  noticeLocalSkillsMode: () => noticeLocalSkillsMode,
+  normalizeSkillsApiOrigin: () => normalizeSkillsApiOrigin,
+  isSkillsLocalOptIn: () => isSkillsLocalOptIn,
+  isSkillsFleetCredentialError: () => isSkillsFleetCredentialError,
+  configuredSkillsApiUrl: () => configuredSkillsApiUrl,
+  SkillsFleetCredentialError: () => SkillsFleetCredentialError,
+  SKILLS_LOCAL_OPT_IN_ENV_KEYS: () => SKILLS_LOCAL_OPT_IN_ENV_KEYS,
+  SKILLS_APP: () => SKILLS_APP,
+  SKILLS_API_URL_ENV_KEYS: () => SKILLS_API_URL_ENV_KEYS,
+  SKILLS_API_URL_ENV: () => SKILLS_API_URL_ENV,
+  SKILLS_API_KEY_ENV_KEYS: () => SKILLS_API_KEY_ENV_KEYS,
+  SKILLS_API_KEY_ENV: () => SKILLS_API_KEY_ENV,
+  MissingSkillsFleetError: () => MissingSkillsFleetError
 });
 function isCredentialResolutionError(error2) {
   return error2 instanceof CredentialResolutionError || typeof error2 === "object" && error2 !== null && error2.name === "CredentialResolutionError";
@@ -6549,7 +6548,9 @@ function normalizeSkillsApiOrigin(apiUrl) {
     throw new SkillsFleetCredentialError("A Skills API URL must use HTTPS (or loopback HTTP), without credentials, query or fragment", "INVALID_API_URL");
   }
   const pathname = url.pathname.replace(/\/+$/, "");
-  if (pathname === "/api" || pathname === "/api/v1") {
+  if (url.origin === "https://api.hasna.com" && pathname === "/skills/v1") {
+    url.pathname = "/skills";
+  } else if (pathname === "/api" || pathname === "/api/v1") {
     url.pathname = "/";
   } else if (pathname.endsWith("/api/v1")) {
     url.pathname = pathname.slice(0, -"/api/v1".length) || "/";
@@ -6558,6 +6559,21 @@ function normalizeSkillsApiOrigin(apiUrl) {
   }
   return url.toString().replace(/\/+$/, "");
 }
+function skillsApiRequestUrl(apiUrl, route) {
+  const origin = normalizeSkillsApiOrigin(apiUrl);
+  if (!route.startsWith("/api/") || route.includes("#") || route.includes("\\")) {
+    throw new SkillsFleetCredentialError("Invalid Skills API route", "INVALID_API_URL");
+  }
+  if (origin === "https://api.hasna.com/skills") {
+    if (route === "/api/auth/whoami")
+      return `${origin}/v1/auth/whoami`;
+    if (!route.startsWith("/api/v1/")) {
+      throw new SkillsFleetCredentialError("The internal Skills gateway has no established login contract yet. Select an explicitly configured instance with supported authentication.", "GATEWAY_AUTH_UNAVAILABLE");
+    }
+    return `${origin}${route.slice("/api".length)}`;
+  }
+  return `${origin}${route}`;
+}
 function configuredSkillsApiUrl(env = process.env, keychain, profile) {
   const declared = SKILLS_API_URL_ENV_KEYS.filter((key) => env[key] !== undefined).map((key) => ({ key, value: env[key] }));
   for (const entry of declared) {
@@ -10636,113 +10652,113 @@ var init_types2 = __esm(() => {
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
-  BRAND: () => BRAND,
-  DIRTY: () => DIRTY,
-  EMPTY_PATH: () => EMPTY_PATH,
-  INVALID: () => INVALID,
-  NEVER: () => NEVER2,
-  OK: () => OK,
-  ParseStatus: () => ParseStatus,
-  Schema: () => ZodType2,
-  ZodAny: () => ZodAny,
-  ZodArray: () => ZodArray2,
-  ZodBigInt: () => ZodBigInt,
-  ZodBoolean: () => ZodBoolean2,
-  ZodBranded: () => ZodBranded,
-  ZodCatch: () => ZodCatch2,
-  ZodDate: () => ZodDate,
-  ZodDefault: () => ZodDefault2,
-  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion2,
-  ZodEffects: () => ZodEffects,
-  ZodEnum: () => ZodEnum2,
-  ZodError: () => ZodError2,
-  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
-  ZodFunction: () => ZodFunction,
-  ZodIntersection: () => ZodIntersection2,
-  ZodIssueCode: () => ZodIssueCode,
-  ZodLazy: () => ZodLazy,
-  ZodLiteral: () => ZodLiteral2,
-  ZodMap: () => ZodMap,
-  ZodNaN: () => ZodNaN,
-  ZodNativeEnum: () => ZodNativeEnum,
-  ZodNever: () => ZodNever2,
-  ZodNull: () => ZodNull2,
-  ZodNullable: () => ZodNullable2,
-  ZodNumber: () => ZodNumber2,
-  ZodObject: () => ZodObject2,
-  ZodOptional: () => ZodOptional2,
-  ZodParsedType: () => ZodParsedType,
-  ZodPipeline: () => ZodPipeline,
-  ZodPromise: () => ZodPromise,
-  ZodReadonly: () => ZodReadonly2,
-  ZodRecord: () => ZodRecord2,
-  ZodSchema: () => ZodType2,
-  ZodSet: () => ZodSet,
-  ZodString: () => ZodString2,
-  ZodSymbol: () => ZodSymbol,
-  ZodTransformer: () => ZodEffects,
-  ZodTuple: () => ZodTuple,
-  ZodType: () => ZodType2,
-  ZodUndefined: () => ZodUndefined,
-  ZodUnion: () => ZodUnion2,
-  ZodUnknown: () => ZodUnknown2,
-  ZodVoid: () => ZodVoid,
-  addIssueToContext: () => addIssueToContext,
-  any: () => anyType,
-  array: () => arrayType,
-  bigint: () => bigIntType,
-  boolean: () => booleanType,
-  coerce: () => coerce,
-  custom: () => custom2,
-  date: () => dateType,
-  datetimeRegex: () => datetimeRegex,
-  defaultErrorMap: () => en_default2,
-  discriminatedUnion: () => discriminatedUnionType,
-  effect: () => effectsType,
-  enum: () => enumType,
-  function: () => functionType,
-  getErrorMap: () => getErrorMap,
-  getParsedType: () => getParsedType2,
-  instanceof: () => instanceOfType,
-  intersection: () => intersectionType,
-  isAborted: () => isAborted,
-  isAsync: () => isAsync,
-  isDirty: () => isDirty,
-  isValid: () => isValid,
-  late: () => late,
-  lazy: () => lazyType,
-  literal: () => literalType,
-  makeIssue: () => makeIssue,
-  map: () => mapType,
-  nan: () => nanType,
-  nativeEnum: () => nativeEnumType,
-  never: () => neverType,
-  null: () => nullType,
-  nullable: () => nullableType,
-  number: () => numberType,
-  object: () => objectType,
-  objectUtil: () => objectUtil,
-  oboolean: () => oboolean,
-  onumber: () => onumber,
-  optional: () => optionalType,
-  ostring: () => ostring,
-  pipeline: () => pipelineType,
-  preprocess: () => preprocessType,
-  promise: () => promiseType,
-  quotelessJson: () => quotelessJson,
-  record: () => recordType,
-  set: () => setType,
-  setErrorMap: () => setErrorMap,
-  strictObject: () => strictObjectType,
-  string: () => stringType,
-  symbol: () => symbolType,
-  transformer: () => effectsType,
-  tuple: () => tupleType,
-  undefined: () => undefinedType,
-  union: () => unionType,
-  unknown: () => unknownType,
+  void: () => voidType,
   util: () => util,
-  void: () => voidType
+  unknown: () => unknownType,
+  union: () => unionType,
+  undefined: () => undefinedType,
+  tuple: () => tupleType,
+  transformer: () => effectsType,
+  symbol: () => symbolType,
+  string: () => stringType,
+  strictObject: () => strictObjectType,
+  setErrorMap: () => setErrorMap,
+  set: () => setType,
+  record: () => recordType,
+  quotelessJson: () => quotelessJson,
+  promise: () => promiseType,
+  preprocess: () => preprocessType,
+  pipeline: () => pipelineType,
+  ostring: () => ostring,
+  optional: () => optionalType,
+  onumber: () => onumber,
+  oboolean: () => oboolean,
+  objectUtil: () => objectUtil,
+  object: () => objectType,
+  number: () => numberType,
+  nullable: () => nullableType,
+  null: () => nullType,
+  never: () => neverType,
+  nativeEnum: () => nativeEnumType,
+  nan: () => nanType,
+  map: () => mapType,
+  makeIssue: () => makeIssue,
+  literal: () => literalType,
+  lazy: () => lazyType,
+  late: () => late,
+  isValid: () => isValid,
+  isDirty: () => isDirty,
+  isAsync: () => isAsync,
+  isAborted: () => isAborted,
+  intersection: () => intersectionType,
+  instanceof: () => instanceOfType,
+  getParsedType: () => getParsedType2,
+  getErrorMap: () => getErrorMap,
+  function: () => functionType,
+  enum: () => enumType,
+  effect: () => effectsType,
+  discriminatedUnion: () => discriminatedUnionType,
+  defaultErrorMap: () => en_default2,
+  datetimeRegex: () => datetimeRegex,
+  date: () => dateType,
+  custom: () => custom2,
+  coerce: () => coerce,
+  boolean: () => booleanType,
+  bigint: () => bigIntType,
+  array: () => arrayType,
+  any: () => anyType,
+  addIssueToContext: () => addIssueToContext,
+  ZodVoid: () => ZodVoid,
+  ZodUnknown: () => ZodUnknown2,
+  ZodUnion: () => ZodUnion2,
+  ZodUndefined: () => ZodUndefined,
+  ZodType: () => ZodType2,
+  ZodTuple: () => ZodTuple,
+  ZodTransformer: () => ZodEffects,
+  ZodSymbol: () => ZodSymbol,
+  ZodString: () => ZodString2,
+  ZodSet: () => ZodSet,
+  ZodSchema: () => ZodType2,
+  ZodRecord: () => ZodRecord2,
+  ZodReadonly: () => ZodReadonly2,
+  ZodPromise: () => ZodPromise,
+  ZodPipeline: () => ZodPipeline,
+  ZodParsedType: () => ZodParsedType,
+  ZodOptional: () => ZodOptional2,
+  ZodObject: () => ZodObject2,
+  ZodNumber: () => ZodNumber2,
+  ZodNullable: () => ZodNullable2,
+  ZodNull: () => ZodNull2,
+  ZodNever: () => ZodNever2,
+  ZodNativeEnum: () => ZodNativeEnum,
+  ZodNaN: () => ZodNaN,
+  ZodMap: () => ZodMap,
+  ZodLiteral: () => ZodLiteral2,
+  ZodLazy: () => ZodLazy,
+  ZodIssueCode: () => ZodIssueCode,
+  ZodIntersection: () => ZodIntersection2,
+  ZodFunction: () => ZodFunction,
+  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
+  ZodError: () => ZodError2,
+  ZodEnum: () => ZodEnum2,
+  ZodEffects: () => ZodEffects,
+  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion2,
+  ZodDefault: () => ZodDefault2,
+  ZodDate: () => ZodDate,
+  ZodCatch: () => ZodCatch2,
+  ZodBranded: () => ZodBranded,
+  ZodBoolean: () => ZodBoolean2,
+  ZodBigInt: () => ZodBigInt,
+  ZodArray: () => ZodArray2,
+  ZodAny: () => ZodAny,
+  Schema: () => ZodType2,
+  ParseStatus: () => ParseStatus,
+  OK: () => OK,
+  NEVER: () => NEVER2,
+  INVALID: () => INVALID,
+  EMPTY_PATH: () => EMPTY_PATH,
+  DIRTY: () => DIRTY,
+  BRAND: () => BRAND
 });
 var init_external2 = __esm(() => {
   init_errors3();
@@ -13305,7 +13321,7 @@ var init_protocol = __esm(() => {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
-var require_code = __commonJS(function(exports) {
+var require_code = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.regexpCode = exports.getEsmExportName = exports.getProperty = exports.safeStringify = exports.stringify = exports.strConcat = exports.addCodeArg = exports.str = exports._ = exports.nil = exports._Code = exports.Name = exports.IDENTIFIER = exports._CodeOrName = undefined;
 
@@ -13459,7 +13475,7 @@ var require_code = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/scope.js
-var require_scope = __commonJS(function(exports) {
+var require_scope = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.ValueScope = exports.ValueScopeName = exports.Scope = exports.varKinds = exports.UsedValueState = undefined;
   var code_1 = require_code();
@@ -13605,7 +13621,7 @@ var require_scope = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/index.js
-var require_codegen = __commonJS(function(exports) {
+var require_codegen = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.or = exports.and = exports.not = exports.CodeGen = exports.operators = exports.varKinds = exports.ValueScopeName = exports.ValueScope = exports.Scope = exports.Name = exports.regexpCode = exports.stringify = exports.getProperty = exports.nil = exports.strConcat = exports.str = exports._ = undefined;
   var code_1 = require_code();
@@ -14315,7 +14331,7 @@ var require_codegen = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/util.js
-var require_util = __commonJS(function(exports) {
+var require_util = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.checkStrictMode = exports.getErrorPath = exports.Type = exports.useFunc = exports.setEvaluated = exports.evaluatedPropsToName = exports.mergeEvaluated = exports.eachItem = exports.unescapeJsonPointer = exports.escapeJsonPointer = exports.escapeFragment = exports.unescapeFragment = exports.schemaRefOrVal = exports.schemaHasRulesButRef = exports.schemaHasRules = exports.checkUnknownRules = exports.alwaysValidSchema = exports.toHash = undefined;
   var codegen_1 = require_codegen();
@@ -14479,7 +14495,7 @@ var require_util = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/names.js
-var require_names = __commonJS(function(exports) {
+var require_names = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var names = {
@@ -14504,7 +14520,7 @@ var require_names = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/errors.js
-var require_errors = __commonJS(function(exports) {
+var require_errors = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.extendErrors = exports.resetErrorsCount = exports.reportExtraError = exports.reportError = exports.keyword$DataError = exports.keywordError = undefined;
   var codegen_1 = require_codegen();
@@ -14622,7 +14638,7 @@ var require_errors = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/boolSchema.js
-var require_boolSchema = __commonJS(function(exports) {
+var require_boolSchema = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.boolOrEmptySchema = exports.topBoolOrEmptySchema = undefined;
   var errors_1 = require_errors();
@@ -14670,7 +14686,7 @@ var require_boolSchema = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/rules.js
-var require_rules = __commonJS(function(exports) {
+var require_rules = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getRules = exports.isJSONType = undefined;
   var _jsonTypes = ["string", "number", "integer", "boolean", "null", "object", "array"];
@@ -14698,7 +14714,7 @@ var require_rules = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/applicability.js
-var require_applicability = __commonJS(function(exports) {
+var require_applicability = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.shouldUseRule = exports.shouldUseGroup = exports.schemaHasRulesForType = undefined;
   function schemaHasRulesForType({ schema, self }, type) {
@@ -14718,7 +14734,7 @@ var require_applicability = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/dataType.js
-var require_dataType = __commonJS(function(exports) {
+var require_dataType = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.reportTypeError = exports.checkDataTypes = exports.checkDataType = exports.coerceAndCheckDataType = exports.getJSONTypes = exports.getSchemaTypes = exports.DataType = undefined;
   var rules_1 = require_rules();
@@ -14899,7 +14915,7 @@ var require_dataType = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/defaults.js
-var require_defaults = __commonJS(function(exports) {
+var require_defaults = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.assignDefaults = undefined;
   var codegen_1 = require_codegen();
@@ -14933,7 +14949,7 @@ var require_defaults = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/code.js
-var require_code2 = __commonJS(function(exports) {
+var require_code2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateUnion = exports.validateArray = exports.usePattern = exports.callValidateCode = exports.schemaProperties = exports.allSchemaProperties = exports.noPropertyInData = exports.propertyInData = exports.isOwnProperty = exports.hasPropFunc = exports.reportMissingProp = exports.checkMissingProp = exports.checkReportMissingProp = undefined;
   var codegen_1 = require_codegen();
@@ -15062,7 +15078,7 @@ var require_code2 = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/keyword.js
-var require_keyword = __commonJS(function(exports) {
+var require_keyword = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateKeywordUsage = exports.validSchemaType = exports.funcKeywordCode = exports.macroKeywordCode = undefined;
   var codegen_1 = require_codegen();
@@ -15177,7 +15193,7 @@ var require_keyword = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/subschema.js
-var require_subschema = __commonJS(function(exports) {
+var require_subschema = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.extendSubschemaMode = exports.extendSubschemaData = exports.getSubschema = undefined;
   var codegen_1 = require_codegen();
@@ -15257,7 +15273,7 @@ var require_subschema = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/fast-deep-equal@3.1.3/node_modules/fast-deep-equal/index.js
-var require_fast_deep_equal = __commonJS(function(exports, module) {
+var require_fast_deep_equal = __commonJS((exports, module) => {
   module.exports = function equal(a, b) {
     if (a === b)
       return true;
@@ -15299,7 +15315,7 @@ var require_fast_deep_equal = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/json-schema-traverse@1.0.0/node_modules/json-schema-traverse/index.js
-var require_json_schema_traverse = __commonJS(function(exports, module) {
+var require_json_schema_traverse = __commonJS((exports, module) => {
   var traverse = module.exports = function(schema, opts, cb) {
     if (typeof opts == "function") {
       cb = opts;
@@ -15382,7 +15398,7 @@ var require_json_schema_traverse = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/resolve.js
-var require_resolve = __commonJS(function(exports) {
+var require_resolve = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getSchemaRefs = exports.resolveUrl = exports.normalizeId = exports._getFullPath = exports.getFullPath = exports.inlineRef = undefined;
   var util_1 = require_util();
@@ -15535,7 +15551,7 @@ var require_resolve = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/validate/index.js
-var require_validate = __commonJS(function(exports) {
+var require_validate = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getData = exports.KeywordCxt = exports.validateFunctionCode = undefined;
   var boolSchema_1 = require_boolSchema();
@@ -16040,7 +16056,7 @@ var require_validate = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/runtime/validation_error.js
