npm - @hasna/skills - Versions diffs - 0.5.4 → 0.5.6 - Mend

@hasna/skills 0.5.4 → 0.5.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (26) hide show

package/README.md +72 -7
package/bin/index.js +2181 -901
package/bin/mcp.js +1960 -508
package/bin/migrate.js +176 -4
package/bin/server.js +419 -195
package/bin/worker.js +413 -222
package/dist/admin-contract.js +174 -176
package/dist/cli/commands/private-publications.d.ts +2 -0
package/dist/index.d.ts +2 -0
package/dist/index.js +1074 -421
package/dist/lib/fleet-credentials.d.ts +6 -1
package/dist/lib/home-adoption.d.ts +2 -7
package/dist/lib/mcp-contracts.d.ts +1 -0
package/dist/lib/private-publication-customer.d.ts +10 -0
package/dist/lib/private-publication-recovery.d.ts +43 -0
package/dist/lib/remote-account.d.ts +5 -0
package/dist/lib/remote-auth.d.ts +3 -0
package/dist/lib/remote-client.d.ts +2 -2
package/dist/lib/remote-private-publications.d.ts +74 -0
package/dist/mcp/private-publication-tools.d.ts +2 -0
package/dist/sdk/execution/dispatchers/ecs.d.ts +25 -14
package/dist/sdk/index.d.ts +2 -0
package/dist/sdk/index.js +1291 -617
package/dist/server/types.d.ts +2 -0
package/dist/storage.js +39 -37
package/package.json +1 -1

package/dist/sdk/index.js CHANGED Viewed

@@ -19,14 +19,12 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  if (mod && typeof mod === "object" || typeof mod === "function") {
-    for (let key of __getOwnPropNames(mod))
-      if (!__hasOwnProp.call(to, key))
-        __defProp(to, key, {
-          get: __accessProp.bind(mod, key),
-          enumerable: true
-        });
-  }
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -48,8 +46,8 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
-// ../../node_modules/.bun/@smithy+types@4.18.0/node_modules/@smithy/types/dist-cjs/index.js
-var require_dist_cjs = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+types@4.18.0/node_modules/@smithy/types/dist-cjs/index.js
+var require_dist_cjs = __commonJS((exports) => {
   var HttpAuthLocation;
   (function(HttpAuthLocation2) {
     HttpAuthLocation2["HEADER"] = "header";
@@ -139,8 +137,8 @@ var require_dist_cjs = __commonJS(function(exports) {
   exports.resolveDefaultRuntimeConfig = resolveDefaultRuntimeConfig;
 });
-// ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/transport/index.js
-var require_transport = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/transport/index.js
+var require_transport = __commonJS((exports) => {
   var { SMITHY_CONTEXT_KEY } = require_dist_cjs();
   var getSmithyContext = (context) => context[SMITHY_CONTEXT_KEY] || (context[SMITHY_CONTEXT_KEY] = {});
   function hasOwn2(o, k) {
@@ -312,8 +310,8 @@ var require_transport = __commonJS(function(exports) {
   exports.toEndpointV1 = toEndpointV1;
 });
-// ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/schema/index.js
-var require_schema = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/schema/index.js
+var require_schema = __commonJS((exports) => {
   var { getSmithyContext, HttpResponse, toEndpointV1 } = require_transport();
   var deref = (schemaRef) => {
     if (typeof schemaRef === "function") {
@@ -981,8 +979,8 @@ var require_schema = __commonJS(function(exports) {
   exports.translateTraits = translateTraits;
 });
-// ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/client/index.js
-var require_client = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/client/index.js
+var require_client = __commonJS((exports) => {
   var { hasOwn: hasOwn2 } = require_transport();
   var { getSmithyContext, normalizeProvider } = require_transport();
   exports.getSmithyContext = getSmithyContext;
@@ -2061,8 +2059,8 @@ var require_client = __commonJS(function(exports) {
   exports.withBaseException = withBaseException;
 });
-// ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/config/index.js
-var require_config = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/config/index.js
+var require_config = __commonJS((exports) => {
   var { homedir } = __require("os");
   var { sep, join: join3 } = __require("path");
   var { createHash: createHash2 } = __require("crypto");
@@ -2756,8 +2754,8 @@ var require_config = __commonJS(function(exports) {
   exports.resolveRegionConfig = resolveRegionConfig;
 });
-// ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/endpoints/index.js
-var require_endpoints = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/endpoints/index.js
+var require_endpoints = __commonJS((exports) => {
   var { CONFIG_PREFIX_SEPARATOR, booleanSelector, SelectorType, loadConfig } = require_config();
   var { toEndpointV1, getSmithyContext, normalizeProvider, isValidHostLabel, hasOwn: hasOwn2 } = require_transport();
   exports.isValidHostLabel = isValidHostLabel;
@@ -3570,8 +3568,8 @@ var require_endpoints = __commonJS(function(exports) {
   exports.resolveParams = resolveParams;
 });
-// ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/serde/index.js
-var require_serde = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/serde/index.js
+var require_serde = __commonJS((exports) => {
   var { createHmac: createHmac2, createHash: createHash2, getRandomValues } = __require("crypto");
   var { hasOwn: hasOwn2, HttpResponse } = require_transport();
   exports.hasOwn = hasOwn2;
@@ -5211,8 +5209,8 @@ ${value}\r
   exports.v4 = v4;
 });
-// ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/checksum/index.js
-var require_checksum = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/checksum/index.js
+var require_checksum = __commonJS((exports) => {
   var { createReadStream } = __require("fs");
   var { Writable } = __require("stream");
   var { toUint8Array, concatBytes } = require_serde();
@@ -5827,8 +5825,8 @@ var require_checksum = __commonJS(function(exports) {
   exports.readableStreamHasher = readableStreamHasher;
 });
-// ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/event-streams/index.js
-var require_event_streams = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/event-streams/index.js
+var require_event_streams = __commonJS((exports) => {
   var { Crc32 } = require_checksum();
   var { hasOwn: hasOwn2 } = require_transport();
   var { toHex, fromHex, toUtf8, fromUtf8 } = require_serde();
@@ -6719,8 +6717,8 @@ var require_event_streams = __commonJS(function(exports) {
   exports.universalEventStreamSerdeProvider = eventStreamSerdeProvider$1;
 });
-// ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/protocols/index.js
-var require_protocols = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/protocols/index.js
+var require_protocols = __commonJS((exports) => {
   var { Uint8ArrayBlobAdapter, sdkStreamMixin, splitEvery, splitHeader, fromBase64, _parseEpochTimestamp, _parseRfc7231DateTime, _parseRfc3339DateTimeWithOffset, LazyJsonString, NumericValue, toUtf8, fromUtf8, generateIdempotencyToken, toBase64, dateToUtcString, quoteHeader } = require_serde();
   var { HttpRequest, HttpResponse, hasOwn: hasOwn2, isValidHostname } = require_transport();
   var { parseQueryString, parseUrl } = require_transport();
@@ -7723,8 +7721,8 @@ var require_protocols = __commonJS(function(exports) {
   exports.resolvedPath = resolvedPath;
 });
-// ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/retry/index.js
-var require_retry = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/retry/index.js
+var require_retry = __commonJS((exports) => {
   var { Readable } = __require("stream");
   var { NoOpLogger, normalizeProvider } = require_client();
   var { HttpResponse, HttpRequest } = require_protocols();
@@ -8523,8 +8521,8 @@ var require_retry = __commonJS(function(exports) {
   exports.retryMiddlewareOptions = retryMiddlewareOptions;
 });
-// ../../node_modules/.bun/@aws+lambda-invoke-store@0.3.0/node_modules/@aws/lambda-invoke-store/dist-cjs/invoke-store.js
-var require_invoke_store = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws+lambda-invoke-store@0.3.0/node_modules/@aws/lambda-invoke-store/dist-cjs/invoke-store.js
+var require_invoke_store = __commonJS((exports) => {
   var PROTECTED_KEYS = {
     REQUEST_ID: Symbol.for("_AWS_LAMBDA_REQUEST_ID"),
     X_RAY_TRACE_ID: Symbol.for("_AWS_LAMBDA_X_RAY_TRACE_ID"),
@@ -8652,8 +8650,8 @@ var require_invoke_store = __commonJS(function(exports) {
   exports.InvokeStoreBase = InvokeStoreBase;
 });
-// ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/index.js
-var require_dist_cjs2 = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/index.js
+var require_dist_cjs2 = __commonJS((exports) => {
   var { getSmithyContext, hasOwn: hasOwn2 } = require_transport();
   exports.getSmithyContext = getSmithyContext;
   var { HttpRequest } = require_protocols();
@@ -8980,8 +8978,8 @@ var require_dist_cjs2 = __commonJS(function(exports) {
   exports.setFeature = setFeature;
 });
-// ../../node_modules/.bun/bowser@2.14.1/node_modules/bowser/es5.js
-var require_es5 = __commonJS(function(exports, module) {
+// ../../../skills-release-055-20260909/node_modules/.bun/bowser@2.14.1/node_modules/bowser/es5.js
+var require_es5 = __commonJS((exports, module) => {
   (function(e, t) {
     typeof exports == "object" && typeof module == "object" ? module.exports = t() : typeof define == "function" && define.amd ? define([], t) : typeof exports == "object" ? exports.bowser = t() : e.bowser = t();
   })(exports, function() {
@@ -9820,8 +9818,8 @@ var require_es5 = __commonJS(function(exports, module) {
   });
 });
-// ../../node_modules/.bun/@aws-sdk+core@3.977.9/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.js
-var require_client2 = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+core@3.977.9/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.js
+var require_client2 = __commonJS((exports) => {
   var { Retry, RETRY_MODES } = require_retry();
   var { HttpRequest, parseUrl } = require_protocols();