-var require_validation_error = __commonJS(function(exports) {
+var require_validation_error = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
 
   class ValidationError extends Error {
@@ -16054,7 +16070,7 @@ var require_validation_error = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/ref_error.js
-var require_ref_error = __commonJS(function(exports) {
+var require_ref_error = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var resolve_1 = require_resolve();
 
@@ -16069,7 +16085,7 @@ var require_ref_error = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/index.js
-var require_compile = __commonJS(function(exports) {
+var require_compile = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.resolveSchema = exports.getCompilingSchema = exports.resolveRef = exports.compileSchema = exports.SchemaEnv = undefined;
   var codegen_1 = require_codegen();
@@ -16290,7 +16306,7 @@ var require_compile = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/refs/data.json
-var require_data = __commonJS(function(exports, module) {
+var require_data = __commonJS((exports, module) => {
   module.exports = {
     $id: "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#",
     description: "Meta-schema for $data reference (JSON AnySchema extension proposal)",
@@ -16307,7 +16323,7 @@ var require_data = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/lib/utils.js
-var require_utils = __commonJS(function(exports, module) {
+var require_utils = __commonJS((exports, module) => {
   var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
   var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
   var isPort = RegExp.prototype.test.bind(/^\d*$/u);
@@ -16824,7 +16840,7 @@ var require_utils = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/lib/schemes.js
-var require_schemes = __commonJS(function(exports, module) {
+var require_schemes = __commonJS((exports, module) => {
   var { isUUID } = require_utils();
   var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
   var supportedSchemeNames = [
@@ -16999,7 +17015,7 @@ var require_schemes = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/index.js
-var require_fast_uri = __commonJS(function(exports, module) {
+var require_fast_uri = __commonJS((exports, module) => {
   var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
   var { SCHEMES, getSchemeHandler } = require_schemes();
   var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
@@ -17401,7 +17417,7 @@ var require_fast_uri = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/runtime/uri.js
-var require_uri = __commonJS(function(exports) {
+var require_uri = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var uri = require_fast_uri();
   uri.code = 'require("ajv/dist/runtime/uri").default';
@@ -17409,7 +17425,7 @@ var require_uri = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/core.js
-var require_core = __commonJS(function(exports) {
+var require_core = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.CodeGen = exports.Name = exports.nil = exports.stringify = exports.str = exports._ = exports.KeywordCxt = undefined;
   var validate_1 = require_validate();
@@ -18002,7 +18018,7 @@ var require_core = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/core/id.js
-var require_id = __commonJS(function(exports) {
+var require_id = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var def = {
     keyword: "id",
@@ -18014,7 +18030,7 @@ var require_id = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/core/ref.js
-var require_ref = __commonJS(function(exports) {
+var require_ref = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.callRef = exports.getValidate = undefined;
   var ref_error_1 = require_ref_error();
@@ -18133,7 +18149,7 @@ var require_ref = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/core/index.js
-var require_core2 = __commonJS(function(exports) {
+var require_core2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var id_1 = require_id();
   var ref_1 = require_ref();
@@ -18151,7 +18167,7 @@ var require_core2 = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitNumber.js
-var require_limitNumber = __commonJS(function(exports) {
+var require_limitNumber = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var ops = codegen_1.operators;
@@ -18180,7 +18196,7 @@ var require_limitNumber = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/multipleOf.js
-var require_multipleOf = __commonJS(function(exports) {
+var require_multipleOf = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var error2 = {
@@ -18205,7 +18221,7 @@ var require_multipleOf = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/runtime/ucs2length.js
-var require_ucs2length = __commonJS(function(exports) {
+var require_ucs2length = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   function ucs2length(str) {
     const len = str.length;
@@ -18228,7 +18244,7 @@ var require_ucs2length = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitLength.js
-var require_limitLength = __commonJS(function(exports) {
+var require_limitLength = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -18257,7 +18273,7 @@ var require_limitLength = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/pattern.js
-var require_pattern = __commonJS(function(exports) {
+var require_pattern = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
   var util_1 = require_util();
@@ -18291,7 +18307,7 @@ var require_pattern = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitProperties.js
-var require_limitProperties = __commonJS(function(exports) {
+var require_limitProperties = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var error2 = {
@@ -18317,7 +18333,7 @@ var require_limitProperties = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/required.js
-var require_required = __commonJS(function(exports) {
+var require_required = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
   var codegen_1 = require_codegen();
@@ -18396,7 +18412,7 @@ var require_required = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitItems.js
-var require_limitItems = __commonJS(function(exports) {
+var require_limitItems = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var error2 = {
@@ -18422,7 +18438,7 @@ var require_limitItems = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/runtime/equal.js
-var require_equal = __commonJS(function(exports) {
+var require_equal = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var equal = require_fast_deep_equal();
   equal.code = 'require("ajv/dist/runtime/equal").default';
@@ -18430,7 +18446,7 @@ var require_equal = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/uniqueItems.js
-var require_uniqueItems = __commonJS(function(exports) {
+var require_uniqueItems = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var dataType_1 = require_dataType();
   var codegen_1 = require_codegen();
@@ -18494,7 +18510,7 @@ var require_uniqueItems = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/const.js
-var require_const = __commonJS(function(exports) {
+var require_const = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -18520,7 +18536,7 @@ var require_const = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/enum.js
-var require_enum = __commonJS(function(exports) {
+var require_enum = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -18566,7 +18582,7 @@ var require_enum = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/index.js
-var require_validation = __commonJS(function(exports) {
+var require_validation = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var limitNumber_1 = require_limitNumber();
   var multipleOf_1 = require_multipleOf();
@@ -18596,7 +18612,7 @@ var require_validation = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/additionalItems.js
-var require_additionalItems = __commonJS(function(exports) {
+var require_additionalItems = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateAdditionalItems = undefined;
   var codegen_1 = require_codegen();
@@ -18646,7 +18662,7 @@ var require_additionalItems = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/items.js
-var require_items = __commonJS(function(exports) {
+var require_items = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateTuple = undefined;
   var codegen_1 = require_codegen();
@@ -18700,7 +18716,7 @@ var require_items = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/prefixItems.js
-var require_prefixItems = __commonJS(function(exports) {
+var require_prefixItems = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var items_1 = require_items();
   var def = {
@@ -18714,7 +18730,7 @@ var require_prefixItems = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/items2020.js
-var require_items2020 = __commonJS(function(exports) {
+var require_items2020 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -18746,7 +18762,7 @@ var require_items2020 = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/contains.js
-var require_contains = __commonJS(function(exports) {
+var require_contains = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -18837,7 +18853,7 @@ var require_contains = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/dependencies.js
-var require_dependencies = __commonJS(function(exports) {
+var require_dependencies = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateSchemaDeps = exports.validatePropertyDeps = exports.error = undefined;
   var codegen_1 = require_codegen();
@@ -18922,7 +18938,7 @@ var require_dependencies = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/propertyNames.js
-var require_propertyNames = __commonJS(function(exports) {
+var require_propertyNames = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -18962,7 +18978,7 @@ var require_propertyNames = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/additionalProperties.js
-var require_additionalProperties = __commonJS(function(exports) {
+var require_additionalProperties = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
   var codegen_1 = require_codegen();
@@ -19065,7 +19081,7 @@ var require_additionalProperties = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/properties.js
-var require_properties = __commonJS(function(exports) {
+var require_properties = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var validate_1 = require_validate();
   var code_1 = require_code2();
@@ -19120,7 +19136,7 @@ var require_properties = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/patternProperties.js
-var require_patternProperties = __commonJS(function(exports) {
+var require_patternProperties = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
   var codegen_1 = require_codegen();
@@ -19191,7 +19207,7 @@ var require_patternProperties = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/not.js
-var require_not = __commonJS(function(exports) {
+var require_not = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var util_1 = require_util();
   var def = {
@@ -19219,7 +19235,7 @@ var require_not = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/anyOf.js
-var require_anyOf = __commonJS(function(exports) {
+var require_anyOf = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
   var def = {
@@ -19233,7 +19249,7 @@ var require_anyOf = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/oneOf.js
-var require_oneOf = __commonJS(function(exports) {
+var require_oneOf = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -19288,7 +19304,7 @@ var require_oneOf = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/allOf.js
-var require_allOf = __commonJS(function(exports) {
+var require_allOf = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var util_1 = require_util();
   var def = {
@@ -19312,7 +19328,7 @@ var require_allOf = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/if.js
-var require_if = __commonJS(function(exports) {
+var require_if = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var util_1 = require_util();
@@ -19378,7 +19394,7 @@ var require_if = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/thenElse.js
-var require_thenElse = __commonJS(function(exports) {
+var require_thenElse = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var util_1 = require_util();
   var def = {
@@ -19393,7 +19409,7 @@ var require_thenElse = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/index.js
-var require_applicator = __commonJS(function(exports) {
+var require_applicator = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var additionalItems_1 = require_additionalItems();
   var prefixItems_1 = require_prefixItems();
@@ -19436,7 +19452,7 @@ var require_applicator = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/format/format.js
-var require_format = __commonJS(function(exports) {
+var require_format = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var error2 = {
@@ -19523,7 +19539,7 @@ var require_format = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/format/index.js
-var require_format2 = __commonJS(function(exports) {
+var require_format2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var format_1 = require_format();
   var format = [format_1.default];
@@ -19531,7 +19547,7 @@ var require_format2 = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/metadata.js
-var require_metadata = __commonJS(function(exports) {
+var require_metadata = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.contentVocabulary = exports.metadataVocabulary = undefined;
   exports.metadataVocabulary = [
@@ -19551,7 +19567,7 @@ var require_metadata = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/draft7.js
-var require_draft7 = __commonJS(function(exports) {
+var require_draft7 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var core_1 = require_core2();
   var validation_1 = require_validation();
@@ -19570,7 +19586,7 @@ var require_draft7 = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/discriminator/types.js
-var require_types = __commonJS(function(exports) {
+var require_types = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.DiscrError = undefined;
   var DiscrError;
@@ -19581,7 +19597,7 @@ var require_types = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/vocabularies/discriminator/index.js
-var require_discriminator = __commonJS(function(exports) {
+var require_discriminator = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
   var types_1 = require_types();
@@ -19683,7 +19699,7 @@ var require_discriminator = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/refs/json-schema-draft-07.json
-var require_json_schema_draft_07 = __commonJS(function(exports, module) {
+var require_json_schema_draft_07 = __commonJS((exports, module) => {
   module.exports = {
     $schema: "http://json-schema.org/draft-07/schema#",
     $id: "http://json-schema.org/draft-07/schema#",
@@ -19838,7 +19854,7 @@ var require_json_schema_draft_07 = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/ajv.js
-var require_ajv = __commonJS(function(exports, module) {
+var require_ajv = __commonJS((exports, module) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.MissingRefError = exports.ValidationError = exports.CodeGen = exports.Name = exports.nil = exports.stringify = exports.str = exports._ = exports.KeywordCxt = exports.Ajv = undefined;
   var core_1 = require_core();
@@ -19906,7 +19922,7 @@ var require_ajv = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.bun/ajv-formats@3.0.1/node_modules/ajv-formats/dist/formats.js
-var require_formats = __commonJS(function(exports) {
+var require_formats = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.formatNames = exports.fastFormats = exports.fullFormats = undefined;
   function fmtDef(validate, compare) {
@@ -20083,7 +20099,7 @@ var require_formats = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv-formats@3.0.1/node_modules/ajv-formats/dist/limit.js
-var require_limit = __commonJS(function(exports) {
+var require_limit = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.formatLimitDefinition = undefined;
   var ajv_1 = require_ajv();
@@ -20152,7 +20168,7 @@ var require_limit = __commonJS(function(exports) {
 });
 
 // ../../node_modules/.bun/ajv-formats@3.0.1/node_modules/ajv-formats/dist/index.js
-var require_dist = __commonJS(function(exports, module) {
+var require_dist = __commonJS((exports, module) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var formats_1 = require_formats();
   var limit_1 = require_limit();
@@ -23125,6 +23141,39 @@ var init_skill_validation = __esm(() => {
   VALID_PROVENANCE_SOURCES = new Set(["official", "custom", "remote", "private", "private-hosted", "upstream", "extension"]);
   VALID_BIN_COMMAND = /^[a-z0-9][a-z0-9._-]*$/;
 });
+
+// src/lib/skill-entry-path.ts
+class SkillEntryPaths {
+  files = new Set;
+  directories = new Set;
+  add(path, maxBytes, invalid, limit) {
+    if (path.length > maxBytes)
+      limit();
+    const encoded = new TextEncoder().encode(path);
+    if (encoded.byteLength > maxBytes)
+      limit();
+    if (new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(encoded) !== path)
+      invalid("Invalid UTF-8 entry path");
+    if (!path || /[\\:\x00-\x1f\x7f]/u.test(path))
+      invalid("Unsafe entry path");
+    if (path.split("/").some((segment) => !segment || segment === "." || segment === ".."))
+      invalid("Unsafe entry path segment");
+    const key = path.normalize("NFC").toLowerCase().normalize("NFC");
+    if (this.files.has(key) || this.directories.has(key))
+      invalid("Duplicate or conflicting entry path");
+    const parents = key.split("/");
+    parents.pop();
+    while (parents.length) {
+      const parent = parents.join("/");
+      if (this.files.has(parent))
+        invalid("Conflicting entry file ancestor");
+      this.directories.add(parent);
+      parents.pop();
+    }
+    this.files.add(key);
+  }
+}
+
 // src/lib/skill-hash.ts
 import { createHash } from "crypto";
 import { existsSync as existsSync5, readdirSync as readdirSync4, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
@@ -23242,6 +23291,186 @@ function hashBundleFiles(files) {
     hash.update(part);
   return hash.digest("hex");
 }
+async function hashBundleFilesCooperatively(files, check2) {
+  const hash = createHash(CONTENT_HASH_ALGORITHM);
+  let bytesSinceYield = 0;
+  for (const part of bundleHashParts(files)) {
+    for (let offset = 0;offset < part.byteLength; offset += 64 * 1024) {
+      check2();
+      const chunk = part.subarray(offset, offset + 64 * 1024);
+      hash.update(chunk);
+      bytesSinceYield += chunk.byteLength;
+      if (bytesSinceYield >= 256 * 1024) {
+        await new Promise((resolve2) => setImmediate(resolve2));
+        bytesSinceYield = 0;
+      }
+    }
+  }
+  check2();
+  return hash.digest("hex");
+}
+function invalidContent(message = "Invalid content hash input") {
+  throw new ContentHashInputError("CONTENT_HASH_INVALID", message);
+}
+function contentLimit(message) {
+  throw new ContentHashInputError("CONTENT_HASH_LIMIT", message);
+}
+function contentRecord(value, allowed) {
+  if (!value || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    invalidContent();
+  const result = Object.create(null);
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string" || !allowed.includes(key))
+      invalidContent();
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !("value" in descriptor))
+      invalidContent("Accessor content hash input is unsupported");
+    result[key] = descriptor.value;
+  }
+  return result;
+}
+function contentOptions(options) {
+  const record3 = contentRecord(options, ["limits", "signal"]);
+  const limits = { ...CONTENT_HASH_LIMITS };
+  if (record3.limits !== undefined) {
+    const supplied = contentRecord(record3.limits, Object.keys(limits));
+    for (const key of Object.keys(supplied)) {
+      const value = supplied[key];
+      if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0 || value > limits[key])
+        contentLimit("Invalid content hash limit");
+      limits[key] = value;
+    }
+  }
+  if (record3.signal !== undefined && !(record3.signal instanceof AbortSignal))
+    invalidContent("Invalid content hash signal");
+  return { limits, signal: record3.signal };
+}
+function snapshotContentEntries(entries, limits, check2) {
+  if (!Array.isArray(entries))
+    invalidContent("Content hash entries must be an array");
+  if (entries.length > limits.entries)
+    contentLimit("Content hash entry limit exceeded");
+  if (Reflect.ownKeys(entries).length !== entries.length + 1)
+    invalidContent("Invalid content hash entry array");
+  const snapshot = [];
+  const paths = new SkillEntryPaths;
+  let rawBytes = 0;
+  for (let index = 0;index < entries.length; index++) {
+    check2();
+    const descriptor = Object.getOwnPropertyDescriptor(entries, String(index));
+    if (!descriptor || !("value" in descriptor))
+      invalidContent("Invalid content hash entry array");
+    const entry = contentRecord(descriptor.value, ["path", "bytes", "mode"]);
+    if (typeof entry.path !== "string" || typeof entry.mode !== "number" || !Number.isInteger(entry.mode) || entry.mode < 0 || entry.mode > 511)
+      invalidContent("Invalid regular-file content hash entry");
+    paths.add(entry.path, limits.pathBytes, invalidContent, () => contentLimit("Content hash path limit exceeded"));
+    if (!(entry.bytes instanceof Uint8Array) || !ArrayBuffer.isView(entry.bytes))
+      invalidContent("Content hash entry requires bytes");
+    const size = byteLengthOf.call(entry.bytes);
+    if (!(bufferOf.call(entry.bytes) instanceof ArrayBuffer))
+      invalidContent("Shared content hash bytes are unsupported");
+    if (size > limits.fileBytes || rawBytes + size > limits.rawBytes)
+      contentLimit("Content hash raw byte limit exceeded");
+    if (entry.path === "skill.json" && size > limits.manifestBytes)
+      contentLimit("Content hash manifest byte limit exceeded");
+    rawBytes += size;
+    const bytes = new Uint8Array(new ArrayBuffer(size));
+    bytes.set(entry.bytes);
+    snapshot.push({ path: entry.path, bytes, mode: entry.mode });
+  }
+  check2();
+  return snapshot;
+}
+function coveredContentPath(path) {
+  const segments = path.split("/");
+  if (!HASH_COVERAGE.includes(segments[0]))
+    return false;
+  return !segments.slice(1).some((segment, index) => excludedHashEntry(segment, index < segments.length - 2));
+}
+function boundedManifest(raw, maxDepth) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return;
+  }
+  const pending = [{ value: parsed, depth: 1 }];
+  while (pending.length) {
+    const { value, depth } = pending.pop();
+    if (!value || typeof value !== "object")
+      continue;
+    if (depth > maxDepth)
+      contentLimit("Content hash manifest depth limit exceeded");
+    for (const child of Object.values(value))
+      pending.push({ value: child, depth: depth + 1 });
+  }
+  return parsed;
+}
+async function hashContentEntries(entries, options) {
+  const { limits, signal } = contentOptions(options);
+  const deadline = performance.now() + limits.timeoutMs;
+  let terminal;
+  const abort = () => {
+    terminal ??= new ContentHashInputError("CONTENT_HASH_ABORTED", "Content hashing aborted");
+  };
+  const timer = setTimeout(() => {
+    terminal ??= new ContentHashInputError("CONTENT_HASH_TIMEOUT", "Content hashing deadline exceeded");
+  }, limits.timeoutMs);
+  const check2 = () => {
+    if (signal?.aborted)
+      abort();
+    if (terminal)
+      throw terminal;
+    if (performance.now() >= deadline)
+      throw new ContentHashInputError("CONTENT_HASH_TIMEOUT", "Content hashing deadline exceeded");
+  };
+  try {
+    signal?.addEventListener("abort", abort, { once: true });
+    check2();
+    const snapshot = snapshotContentEntries(entries, limits, check2);
+    const normalized = [];
+    let normalizedBytes = 0;
+    let manifest;
+    await new Promise((resolve2) => setImmediate(resolve2));
+    for (const entry of snapshot) {
+      check2();
+      if (!coveredContentPath(entry.path))
+        continue;
+      if (entry.path === "skill.json")
+        manifest = boundedManifest(new TextDecoder().decode(entry.bytes), limits.manifestDepth);
+      const file = normalizeBundleFile(entry.path, entry.bytes);
+      check2();
+      if (file.content.byteLength > limits.normalizedFileBytes || normalizedBytes + file.content.byteLength > limits.normalizedBytes)
+        contentLimit("Content hash normalized byte limit exceeded");
+      normalizedBytes += file.content.byteLength;
+      normalized.push(file);
+      await new Promise((resolve2) => setImmediate(resolve2));
+    }
+    normalized.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
+    check2();
+    return { hash: await hashBundleFilesCooperatively(normalized, check2), manifest };
+  } catch (error2) {
+    if (error2 instanceof ContentHashInputError)
+      throw error2;
+    throw new ContentHashInputError("CONTENT_HASH_INVALID", "Invalid content hash input");
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", abort);
+  }
+}
+async function verifyContentHashFromEntries(entries, options = {}) {
+  const { hash, manifest } = await hashContentEntries(entries, options);
+  const provenance = manifest && typeof manifest === "object" && !Array.isArray(manifest) ? manifest.provenance : undefined;
+  const value = provenance && typeof provenance === "object" && !Array.isArray(provenance) ? provenance.content_hash : undefined;
+  if (value !== undefined && typeof value !== "string")
+    invalidContent("Invalid content hash declaration");
+  const declaredHash = value?.trim() || undefined;
+  if (!declaredHash)
+    return { declared: false, valid: false };
+  if (!/^[a-f0-9]{64}$/.test(declaredHash))
+    return { declared: true, valid: false, declaredHash };
+  return { declared: true, valid: hash === declaredHash, declaredHash, computedHash: hash };
+}
 function verifyContentHash(skillPath, manifest) {
   const declaredHash = manifest?.provenance?.content_hash?.trim() || undefined;
   if (!declaredHash)
@@ -23257,7 +23486,7 @@ function verifyContentHash(skillPath, manifest) {
     computedHash
   };
 }
-var CONTENT_HASH_ALGORITHM = "sha256", HASH_EXCLUDE_DIRS, HASH_COVERAGE, CONTENT_HASH_LIMITS, typedArrayPrototype, byteLengthOf, bufferOf;
+var CONTENT_HASH_ALGORITHM = "sha256", HASH_EXCLUDE_DIRS, HASH_COVERAGE, CONTENT_HASH_LIMITS, ContentHashInputError, typedArrayPrototype, byteLengthOf, bufferOf;
 var init_skill_hash = __esm(() => {
   HASH_EXCLUDE_DIRS = new Set([".git", "node_modules", "dist", "build", ".turbo"]);
   HASH_COVERAGE = [
@@ -23282,6 +23511,14 @@ var init_skill_hash = __esm(() => {
     manifestDepth: 64,
     timeoutMs: 5000
   });
+  ContentHashInputError = class ContentHashInputError extends Error {
+    code;
+    constructor(code, message) {
+      super(message);
+      this.code = code;
+      this.name = "ContentHashInputError";
+    }
+  };
   typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
   byteLengthOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteLength").get;
   bufferOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer").get;
@@ -24867,7 +25104,14 @@ function getConfiguredApiUrl(env = process.env) {
 }
 function buildSkillsApiUrl(apiUrl, endpoint = "/skills") {
   const url = new URL(apiUrl);
+  if (url.origin === "https://api.hasna.com" && /^\/skills\/(?:api\/)?v1\/skills\/?$/.test(url.pathname)) {
+    url.pathname = "/skills";
+    apiUrl = url.toString();
+  }
   const cleanEndpoint = endpoint.startsWith("/") ? endpoint : `/${endpoint}`;
+  if (normalizeSkillsApiOrigin(apiUrl) === "https://api.hasna.com/skills") {
+    return skillsApiRequestUrl(apiUrl, `/api/v1${cleanEndpoint}`);
+  }
   const pathname = url.pathname.replace(/\/+$/, "");
   const apiBase = /\/api(?:\/v1)?\/skills$/.test(pathname) ? pathname.slice(0, -"/skills".length) : pathname;
   if (/\/api(?:\/v1)?$/.test(apiBase)) {
@@ -25769,7 +26013,7 @@ var MCP_CONTRACT_SCHEMA_VERSION = 1, stringSchema = (description) => ({
   type: "array",
   items,
   ...description ? { description } : {}
-}), skillNameInput, optionalAgentInput, scopeInput, runInputSchema, runArgsSchema, errorSchema, skillSummarySchema, toolPrimitiveSummarySchema, skillToolDependencySchema, validationMessageSchema, validationOutputSchema, installOutputSchema, runOutputSchema, toolContracts, remoteCustomerContracts, contracts, resourceContracts;
+}), skillNameInput, optionalAgentInput, scopeInput, runInputSchema, runArgsSchema, errorSchema, skillSummarySchema, toolPrimitiveSummarySchema, skillToolDependencySchema, validationMessageSchema, validationOutputSchema, installOutputSchema, runOutputSchema, toolContracts, remoteCustomerContracts, publicationUuidSchema, publicationVerification, privatePublicationContracts, contracts, resourceContracts;
 var init_mcp_contracts = __esm(() => {
   init_remote_customer_operations();
   skillNameInput = stringSchema("skill name or alias.");
@@ -26275,7 +26519,7 @@ var init_mcp_contracts = __esm(() => {
       name: "run_skill",
       title: "Run Skill",
       description: "Run a skill locally or through a configured remote runner. Returns compact stdout/stderr previews and run summaries by default; pass detail:true for full records.",
-      params: ["name", "input?", "args?", "detail?", "remote?", "maxCredits?", "maxCostCents?", "idempotency_key?", "files?"],
+      params: ["name", "input?", "args?", "detail?", "remote?", "maxCredits?", "maxCostCents?", "quoteReceipt?", "idempotency_key?", "files?"],
       category: "execution",
       sideEffects: "local-process-or-remote-run",
       stable: true,
@@ -26287,6 +26531,7 @@ var init_mcp_contracts = __esm(() => {
         remote: { type: "boolean", description: "Use the configured server catalog." },
         maxCredits: { type: "integer", minimum: 0, description: "Maximum explicitly approved integer credits; omitted permits only free remote runs." },
         maxCostCents: { type: "integer", minimum: 0, description: "Legacy alias for maxCredits; both must agree." },
+        quoteReceipt: { type: "string", minLength: 1, maxLength: 4096, description: "Opaque approved quote receipt, at most 4096 UTF-8 bytes. Preserve it and the quoted input/args unchanged; never refresh after confirmation." },
         idempotency_key: { type: "string", pattern: "^[A-Za-z0-9._:-]{1,128}$", description: "Stable retry key for the same remote submission." },
         files: { type: "array", maxItems: 10, items: objectSchema({ name: stringSchema("Safe basename"), base64: { type: "string", maxLength: 1398104 }, contentType: stringSchema("MIME type") }, ["name", "base64"]), description: "Inline remote inputs, at most 1 MiB combined." }
       }, ["name"]),
@@ -26570,12 +26815,17 @@ var init_mcp_contracts = __esm(() => {
     name: "quote_skill",
     title: "Quote Remote Skill",
     description: "Get a server credit quote without submitting a run.",
-    params: ["name", "input?", "args?"],
+    params: ["name", "input?", "args?", "files?"],
     category: "execution",
     sideEffects: "none",
     stable: true,
-    inputSchema: objectSchema({ name: skillNameInput, input: runInputSchema, args: runArgsSchema }, ["name"]),
-    outputSchema: objectSchema({ skill: stringSchema("Canonical server skill."), pricing: objectSchema({}, [], "Quoted integer credits.", true) }, ["skill", "pricing"], undefined, true)
+    inputSchema: objectSchema({
+      name: skillNameInput,
+      input: runInputSchema,
+      args: runArgsSchema,
+      files: { type: "array", maxItems: 10, items: objectSchema({ name: stringSchema("Safe basename"), base64: { type: "string", maxLength: 1398104 }, contentType: stringSchema("MIME type") }, ["name", "base64"]), description: "Same inline files to submit after approval, at most 1 MiB combined." }
+    }, ["name"]),
+    outputSchema: objectSchema({ skill: stringSchema("Canonical server skill."), pricing: objectSchema({}, [], "Quoted integer credits.", true), quoteReceipt: { type: "string", minLength: 1, maxLength: 4096, description: "Opaque server quote binding, at most 4096 UTF-8 bytes; preserve verbatim for approval." } }, ["skill", "pricing"], undefined, true)
   });
   remoteCustomerContracts.push({
     name: "download_run_artifact",
@@ -26588,7 +26838,47 @@ var init_mcp_contracts = __esm(() => {
     inputSchema: objectSchema({ run_id: stringSchema("Run identifier."), artifact_id: stringSchema("Artifact identifier.") }, ["run_id", "artifact_id"]),
     outputSchema: objectSchema({ id: stringSchema("Artifact identifier."), fileName: stringSchema("Artifact file name."), base64: stringSchema("Verified bytes."), sha256: stringSchema("SHA256 digest."), byteSize: { type: "integer", minimum: 0 } }, ["id", "fileName", "base64", "sha256", "byteSize"])
   });
-  contracts = [...toolContracts, ...remoteCustomerContracts].sort((a, b) => a.name.localeCompare(b.name));