   var { InvokeStore } = require_invoke_store();
@@ -10758,8 +10756,8 @@ More information can be found at: https://a.co/c895JFp`);
   exports.userAgentMiddleware = userAgentMiddleware;
 });
-// ../../node_modules/.bun/@aws-sdk+checksums@3.1000.29/node_modules/@aws-sdk/checksums/dist-cjs/submodules/crc/index.js
-var require_crc = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+checksums@3.1000.29/node_modules/@aws-sdk/checksums/dist-cjs/submodules/crc/index.js
+var require_crc = __commonJS((exports) => {
   var { Crc32, Crc32Js, Crc32Node } = require_checksum();
   exports.Crc32 = Crc32;
   exports.Crc32Js = Crc32Js;
@@ -10915,8 +10913,8 @@ var require_crc = __commonJS(function(exports) {
   exports.crc64NvmeCrtContainer = crc64NvmeCrtContainer;
 });
-// ../../node_modules/.bun/@smithy+signature-v4@5.7.3/node_modules/@smithy/signature-v4/dist-cjs/index.js
-var require_dist_cjs3 = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+signature-v4@5.7.3/node_modules/@smithy/signature-v4/dist-cjs/index.js
+var require_dist_cjs3 = __commonJS((exports) => {
   var { hasOwn: hasOwn2, fromUtf8, fromHex, toHex, toUint8Array: toUint8Array2, isArrayBuffer: isArrayBuffer2 } = require_serde();
   var { normalizeProvider: normalizeProvider2 } = require_client();
   var { escapeUri, HttpRequest: HttpRequest2 } = require_protocols();
@@ -11467,8 +11465,8 @@ ${toHex(hashedRequest)}`;
   exports.signatureV4aContainer = signatureV4aContainer;
 });
-// ../../node_modules/.bun/@aws-sdk+signature-v4-multi-region@3.996.46/node_modules/@aws-sdk/signature-v4-multi-region/dist-cjs/index.js
-var require_dist_cjs4 = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+signature-v4-multi-region@3.996.46/node_modules/@aws-sdk/signature-v4-multi-region/dist-cjs/index.js
+var require_dist_cjs4 = __commonJS((exports) => {
   var { SignatureV4, signatureV4aContainer } = require_dist_cjs3();
   var signatureV4CrtContainer = {
     CrtSignerV4: null
@@ -11599,8 +11597,8 @@ var require_dist_cjs4 = __commonJS(function(exports) {
   exports.signatureV4CrtContainer = signatureV4CrtContainer;
 });
-// ../../node_modules/.bun/@aws-sdk+core@3.977.9/node_modules/@aws-sdk/core/dist-cjs/submodules/util/index.js
-var require_util = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+core@3.977.9/node_modules/@aws-sdk/core/dist-cjs/submodules/util/index.js
+var require_util = __commonJS((exports) => {
   var { buildQueryString } = require_protocols();
   var validate = (str) => typeof str === "string" && str.indexOf("arn:") === 0 && str.split(":").length >= 6;
   var parse = (arn) => {
@@ -11657,8 +11655,8 @@ var require_util = __commonJS(function(exports) {
   exports.validate = validate;
 });
-// ../../node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/cbor/index.js
-var require_cbor = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+core@3.33.3/node_modules/@smithy/core/dist-cjs/submodules/cbor/index.js
+var require_cbor = __commonJS((exports) => {
   var { nv, NumericValue, calculateBodyLength, generateIdempotencyToken, fromBase64, _parseEpochTimestamp } = require_serde();
   var { hasOwn: hasOwn2, getSmithyContext } = require_transport();
   var { HttpRequest: HttpRequest2, collectBody, SerdeContext, RpcProtocol } = require_protocols();
@@ -14107,8 +14105,8 @@ var require_cbor = __commonJS(function(exports) {
   exports.tagSymbol = tagSymbol;
 });
-// ../../node_modules/.bun/@aws-sdk+xml-builder@3.972.40/node_modules/@aws-sdk/xml-builder/dist-cjs/index.js
-var require_dist_cjs5 = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+xml-builder@3.972.40/node_modules/@aws-sdk/xml-builder/dist-cjs/index.js
+var require_dist_cjs5 = __commonJS((exports) => {
   var ATTR_ESCAPE_RE = /[&<>"]/g;
   var ATTR_ESCAPE_MAP = {
     "&": "&amp;",
@@ -14475,8 +14473,8 @@ var require_dist_cjs5 = __commonJS(function(exports) {
   exports.parseXML = parseXML;
 });
-// ../../node_modules/.bun/@aws-sdk+core@3.977.9/node_modules/@aws-sdk/core/dist-cjs/submodules/protocols/index.js
-var require_protocols2 = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+core@3.977.9/node_modules/@aws-sdk/core/dist-cjs/submodules/protocols/index.js
+var require_protocols2 = __commonJS((exports) => {
   var { SmithyRpcV2CborProtocol, loadSmithyRpcV2CborErrorCode } = require_cbor();
   var { TypeRegistry, NormalizedSchema, deref } = require_schema();
   var { decorateServiceException, getValueFromTextNode } = require_client();
@@ -17316,8 +17314,8 @@ var require_protocols2 = __commonJS(function(exports) {
   exports.parseXmlErrorBody = parseXmlErrorBody;
 });
-// ../../node_modules/.bun/@aws-sdk+core@3.977.9/node_modules/@aws-sdk/core/dist-cjs/submodules/httpAuthSchemes/index.js
-var require_httpAuthSchemes = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+core@3.977.9/node_modules/@aws-sdk/core/dist-cjs/submodules/httpAuthSchemes/index.js
+var require_httpAuthSchemes = __commonJS((exports) => {
   var { ProviderError, booleanSelector: booleanSelector2, SelectorType: SelectorType3, loadConfig } = require_config();
   var { setCredentialFeature } = require_client2();
   var { normalizeProvider: normalizeProvider2, memoizeIdentityProvider, isIdentityExpired, doesIdentityRequireRefresh } = require_dist_cjs2();
@@ -17646,7 +17644,7 @@ var require_httpAuthSchemes = __commonJS(function(exports) {
   exports.validateSigningProperties = validateSigningProperties;
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-env@3.972.70/node_modules/@aws-sdk/credential-provider-env/dist-es/fromEnv.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-env@3.972.70/node_modules/@aws-sdk/credential-provider-env/dist-es/fromEnv.js
 var import_client8, import_config, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET = "AWS_SECRET_ACCESS_KEY", ENV_SESSION = "AWS_SESSION_TOKEN", ENV_EXPIRATION = "AWS_CREDENTIAL_EXPIRATION", ENV_CREDENTIAL_SCOPE = "AWS_CREDENTIAL_SCOPE", ENV_ACCOUNT_ID = "AWS_ACCOUNT_ID", fromEnv = (init) => async () => {
   init?.logger?.debug("@aws-sdk/credential-provider-env - fromEnv");
   const accessKeyId = process.env[ENV_KEY];
@@ -17674,22 +17672,22 @@ var init_fromEnv = __esm(() => {
   import_config = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-env@3.972.70/node_modules/@aws-sdk/credential-provider-env/dist-es/index.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-env@3.972.70/node_modules/@aws-sdk/credential-provider-env/dist-es/index.js
 var exports_dist_es = {};
 __export(exports_dist_es, {
-  ENV_ACCOUNT_ID: () => ENV_ACCOUNT_ID,
-  ENV_CREDENTIAL_SCOPE: () => ENV_CREDENTIAL_SCOPE,
-  ENV_EXPIRATION: () => ENV_EXPIRATION,
-  ENV_KEY: () => ENV_KEY,
-  ENV_SECRET: () => ENV_SECRET,
+  fromEnv: () => fromEnv,
   ENV_SESSION: () => ENV_SESSION,
-  fromEnv: () => fromEnv
+  ENV_SECRET: () => ENV_SECRET,
+  ENV_KEY: () => ENV_KEY,
+  ENV_EXPIRATION: () => ENV_EXPIRATION,
+  ENV_CREDENTIAL_SCOPE: () => ENV_CREDENTIAL_SCOPE,
+  ENV_ACCOUNT_ID: () => ENV_ACCOUNT_ID
 });
 var init_dist_es = __esm(() => {
   init_fromEnv();
 });
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/ImdsCredentials.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/ImdsCredentials.js
 var isImdsCredentials = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.AccessKeyId === "string" && typeof arg.SecretAccessKey === "string" && typeof arg.Token === "string" && typeof arg.Expiration === "string", fromImdsCredentials = (creds) => ({
   accessKeyId: creds.AccessKeyId,
   secretAccessKey: creds.SecretAccessKey,
@@ -17698,14 +17696,14 @@ var isImdsCredentials = (arg) => Boolean(arg) && typeof arg === "object" && type
   ...creds.AccountId && { accountId: creds.AccountId }
 });
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/RemoteProviderInit.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/RemoteProviderInit.js
 var DEFAULT_TIMEOUT = 1000, DEFAULT_MAX_RETRIES = 0, providerConfigFromInit = ({ maxRetries = DEFAULT_MAX_RETRIES, timeout = DEFAULT_TIMEOUT }) => ({ maxRetries, timeout });
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/node-http.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/node-http.js
 import node_http from "http";
 var init_node_http = () => {};
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/httpRequest.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/httpRequest.js
 function httpRequest(options) {
   return new Promise((resolve, reject) => {
     const req = node_http.request({
@@ -17745,7 +17743,7 @@ var init_httpRequest = __esm(() => {
   import_config2 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/retry.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/retry.js
 var retry = (toRetry, maxRetries) => {
   let promise = toRetry();
   for (let i2 = 0;i2 < maxRetries; i2++) {
@@ -17754,7 +17752,7 @@ var retry = (toRetry, maxRetries) => {
   return promise;
 };
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/fromContainerMetadata.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/fromContainerMetadata.js
 var import_config3, ENV_CMDS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", ENV_CMDS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", ENV_CMDS_AUTH_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromContainerMetadata = (init = {}) => {
   const { timeout, maxRetries } = providerConfigFromInit(init);
   return () => retry(async () => {
@@ -17824,7 +17822,7 @@ var init_fromContainerMetadata = __esm(() => {
   GREENGRASS_PROTOCOLS = new Set(["http:", "https:"]);
 });
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/error/InstanceMetadataV1FallbackError.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/error/InstanceMetadataV1FallbackError.js
 var import_config4, InstanceMetadataV1FallbackError;
 var init_InstanceMetadataV1FallbackError = __esm(() => {
   import_config4 = __toESM(require_config(), 1);
@@ -17839,7 +17837,7 @@ var init_InstanceMetadataV1FallbackError = __esm(() => {
   };
 });
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/config/Endpoint.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/config/Endpoint.js
 var Endpoint;
 var init_Endpoint = __esm(() => {
   (function(Endpoint2) {
@@ -17848,7 +17846,7 @@ var init_Endpoint = __esm(() => {
   })(Endpoint || (Endpoint = {}));
 });
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/config/EndpointConfigOptions.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/config/EndpointConfigOptions.js
 var ENV_ENDPOINT_NAME = "AWS_EC2_METADATA_SERVICE_ENDPOINT", CONFIG_ENDPOINT_NAME = "ec2_metadata_service_endpoint", ENDPOINT_CONFIG_OPTIONS;
 var init_EndpointConfigOptions = __esm(() => {
   ENDPOINT_CONFIG_OPTIONS = {
@@ -17858,7 +17856,7 @@ var init_EndpointConfigOptions = __esm(() => {
   };
 });
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/config/EndpointMode.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/config/EndpointMode.js
 var EndpointMode;
 var init_EndpointMode = __esm(() => {
   (function(EndpointMode2) {
@@ -17867,7 +17865,7 @@ var init_EndpointMode = __esm(() => {
   })(EndpointMode || (EndpointMode = {}));
 });
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/config/EndpointModeConfigOptions.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/config/EndpointModeConfigOptions.js
 var ENV_ENDPOINT_MODE_NAME = "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE", CONFIG_ENDPOINT_MODE_NAME = "ec2_metadata_service_endpoint_mode", ENDPOINT_MODE_CONFIG_OPTIONS;
 var init_EndpointModeConfigOptions = __esm(() => {
   init_EndpointMode();
@@ -17878,7 +17876,7 @@ var init_EndpointModeConfigOptions = __esm(() => {
   };
 });
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/utils/getInstanceMetadataEndpoint.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/utils/getInstanceMetadataEndpoint.js
 var import_config5, import_protocols, getInstanceMetadataEndpoint = async () => import_protocols.parseUrl(await getFromEndpointConfig() || await getFromEndpointModeConfig()), getFromEndpointConfig = async () => import_config5.loadConfig(ENDPOINT_CONFIG_OPTIONS)(), getFromEndpointModeConfig = async () => {
   const endpointMode = await import_config5.loadConfig(ENDPOINT_MODE_CONFIG_OPTIONS)();
   switch (endpointMode) {
@@ -17899,7 +17897,7 @@ var init_getInstanceMetadataEndpoint = __esm(() => {
   import_protocols = __toESM(require_protocols(), 1);
 });
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/utils/getExtendedInstanceMetadataCredentials.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/utils/getExtendedInstanceMetadataCredentials.js
 var STATIC_STABILITY_REFRESH_INTERVAL_SECONDS, STATIC_STABILITY_REFRESH_INTERVAL_JITTER_WINDOW_SECONDS, STATIC_STABILITY_DOC_URL = "https://docs.aws.amazon.com/sdkref/latest/guide/feature-static-credentials.html", getExtendedInstanceMetadataCredentials = (credentials, logger) => {
   const refreshInterval = STATIC_STABILITY_REFRESH_INTERVAL_SECONDS + Math.floor(Math.random() * STATIC_STABILITY_REFRESH_INTERVAL_JITTER_WINDOW_SECONDS);
   const newExpiration = new Date(Date.now() + refreshInterval * 1000);
@@ -17917,7 +17915,7 @@ var init_getExtendedInstanceMetadataCredentials = __esm(() => {
   STATIC_STABILITY_REFRESH_INTERVAL_JITTER_WINDOW_SECONDS = 5 * 60;
 });
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/utils/staticStabilityProvider.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/utils/staticStabilityProvider.js
 var staticStabilityProvider = (provider, options = {}) => {
   const logger = options?.logger || console;
   let pastCredentials;
@@ -17944,7 +17942,7 @@ var init_staticStabilityProvider = __esm(() => {
   init_getExtendedInstanceMetadataCredentials();
 });
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/fromInstanceMetadata.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/fromInstanceMetadata.js
 var import_config6, IMDS_PATH = "/latest/meta-data/iam/security-credentials/", IMDS_TOKEN_PATH = "/latest/api/token", AWS_EC2_METADATA_V1_DISABLED = "AWS_EC2_METADATA_V1_DISABLED", PROFILE_AWS_EC2_METADATA_V1_DISABLED = "ec2_metadata_v1_disabled", X_AWS_EC2_METADATA_TOKEN = "x-aws-ec2-metadata-token", fromInstanceMetadata = (init = {}) => staticStabilityProvider(getInstanceMetadataProvider(init), { logger: init.logger }), getInstanceMetadataProvider = (init = {}) => {
   let disableFetchToken = false;
   const { logger, profile } = init;
@@ -18064,20 +18062,20 @@ var init_fromInstanceMetadata = __esm(() => {
   import_config6 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/index.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/index.js
 var exports_dist_es2 = {};
 __export(exports_dist_es2, {
-  DEFAULT_MAX_RETRIES: () => DEFAULT_MAX_RETRIES,
-  DEFAULT_TIMEOUT: () => DEFAULT_TIMEOUT,
-  ENV_CMDS_AUTH_TOKEN: () => ENV_CMDS_AUTH_TOKEN,
-  ENV_CMDS_FULL_URI: () => ENV_CMDS_FULL_URI,
-  ENV_CMDS_RELATIVE_URI: () => ENV_CMDS_RELATIVE_URI,
-  Endpoint: () => Endpoint,
-  fromContainerMetadata: () => fromContainerMetadata,
-  fromInstanceMetadata: () => fromInstanceMetadata,
-  getInstanceMetadataEndpoint: () => getInstanceMetadataEndpoint,
+  providerConfigFromInit: () => providerConfigFromInit,
   httpRequest: () => httpRequest,
-  providerConfigFromInit: () => providerConfigFromInit
+  getInstanceMetadataEndpoint: () => getInstanceMetadataEndpoint,
+  fromInstanceMetadata: () => fromInstanceMetadata,
+  fromContainerMetadata: () => fromContainerMetadata,
+  Endpoint: () => Endpoint,
+  ENV_CMDS_RELATIVE_URI: () => ENV_CMDS_RELATIVE_URI,
+  ENV_CMDS_FULL_URI: () => ENV_CMDS_FULL_URI,
+  ENV_CMDS_AUTH_TOKEN: () => ENV_CMDS_AUTH_TOKEN,
+  DEFAULT_TIMEOUT: () => DEFAULT_TIMEOUT,
+  DEFAULT_MAX_RETRIES: () => DEFAULT_MAX_RETRIES
 });
 var init_dist_es2 = __esm(() => {
   init_fromContainerMetadata();
@@ -18087,8 +18085,8 @@ var init_dist_es2 = __esm(() => {
   init_Endpoint();
 });
-// ../../node_modules/.bun/@smithy+node-http-handler@4.12.1/node_modules/@smithy/node-http-handler/dist-cjs/index.js
-var require_dist_cjs6 = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@smithy+node-http-handler@4.12.1/node_modules/@smithy/node-http-handler/dist-cjs/index.js
+var require_dist_cjs6 = __commonJS((exports) => {
   var { hasOwn: hasOwn2 } = require_serde();
   var { streamCollector } = require_serde();
   exports.streamCollector = streamCollector;
@@ -18913,7 +18911,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
   exports.NodeHttpHandler = NodeHttpHandler;
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-http@3.972.72/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/checkUrl.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-http@3.972.72/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/checkUrl.js
 var import_config7, ECS_CONTAINER_HOST = "169.254.170.2", EKS_CONTAINER_HOST_IPv4 = "169.254.170.23", EKS_CONTAINER_HOST_IPv6 = "[fd00:ec2::23]", checkUrl = (url, logger) => {
   if (url.protocol === "https:") {
     return;
@@ -18947,7 +18945,7 @@ var init_checkUrl = __esm(() => {
   import_config7 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-http@3.972.72/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/requestHelpers.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-http@3.972.72/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/requestHelpers.js
 function createGetRequest(url) {
   return new import_protocols2.HttpRequest({
     protocol: url.protocol,
@@ -18996,7 +18994,7 @@ var init_requestHelpers = __esm(() => {
   import_serde2 = __toESM(require_serde(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-http@3.972.72/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/retry-wrapper.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-http@3.972.72/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/retry-wrapper.js
 var retryWrapper = (toRetry, maxRetries, delayMs) => {
   return async () => {
     for (let i2 = 0;i2 < maxRetries; ++i2) {
@@ -19010,7 +19008,7 @@ var retryWrapper = (toRetry, maxRetries, delayMs) => {
   };
 };
-// ../../node_modules/.bun/@aws-sdk+credential-provider-http@3.972.72/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/fromHttp.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-http@3.972.72/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/fromHttp.js
 import fs from "fs/promises";
 var import_client9, import_config9, import_node_http_handler, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2", AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromHttp = (options = {}) => {
   options.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");
@@ -19076,7 +19074,7 @@ var init_fromHttp = __esm(() => {
   import_node_http_handler = __toESM(require_dist_cjs6(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-http@3.972.72/node_modules/@aws-sdk/credential-provider-http/dist-es/index.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-http@3.972.72/node_modules/@aws-sdk/credential-provider-http/dist-es/index.js
 var exports_dist_es3 = {};
 __export(exports_dist_es3, {
   fromHttp: () => fromHttp
@@ -19085,17 +19083,17 @@ var init_dist_es3 = __esm(() => {
   init_fromHttp();
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/isSsoProfile.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/isSsoProfile.js
 var isSsoProfile = (arg) => arg && (typeof arg.sso_start_url === "string" || typeof arg.sso_account_id === "string" || typeof arg.sso_session === "string" || typeof arg.sso_region === "string" || typeof arg.sso_role_name === "string");
-// ../../node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/constants.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/constants.js
 var EXPIRE_WINDOW_MS, REFRESH_MESSAGE = `To refresh this SSO session run 'aws sso login' with the corresponding profile.`;