+  publicationUuidSchema = { type: "string", pattern: "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$" };
+  publicationVerification = {
+    email: { type: "string", format: "email", maxLength: 254 },
+    code: { type: "string", pattern: "^\\d{6}$" },
+    userId: publicationUuidSchema,
+    membershipId: publicationUuidSchema,
+    recoveryDirectory: { type: "string", maxLength: 4096, description: "Absolute host-local recovery directory without symbolic links." }
+  };
+  privatePublicationContracts = [
+    { name: "publish_private_skill", title: "Publish private skill", extras: {
+      directory: { type: "string", maxLength: 4096, description: "Absolute local skill source directory." },
+      skillId: publicationUuidSchema,
+      expectedCurrentVersionId: { oneOf: [publicationUuidSchema, { type: "null" }] },
+      idempotencyKey: publicationUuidSchema,
+      confirm: { const: true },
+      waitMs: { type: "integer", minimum: 0, maximum: 300000 }
+    }, required: ["directory", "skillId", "expectedCurrentVersionId", "confirm"] },
+    { name: "get_private_publication", title: "Get private publication", extras: {}, required: [] },
+    { name: "resume_private_publication", title: "Resume private publication", extras: { confirm: { const: true }, waitMs: { type: "integer", minimum: 0, maximum: 300000 } }, required: ["confirm"] },
+    { name: "cancel_private_publication", title: "Cancel private publication", extras: { confirm: { const: true } }, required: ["confirm"] }
+  ].map((operation) => ({
+    name: operation.name,
+    title: operation.title,
+    description: "Manage private source publication with fresh workspace verification and durable host-local recovery. Upload consent and current version comparison are explicit; private execution remains unavailable.",
+    params: [...Object.keys(publicationVerification), ...Object.keys(operation.extras)],
+    category: "storage",
+    sideEffects: "filesystem",
+    stable: true,
+    inputSchema: objectSchema({ ...publicationVerification, ...operation.extras }, [...Object.keys(publicationVerification), ...operation.required]),
+    outputSchema: objectSchema({
+      recoveryDirectory: { type: "string" },
+      skillId: publicationUuidSchema,
+      intentId: { oneOf: [publicationUuidSchema, { type: "null" }] },
+      state: { type: "string" },
+      versionId: { oneOf: [publicationUuidSchema, { type: "null" }] },
+      committed: { type: "boolean" },
+      executionEnabled: { const: false },
+      nextAction: { type: "string" }
+    }, ["recoveryDirectory", "skillId", "intentId", "state", "versionId", "committed", "executionEnabled", "nextAction"])
+  }));
+  contracts = [...toolContracts, ...remoteCustomerContracts, ...privatePublicationContracts].sort((a, b) => a.name.localeCompare(b.name));
   resourceContracts = [
     {
       uri: "skills://mcp/contracts",
@@ -27656,10 +27946,10 @@ var init_run_routing = __esm(() => {
 // src/lib/blog-article.ts
 var exports_blog_article = {};
 __export(exports_blog_article, {
-  ARTICLE_COUNT_ERROR: () => ARTICLE_COUNT_ERROR,
-  ARTICLE_GENERATION_SLUG: () => ARTICLE_GENERATION_SLUG,
+  validateBlogArticleRunOptions: () => validateBlogArticleRunOptions,
   ARTICLE_MAX_COUNT: () => ARTICLE_MAX_COUNT,
-  validateBlogArticleRunOptions: () => validateBlogArticleRunOptions
+  ARTICLE_GENERATION_SLUG: () => ARTICLE_GENERATION_SLUG,
+  ARTICLE_COUNT_ERROR: () => ARTICLE_COUNT_ERROR
 });
 function validateBlogArticleRunOptions(input, args = [], validation = {}) {
   const options = collectRunOptions(input, args);
@@ -27786,11 +28076,11 @@ var init_blog_article = __esm(() => {
 // src/lib/remote-files.ts
 var exports_remote_files = {};
 __export(exports_remote_files, {
-  MAX_REMOTE_FILE_BYTES: () => MAX_REMOTE_FILE_BYTES,
-  decodeRemoteFiles: () => decodeRemoteFiles,
-  describeRemoteFiles: () => describeRemoteFiles,
+  sha256: () => sha256,
   readBoundedResponse: () => readBoundedResponse,
-  sha256: () => sha256
+  describeRemoteFiles: () => describeRemoteFiles,
+  decodeRemoteFiles: () => decodeRemoteFiles,
+  MAX_REMOTE_FILE_BYTES: () => MAX_REMOTE_FILE_BYTES
 });
 import { createHash as createHash3 } from "crypto";
 function describeRemoteFiles(files) {
@@ -28290,8 +28580,17 @@ function creditCount(value) {
   }
   return value;
 }
+function runQuoteReceipt(value) {
+  if (value === undefined)
+    return;
+  if (typeof value !== "string" || !value.length || Buffer.byteLength(value, "utf8") > 4096) {
+    throw new Error("Invalid quote receipt");
+  }
+  return value;
+}
 function parseRemoteRunQuote(value) {
   const quote = object4(value);
+  runQuoteReceipt(quote.quoteReceipt);
   const pricing = object4(quote.pricing);
   if (typeof quote.skill !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(quote.skill))
     throw new Error("Invalid quoted skill");
@@ -28462,15 +28761,15 @@ var init_remote_quote_errors = __esm(() => {
 // src/lib/remote-client.ts
 var exports_remote_client = {};
 __export(exports_remote_client, {
-  RemoteCapabilityUnavailableError: () => RemoteCapabilityUnavailableError,
-  RemoteQuoteUnavailableError: () => RemoteQuoteUnavailableError,
-  RemoteRequestError: () => RemoteRequestError,
-  RemoteRouteUnsupportedError: () => RemoteRouteUnsupportedError,
-  RemoteSkillsClient: () => RemoteSkillsClient,
-  RemoteWorkspaceMemberError: () => RemoteWorkspaceMemberError,
-  RemoteWorkspaceSelectionError: () => RemoteWorkspaceSelectionError,
+  createRemoteSkillsClientReadOnly: () => createRemoteSkillsClientReadOnly,
   createRemoteSkillsClient: () => createRemoteSkillsClient,
-  createRemoteSkillsClientReadOnly: () => createRemoteSkillsClientReadOnly
+  RemoteWorkspaceSelectionError: () => RemoteWorkspaceSelectionError,
+  RemoteWorkspaceMemberError: () => RemoteWorkspaceMemberError,
+  RemoteSkillsClient: () => RemoteSkillsClient,
+  RemoteRouteUnsupportedError: () => RemoteRouteUnsupportedError,
+  RemoteRequestError: () => RemoteRequestError,
+  RemoteQuoteUnavailableError: () => RemoteQuoteUnavailableError,
+  RemoteCapabilityUnavailableError: () => RemoteCapabilityUnavailableError
 });
 
 class RemoteSkillsClient {
@@ -28482,7 +28781,7 @@ class RemoteSkillsClient {
     this.apiUrl = normalizeSkillsApiOrigin(apiUrl);
   }
   async request(path, options) {
-    return fetch(`${this.apiUrl}${path}`, {
+    return fetch(skillsApiRequestUrl(this.apiUrl, path), {
       ...options,
       redirect: "error",
       credentials: "omit",
@@ -28542,6 +28841,7 @@ class RemoteSkillsClient {
     return { status: res.status, body };
   }
   async submitRun(slug, input, args, approval = {}) {
+    const quoteReceipt = runQuoteReceipt(approval.quoteReceipt);
     if (approval.idempotencyKey !== undefined && !/^[A-Za-z0-9._:-]{1,128}$/.test(approval.idempotencyKey))
       throw new Error("Idempotency key must be 1-128 URL-safe characters");
     if (approval.maxCostCents !== undefined)
@@ -28558,15 +28858,20 @@ class RemoteSkillsClient {
         ...approval.maxCredits !== undefined ? { maxCredits: approval.maxCredits } : {},
         ...approval.maxCostCents !== undefined ? { maxCostCents: approval.maxCostCents } : {},
         ...approval.idempotencyKey !== undefined ? { idempotencyKey: approval.idempotencyKey } : {},
-        ...approval.inputFiles !== undefined ? { files: approval.inputFiles } : {}
+        ...approval.inputFiles !== undefined ? { files: approval.inputFiles } : {},
+        ...quoteReceipt !== undefined ? { quoteReceipt } : {}
       })
     });
+    if (!res.ok) {
+      res.body?.cancel().catch(() => {});
+      throw new RemoteRequestError(`/api/v1/runs/${encodeURIComponent(slug)}`, res.status);
+    }
     return normalizeRemoteSkillRunContract(await res.json(), slug);
   }
-  async quoteRun(slug, input = {}, args = []) {
+  async quoteRun(slug, input = {}, args = [], files) {
     const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/quote`, {
       method: "POST",
-      body: JSON.stringify({ input, args })
+      body: JSON.stringify({ input, args, ...files === undefined ? {} : { files } })
     }, { quoteRefusal: true });
     return parseRemoteRunQuote(await response.json());
   }
@@ -28582,17 +28887,24 @@ class RemoteSkillsClient {
     return this.capabilities;
   }
   async submitQuotedRun(slug, input = {}, args = [], approval = {}) {
+    runQuoteReceipt(approval.quoteReceipt);
+    ({ input, args, approval } = JSON.parse(JSON.stringify({ input, args, approval })));
     const maximum = creditCount(approval.maxCredits ?? approval.maxCostCents ?? 0);
     if (approval.maxCostCents !== undefined && approval.maxCostCents !== maximum)
       throw new Error("Credit approval fields disagree");
-    const quote = await this.quoteRun(slug, input, args);
-    if (quote.pricing.costCents > maximum)
+    const quote = approval.quoteReceipt === undefined ? await this.quoteRun(slug, input, args, approval.inputFiles?.length ? approval.inputFiles : undefined) : undefined;
+    if (quote && quote.pricing.costCents > maximum)
       throw new RemoteCreditApprovalError(quote.pricing.costCents, maximum);
     const capabilities = await this.getCapabilities();
     if (!capabilities.capabilities.includes("runs.submit") || capabilities.billing?.boundedRunApproval !== true || capabilities.billing.unit !== "credits") {
       throw new Error("The configured server does not support bounded credit approval; refusing remote submission");
     }
-    return this.submitRun(quote.skill, input, args, { ...approval, maxCredits: maximum, maxCostCents: maximum });
+    return this.submitRun(quote?.skill ?? slug, input, args, {
+      ...approval,
+      maxCredits: maximum,
+      maxCostCents: maximum,
+      ...(quote?.quoteReceipt ?? approval.quoteReceipt) === undefined ? {} : { quoteReceipt: quote?.quoteReceipt ?? approval.quoteReceipt }
+    });
   }
   async getIdentity() {
     return (await this.requestNewRoute("/api/auth/whoami")).json();
@@ -28880,6 +29192,10 @@ class RemoteSkillsClient {
     return { id: artifactId, fileName: String(artifact.fileName ?? artifactId), bytes, byteSize: bytes.byteLength, sha256: artifact.sha256 };
   }
   async submitQuotedRunWithFiles(slug, input, args, files, approval = {}) {
+    runQuoteReceipt(approval.quoteReceipt);
+    ({ input, args, approval } = JSON.parse(JSON.stringify({ input, args, approval })));
+    describeRemoteFiles(files);
+    files = files.map((file) => ({ name: file.name, contentType: file.contentType, bytes: new Uint8Array(file.bytes) }));
     const inputFiles = describeRemoteFiles(files);
     if (files.length && !(await this.getCapabilities()).capabilities.includes("runs.uploads"))
       throw new Error("The configured server does not support input uploads");
@@ -28943,7 +29259,7 @@ class RemoteSkillsClient {
     const headers = { Authorization: `Bearer ${this.apiKey}` };
     if (ifMatch)
       headers["If-Match"] = ifMatch;
-    return fetch(`${this.apiUrl}/api/v1/skills`, {
+    return fetch(skillsApiRequestUrl(this.apiUrl, "/api/v1/skills"), {
       method: "POST",
       headers,
       body: form,
@@ -29448,11 +29764,12 @@ function registerOperationTools(server) {
       detail: exports_external.boolean().optional(),
       maxCostCents: exports_external.number().int().min(0).max(2147483647).optional().describe("Maximum integer credits explicitly approved by the user for a remote run; omitted permits only free runs"),
       maxCredits: exports_external.number().int().min(0).max(2147483647).optional(),
+      quoteReceipt: exports_external.string().min(1).max(4096).refine((value) => Buffer.byteLength(value, "utf8") <= 4096, "Quote receipt exceeds 4096 UTF-8 bytes").optional().describe("Opaque receipt from the approved quote; send unchanged with the same input, args and files. Never refresh after confirmation."),
       remote: exports_external.boolean().optional().describe("Use the configured server catalog, including skills not installed locally"),
       idempotency_key: exports_external.string().regex(/^[A-Za-z0-9._:-]{1,128}$/).optional().describe("Reuse for the same approved submission after an interrupted response"),
       files: exports_external.array(exports_external.object({ name: exports_external.string(), base64: exports_external.string().max(1398104), contentType: exports_external.string().optional() })).max(10).optional().describe("Inline remote inputs, at most 1 MiB combined; use CLI or SDK for larger files")
     }
-  }, async ({ name, input, args, detail, maxCostCents, maxCredits, remote, idempotency_key, files }) => {
+  }, async ({ name, input, args, detail, maxCostCents, maxCredits, quoteReceipt, remote, idempotency_key, files }) => {
     const skill = remote ? { name, serverOwned: true } : getSkill(name);
     if (!skill) {
       return mcpError("SKILL_NOT_FOUND", `Skill '${name}' not found`, findSimilarSkills(name));
@@ -29493,7 +29810,7 @@ function registerOperationTools(server) {
       try {
         const { RemoteSkillsClient: RemoteSkillsClient2 } = await Promise.resolve().then(() => (init_remote_client(), exports_remote_client));
         const client = new RemoteSkillsClient2(routing.apiKey, routing.apiOrigin);
-        const run = await client.submitQuotedRunWithFiles(skillName, runInput, runArgs, inputFiles, { maxCredits, maxCostCents, idempotencyKey: idempotency_key ?? runContext.record.id });
+        const run = await client.submitQuotedRunWithFiles(skillName, runInput, runArgs, inputFiles, { maxCredits, maxCostCents, quoteReceipt, idempotencyKey: idempotency_key ?? runContext.record.id });
         if (run.error) {
           writeRunLogs(runContext, "", String(run.error) + `
 `);
@@ -30487,7 +30804,7 @@ async function requestInvitationEmail(origin, action, input) {
   }
   const body = JSON.stringify({ invitationId: value.invitationId, token: value.token, challengeId: value.challengeId, ...action === "accept" ? { code: value.code } : {} });
   try {
-    const response = await fetch(`${target}/api/v1/account/invitations/email-${action}`, {
+    const response = await fetch(skillsApiRequestUrl(target, `/api/v1/account/invitations/email-${action}`), {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body,
@@ -30562,14 +30879,318 @@ var init_remote_invitation_recovery = __esm(() => {
   };
 });
 
+// src/lib/remote-private-publications.ts
+import { createHash as createHash5 } from "crypto";
+function checkedPublicationDeclaration(value) {
+  if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
+    return bad();
+  try {
+    const manifest = JSON.parse(value.manifestText);
+    if (!record7(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash(manifest.provenance?.content_hash))
+      return bad();
+  } catch {
+    return bad();
+  }
+  return Object.freeze({ ...value });
+}
+function checkedPublicationView(value, skillId, intentId, declaration) {
+  if (!exact(value, ["id", "skillId", "version", "expectedCurrentVersionId", "archiveSha256", "archiveByteSize", "state", "expiresAt", "createdAt", "versionId"]) || !publicationUuid(value.id) || value.skillId !== skillId || intentId !== undefined && value.id !== intentId || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || !hash(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES || typeof value.state !== "string" || !["awaiting_upload", "queued", "verifying", "needs_attention", "committed", "rejected", "cancelled", "expired"].includes(value.state) || !date4(value.expiresAt) || !date4(value.createdAt) || !(value.versionId === null || publicationUuid(value.versionId)) || value.state === "committed" && value.versionId === null)