 var init_constants = __esm(() => {
   EXPIRE_WINDOW_MS = 5 * 60 * 1000;
 });
-// ../../node_modules/.bun/@aws-sdk+nested-clients@3.997.44/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sso-oidc/index.js
-var require_sso_oidc = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+nested-clients@3.997.44/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sso-oidc/index.js
+var require_sso_oidc = __commonJS((exports) => {
   var { awsEndpointFunctions: awsEndpointFunctions2, emitWarningIfUnsupportedVersion: emitWarningIfUnsupportedVersion$1, createDefaultUserAgentProvider, NODE_APP_ID_CONFIG_OPTIONS, getAwsRegionExtensionConfiguration, resolveAwsRegionExtensionConfiguration, resolveUserAgentConfig, resolveHostHeaderConfig, getUserAgentPlugin, getHostHeaderPlugin, getLoggerPlugin, getRecursionDetectionPlugin } = require_client2();
   var { NoAuthSigner, getHttpAuthSchemeEndpointRuleSetPlugin, DefaultIdentityProviderConfig, getHttpSigningPlugin } = require_dist_cjs2();
   var { normalizeProvider: normalizeProvider3, getSmithyContext: getSmithyContext3, ServiceException, NoOpLogger: NoOpLogger2, emitWarningIfUnsupportedVersion, loadConfigsForDefaultMode, getDefaultExtensionConfiguration, resolveDefaultRuntimeConfig, Client, makeBuilder: makeBuilder2, createAggregatedClient } = require_client();
@@ -19849,7 +19847,7 @@ var require_sso_oidc = __commonJS(function(exports) {
   exports.errorTypeRegistries = errorTypeRegistries2;
 });
-// ../../node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/getSsoOidcClient.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/getSsoOidcClient.js
 var getSsoOidcClient = async (ssoRegion, init = {}, callerClientConfig) => {
   const { SSOOIDCClient } = await Promise.resolve().then(() => __toESM(require_sso_oidc(), 1));
   const coalesce = (prop) => init.clientConfig?.[prop] ?? init.parentClientConfig?.[prop] ?? callerClientConfig?.[prop];
@@ -19861,7 +19859,7 @@ var getSsoOidcClient = async (ssoRegion, init = {}, callerClientConfig) => {
   return ssoOidcClient;
 };
-// ../../node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/getNewSsoOidcToken.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/getNewSsoOidcToken.js
 var getNewSsoOidcToken = async (ssoToken, ssoRegion, init = {}, callerClientConfig) => {
   const { CreateTokenCommand } = await Promise.resolve().then(() => __toESM(require_sso_oidc(), 1));
   const ssoOidcClient = await getSsoOidcClient(ssoRegion, init, callerClientConfig);
@@ -19874,7 +19872,7 @@ var getNewSsoOidcToken = async (ssoToken, ssoRegion, init = {}, callerClientConf
 };
 var init_getNewSsoOidcToken = () => {};
-// ../../node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/validateTokenExpiry.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/validateTokenExpiry.js
 var import_config11, validateTokenExpiry = (token) => {
   if (token.expiration && token.expiration.getTime() < Date.now()) {
     throw new import_config11.TokenProviderError(`Token is expired. ${REFRESH_MESSAGE}`, false);
@@ -19885,7 +19883,7 @@ var init_validateTokenExpiry = __esm(() => {
   import_config11 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/validateTokenKey.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/validateTokenKey.js
 var import_config12, validateTokenKey = (key, value, forRefresh = false) => {
   if (typeof value === "undefined") {
     throw new import_config12.TokenProviderError(`Value not present for '${key}' in SSO Token${forRefresh ? ". Cannot refresh" : ""}. ${REFRESH_MESSAGE}`, false);
@@ -19896,7 +19894,7 @@ var init_validateTokenKey = __esm(() => {
   import_config12 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/writeSSOTokenToFile.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/writeSSOTokenToFile.js
 import { promises as fsPromises } from "fs";
 var import_config13, writeFile, writeSSOTokenToFile = (id, ssoToken) => {
   const tokenFilepath = import_config13.getSSOTokenFilepath(id);
@@ -19908,7 +19906,7 @@ var init_writeSSOTokenToFile = __esm(() => {
   ({ writeFile } = fsPromises);
 });
-// ../../node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/fromSso.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/fromSso.js
 var import_config14, lastRefreshAttemptTimes, fromSso = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/token-providers - fromSso");
   const profiles = await import_config14.parseKnownFiles(init);
@@ -19991,12 +19989,12 @@ var init_fromSso = __esm(() => {
   lastRefreshAttemptTimes = new Map;
 });
-// ../../node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/index.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/index.js
 var init_dist_es4 = __esm(() => {
   init_fromSso();
 });
-// ../../node_modules/.bun/@aws-sdk+nested-clients@3.997.44/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sso/index.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+nested-clients@3.997.44/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sso/index.js
 function createAwsAuthSigv4HttpAuthOption2(authParameters) {
   return {
     schemeId: "aws.auth#sigv4",
@@ -20444,17 +20442,17 @@ var init_sso = __esm(() => {
   $SSOClient = SSOClient;
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/loadSso.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/loadSso.js
 var exports_loadSso = {};
 __export(exports_loadSso, {
-  GetRoleCredentialsCommand: () => $GetRoleCredentialsCommand,
-  SSOClient: () => $SSOClient
+  SSOClient: () => $SSOClient,
+  GetRoleCredentialsCommand: () => $GetRoleCredentialsCommand
 });
 var init_loadSso = __esm(() => {
   init_sso();
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/resolveSSOCredentials.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/resolveSSOCredentials.js
 var import_client10, import_config15, SHOULD_FAIL_CREDENTIAL_CHAIN = false, resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger }) => {
   let token;
   const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
@@ -20543,7 +20541,7 @@ var init_resolveSSOCredentials = __esm(() => {
   import_config15 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/validateSsoProfile.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/validateSsoProfile.js
 var import_config16, validateSsoProfile = (profile, logger) => {
   const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;
   if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {
@@ -20556,7 +20554,7 @@ var init_validateSsoProfile = __esm(() => {
   import_config16 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/fromSSO.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/fromSSO.js
 var import_config17, fromSSO = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");
   const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
@@ -20638,19 +20636,19 @@ var init_fromSSO = __esm(() => {
   import_config17 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/index.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/index.js
 var exports_dist_es4 = {};
 __export(exports_dist_es4, {
-  fromSSO: () => fromSSO,
+  validateSsoProfile: () => validateSsoProfile,
   isSsoProfile: () => isSsoProfile,
-  validateSsoProfile: () => validateSsoProfile
+  fromSSO: () => fromSSO
 });
 var init_dist_es5 = __esm(() => {
   init_fromSSO();
   init_validateSsoProfile();
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveCredentialSource.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveCredentialSource.js
 var import_client11, import_config18, resolveCredentialSource = (credentialSource, profileName, logger) => {
   const sourceProvidersMap = {
     EcsContainer: async (options) => {
@@ -20681,8 +20679,8 @@ var init_resolveCredentialSource = __esm(() => {
   import_config18 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+nested-clients@3.997.44/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sts/index.js
-var require_sts = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+nested-clients@3.997.44/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sts/index.js
+var require_sts = __commonJS((exports) => {
   var { awsEndpointFunctions: awsEndpointFunctions3, emitWarningIfUnsupportedVersion: emitWarningIfUnsupportedVersion$12, createDefaultUserAgentProvider: createDefaultUserAgentProvider2, NODE_APP_ID_CONFIG_OPTIONS: NODE_APP_ID_CONFIG_OPTIONS2, getAwsRegionExtensionConfiguration: getAwsRegionExtensionConfiguration2, resolveAwsRegionExtensionConfiguration: resolveAwsRegionExtensionConfiguration2, resolveUserAgentConfig: resolveUserAgentConfig2, resolveHostHeaderConfig: resolveHostHeaderConfig2, getUserAgentPlugin: getUserAgentPlugin2, getHostHeaderPlugin: getHostHeaderPlugin2, getLoggerPlugin: getLoggerPlugin2, getRecursionDetectionPlugin: getRecursionDetectionPlugin2, setCredentialFeature: setCredentialFeature5, stsRegionDefaultResolver } = require_client2();
   var { NoAuthSigner: NoAuthSigner2, getHttpAuthSchemeEndpointRuleSetPlugin: getHttpAuthSchemeEndpointRuleSetPlugin2, DefaultIdentityProviderConfig: DefaultIdentityProviderConfig2, getHttpSigningPlugin: getHttpSigningPlugin2 } = require_dist_cjs2();
   var { normalizeProvider: normalizeProvider4, getSmithyContext: getSmithyContext4, ServiceException: ServiceException2, NoOpLogger: NoOpLogger3, emitWarningIfUnsupportedVersion: emitWarningIfUnsupportedVersion2, loadConfigsForDefaultMode: loadConfigsForDefaultMode2, getDefaultExtensionConfiguration: getDefaultExtensionConfiguration2, resolveDefaultRuntimeConfig: resolveDefaultRuntimeConfig2, Client: Client2, makeBuilder: makeBuilder3, createAggregatedClient: createAggregatedClient2 } = require_client();
@@ -21703,7 +21701,7 @@ var require_sts = __commonJS(function(exports) {
   exports.getDefaultRoleAssumerWithWebIdentity = getDefaultRoleAssumerWithWebIdentity;
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveAssumeRoleCredentials.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveAssumeRoleCredentials.js
 var import_client12, import_config19, isAssumeRoleProfile = (arg, { profile = "default", logger } = {}) => {
   return Boolean(arg) && typeof arg === "object" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1 && ["undefined", "string"].indexOf(typeof arg.external_id) > -1 && ["undefined", "string"].indexOf(typeof arg.mfa_serial) > -1 && (isAssumeRoleWithSourceProfile(arg, { profile, logger }) || isCredentialSourceProfile(arg, { profile, logger }));
 }, isAssumeRoleWithSourceProfile = (arg, { profile, logger }) => {
@@ -21771,8 +21769,8 @@ var init_resolveAssumeRoleCredentials = __esm(() => {
   import_config19 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+nested-clients@3.997.44/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/signin/index.js
-var require_signin = __commonJS(function(exports) {
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+nested-clients@3.997.44/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/signin/index.js
+var require_signin = __commonJS((exports) => {
   var { awsEndpointFunctions: awsEndpointFunctions3, emitWarningIfUnsupportedVersion: emitWarningIfUnsupportedVersion$12, createDefaultUserAgentProvider: createDefaultUserAgentProvider2, NODE_APP_ID_CONFIG_OPTIONS: NODE_APP_ID_CONFIG_OPTIONS2, getAwsRegionExtensionConfiguration: getAwsRegionExtensionConfiguration2, resolveAwsRegionExtensionConfiguration: resolveAwsRegionExtensionConfiguration2, resolveUserAgentConfig: resolveUserAgentConfig2, resolveHostHeaderConfig: resolveHostHeaderConfig2, getUserAgentPlugin: getUserAgentPlugin2, getHostHeaderPlugin: getHostHeaderPlugin2, getLoggerPlugin: getLoggerPlugin2, getRecursionDetectionPlugin: getRecursionDetectionPlugin2 } = require_client2();
   var { NoAuthSigner: NoAuthSigner2, getHttpAuthSchemeEndpointRuleSetPlugin: getHttpAuthSchemeEndpointRuleSetPlugin2, DefaultIdentityProviderConfig: DefaultIdentityProviderConfig2, getHttpSigningPlugin: getHttpSigningPlugin2 } = require_dist_cjs2();
   var { normalizeProvider: normalizeProvider4, getSmithyContext: getSmithyContext4, ServiceException: ServiceException2, NoOpLogger: NoOpLogger3, emitWarningIfUnsupportedVersion: emitWarningIfUnsupportedVersion2, loadConfigsForDefaultMode: loadConfigsForDefaultMode2, getDefaultExtensionConfiguration: getDefaultExtensionConfiguration2, resolveDefaultRuntimeConfig: resolveDefaultRuntimeConfig2, Client: Client2, makeBuilder: makeBuilder3, createAggregatedClient: createAggregatedClient2 } = require_client();
@@ -22503,7 +22501,7 @@ var require_signin = __commonJS(function(exports) {
   exports.errorTypeRegistries = errorTypeRegistries3;
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-login@3.972.77/node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-login@3.972.77/node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.js
 import { createHash as createHash2, createPrivateKey, createPublicKey, sign } from "crypto";
 import { promises as fs2 } from "fs";
 import { homedir } from "os";
@@ -22767,7 +22765,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
   };
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-login@3.972.77/node_modules/@aws-sdk/credential-provider-login/dist-es/fromLoginCredentials.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-login@3.972.77/node_modules/@aws-sdk/credential-provider-login/dist-es/fromLoginCredentials.js
 var import_client13, import_config21, fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
   init?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");
   const profiles = await import_config21.parseKnownFiles(init || {});
@@ -22791,7 +22789,7 @@ var init_fromLoginCredentials = __esm(() => {
   import_config21 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-login@3.972.77/node_modules/@aws-sdk/credential-provider-login/dist-es/index.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-login@3.972.77/node_modules/@aws-sdk/credential-provider-login/dist-es/index.js
 var exports_dist_es5 = {};
 __export(exports_dist_es5, {
   fromLoginCredentials: () => fromLoginCredentials
@@ -22800,7 +22798,7 @@ var init_dist_es6 = __esm(() => {
   init_fromLoginCredentials();
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveLoginCredentials.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveLoginCredentials.js
 var import_client14, isLoginProfile = (data) => {
   return Boolean(data && data.login_session);
 }, resolveLoginCredentials = async (profileName, options, callerClientConfig) => {
@@ -22815,7 +22813,7 @@ var init_resolveLoginCredentials = __esm(() => {
   import_client14 = __toESM(require_client2(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-process@3.972.70/node_modules/@aws-sdk/credential-provider-process/dist-es/getValidatedProcessCredentials.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-process@3.972.70/node_modules/@aws-sdk/credential-provider-process/dist-es/getValidatedProcessCredentials.js
 var import_client15, getValidatedProcessCredentials = (profileName, data, profiles) => {
   if (data.Version !== 1) {
     throw Error(`Profile ${profileName} credential_process did not return Version 1.`);
@@ -22849,7 +22847,7 @@ var init_getValidatedProcessCredentials = __esm(() => {
   import_client15 = __toESM(require_client2(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-process@3.972.70/node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-process@3.972.70/node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js
 import { exec } from "child_process";
 import { promisify } from "util";
 var import_config22, resolveProcessCredentials = async (profileName, profiles, logger) => {
@@ -22884,7 +22882,7 @@ var init_resolveProcessCredentials = __esm(() => {
   import_config22 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-process@3.972.70/node_modules/@aws-sdk/credential-provider-process/dist-es/fromProcess.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-process@3.972.70/node_modules/@aws-sdk/credential-provider-process/dist-es/fromProcess.js
 var import_config23, fromProcess = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");
   const profiles = await import_config23.parseKnownFiles(init);
@@ -22897,7 +22895,7 @@ var init_fromProcess = __esm(() => {
   import_config23 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-process@3.972.70/node_modules/@aws-sdk/credential-provider-process/dist-es/index.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-process@3.972.70/node_modules/@aws-sdk/credential-provider-process/dist-es/index.js
 var exports_dist_es6 = {};
 __export(exports_dist_es6, {
   fromProcess: () => fromProcess
@@ -22906,7 +22904,7 @@ var init_dist_es7 = __esm(() => {
   init_fromProcess();
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProcessCredentials.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProcessCredentials.js
 var import_client16, isProcessProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.credential_process === "string", resolveProcessCredentials2 = async (options, profile) => {
   const { fromProcess: fromProcess2 } = await Promise.resolve().then(() => (init_dist_es7(), exports_dist_es6));
   const credentials = await fromProcess2({
@@ -22919,7 +22917,7 @@ var init_resolveProcessCredentials2 = __esm(() => {
   import_client16 = __toESM(require_client2(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveSsoCredentials.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveSsoCredentials.js
 var import_client17, resolveSsoCredentials = async (profile, profileData, options = {}, callerClientConfig) => {
   const { fromSSO: fromSSO2 } = await Promise.resolve().then(() => (init_dist_es5(), exports_dist_es4));
   return fromSSO2({
@@ -22941,7 +22939,7 @@ var init_resolveSsoCredentials = __esm(() => {
   import_client17 = __toESM(require_client2(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveStaticCredentials.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveStaticCredentials.js
 var import_client18, isStaticCredsProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.aws_access_key_id === "string" && typeof arg.aws_secret_access_key === "string" && ["undefined", "string"].indexOf(typeof arg.aws_session_token) > -1 && ["undefined", "string"].indexOf(typeof arg.aws_account_id) > -1, resolveStaticCredentials = async (profile, options) => {
   options?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");
   const credentials = {
@@ -22957,7 +22955,7 @@ var init_resolveStaticCredentials = __esm(() => {
   import_client18 = __toESM(require_client2(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-web-identity@3.972.76/node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromWebToken.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-web-identity@3.972.76/node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromWebToken.js
 var fromWebToken = (init) => async (awsIdentityProperties) => {
   init.logger?.debug("@aws-sdk/credential-provider-web-identity - fromWebToken");
   const { roleArn, roleSessionName, webIdentityToken, providerId, policyArns, policy, durationSeconds } = init;
@@ -22984,7 +22982,7 @@ var fromWebToken = (init) => async (awsIdentityProperties) => {
   });
 };
-// ../../node_modules/.bun/@aws-sdk+credential-provider-web-identity@3.972.76/node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromTokenFile.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-web-identity@3.972.76/node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromTokenFile.js
 import { readFileSync as readFileSync3 } from "fs";
 var import_client19, import_config24, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE", ENV_ROLE_ARN = "AWS_ROLE_ARN", ENV_ROLE_SESSION_NAME = "AWS_ROLE_SESSION_NAME", fromTokenFile = (init = {}) => async (awsIdentityProperties) => {