+    return invalid3();
+  if (declaration && ["version", "expectedCurrentVersionId", "archiveSha256", "archiveByteSize"].some((k) => value[k] !== declaration[k]))
+    return invalid3();
+  return Object.freeze({ ...value });
+}
+async function boundedJson(url, init, token, mutation, budget = 15000, signal) {
+  const controller = new AbortController;
+  let reader;
+  let response;
+  const timeout = new PrivatePublicationError("PUBLICATION_UNCONFIRMED", "No confirmed publication result. Inspect the saved intent before retrying.", mutation);
+  let timer;
+  let abort;
+  try {
+    return await Promise.race([(async () => {
+      if (signal?.aborted)
+        throw timeout;
+      response = await fetch(url, {
+        ...init,
+        redirect: "error",
+        credentials: "omit",
+        signal: controller.signal,
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` }
+      });
+      const length = response.headers.get("content-length");
+      if (length !== null && (!/^\d+$/.test(length) || Number(length) > 65536))
+        return invalid3();
+      reader = response.body?.getReader();
+      const chunks = [];
+      let size = 0;
+      if (reader)
+        while (true) {
+          const part = await reader.read();
+          if (part.done)
+            break;
+          size += part.value.byteLength;
+          if (size > 65536)
+            return invalid3();
+          chunks.push(part.value);
+        }
+      if (controller.signal.aborted)
+        throw timeout;
+      const bytes = Buffer.concat(chunks);
+      let body;
+      try {
+        body = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+      } catch {
+        return invalid3();
+      }
+      if (!response.ok) {
+        const code = record7(body) && typeof body.code === "string" && Object.hasOwn(failures, body.code) ? body.code : null;
+        if (code && failures[code][0] === response.status)
+          throw new PrivatePublicationError(code, failures[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
+        throw new PrivatePublicationError("PUBLICATION_REQUEST_FAILED", "The publication request was refused. Inspect its status before retrying.", mutation && response.status >= 500, response.status);
+      }
+      return body;
+    })(), new Promise((_, reject) => {
+      abort = () => {
+        controller.abort();
+        reject(timeout);
+      };
+      timer = setTimeout(abort, Math.max(1, Math.min(15000, budget)));
+      signal?.addEventListener("abort", abort, { once: true });
+    })]);
+  } catch (error2) {
+    if (error2 instanceof PrivatePublicationError) {
+      if (mutation && error2.code === "INVALID_PUBLICATION_RESPONSE")
+        throw timeout;
+      throw error2;
+    }
+    throw timeout;
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+    if (abort)
+      signal?.removeEventListener("abort", abort);
+    controller.abort();
+    if (reader)
+      reader.cancel().catch(() => {});
+    else
+      response?.body?.cancel().catch(() => {});
+  }
+}
+
+class RemotePrivatePublicationsClient {
+  apiOrigin;
+  organizationId;
+  userId;
+  membershipId;
+  #token;
+  constructor(apiUrl, session) {
+    const checked = parseWorkspaceSession(session, { userId: session?.user?.id, membershipId: session?.user?.membershipId });
+    if (checked.user.role === "viewer")
+      throw new PrivatePublicationError("PUBLICATION_FORBIDDEN", failures.PUBLICATION_FORBIDDEN[1]);
+    this.apiOrigin = normalizeSkillsApiOrigin(apiUrl);
+    this.#token = checked.token;
+    this.organizationId = checked.organization.id;
+    this.userId = checked.user.id;
+    this.membershipId = checked.user.membershipId;
+    Object.freeze(this);
+  }
+  async getCapability(options = {}) {
+    if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
+      return bad();
+    const response = await boundedJson(skillsApiRequestUrl(this.apiOrigin, "/api/v1/capabilities"), {}, this.#token, false, options.timeoutMs, options.signal);
+    const p = record7(response) && response.privatePublishing;
+    if (!record7(response) || response.contractVersion !== 1 || response.apiVersion !== 1 || !exact(p, ["contractVersion", "enabled", "authentication", "maxArchiveBytes", "uploadMaxTtlSeconds", "executionEnabled"]) || p.contractVersion !== 1 || typeof p.enabled !== "boolean" || p.authentication !== "interactive-session" || p.maxArchiveBytes !== PRIVATE_PUBLICATION_MAX_BYTES || p.uploadMaxTtlSeconds !== 300 || p.executionEnabled !== false)
+      throw new PrivatePublicationError("PUBLICATION_CONTRACT_UNAVAILABLE", "This server does not support the hosted private publication contract.");
+    return Object.freeze({ ...p });
+  }
+  async#gate(enabled, options = {}) {
+    if (!(await this.getCapability(options)).enabled && enabled)
+      throw new PrivatePublicationError("PUBLICATION_CAPABILITY_UNAVAILABLE", failures.PUBLICATION_CAPABILITY_UNAVAILABLE[1]);
+  }
+  #path(skillId, intentId) {
+    if (!publicationUuid(skillId) || intentId !== undefined && !publicationUuid(intentId))
+      return bad();
+    return skillsApiRequestUrl(this.apiOrigin, `/api/v1/skills/${skillId}/publication-uploads${intentId ? `/${intentId}` : ""}`);
+  }
+  async#view(path, method, skillId, intentId, declaration, options = {}) {
+    const value = await boundedJson(path, { method, ...method === "GET" ? {} : { body: JSON.stringify(declaration ?? {}) } }, this.#token, method !== "GET", options.timeoutMs, options.signal);
+    try {
+      if (!record7(value) || !Object.keys(value).every((k) => k === "upload" || k === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
+        return invalid3();
+      return checkedPublicationView(value.upload, skillId, intentId, declaration);
+    } catch (error2) {
+      if (method !== "GET")
+        throw new PrivatePublicationError("PUBLICATION_UNCONFIRMED", "The publication result could not be confirmed. Reconcile the saved intent before another action.", true);
+      throw error2;
+    }
+  }
+  async begin(skillId, input) {
+    const path = this.#path(skillId), declaration = checkedPublicationDeclaration(input);
+    await this.#gate(true);
+    return this.#view(path, "POST", skillId, undefined, declaration);
+  }
+  async get(skillId, intentId, options = {}) {
+    const path = this.#path(skillId, intentId), until = Date.now() + (options.timeoutMs ?? 15000);
+    await this.#gate(false, options);
+    return this.#view(path, "GET", skillId, intentId, undefined, { ...options, timeoutMs: Math.max(1, until - Date.now()) });
+  }
+  async finalize(skillId, intentId) {
+    const path = this.#path(skillId, intentId);
+    await this.#gate(true);
+    return this.#view(`${path}/finalize`, "POST", skillId, intentId);
+  }
+  async cancel(skillId, intentId) {
+    const path = this.#path(skillId, intentId);
+    await this.#gate(false);
+    return this.#view(path, "DELETE", skillId, intentId);
+  }
+  async upload(skillId, intent, bytes) {
+    const captured = checkedPublicationView(intent, skillId), path = this.#path(skillId, captured.id);
+    if (!(bytes instanceof Uint8Array) || bytes.byteLength !== captured.archiveByteSize)
+      return bad();
+    const owned = Buffer.from(bytes);
+    if (captured.state !== "awaiting_upload" || owned.byteLength !== captured.archiveByteSize || publicationSha256(owned) !== captured.archiveSha256)
+      return bad();
+    await this.#gate(true);
+    const value = await boundedJson(`${path}/upload-url`, { method: "POST", body: "{}" }, this.#token, false);
+    const upload = this.#upload(value, captured);
+    const controller = new AbortController;
+    let timer;
+    const uncertain = () => new PrivatePublicationError("PUBLICATION_UPLOAD_UNCONFIRMED", "Upload acceptance is uncertain. Resume this saved intent to finalize and inspect it; do not upload again.", true);
+    try {
+      await Promise.race([(async () => {
+        const response = await fetch(upload.uploadUrl, { method: "PUT", headers: upload.headers, body: owned, redirect: "error", credentials: "omit", signal: controller.signal });
+        response.body?.cancel().catch(() => {});
+        if (response.status !== 200 || controller.signal.aborted)
+          throw uncertain();
+      })(), new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          controller.abort();
+          reject(uncertain());
+        }, 30000);
+      })]);
+    } catch {
+      throw uncertain();
+    } finally {
+      if (timer)
+        clearTimeout(timer);
+      controller.abort();
+    }
+  }
+  #upload(value, intent) {
+    if (!exact(value, ["upload"]) || !exact(value.upload, ["method", "uploadUrl", "headers", "expiresAt"]))
+      return invalid3();
+    const p = value.upload;
+    if (p.method !== "PUT" || typeof p.uploadUrl !== "string" || p.uploadUrl.length > 8192 || /[\x00-\x20\x7f]/.test(p.uploadUrl) || !date4(p.expiresAt) || Date.parse(p.expiresAt) - Date.now() < 1000 || Date.parse(p.expiresAt) - Date.now() > 300000 || Date.parse(p.expiresAt) > Date.parse(intent.expiresAt) || !exact(p.headers, ["content-type", "content-length", "x-amz-checksum-sha256", "x-amz-expected-bucket-owner"]) || p.headers["content-type"] !== "application/gzip" || p.headers["content-length"] !== String(intent.archiveByteSize) || p.headers["x-amz-checksum-sha256"] !== Buffer.from(intent.archiveSha256, "hex").toString("base64") || typeof p.headers["x-amz-expected-bucket-owner"] !== "string" || !/^\d{12}$/.test(p.headers["x-amz-expected-bucket-owner"]))
+      return invalid3();
+    let url;
+    try {
+      url = new URL(p.uploadUrl);
+    } catch {
+      return invalid3();
+    }
+    if (url.protocol !== "https:" || url.port || url.username || url.password || url.hash || !/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]\.s3\.[a-z]{2}(?:-[a-z]+)+-[1-9]\.amazonaws\.com$/.test(url.hostname) || url.pathname !== `/private-publication-staging/${this.organizationId}/${intent.id}/bundle.tgz` || !url.search || url.searchParams.get("X-Amz-Algorithm") !== "AWS4-HMAC-SHA256" || url.searchParams.get("X-Amz-SignedHeaders") !== "content-length;content-type;host;x-amz-checksum-sha256;x-amz-expected-bucket-owner" || !/^[a-f0-9]{64}$/.test(url.searchParams.get("X-Amz-Signature") ?? ""))
+      return invalid3();
+    const queryKeys = ["X-Amz-Algorithm", "X-Amz-Credential", "X-Amz-Date", "X-Amz-Expires", "X-Amz-Security-Token", "X-Amz-Signature", "X-Amz-SignedHeaders"];
+    if ([...url.searchParams.keys()].sort().join(",") !== queryKeys.sort().join(","))
+      return invalid3();
+    const issued = url.searchParams.get("X-Amz-Date"), ttl = url.searchParams.get("X-Amz-Expires"), credential = url.searchParams.get("X-Amz-Credential");
+    const timestamp3 = /^(\d{4})(\d\d)(\d\d)T(\d\d)(\d\d)(\d\d)Z$/.exec(issued);
+    const region = url.hostname.split(".s3.")[1].split(".amazonaws.com")[0];
+    if (!timestamp3 || !/^[1-9]\d{0,2}$/.test(ttl) || Number(ttl) > 300 || !/^[A-Z0-9]{16,128}\//.test(credential) || credential.split("/").slice(1).join("/") !== `${issued.slice(0, 8)}/${region}/s3/aws4_request` || !/^[\x21-\x7e]{1,4096}$/.test(url.searchParams.get("X-Amz-Security-Token")))
+      return invalid3();
+    const issuedAt = Date.parse(`${timestamp3[1]}-${timestamp3[2]}-${timestamp3[3]}T${timestamp3[4]}:${timestamp3[5]}:${timestamp3[6]}Z`);
+    if (!Number.isFinite(issuedAt) || issuedAt > Date.now() + 1000 || issuedAt + Number(ttl) * 1000 !== Date.parse(p.expiresAt))
+      return invalid3();
+    return { method: "PUT", uploadUrl: url.href, expiresAt: p.expiresAt, headers: Object.freeze({ ...p.headers }) };
+  }
+  async wait(skillId, intentId, options = {}) {
+    const timeout = options.timeoutMs ?? 60000;
+    if (!Number.isSafeInteger(timeout) || timeout < 0 || timeout > 300000)
+      return bad();
+    const until = Date.now() + timeout;
+    let previous;
+    while (true) {
+      if (options.signal?.aborted)
+        throw new PrivatePublicationError("PUBLICATION_WAIT_ABORTED", "Stopped waiting. The server publication continues; inspect the saved intent.");
+      let view;
+      try {
+        view = await this.get(skillId, intentId, { timeoutMs: timeout === 0 ? 15000 : Math.max(1, Math.min(15000, until - Date.now())), signal: options.signal });
+      } catch (error2) {
+        if (previous && Date.now() >= until && !options.signal?.aborted)
+          return previous;
+        throw error2;
+      }
+      previous = view;
+      if (!["queued", "verifying"].includes(view.state) || Date.now() >= until)
+        return view;
+      await new Promise((resolve2) => {
+        const timer = setTimeout(done, Math.min(1000, until - Date.now()));
+        function done() {
+          clearTimeout(timer);
+          options.signal?.removeEventListener("abort", done);
+          resolve2();
+        }
+        options.signal?.addEventListener("abort", done, { once: true });
+      });
+    }
+  }
+}
+var PRIVATE_PUBLICATION_MAX_BYTES, failures, PrivatePublicationError, bad = () => {
+  throw new PrivatePublicationError("INVALID_PUBLICATION_INPUT", "Invalid publication input or recovery data.");
+}, invalid3 = () => {
+  throw new PrivatePublicationError("INVALID_PUBLICATION_RESPONSE", "The server returned an invalid publication result.");
+}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record7 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys) => record7(v) && Object.keys(v).sort().join(",") === keys.sort().join(","), date4 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash5("sha256").update(bytes).digest("hex");
+var init_remote_private_publications = __esm(() => {
+  init_fleet_credentials();
+  init_remote_workspace_selection();
+  init_skill_contract();
+  PRIVATE_PUBLICATION_MAX_BYTES = 16 * 1024 * 1024;
+  failures = {
+    INVALID_REQUEST: [400, "The publication request is invalid."],
+    SESSION_EXPIRED: [401, "Sign in again to manage this publication."],
+    ACCOUNT_UNAVAILABLE: [403, "The account is unavailable."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "An interactive account session is required."],
+    PUBLICATION_FORBIDDEN: [403, "This session cannot manage the publication."],
+    PUBLICATION_ENTITLEMENT_REQUIRED: [403, "The workspace is not entitled to publish private skills."],
+    PUBLICATION_UNAVAILABLE: [404, "The publication is unavailable to this session."],
+    MANIFEST_NAME_MISMATCH: [409, "The manifest name does not match the selected skill."],
+    IDEMPOTENCY_CONFLICT: [409, "This request key already identifies different publication bytes. Use the saved recovery directory."],
+    CURRENT_VERSION_CHANGED: [409, "The current version changed. Inspect it before explicitly starting another publication."],
+    VERSION_EXISTS: [409, "This version already exists."],
+    VERSION_RESERVED: [409, "This version is reserved by another publication."],
+    PUBLICATION_COMMITTED: [409, "The publication is already committed."],
+    PUBLICATION_UPLOAD_UNAVAILABLE: [409, "This publication cannot receive another upload."],
+    PUBLICATION_LIMIT: [429, "The workspace publication limit has been reached."],
+    PUBLICATION_BUSY: [503, "The publication is busy. Reconcile the saved intent before retrying."],
+    PUBLICATION_UNCERTAIN: [503, "The publication outcome is uncertain. Reconcile the saved intent."],
+    PUBLICATION_CAPABILITY_UNAVAILABLE: [503, "Private publishing is not enabled on this server."],
+    PUBLICATION_SIGNING_UNAVAILABLE: [503, "Upload authorization is temporarily unavailable. Keep the same intent."]
+  };
+  PrivatePublicationError = class PrivatePublicationError extends Error {
+    code;
+    uncertain;
+    status;
+    constructor(code, message, uncertain = false, status) {
+      super(message);
+      this.code = code;
+      this.uncertain = uncertain;
+      this.status = status;
+      this.name = "PrivatePublicationError";
+    }
+  };
+});
+
 // src/lib/remote-auth.ts
 async function requestAuthApi(instance, path, options) {
   const url = normalizeSkillsApiOrigin(instance);
   const safeUrl = url;
-  const endpoint = `${(options?.method || "GET").toUpperCase()} ${safeUrl}${path}`;
+  const requestUrl = skillsApiRequestUrl(url, path);
+  const endpoint = `${(options?.method || "GET").toUpperCase()} ${requestUrl}`;
   let res;
   try {
-    res = await fetch(`${url}${path}`, {
+    res = await fetch(requestUrl, {
       ...options,
       redirect: "error",
       signal: options?.signal ?? AbortSignal.timeout(15000),
@@ -30584,10 +31205,10 @@ async function requestAuthApi(instance, path, options) {
   const text2 = await res.text();
   const body = text2 ? parseJsonBody(text2) : {};
   if (!res.ok) {
-    const record7 = isRecord5(body) ? body : {};
-    const detail = typeof record7.detail === "string" ? record7.detail : undefined;
-    const error2 = typeof record7.error === "string" ? record7.error : undefined;
-    const code = typeof record7.code === "string" ? record7.code : undefined;
+    const record8 = isRecord5(body) ? body : {};
+    const detail = typeof record8.detail === "string" ? record8.detail : undefined;
+    const error2 = typeof record8.error === "string" ? record8.error : undefined;
+    const code = typeof record8.code === "string" ? record8.code : undefined;
     throw new HostedApiError(detail || error2 || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -30621,6 +31242,10 @@ class RemoteSkillsAuthClient {
   constructor(apiUrl) {
     this.apiOrigin = normalizeSkillsApiOrigin(apiUrl);
   }
+  async openPrivatePublications(email3, code, context) {
+    const origin = this.apiOrigin, captured = workspaceContext(context);
+    return new RemotePrivatePublicationsClient(origin, await this.switchWorkspace(email3, code, captured));
+  }
   requestInvitationEmailChallenge(input) {
     return requestInvitationEmail(this.apiOrigin, "challenge", input);
   }
@@ -30668,9 +31293,10 @@ class RemoteSkillsAuthClient {
     const apiOrigin = this.apiOrigin;
     if (typeof email3 !== "string" || !email3.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
+    const requestUrl = skillsApiRequestUrl(apiOrigin, "/api/auth/verify");
     let response;
     try {
-      response = await fetch(`${apiOrigin}/api/auth/verify`, {
+      response = await fetch(requestUrl, {
         method: "POST",
         redirect: "error",
         credentials: "omit",
@@ -30764,6 +31390,7 @@ class RemoteSkillsAuthClient {
 var MAX_ERROR_DETAIL_LENGTH = 200, HostedApiError;
 var init_remote_auth = __esm(() => {
   init_remote_invitation_recovery();
+  init_remote_private_publications();
   init_remote_invitations();
   init_remote_workspace_leave();
   init_remote_workspace_selection();
@@ -30966,9 +31593,824 @@ var init_remote_invitation_tools = __esm(() => {
   init_helpers();
 });
 
+// src/lib/private-publication-customer.ts
+async function privatePublicationSession(email3, code, requested) {
+  const target = await captureProfileWorkspace("Manage private publications");
+  const context = requested ?? target.context;
+  if (!context || !publicationUuid(context.userId) || !publicationUuid(context.membershipId) || target.context && (context.userId !== target.context.userId || context.membershipId !== target.context.membershipId))
+    throw new PrivatePublicationError("PUBLICATION_CONTEXT_REQUIRED", "Provide the observed user and membership IDs, or select an enrolled workspace profile.");
+  target.unchanged();
+  const client = await new RemoteSkillsAuthClient(target.origin).openPrivatePublications(email3, code, context);
+  target.unchanged();
+  return client;
+}
+function privatePublicationCustomerError(error2) {
+  return error2 instanceof PrivatePublicationError ? { error: error2.message, code: error2.code, uncertain: error2.uncertain } : { error: "The publication action could not be confirmed. Preserve the recovery directory and inspect the same intent; credentials were not changed.", code: "PUBLICATION_ACTION_UNCONFIRMED", uncertain: true };
+}
+var init_private_publication_customer = __esm(() => {
+  init_remote_auth();
+  init_remote_private_publications();
+  init_workspace_profile();
+});
+
+// src/lib/skill-bundle.ts
+import { createHash as createHash6 } from "crypto";
+import { readFileSync as readFileSync16, readdirSync as readdirSync10, statSync as statSync11 } from "fs";
+import { join as join19, relative as relative4 } from "path";
+import { createGunzip } from "zlib";
+function isDotenvFile(lower) {
+  if (lower === ".env" || lower.startsWith(".env."))
+    return true;
+  if (lower === "env")
+    return true;
+  if (lower.startsWith("env.")) {
+    const extension = lower.slice(lower.lastIndexOf(".") + 1);
+    return !NON_DOTENV_EXTENSIONS.has(extension);
+  }
+  return false;
+}
+function isCredentialFile(name) {
+  const lower = name.toLowerCase();
+  if (ENV_TEMPLATE_NAMES.has(lower))
+    return false;
+  if (isDotenvFile(lower))
+    return true;
+  if (CREDENTIAL_FILENAMES.has(lower))
+    return true;
+  return CREDENTIAL_EXTENSIONS.some((extension) => lower.endsWith(extension));
+}
+function ownBytes(view) {
+  const source = view instanceof ArrayBuffer ? new Uint8Array(view) : view;
+  const out = new Uint8Array(new ArrayBuffer(source.byteLength));
+  out.set(source);
+  return out;
+}
+function sha256Hex(bytes) {
+  return createHash6("sha256").update(bytes).digest("hex");
+}
+function collectSkillBundleEntries(dir) {
+  const entries = [];
+  walk(dir, dir, entries);
+  return entries.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+}
+function walk(root, current, out) {
+  for (const entry of readdirSync10(current, { withFileTypes: true })) {
+    const absolute = join19(current, entry.name);
+    const rel = relative4(root, absolute).split("\\").join("/");
+    const isRootLevel = !rel.includes("/");
+    if (ANY_SEGMENT_EXCLUDES.has(entry.name.toLowerCase()))
+      continue;
+    if (isRootLevel && ROOT_EXCLUDES.has(entry.name.toLowerCase()))
+      continue;
+    if (isRootLevel && TOOL_SIDECAR_FILENAMES.has(entry.name.toLowerCase()))
+      continue;
+    if (entry.name.startsWith("._"))
+      continue;
+    if (entry.isSymbolicLink())
+      continue;
+    if (entry.isDirectory()) {
+      walk(root, absolute, out);
+      continue;
+    }
+    if (!entry.isFile())
+      continue;
+    if (isCredentialFile(entry.name))
+      continue;
+    const stats = statSync11(absolute);
+    out.push({
+      path: rel,
+      bytes: ownBytes(readFileSync16(absolute)),
+      mode: stats.mode & 64 ? 493 : 420
+    });
+  }
+}
+function packSkillBundle(dir, options = {}) {
+  const entries = collectSkillBundleEntries(dir);
+  if (entries.length === 0) {
+    throw new Error(`Nothing to pack: ${dir} contains no files after exclusions (.git, node_modules, dist, .env)`);
+  }
+  const unpackedByteSize = entries.reduce((sum, entry) => sum + entry.bytes.byteLength, 0);
+  const max = options.maxUnpackedBytes ?? 0;
+  if (max > 0 && unpackedByteSize > max) {
+    throw new Error(`Skill sources are ${unpackedByteSize} bytes, over the ${max} byte limit. Remove build output or large fixtures.`);
+  }
+  const tar = writeTar(entries);
+  const bytes = canonicalGzip(tar);
+  return {
+    bytes,
+    sha256: sha256Hex(bytes),
+    fileCount: entries.length,
+    unpackedByteSize,
+    paths: entries.map((entry) => entry.path)
+  };
+}
+function canonicalGzip(tar) {
+  const bytes = ownBytes(Bun.gzipSync(tar, { level: 6 }));
+  if (bytes.byteLength >= 10) {
+    bytes[4] = 0;
+    bytes[5] = 0;
+    bytes[6] = 0;
+    bytes[7] = 0;
+    bytes[9] = 255;
+  }
+  return bytes;
+}
+function writeTar(entries) {
+  const blocks = [];
+  for (const entry of entries) {
+    blocks.push(ustarHeader(entry));
+    blocks.push(entry.bytes);
+    const remainder = entry.bytes.byteLength % BLOCK;
+    if (remainder !== 0)
+      blocks.push(new Uint8Array(new ArrayBuffer(BLOCK - remainder)));
+  }
+  blocks.push(new Uint8Array(new ArrayBuffer(BLOCK * 2)));
+  return concat(blocks);
+}
+function ustarHeader(entry) {
+  const header = new Uint8Array(new ArrayBuffer(BLOCK));
+  const encoder = new TextEncoder;
+  const put = (offset, length, value) => {
+    const encoded = encoder.encode(value);
+    if (encoded.byteLength > length) {
+      throw new Error(`Cannot pack '${entry.path}': field does not fit in a ustar header (${encoded.byteLength} > ${length})`);
+    }
+    header.set(encoded, offset);
+  };
+  if (encoder.encode(entry.path).byteLength > 100) {
+    throw new Error(`Cannot pack '${entry.path}': path is longer than the 100 bytes a ustar header holds`);
+  }
+  put(0, 100, entry.path);
+  put(100, 8, `${entry.mode.toString(8).padStart(7, "0")}\x00`);
+  put(108, 8, "0000000\x00");
+  put(116, 8, "0000000\x00");
+  put(124, 12, `${entry.bytes.byteLength.toString(8).padStart(11, "0")}\x00`);
+  put(136, 12, `${0 .toString(8).padStart(11, "0")}\x00`);
+  put(148, 8, "        ");
+  put(156, 1, "0");
+  put(257, 6, "ustar\x00");
+  put(263, 2, "00");
+  let checksum = 0;
+  for (const byte of header)
+    checksum += byte;
+  put(148, 8, `${checksum.toString(8).padStart(6, "0")}\x00 `);
+  return header;
+}
+function concat(chunks) {
+  const total = chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0);
+  const merged = new Uint8Array(new ArrayBuffer(total));
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return merged;
+}
+function invalidBundle(message) {
+  throw new SkillBundleInspectionError("BUNDLE_INVALID", message);
+}
+function inspectionLimits(options) {
+  const limits = { ...SKILL_BUNDLE_INSPECTION_LIMITS };
+  for (const key of Object.keys(options.limits ?? {})) {
+    if (!Object.hasOwn(limits, key))
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Unknown bundle limit");
+    const field = key;
+    const value = options.limits[field];
+    if (!Number.isSafeInteger(value) || value <= 0 || value > limits[field]) {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle limits must be positive integers within the hard ceilings");
+    }
+    limits[field] = value;
+  }
+  return limits;
+}
+async function inspectSkillBundle(bundle, options = {}) {
+  const signal = options.signal;
+  const limits = inspectionLimits(options);
+  const deadline = performance.now() + limits.timeoutMs;
+  const check2 = () => {
+    if (signal?.aborted)
+      throw new SkillBundleInspectionError("BUNDLE_ABORTED", "Bundle inspection aborted");
+    if (performance.now() >= deadline)
+      throw new SkillBundleInspectionError("BUNDLE_TIMEOUT", "Bundle inspection deadline exceeded");
+  };
+  check2();
+  if (bundle.byteLength > limits.compressedBytes)
+    throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Compressed bundle exceeds byte limit");
+  const snapshot = ownBytes(bundle);
+  check2();
+  const sha2562 = sha256Hex(snapshot);
+  check2();
+  const parser = new BoundedTarReader(limits, check2);
+  const streamOptions = { chunkSize: 16 * 1024, highWaterMark: 16 * 1024 };
+  const decoder = createGunzip(streamOptions);
+  let terminalError;
+  const stop = (code) => {
+    terminalError ??= new SkillBundleInspectionError(code, code === "BUNDLE_ABORTED" ? "Bundle inspection aborted" : "Bundle inspection deadline exceeded");
+    decoder.destroy(terminalError);
+  };
+  const onAbort = () => stop("BUNDLE_ABORTED");
+  const timer = setTimeout(() => stop("BUNDLE_TIMEOUT"), Math.max(1, deadline - performance.now()));
+  signal?.addEventListener("abort", onAbort, { once: true });
+  let decompressedByteSize = 0;
+  let bytesSinceYield = 0;
+  try {
+    check2();
+    decoder.end(snapshot);
+    for await (const chunk of decoder) {
+      check2();
+      decompressedByteSize += chunk.byteLength;
+      if (decompressedByteSize > limits.decompressedBytes)
+        throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Decompressed bundle exceeds byte limit");
+      parser.push(chunk);
+      bytesSinceYield += chunk.byteLength;
+      if (bytesSinceYield >= 256 * 1024) {
+        await new Promise((resolve2) => setTimeout(resolve2, 0));
+        bytesSinceYield = 0;
+        check2();
+      }
+    }
+    check2();
+    const entries = parser.finish();
+    return {
+      entries,
+      sha256: sha2562,
+      compressedByteSize: snapshot.byteLength,
+      decompressedByteSize,
+      unpackedByteSize: parser.fileBytes,
+      fileCount: entries.length
+    };
+  } catch (error2) {
+    if (terminalError)
+      throw terminalError;
+    if (error2 instanceof SkillBundleInspectionError)
+      throw error2;
+    throw new SkillBundleInspectionError("BUNDLE_INVALID", "Invalid or truncated gzip bundle");
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", onAbort);
+    decoder.destroy();
+  }
+}
+
+class BoundedTarReader {
+  limits;
+  check;
+  header = new Uint8Array(BLOCK);
+  headerOffset = 0;
+  pending;
+  bodyOffset = 0;
+  padding = 0;
+  zeroBlocks = 0;
+  entries = [];
+  paths = new SkillEntryPaths;
+  fileBytes = 0;
+  constructor(limits, check2) {
+    this.limits = limits;
+    this.check = check2;
+  }
+  push(chunk) {
+    let offset = 0;
+    while (offset < chunk.byteLength) {
+      this.check();
+      if (this.pending) {
+        const count = Math.min(this.pending.bytes.byteLength - this.bodyOffset, chunk.byteLength - offset);
+        this.pending.bytes.set(chunk.subarray(offset, offset + count), this.bodyOffset);
+        offset += count;
+        this.bodyOffset += count;
+        if (this.bodyOffset === this.pending.bytes.byteLength) {
+          this.entries.push(this.pending);
+          this.pending = undefined;
+        }
+      } else if (this.padding) {
+        const count = Math.min(this.padding, chunk.byteLength - offset);