   init.logger?.debug("@aws-sdk/credential-provider-web-identity - fromTokenFile");
@@ -23012,17 +23010,17 @@ var init_fromTokenFile = __esm(() => {
   import_config24 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-web-identity@3.972.76/node_modules/@aws-sdk/credential-provider-web-identity/dist-es/index.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-web-identity@3.972.76/node_modules/@aws-sdk/credential-provider-web-identity/dist-es/index.js
 var exports_dist_es7 = {};
 __export(exports_dist_es7, {
-  fromTokenFile: () => fromTokenFile,
-  fromWebToken: () => fromWebToken
+  fromWebToken: () => fromWebToken,
+  fromTokenFile: () => fromTokenFile
 });
 var init_dist_es8 = __esm(() => {
   init_fromTokenFile();
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveWebIdentityCredentials.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveWebIdentityCredentials.js
 var import_client20, isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.web_identity_token_file === "string" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1, resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => {
   const { fromTokenFile: fromTokenFile2 } = await Promise.resolve().then(() => (init_dist_es8(), exports_dist_es7));
   const credentials = await fromTokenFile2({
@@ -23041,7 +23039,7 @@ var init_resolveWebIdentityCredentials = __esm(() => {
   import_client20 = __toESM(require_client2(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProfileData.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProfileData.js
 var import_config25, resolveProfileData = async (profileName, profiles, options, callerClientConfig, visitedProfiles = {}, isAssumeRoleRecursiveCall = false) => {
   const data = profiles[profileName];
   if (Object.keys(visitedProfiles).length > 0 && isStaticCredsProfile(data)) {
@@ -23077,7 +23075,7 @@ var init_resolveProfileData = __esm(() => {
   import_config25 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/fromIni.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/fromIni.js
 var import_config26, fromIni = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/credential-provider-ini - fromIni");
   const profiles = await import_config26.parseKnownFiles(init);
@@ -23090,7 +23088,7 @@ var init_fromIni = __esm(() => {
   import_config26 = __toESM(require_config(), 1);
 });
-// ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/index.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/index.js
 var exports_dist_es8 = {};
 __export(exports_dist_es8, {
   fromIni: () => fromIni
@@ -23099,7 +23097,7 @@ var init_dist_es9 = __esm(() => {
   init_fromIni();
 });
-// ../events/dist/index.js
+// ../../../skills-release-055-20260909/apps/events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile as writeFile2 } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
 import { existsSync as existsSync22 } from "fs";
@@ -24427,7 +24425,7 @@ var init_event_sink = __esm(() => {
   init_dist();
 });
-// ../contracts/dist/client/transport.js
+// ../../../skills-release-055-20260909/apps/contracts/dist/client/transport.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
 import { closeSync, fstatSync, openSync, readFileSync } from "fs";
@@ -25256,7 +25254,9 @@ function normalizeSkillsApiOrigin(apiUrl) {
     throw new SkillsFleetCredentialError("A Skills API URL must use HTTPS (or loopback HTTP), without credentials, query or fragment", "INVALID_API_URL");
   }
   const pathname = url.pathname.replace(/\/+$/, "");
-  if (pathname === "/api" || pathname === "/api/v1") {
+  if (url.origin === "https://api.hasna.com" && pathname === "/skills/v1") {
+    url.pathname = "/skills";
+  } else if (pathname === "/api" || pathname === "/api/v1") {
     url.pathname = "/";
   } else if (pathname.endsWith("/api/v1")) {
     url.pathname = pathname.slice(0, -"/api/v1".length) || "/";
@@ -25265,6 +25265,21 @@ function normalizeSkillsApiOrigin(apiUrl) {
   }
   return url.toString().replace(/\/+$/, "");
 }
+function skillsApiRequestUrl(apiUrl, route) {
+  const origin = normalizeSkillsApiOrigin(apiUrl);
+  if (!route.startsWith("/api/") || route.includes("#") || route.includes("\\")) {
+    throw new SkillsFleetCredentialError("Invalid Skills API route", "INVALID_API_URL");
+  }
+  if (origin === "https://api.hasna.com/skills") {
+    if (route === "/api/auth/whoami")
+      return `${origin}/v1/auth/whoami`;
+    if (!route.startsWith("/api/v1/")) {
+      throw new SkillsFleetCredentialError("The internal Skills gateway has no established login contract yet. Select an explicitly configured instance with supported authentication.", "GATEWAY_AUTH_UNAVAILABLE");
+    }
+    return `${origin}${route.slice("/api".length)}`;
+  }
+  return `${origin}${route}`;
+}
 function configuredSkillsApiUrl(env = process.env, keychain, profile) {
   const declared = SKILLS_API_URL_ENV_KEYS.filter((key) => env[key] !== undefined).map((key) => ({ key, value: env[key] }));
   for (const entry of declared) {
@@ -25481,7 +25496,7 @@ class MissingSkillsFleetError extends Error {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.5.4",
+  version: "0.5.6",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -26254,7 +26269,7 @@ function verifyBundleSignature(bytes, signature, key) {
   return expected.length === actual.length && timingSafeEqual(expected, actual);
 }
-// ../../node_modules/.bun/@aws-sdk+checksums@3.1000.29/node_modules/@aws-sdk/checksums/dist-cjs/submodules/flexible-checksums/index.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+checksums@3.1000.29/node_modules/@aws-sdk/checksums/dist-cjs/submodules/flexible-checksums/index.js
 var { setFeature } = require_client2();
 var { HttpRequest } = require_protocols();
 var { isArrayBuffer, toUint8Array, createBufferedReadable, createChecksumStream } = require_serde();
@@ -26647,10 +26662,10 @@ var $NODE_RESPONSE_CHECKSUM_VALIDATION_CONFIG_OPTIONS = NODE_RESPONSE_CHECKSUM_V
 var $getFlexibleChecksumsPlugin = getFlexibleChecksumsPlugin;
 var $resolveFlexibleChecksumsConfig = resolveFlexibleChecksumsConfig;
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
 var import_client26 = __toESM(require_client2(), 1);
-// ../../node_modules/.bun/@aws-sdk+middleware-sdk-s3@3.972.75/node_modules/@aws-sdk/middleware-sdk-s3/dist-cjs/submodules/s3/index.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+middleware-sdk-s3@3.972.75/node_modules/@aws-sdk/middleware-sdk-s3/dist-cjs/submodules/s3/index.js
 var { NoOpLogger, getSmithyContext } = require_client();
 var { HttpRequest: HttpRequest2, HttpResponse } = require_protocols();
 var { parseRfc7231DateTime } = require_serde();
@@ -27255,7 +27270,7 @@ var $getThrow200ExceptionsPlugin = getThrow200ExceptionsPlugin;
 var $getValidateBucketNamePlugin = getValidateBucketNamePlugin;
 var $resolveS3Config = resolveS3Config;
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
 var import_core = __toESM(require_dist_cjs2(), 1);
 var import_client27 = __toESM(require_client(), 1);
 var import_config29 = __toESM(require_config(), 1);
@@ -27265,17 +27280,17 @@ var import_protocols6 = __toESM(require_protocols(), 1);
 var import_retry4 = __toESM(require_retry(), 1);
 var import_schema2 = __toESM(require_schema(), 1);
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
 var import_httpAuthSchemes = __toESM(require_httpAuthSchemes(), 1);
 var import_signature_v4_multi_region = __toESM(require_dist_cjs4(), 1);
 var import_client5 = __toESM(require_client(), 1);
 var import_endpoints3 = __toESM(require_endpoints(), 1);
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/endpointResolver.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/endpointResolver.js
 var import_client4 = __toESM(require_client2(), 1);
 var import_endpoints2 = __toESM(require_endpoints(), 1);
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/bdd.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/bdd.js
 var import_endpoints = __toESM(require_endpoints(), 1);
 var aw = "ref";
 var ax = "argv";
@@ -29219,7 +29234,7 @@ var nodes = new Int32Array([
 ]);
 var bdd = import_endpoints.BinaryDecisionDiagram.from(nodes, root, _data.conditions, _data.results);
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/endpointResolver.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/endpointResolver.js
 var cache = new import_endpoints2.EndpointCache({
   size: 50,
   params: [
@@ -29247,7 +29262,7 @@ var defaultEndpointResolver = (endpointParams, context = {}) => {
 };
 import_endpoints2.customEndpointFunctions.aws = import_client4.awsEndpointFunctions;
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
 var createEndpointRuleSetHttpAuthSchemeParametersProvider = (defaultHttpAuthSchemeParametersProvider) => async (config, context, input) => {
   if (!input) {
     throw new Error("Could not find `input` for `defaultEndpointRuleSetHttpAuthSchemeParametersProvider`");
@@ -29363,11 +29378,11 @@ var resolveHttpAuthSchemeConfig = (config) => {
   });
 };
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
 var import_client6 = __toESM(require_client(), 1);
 var import_endpoints4 = __toESM(require_endpoints(), 1);
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/EndpointParameters.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/EndpointParameters.js
 var resolveClientEndpointParameters = (options) => {
   return Object.assign(options, {
     useFipsEndpoint: options.useFipsEndpoint ?? false,
@@ -29393,7 +29408,7 @@ var commonParams = {
   UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
 };
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
 var command = import_client6.makeBuilder(commonParams, "AmazonS3", "S3Client", import_endpoints4.getEndpointPlugin);
 var _ep0 = {
   Bucket: { type: "contextParams", name: "Bucket" },
@@ -29425,10 +29440,10 @@ var _mw11 = (Command, cs, config, o2) => [
   $getSsecPlugin(config)
 ];
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/schemas/schemas_0.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/schemas/schemas_0.js
 var import_schema = __toESM(require_schema(), 1);
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/models/S3ServiceException.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/models/S3ServiceException.js
 var import_client7 = __toESM(require_client(), 1);
 class S3ServiceException extends import_client7.ServiceException {
   constructor(options) {
@@ -29437,7 +29452,7 @@ class S3ServiceException extends import_client7.ServiceException {
   }
 }
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/models/errors.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/models/errors.js
 class NoSuchUpload extends S3ServiceException {
   name = "NoSuchUpload";
   $fault = "client";
@@ -29715,7 +29730,7 @@ class ObjectAlreadyInActiveTierError extends S3ServiceException {
   }
 }
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/schemas/schemas_0.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/schemas/schemas_0.js
 var _A = "Account";
 var _AAO = "AnalyticsAndOperator";
 var _AC = "AccelerateConfiguration";
@@ -35167,10 +35182,10 @@ var WriteGetObjectResponse$ = [
   () => __Unit
 ];
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/CreateSessionCommand.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/CreateSessionCommand.js
 class CreateSessionCommand extends command(_ep4, _mw0, "CreateSession", CreateSession$) {
 }
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/package.json
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/package.json
 var package_default2 = {
   name: "@aws-sdk/client-s3",
   version: "3.1127.0",
@@ -35255,15 +35270,15 @@ var package_default2 = {
   }
 };
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var import_client22 = __toESM(require_client2(), 1);
 var import_httpAuthSchemes3 = __toESM(require_httpAuthSchemes(), 1);
-// ../../node_modules/.bun/@aws-sdk+credential-provider-node@3.972.82/node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-node@3.972.82/node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.js
 init_dist_es();
 var import_config27 = __toESM(require_config(), 1);
-// ../../node_modules/.bun/@aws-sdk+credential-provider-node@3.972.82/node_modules/@aws-sdk/credential-provider-node/dist-es/remoteProvider.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-node@3.972.82/node_modules/@aws-sdk/credential-provider-node/dist-es/remoteProvider.js
 var import_config10 = __toESM(require_config(), 1);
 var ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
 var remoteProvider = async (init) => {
@@ -35282,7 +35297,7 @@ var remoteProvider = async (init) => {
   return fromInstanceMetadata2(init);
 };
-// ../../node_modules/.bun/@aws-sdk+credential-provider-node@3.972.82/node_modules/@aws-sdk/credential-provider-node/dist-es/runtime/memoize-chain.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-node@3.972.82/node_modules/@aws-sdk/credential-provider-node/dist-es/runtime/memoize-chain.js
 function memoizeChain(providers, treatAsExpired) {
   const chain2 = internalCreateChain(providers);
   let activeLock;
@@ -35346,7 +35361,7 @@ var internalCreateChain = (providers) => async (awsIdentityProperties) => {
   throw lastProviderError;
 };
-// ../../node_modules/.bun/@aws-sdk+credential-provider-node@3.972.82/node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+credential-provider-node@3.972.82/node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.js
 var multipleCredentialSourceWarningEmitted = false;
 var defaultProvider = (init = {}) => memoizeChain([
   async () => {
@@ -35412,7 +35427,7 @@ var defaultProvider = (init = {}) => memoizeChain([
   }
 ], credentialsTreatedAsExpired);
 var credentialsTreatedAsExpired = (credentials) => credentials?.expiration !== undefined && credentials.expiration.getTime() - Date.now() < 300000;
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var import_checksum2 = __toESM(require_checksum(), 1);
 var import_client23 = __toESM(require_client(), 1);
 var import_config28 = __toESM(require_config(), 1);
@@ -35421,7 +35436,7 @@ var import_retry3 = __toESM(require_retry(), 1);
 var import_serde4 = __toESM(require_serde(), 1);
 var import_node_http_handler2 = __toESM(require_dist_cjs6(), 1);
-// ../../node_modules/.bun/@aws-sdk+checksums@3.1000.29/node_modules/@aws-sdk/checksums/dist-cjs/submodules/sha/index.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+checksums@3.1000.29/node_modules/@aws-sdk/checksums/dist-cjs/submodules/sha/index.js
 var { toUint8Array: toUint8Array2, concatBytes } = require_serde();
 var { createHmac: createHmac2, createHash: createHash3 } = __require("crypto");
 var { Sha256: Sha2562, Sha256Js, Sha256Node } = require_checksum();
@@ -35650,7 +35665,7 @@ var subtle = typeof digest === "function" && typeof sign2 === "function" && type
 var MAX_PENDING_BYTES = 8 * 1024 * 1024;
 var $Sha1 = Sha1Node;
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.shared.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.shared.js
 var import_httpAuthSchemes2 = __toESM(require_httpAuthSchemes(), 1);
 var import_signature_v4_multi_region2 = __toESM(require_dist_cjs4(), 1);
 var import_checksum = __toESM(require_checksum(), 1);
@@ -35702,7 +35717,7 @@ var getRuntimeConfig2 = (config) => {
   };
 };
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var getRuntimeConfig3 = (config) => {
   import_client23.emitWarningIfUnsupportedVersion(process.version);
   const defaultsMode = import_config28.resolveDefaultsModeConfig(config);
@@ -35743,12 +35758,12 @@ var getRuntimeConfig3 = (config) => {
   };
 };
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
 var import_client24 = __toESM(require_client2(), 1);
 var import_client25 = __toESM(require_client(), 1);
 var import_protocols5 = __toESM(require_protocols(), 1);
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthExtensionConfiguration.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthExtensionConfiguration.js
 var getHttpAuthExtensionConfiguration2 = (runtimeConfig) => {
   const _httpAuthSchemes = runtimeConfig.httpAuthSchemes;
   let _httpAuthSchemeProvider = runtimeConfig.httpAuthSchemeProvider;
@@ -35787,14 +35802,14 @@ var resolveHttpAuthRuntimeConfig2 = (config) => {
   };
 };
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
 var resolveRuntimeExtensions2 = (runtimeConfig, extensions) => {
   const extensionConfiguration = Object.assign(import_client24.getAwsRegionExtensionConfiguration(runtimeConfig), import_client25.getDefaultExtensionConfiguration(runtimeConfig), import_protocols5.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration2(runtimeConfig));
   extensions.forEach((extension) => extension.configure(extensionConfiguration));
   return Object.assign(runtimeConfig, import_client24.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client25.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols5.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig2(extensionConfiguration));
 };
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
 class S3Client extends import_client27.Client {
   config;
   constructor(...[configuration]) {
@@ -35839,15 +35854,15 @@ class S3Client extends import_client27.Client {
   }
 }
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/DeleteObjectCommand.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/DeleteObjectCommand.js
 class DeleteObjectCommand extends command(_ep0, _mw0, "DeleteObject", DeleteObject$) {
 }
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/GetObjectCommand.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/GetObjectCommand.js
 class GetObjectCommand extends command(_ep0, _mw7, "GetObject", GetObject$) {
 }
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/PutObjectCommand.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/PutObjectCommand.js
 class PutObjectCommand extends command(_ep0, _mw11, "PutObject", PutObject$) {
 }
@@ -37116,10 +37131,16 @@ class SqliteSkillsStore {
     const orgId = input.principal.orgId;
     const now = nowIso();
     return this.db.transaction(() => {
-      const previous = this.get("SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+      const previous = this.get("SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at, source FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
       const previousSha = typeof previous?.bundle_sha256 === "string" ? previous.bundle_sha256 : null;
       const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? previous.revision_id : null;
       const tombstoned = previous?.tombstoned_at != null;
+      if (input.seedBundledOnly && input.expectedRevisionId && !previous) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, null);
+      }
+      if (input.seedBundledOnly && previous && (tombstoned || previous.source !== "bundled")) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
       const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? previous.skill_md : null;
       if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
         throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
@@ -37193,8 +37214,9 @@ class SqliteSkillsStore {
            tombstoned_at = NULL,
            tombstone_purge_after = NULL,
            updated_at = excluded.updated_at
-         WHERE skills_registry.tombstoned_at IS NOT NULL
-            OR skills_registry.revision_id = ?
+         WHERE (skills_registry.tombstoned_at IS NOT NULL OR skills_registry.revision_id = ?)
+           AND (? = 0 OR (skills_registry.tombstoned_at IS NULL AND skills_registry.source = 'bundled'
+             AND skills_registry.revision_id = ?))