+        if (chunk.subarray(offset, offset + count).some((byte) => byte !== 0))
+          invalidBundle("Nonzero tar body padding");
+        offset += count;
+        this.padding -= count;
+      } else {
+        const count = Math.min(BLOCK - this.headerOffset, chunk.byteLength - offset);
+        this.header.set(chunk.subarray(offset, offset + count), this.headerOffset);
+        offset += count;
+        this.headerOffset += count;
+        if (this.headerOffset === BLOCK) {
+          this.readHeader();
+          this.headerOffset = 0;
+        }
+      }
+    }
+  }
+  finish() {
+    this.check();
+    if (this.pending || this.padding || this.headerOffset || this.zeroBlocks < 2)
+      invalidBundle("Truncated tar bundle");
+    return this.entries;
+  }
+  readHeader() {
+    this.check();
+    const h = this.header;
+    if (h.every((byte) => byte === 0)) {
+      this.zeroBlocks++;
+      return;
+    }
+    if (this.zeroBlocks)
+      invalidBundle("Nonzero tar data after terminator");
+    if (this.entries.length >= this.limits.entries)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle entry limit exceeded");
+    let checksum = 0;
+    for (let i = 0;i < BLOCK; i++)
+      checksum += i >= 148 && i < 156 ? 32 : h[i];
+    if (tarOctal(h.subarray(148, 156)) !== checksum)
+      invalidBundle("Invalid tar header checksum");
+    if (new TextDecoder().decode(h.subarray(257, 265)) !== "ustar\x00" + "00")
+      invalidBundle("Unsupported tar format");
+    if (h[156] !== 48 && h[156] !== 0 || h.subarray(157, 257).some((b) => b !== 0) || h.subarray(345).some((b) => b !== 0))
+      invalidBundle("Unsupported tar entry or path prefix");
+    const mode = tarOctal(h.subarray(100, 108));
+    if (mode > 511)
+      invalidBundle("Unsupported tar permission bits");
+    tarOctal(h.subarray(108, 116));
+    tarOctal(h.subarray(116, 124));
+    tarOctal(h.subarray(136, 148));
+    const size = tarOctal(h.subarray(124, 136));
+    if (size > this.limits.fileBytes || this.fileBytes + size > this.limits.decompressedBytes) {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle file byte limit exceeded");
+    }
+    const name = h.subarray(0, 100);
+    const end = name.indexOf(0);
+    if (end !== -1 && name.subarray(end).some((b) => b !== 0))
+      invalidBundle("Invalid tar path padding");
+    const raw = end === -1 ? name : name.subarray(0, end);
+    if (raw.byteLength > this.limits.pathBytes)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    let path;
+    try {
+      path = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw);
+    } catch {
+      return invalidBundle("Invalid UTF-8 bundle path");
+    }
+    this.paths.add(path, this.limits.pathBytes, invalidBundle, () => {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    });
+    this.fileBytes += size;
+    this.pending = { path, mode, bytes: new Uint8Array(new ArrayBuffer(size)) };
+    this.bodyOffset = 0;
+    this.padding = (BLOCK - size % BLOCK) % BLOCK;
+    if (!size) {
+      this.entries.push(this.pending);
+      this.pending = undefined;
+    }
+  }
+}
+function tarOctal(field) {
+  const text2 = new TextDecoder().decode(field);
+  if (!/^[0-7]+[\0 ]*$/.test(text2))
+    invalidBundle("Invalid tar octal field");
+  const value = Number.parseInt(text2, 8);
+  if (!Number.isSafeInteger(value))
+    invalidBundle("Tar integer is out of range");
+  return value;
+}
+var BLOCK = 512, ANY_SEGMENT_EXCLUDES, ROOT_EXCLUDES, TOOL_SIDECAR_FILENAMES, CREDENTIAL_FILENAMES, CREDENTIAL_EXTENSIONS, ENV_TEMPLATE_NAMES, NON_DOTENV_EXTENSIONS, SKILL_BUNDLE_INSPECTION_LIMITS, SkillBundleInspectionError;
+var init_skill_bundle = __esm(() => {
+  ANY_SEGMENT_EXCLUDES = new Set([
+    ".git",
+    ".ds_store",
+    ".system",
+    "node_modules",
+    ".aws",
+    ".ssh",
+    ".gnupg",
+    ".docker"
+  ]);
+  ROOT_EXCLUDES = new Set(["dist", "build", ".turbo"]);
+  TOOL_SIDECAR_FILENAMES = new Set([".hasna-skills.json"]);
+  CREDENTIAL_FILENAMES = new Set([
+    ".npmrc",
+    ".pypirc",
+    ".netrc",
+    ".envrc",
+    ".pgpass",
+    ".git-credentials",
+    "credentials",
+    "id_rsa",
+    "id_dsa",
+    "id_ecdsa",
+    "id_ed25519"
+  ]);
+  CREDENTIAL_EXTENSIONS = [".pem", ".key", ".p12", ".pfx", ".keystore", ".jks"];
+  ENV_TEMPLATE_NAMES = new Set([".env.example", ".env.sample", ".env.template", ".env.dist"]);
+  NON_DOTENV_EXTENSIONS = new Set([
+    "ts",
+    "tsx",
+    "mts",
+    "cts",
+    "js",
+    "jsx",
+    "mjs",
+    "cjs",
+    "json",
+    "jsonc",
+    "json5",
+    "py",
+    "rb",
+    "go",
+    "rs",
+    "java",
+    "kt",
+    "kts",
+    "swift",
+    "c",
+    "h",
+    "cc",
+    "cpp",
+    "hpp",
+    "cs",
+    "php",
+    "sh",
+    "bash",
+    "zsh",
+    "fish",
+    "ps1",
+    "bat",
+    "cmd",
+    "lua",
+    "pl",
+    "pm",
+    "r",
+    "jl",
+    "dart",
+    "ex",
+    "exs",
+    "scala",
+    "clj",
+    "cljs",
+    "groovy",
+    "gradle",
+    "vb",
+    "fs",
+    "yaml",
+    "yml",
+    "toml",
+    "ini",
+    "xml",
+    "csv",
+    "tsv",
+    "html",
+    "htm",
+    "css",
+    "scss",
+    "sass",
+    "less",
+    "md",
+    "mdx",
+    "txt",
+    "rst",
+    "adoc",
+    "sql",
+    "graphql",
+    "gql",
+    "proto",
+    "d",
+    "png",
+    "jpg",
+    "jpeg",
+    "gif",
+    "svg",
+    "webp",
+    "ico",
+    "bmp",
+    "pdf",
+    "woff",
+    "woff2",
+    "ttf",
+    "otf",
+    "eot",
+    "mp3",
+    "mp4",
+    "wav",
+    "webm",
+    "zip",
+    "gz",
+    "tar",
+    "wasm"
+  ]);
+  SKILL_BUNDLE_INSPECTION_LIMITS = Object.freeze({
+    compressedBytes: 16 * 1024 * 1024,
+    decompressedBytes: 64 * 1024 * 1024,
+    entries: 1024,
+    fileBytes: 16 * 1024 * 1024,
+    pathBytes: 100,
+    timeoutMs: 5000
+  });
+  SkillBundleInspectionError = class SkillBundleInspectionError extends Error {
+    code;
+    constructor(code, message) {
+      super(message);
+      this.code = code;
+      this.name = "SkillBundleInspectionError";
+    }
+  };
+});
+
+// src/lib/private-publication-recovery.ts
+import { constants as constants3, closeSync as closeSync4, fsyncSync, fstatSync as fstatSync4, lstatSync as lstatSync5, mkdirSync as mkdirSync11, openSync as openSync4, readSync as readSync2, realpathSync as realpathSync2, renameSync as renameSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname8, isAbsolute as isAbsolute4, join as join20, resolve as resolve2 } from "path";
+import { randomUUID } from "crypto";
+function safeDirectory(directory) {
+  if (!isAbsolute4(directory) || directory !== resolve2(directory) || realpathSync2(directory) !== directory)
+    return fail2();
+  for (let path = directory;; path = dirname8(path)) {
+    const stat2 = lstatSync5(path);
+    if (!stat2.isDirectory() || stat2.isSymbolicLink())
+      return fail2();
+    if (path === dirname8(path))
+      break;
+  }
+  const own = lstatSync5(directory);
+  if ((own.mode & 63) !== 0 || process.getuid && own.uid !== process.getuid())
+    return fail2();
+  return { dev: own.dev, ino: own.ino };
+}
+function unchangedDirectory(directory, identity) {
+  const now = safeDirectory(directory);
+  if (now.dev !== identity.dev || now.ino !== identity.ino)
+    return fail2();
+}
+function readOwned(directory, name, max) {
+  const identity = safeDirectory(directory), file = join20(directory, name);
+  const fd = openSync4(file, constants3.O_RDONLY | constants3.O_NOFOLLOW);
+  try {
+    const stat2 = fstatSync4(fd);
+    if (!stat2.isFile() || stat2.nlink !== 1 || stat2.size > max || stat2.size < 1 || (stat2.mode & 63) !== 0 || process.getuid && stat2.uid !== process.getuid())
+      return fail2();
+    const buffer = Buffer.alloc(Math.min(max, stat2.size) + 1);
+    let length = 0;
+    while (length < buffer.length) {
+      const count = readSync2(fd, buffer, length, buffer.length - length, length);
+      if (count === 0)
+        break;
+      length += count;
+    }
+    const bytes = buffer.subarray(0, length), after = fstatSync4(fd);
+    unchangedDirectory(directory, identity);
+    if (bytes.length !== stat2.size || stat2.size !== after.size || stat2.mtimeMs !== after.mtimeMs || stat2.ctimeMs !== after.ctimeMs)
+      return fail2();
+    return bytes;
+  } finally {
+    closeSync4(fd);
+  }
+}
+function writeOwned(directory, name, bytes) {
+  const fd = openSync4(join20(directory, name), constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+  try {
+    writeFileSync10(fd, bytes);
+    fsyncSync(fd);
+  } finally {
+    closeSync4(fd);
+  }
+}
+function save(directory, value) {
+  const identity = safeDirectory(directory), temporary = `.receipt-${randomUUID()}.json`;
+  writeOwned(directory, temporary, JSON.stringify(value) + `
+`);
+  unchangedDirectory(directory, identity);
+  renameSync4(join20(directory, temporary), join20(directory, "receipt.json"));
+  const fd = openSync4(directory, constants3.O_RDONLY | constants3.O_NOFOLLOW);
+  try {
+    fsyncSync(fd);
+  } finally {
+    closeSync4(fd);
+  }
+}
+function bind(client, receipt) {
+  if (["apiOrigin", "organizationId", "userId", "membershipId"].some((k) => client[k] !== receipt[k]))
+    throw new PrivatePublicationError("PUBLICATION_IDENTITY_CHANGED", "The fresh session does not match the recovery directory's server, account and membership.");
+}
+async function locked(directory, action) {
+  const identity = safeDirectory(directory), file = join20(directory, "operation.lock");
+  let fd;
+  try {
+    fd = openSync4(file, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+  } catch {
+    throw new PrivatePublicationError("PUBLICATION_RECOVERY_BUSY", "Another operation holds this recovery directory. If it crashed, confirm that process has stopped before explicitly removing operation.lock and resuming.");
+  }
+  const lock = fstatSync4(fd);
+  try {
+    writeFileSync10(fd, JSON.stringify({ pid: process.pid }) + `
+`);
+    fsyncSync(fd);
+    return await action();
+  } finally {
+    closeSync4(fd);
+    unchangedDirectory(directory, identity);
+    const now = lstatSync5(file);
+    if (now.dev !== lock.dev || now.ino !== lock.ino || !now.isFile() || now.isSymbolicLink())
+      fail2();
+    unlinkSync2(file);
+  }
+}
+function readPrivatePublicationRecovery(directory) {
+  try {
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(readOwned(directory, "receipt.json", 65536)));
+    if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).sort().join(",") !== ["contractVersion", "apiOrigin", "organizationId", "userId", "membershipId", "skillId", "declaration", "phase", "intent"].sort().join(",") || value.contractVersion !== 1 || ![value.organizationId, value.userId, value.membershipId, value.skillId].every(publicationUuid) || typeof value.apiOrigin !== "string" || normalizeSkillsApiOrigin(value.apiOrigin) !== value.apiOrigin || !["prepared", "begin_uncertain", "awaiting_upload", "upload_uncertain", "uploaded", "finalize_uncertain", "observed"].includes(value.phase))
+      return fail2();
+    value.declaration = checkedPublicationDeclaration(value.declaration);
+    if (value.intent !== null)
+      value.intent = checkedPublicationView(value.intent, value.skillId, undefined, value.declaration);
+    if (value.intent === null && !["prepared", "begin_uncertain"].includes(value.phase))
+      return fail2();
+    const bytes = readOwned(directory, "bundle.tgz", PRIVATE_PUBLICATION_MAX_BYTES);
+    if (bytes.length !== value.declaration.archiveByteSize || publicationSha256(bytes) !== value.declaration.archiveSha256)
+      return fail2();
+    return { receipt: value, bytes };
+  } catch {
+    return fail2();
+  }
+}
+async function preparePrivatePublication(client, sourceDirectory, recoveryDirectory, input) {
+  if (!publicationUuid(input.skillId) || !(input.expectedCurrentVersionId === null || publicationUuid(input.expectedCurrentVersionId)) || input.idempotencyKey !== undefined && !publicationUuid(input.idempotencyKey))
+    return fail2();
+  const packed = packSkillBundle(sourceDirectory, { maxUnpackedBytes: 32 * 1024 * 1024 });
+  const inspected = await inspectSkillBundle(packed.bytes, { limits: { compressedBytes: PRIVATE_PUBLICATION_MAX_BYTES } });
+  const manifest = inspected.entries.find((entry) => entry.path === "skill.json");
+  if (!manifest || manifest.bytes.length > 16384 || !(await verifyContentHashFromEntries(inspected.entries)).valid)
+    throw new PrivatePublicationError("PUBLICATION_BUNDLE_INVALID", "The skill must have a valid skill.json with its current content hash. Validate the skill before publishing.");
+  const manifestText = new TextDecoder("utf-8", { fatal: true }).decode(manifest.bytes);
+  const declaration = checkedPublicationDeclaration({
+    idempotencyKey: input.idempotencyKey ?? randomUUID(),
+    version: JSON.parse(manifestText).version,
+    expectedCurrentVersionId: input.expectedCurrentVersionId,
+    manifestText,
+    archiveSha256: inspected.sha256,
+    archiveByteSize: packed.bytes.length
+  });
+  const receipt = {
+    contractVersion: 1,
+    apiOrigin: client.apiOrigin,
+    organizationId: client.organizationId,
+    userId: client.userId,
+    membershipId: client.membershipId,
+    skillId: input.skillId,
+    declaration,
+    phase: "prepared",
+    intent: null
+  };
+  if (!isAbsolute4(recoveryDirectory) || resolve2(recoveryDirectory) !== recoveryDirectory || realpathSync2(dirname8(recoveryDirectory)) !== dirname8(recoveryDirectory))
+    return fail2();
+  mkdirSync11(recoveryDirectory, { mode: 448 });
+  safeDirectory(recoveryDirectory);
+  const parent = openSync4(dirname8(recoveryDirectory), constants3.O_RDONLY | constants3.O_NOFOLLOW);
+  try {
+    fsyncSync(parent);
+  } finally {
+    closeSync4(parent);
+  }
+  writeOwned(recoveryDirectory, "bundle.tgz", packed.bytes);
+  save(recoveryDirectory, receipt);
+  return receipt;
+}
+function privatePublicationResult(directory, receipt) {
+  const state = receipt.intent?.state ?? receipt.phase, committed = state === "committed";
+  const nextAction = committed ? "The version is published. Private execution remains unavailable." : ["rejected", "cancelled", "expired"].includes(state) ? "This intent is terminal. Inspect the result before explicitly preparing another version." : state === "needs_attention" ? "Keep this intent and contact the service operator; do not create a replacement or upload again." : receipt.phase === "upload_uncertain" ? "Run publication resume with this recovery directory to finalize the same intent without another upload." : receipt.intent ? "Run publication status or resume with this recovery directory; cancel explicitly if you want to stop." : "Run publication resume with this recovery directory to reconcile the identical request key and declaration.";
+  return {
+    recoveryDirectory: directory,
+    skillId: receipt.skillId,
+    intentId: receipt.intent?.id ?? null,
+    state,
+    versionId: receipt.intent?.versionId ?? null,
+    committed,
+    executionEnabled: false,
+    nextAction
+  };
+}
+async function continuePrivatePublication(client, directory, options) {
+  if (options.confirm !== true)
+    throw new PrivatePublicationError("PUBLICATION_CONFIRM_REQUIRED", "Explicit upload confirmation is required.");
+  if (options.waitMs !== undefined && (!Number.isSafeInteger(options.waitMs) || options.waitMs < 0 || options.waitMs > 300000))
+    return fail2();
+  return locked(directory, () => continueLocked(client, directory, options));
+}
+async function continueLocked(client, directory, options) {
+  const { receipt, bytes } = readPrivatePublicationRecovery(directory);
+  bind(client, receipt);
+  if (!receipt.intent) {
+    receipt.phase = "begin_uncertain";
+    save(directory, receipt);
+    receipt.intent = await client.begin(receipt.skillId, receipt.declaration);
+    receipt.phase = "awaiting_upload";
+    save(directory, receipt);
+  } else {
+    receipt.intent = checkedPublicationView(await client.get(receipt.skillId, receipt.intent.id), receipt.skillId, receipt.intent.id, receipt.declaration);
+    save(directory, receipt);
+  }
+  if (receipt.intent.state === "awaiting_upload") {
+    if (receipt.phase === "awaiting_upload") {
+      receipt.phase = "upload_uncertain";
+      save(directory, receipt);
+      try {
+        await client.upload(receipt.skillId, receipt.intent, bytes);
+      } catch (error2) {
+        if (error2 instanceof PrivatePublicationError && !error2.uncertain) {
+          receipt.phase = "awaiting_upload";
+          save(directory, receipt);
+        }
+        throw error2;
+      }
+      receipt.phase = "uploaded";
+      save(directory, receipt);
+    }
+    receipt.phase = "finalize_uncertain";
+    save(directory, receipt);
+    receipt.intent = checkedPublicationView(await client.finalize(receipt.skillId, receipt.intent.id), receipt.skillId, receipt.intent.id, receipt.declaration);
+    receipt.phase = "observed";
+    save(directory, receipt);
+  }
+  if (options.waitMs !== undefined && options.waitMs > 0 && ["queued", "verifying"].includes(receipt.intent.state)) {
+    receipt.intent = checkedPublicationView(await client.wait(receipt.skillId, receipt.intent.id, { timeoutMs: options.waitMs }), receipt.skillId, receipt.intent.id, receipt.declaration);
+    receipt.phase = "observed";
+    save(directory, receipt);
+  }
+  return privatePublicationResult(directory, receipt);
+}
+async function inspectPrivatePublication(client, directory, cancel = false) {
+  return locked(directory, () => inspectLocked(client, directory, cancel));
+}
+async function inspectLocked(client, directory, cancel) {
+  const { receipt } = readPrivatePublicationRecovery(directory);
+  bind(client, receipt);
+  if (receipt.intent) {
+    receipt.intent = checkedPublicationView(await (cancel ? client.cancel(receipt.skillId, receipt.intent.id) : client.get(receipt.skillId, receipt.intent.id)), receipt.skillId, receipt.intent.id, receipt.declaration);
+    save(directory, receipt);
+  } else if (cancel)
+    throw new PrivatePublicationError("PUBLICATION_INTENT_UNKNOWN", "Reconcile the saved begin request with publication resume before cancelling its intent.");
+  return privatePublicationResult(directory, receipt);
+}
+var fail2 = () => {
+  throw new PrivatePublicationError("PUBLICATION_RECOVERY_INVALID", "The recovery directory is invalid or changed. Preserve it and inspect the existing intent; do not start a replacement automatically.");
+};
+var init_private_publication_recovery = __esm(() => {
+  init_skill_bundle();
+  init_skill_hash();
+  init_remote_private_publications();
+  init_fleet_credentials();
+});
+
+// src/mcp/private-publication-tools.ts
+import { isAbsolute as isAbsolute5 } from "path";
+function registerPrivatePublicationTools(server) {
+  const uuid6 = exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/);
+  const directory = exports_external.string().max(4096).refine(isAbsolute5, "Use an absolute local directory");
+  const verification = { email: exports_external.string().email().max(254), code: exports_external.string().regex(/^\d{6}$/), userId: uuid6, membershipId: uuid6, recoveryDirectory: directory };
+  const description = "Manage a private source publication using fresh workspace-bound verification and a host-local recovery directory. Publishing requires explicit UUID current-version comparison and upload consent. Resume reuses immutable saved bytes and intent; an uncertain PUT is finalized for server verification, never uploaded twice. Sessions and signed URLs are not returned or persisted. Private execution is unavailable. Host request history may contain the supplied verification code.";
+  const handler = (action) => async (value) => {
+    try {
+      const client = await privatePublicationSession(String(value.email), String(value.code), { userId: String(value.userId), membershipId: String(value.membershipId) });
+      const recovery = String(value.recoveryDirectory);
+      if (action === "publish")
+        await preparePrivatePublication(client, String(value.directory), recovery, { skillId: String(value.skillId), expectedCurrentVersionId: value.expectedCurrentVersionId, idempotencyKey: value.idempotencyKey });
+      const result = action === "publish" || action === "resume" ? await continuePrivatePublication(client, recovery, { confirm: true, waitMs: value.waitMs }) : await inspectPrivatePublication(client, recovery, action === "cancel");
+      return mcpJson(result);
+    } catch (error2) {
+      const result = privatePublicationCustomerError(error2);
+      return mcpError(result.code, result.error);
+    }
+  };
+  server.registerTool("publish_private_skill", {
+    title: "Publish private skill",
+    description,
+    annotations: { destructiveHint: true, readOnlyHint: false, idempotentHint: false },
+    inputSchema: exports_external.object({ ...verification, directory, skillId: uuid6, expectedCurrentVersionId: uuid6.nullable(), idempotencyKey: uuid6.optional(), confirm: exports_external.literal(true), waitMs: exports_external.number().int().min(0).max(300000).optional() }).strict()
+  }, handler("publish"));
+  server.registerTool("get_private_publication", {
+    title: "Get private publication",
+    description,
+    annotations: { destructiveHint: false, readOnlyHint: true, idempotentHint: true },
+    inputSchema: exports_external.object(verification).strict()
+  }, handler("get"));
+  server.registerTool("resume_private_publication", {
+    title: "Resume private publication",
+    description,
+    annotations: { destructiveHint: true, readOnlyHint: false, idempotentHint: true },
+    inputSchema: exports_external.object({ ...verification, confirm: exports_external.literal(true), waitMs: exports_external.number().int().min(0).max(300000).optional() }).strict()
+  }, handler("resume"));
+  server.registerTool("cancel_private_publication", {
+    title: "Cancel private publication",
+    description,
+    annotations: { destructiveHint: true, readOnlyHint: false, idempotentHint: true },
+    inputSchema: exports_external.object({ ...verification, confirm: exports_external.literal(true) }).strict()
+  }, handler("cancel"));
+}
+var init_private_publication_tools = __esm(() => {
+  init_zod();
+  init_private_publication_customer();
+  init_private_publication_recovery();
+  init_helpers();
+});
+
 // src/mcp/remote-customer-tools.ts
 function registerRemoteCustomerTools(server) {
   registerRemoteInvitationTools(server);
+  registerPrivatePublicationTools(server);
   const memberRole = exports_external.enum(["owner", "admin", "member", "viewer"]);
   const memberInput = {
     membershipId: exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/),
@@ -31086,8 +32528,16 @@ function registerRemoteCustomerTools(server) {
   server.registerTool("quote_skill", {
     title: "Quote Remote Skill",
     description: "Get the configured server's credit quote without submitting a run.",
-    inputSchema: { name: exports_external.string(), input: exports_external.record(exports_external.string(), exports_external.unknown()).optional(), args: exports_external.array(exports_external.string()).optional() }
-  }, ({ name, input, args }) => callRemote((client) => client.quoteRun(name, input, args)));
+    inputSchema: {
+      name: exports_external.string(),
+      input: exports_external.record(exports_external.string(), exports_external.unknown()).optional(),
+      args: exports_external.array(exports_external.string()).optional(),
+      files: exports_external.array(exports_external.object({ name: exports_external.string(), base64: exports_external.string().max(1398104), contentType: exports_external.string().optional() })).max(10).optional().describe("The same inline files to submit after approval; quoted descriptors bind their exact bytes, names and types.")
+    }
+  }, ({ name, input, args, files }) => callRemote((client) => {
+    const descriptors = describeRemoteFiles(decodeRemoteFiles(files ?? []));
+    return client.quoteRun(name, input, args, descriptors.length ? descriptors : undefined);
+  }));
   server.registerTool("download_run_artifact", {
     title: "Download Verified Run Artifact",
     description: "Return verified artifact bytes as base64 (at most 1 MiB); use the CLI for larger files.",
@@ -31121,6 +32571,7 @@ async function freshAccount(action, operation) {
 }
 var init_remote_customer_tools = __esm(() => {
   init_remote_invitation_tools();
+  init_private_publication_tools();
   init_zod();
   init_remote_auth();
   init_workspace_profile();
@@ -31128,13 +32579,14 @@ var init_remote_customer_tools = __esm(() => {
   init_remote_client();
   init_remote_workspace_leave();
   init_helpers();
+  init_remote_files();
 });
 
 // src/mcp/server.ts
 var exports_server = {};
 __export(exports_server, {
-  buildServer: () => buildServer,
-  server: () => server
+  server: () => server,
+  buildServer: () => buildServer
 });
 function buildServer() {
   const server = new McpServer({
@@ -31541,7 +32993,7 @@ var RequestError, toRequestError = (e) => {
         });
         if (!chunk) {
           if (i === 1) {
-            await new Promise((resolve2) => setTimeout(resolve2));
+            await new Promise((resolve3) => setTimeout(resolve3));
             maxReadCount = 3;
             continue;
           }
@@ -31832,7 +33284,7 @@ var init_dist = __esm(() => {
 });
 
 // ../../node_modules/.bun/content-type@1.0.5/node_modules/content-type/index.js
-var require_content_type = __commonJS(function(exports) {
+var require_content_type = __commonJS((exports) => {
   /*!
    * content-type
    * Copyright(c) 2015 Douglas Christopher Wilson
@@ -32376,9 +33828,9 @@ data:
       const initRequest = messages.find((m) => isInitializeRequest(m));
       const clientProtocolVersion = initRequest ? initRequest.params.protocolVersion : req.headers.get("mcp-protocol-version") ?? DEFAULT_NEGOTIATED_PROTOCOL_VERSION;
       if (this._enableJsonResponse) {
-        return new Promise((resolve2) => {
+        return new Promise((resolve3) => {
           this._streamMapping.set(streamId, {
-            resolveJson: resolve2,
+            resolveJson: resolve3,
             cleanup: () => {
               this._streamMapping.delete(streamId);
             }
@@ -32707,13 +34159,13 @@ var init_streamableHttp = __esm(() => {
 // src/mcp/http.ts
 var exports_http = {};
 __export(exports_http, {
-  MCP_HTTP_DEFAULT_PORT: () => MCP_HTTP_DEFAULT_PORT,
-  MCP_HTTP_SERVICE_NAME: () => MCP_HTTP_SERVICE_NAME,
-  handleMcpHttpNodeRequest: () => handleMcpHttpNodeRequest,
-  isMcpHttpMode: () => isMcpHttpMode,
-  isMcpStdioMode: () => isMcpStdioMode,
+  startSkillsMcpHttpServer: () => startSkillsMcpHttpServer,
   parseMcpHttpPort: () => parseMcpHttpPort,
-  startSkillsMcpHttpServer: () => startSkillsMcpHttpServer
+  isMcpStdioMode: () => isMcpStdioMode,
+  isMcpHttpMode: () => isMcpHttpMode,
+  handleMcpHttpNodeRequest: () => handleMcpHttpNodeRequest,
+  MCP_HTTP_SERVICE_NAME: () => MCP_HTTP_SERVICE_NAME,
+  MCP_HTTP_DEFAULT_PORT: () => MCP_HTTP_DEFAULT_PORT
 });
 import { createServer } from "http";
 function isMcpHttpMode(argv = process.argv.slice(2)) {
@@ -32747,19 +34199,19 @@ async function connectMcpForNode() {
   return { server: server2, transport };
 }
 function readBody(req) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const chunks = [];
     req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve2(undefined);
+        resolve3(undefined);
         return;
       }
       try {
-        resolve2(JSON.parse(raw));
+        resolve3(JSON.parse(raw));
       } catch {
-        resolve2(undefined);
+        resolve3(undefined);
       }
     });
     req.on("error", reject);
@@ -32801,9 +34253,9 @@ async function startSkillsMcpHttpServer(options = {}) {
       }
     }
   });
-  await new Promise((resolve2, reject) => {
+  await new Promise((resolve3, reject) => {
     httpServer.once("error", reject);
-    httpServer.listen(port, hostname2, () => resolve2());
+    httpServer.listen(port, hostname2, () => resolve3());
   });
   const address = httpServer.address();
   const listenPort = typeof address === "object" && address ? address.port : port;
@@ -32885,6 +34337,6 @@ if (import.meta.main) {
   });
 }
 export {
-  assertSkillsMcpConfigured,
-  startMcpStdio
+  startMcpStdio,
+  assertSkillsMcpConfigured
 };