          RETURNING *`, [
         orgId,
         input.slug,
@@ -37212,6 +37234,8 @@ class SqliteSkillsStore {
         revisionId,
         now,
         now,
+        input.expectedRevisionId ?? NO_REVISION_SENTINEL,
+        input.seedBundledOnly ? 1 : 0,
         input.expectedRevisionId ?? NO_REVISION_SENTINEL
       ]);
       if (!row) {
@@ -42257,6 +42281,12 @@ async function storePublishedSkill(store, artifactStorage, principal, parsed, ex
     principal,
     ...expectedRevisionId ? { expectedRevisionId } : {}
   };
+  if (input.seedBundledOnly && expectedRevisionId && !current) {
+    throw new SkillRevisionConflictError(input.slug, expectedRevisionId, null);
+  }
+  if (input.seedBundledOnly && current && (current.tombstonedAt || current.source !== "bundled")) {
+    throw new SkillRevisionConflictError(input.slug, expectedRevisionId, current.revisionId);
+  }
   if (current && !current.tombstonedAt && expectedRevisionId !== current.revisionId) {
     throw new SkillRevisionConflictError(input.slug, expectedRevisionId, current.revisionId);
   }
@@ -42506,6 +42536,15 @@ async function seedBundledCorpus(options) {
         result.skipped.push(slug);
         continue;
       }
+      const current = await options.store.getSkill(options.principal, slug);
+      if (current) {
+        const previousVersion = current.version ? await options.store.getSkillVersion(options.principal, slug, current.version) : null;
+        const provenance = previousVersion?.manifest.provenance;
+        if (current.tombstonedAt || current.source !== "bundled" || provenance?.seededFrom !== "bundled-corpus" || provenance.seededRevisionId !== current.revisionId) {
+          result.skipped.push(slug);
+          continue;
+        }
+      }
       const dir = getSkillPath(slug);
       if (!existsSync15(dir)) {
         result.skipped.push(slug);
@@ -42515,32 +42554,40 @@ async function seedBundledCorpus(options) {
       const packed = packSkillBundle(dir, { maxUnpackedBytes: 50000000 });
       const skillMdPath = join19(dir, "SKILL.md");
       const skillMd = existsSync15(skillMdPath) ? readFileSync16(skillMdPath, "utf-8") : undefined;
-      const current = await options.store.getSkill(options.principal, slug);
+      const content = {
+        slug,
+        displayName: manifest.displayName ?? skill.displayName ?? slug,
+        description: manifest.description ?? skill.description ?? slug,
+        category: manifest.category ?? skill.category ?? "Development Tools",
+        tags: manifest.tags ?? skill.tags ?? [],
+        source: "bundled",
+        kind: manifest.kind ?? "instruction",
+        version: version2,
+        ...skillMd ? { skillMd } : {},
+        bundleSha256: packed.sha256,
+        bundleByteSize: packed.bytes.byteLength
+      };
       const { record } = await storePublishedSkill(options.store, options.artifactStorage, options.principal, {
         input: {
-          slug,
-          displayName: manifest.displayName ?? skill.displayName ?? slug,
-          description: manifest.description ?? skill.description ?? slug,
-          category: manifest.category ?? skill.category ?? "Development Tools",
-          tags: manifest.tags ?? skill.tags ?? [],
-          source: "bundled",
-          kind: manifest.kind ?? "instruction",
-          version: version2,
-          ...skillMd ? { skillMd } : {},
+          ...content,
+          seedBundledOnly: true,
           bundle: { sha256: packed.sha256, byteSize: packed.bytes.byteLength, contentType: "application/gzip", storageKind: "db" },
           versionManifest: {
             files: packed.paths,
             fileCount: packed.fileCount,
             unpackedByteSize: packed.unpackedByteSize,
             bundleSha256: packed.sha256,
-            provenance: { seededFrom: "bundled-corpus", packageVersion: package_default.version }
+            provenance: { seededFrom: "bundled-corpus", packageVersion: package_default.version, seededRevisionId: revisionIdOfRecord(content) }
           }
         },
         bundleBytes: packed.bytes
       }, current?.revisionId);
       result.seeded.push(`${record.slug}@${version2}`);
     } catch (error) {
-      result.failed.push({ slug, error: error.message });
+      if (error instanceof SkillRevisionConflictError)
+        result.skipped.push(slug);
+      else
+        result.failed.push({ slug, error: error.message });
     }
   }
   log(`skills: bundled corpus seed v${version2}: ${result.seeded.length} seeded, ${result.skipped.length} skipped, ${result.failed.length} failed`);
@@ -42750,6 +42797,12 @@ class MemorySkillsStore {
     const key = skillKey(input.principal.orgId, input.slug);
     const now = nowIso();
     const previous = this.skills.get(key);
+    if (input.seedBundledOnly && input.expectedRevisionId && !previous) {
+      throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, null);
+    }
+    if (input.seedBundledOnly && previous && (previous.tombstonedAt || previous.source !== "bundled")) {
+      throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previous.revisionId);
+    }
     if (previous && !previous.tombstonedAt && input.expectedRevisionId !== previous.revisionId) {
       throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previous.revisionId);
     }
@@ -43203,13 +43256,19 @@ class PostgresSkillsStore {
     const orgId = input.principal.orgId;
     return await this.sql.begin(async (tx) => {
       const previousRows = await tx`
-        SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at
+        SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at, source
         FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1
       `;
       const previous = previousRows[0];
       const previousSha = typeof previous?.bundle_sha256 === "string" ? String(previous.bundle_sha256) : null;
       const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? String(previous.revision_id) : null;
       const tombstoned = previous?.tombstoned_at != null;
+      if (input.seedBundledOnly && input.expectedRevisionId && !previous) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, null);
+      }
+      if (input.seedBundledOnly && previous && (tombstoned || previous.source !== "bundled")) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
       const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? String(previous.skill_md) : null;
       if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
         throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
@@ -43250,6 +43309,12 @@ class PostgresSkillsStore {
             body_blob = EXCLUDED.body_blob
         `;
       }
+      if (input.seedBundledOnly) {
+        const seedRows = await tx`SELECT revision_id FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} FOR UPDATE`;
+        if (input.expectedRevisionId && !seedRows[0]) {
+          throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, null);
+        }
+      }
       const rows = await tx`
         INSERT INTO skills_registry (org_id, slug, display_name, description, category, tags_json, source, kind, version, skill_md,
                                      bundle_sha256, bundle_byte_size, published_by_user_id, revision_id, revision_number, updated_at)
@@ -43278,8 +43343,11 @@ class PostgresSkillsStore {
           tombstoned_at = NULL,
           tombstone_purge_after = NULL,
           updated_at = EXCLUDED.updated_at
-        WHERE skills_registry.tombstoned_at IS NOT NULL
-           OR skills_registry.revision_id = ${input.expectedRevisionId ?? NO_REVISION_SENTINEL2}
+        WHERE (skills_registry.tombstoned_at IS NOT NULL
+           OR skills_registry.revision_id = ${input.expectedRevisionId ?? NO_REVISION_SENTINEL2})
+          AND (NOT ${Boolean(input.seedBundledOnly)} OR
+            (skills_registry.tombstoned_at IS NULL AND skills_registry.source = 'bundled'
+             AND skills_registry.revision_id = ${input.expectedRevisionId ?? NO_REVISION_SENTINEL2}))
         RETURNING *
       `;
       if (!rows[0]) {
@@ -43694,6 +43762,15 @@ async function createSkillsFetchHandler(options = {}) {
   }
   return async function fetch2(request) {
     const url = new URL(request.url);
+    const versionedAliases = {
+      "/v1/health": "/health",
+      "/v1/auth/whoami": "/api/auth/whoami"
+    };
+    const alias = versionedAliases[url.pathname] ?? (url.pathname === "/v1" || url.pathname.startsWith("/v1/") ? `/api${url.pathname}` : undefined);
+    if (alias) {
+      url.pathname = alias;
+      request = new Request(url, request);
+    }
     const segments = pathSegments(url.pathname);
     try {
       if (request.method === "GET" && url.pathname === "/health") {
@@ -44055,119 +44132,119 @@ var bundledRegistry = {
 var currentVersionService = {
   resolveVersion: (record) => record.version
 };
-// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
+// ../../../skills-release-055-20260909/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
-  BRAND: () => BRAND,
-  DIRTY: () => DIRTY,
-  EMPTY_PATH: () => EMPTY_PATH,
-  INVALID: () => INVALID,
-  NEVER: () => NEVER,
-  OK: () => OK,
-  ParseStatus: () => ParseStatus,
-  Schema: () => ZodType,
-  ZodAny: () => ZodAny,
-  ZodArray: () => ZodArray,
-  ZodBigInt: () => ZodBigInt,
-  ZodBoolean: () => ZodBoolean,
-  ZodBranded: () => ZodBranded,
-  ZodCatch: () => ZodCatch,
-  ZodDate: () => ZodDate,
-  ZodDefault: () => ZodDefault,
-  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
-  ZodEffects: () => ZodEffects,
-  ZodEnum: () => ZodEnum,
-  ZodError: () => ZodError,
-  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
-  ZodFunction: () => ZodFunction,
-  ZodIntersection: () => ZodIntersection,
-  ZodIssueCode: () => ZodIssueCode,
-  ZodLazy: () => ZodLazy,
-  ZodLiteral: () => ZodLiteral,
-  ZodMap: () => ZodMap,
-  ZodNaN: () => ZodNaN,
-  ZodNativeEnum: () => ZodNativeEnum,
-  ZodNever: () => ZodNever,
-  ZodNull: () => ZodNull,
-  ZodNullable: () => ZodNullable,
-  ZodNumber: () => ZodNumber,
-  ZodObject: () => ZodObject,
-  ZodOptional: () => ZodOptional,
-  ZodParsedType: () => ZodParsedType,
-  ZodPipeline: () => ZodPipeline,
-  ZodPromise: () => ZodPromise,
-  ZodReadonly: () => ZodReadonly,
-  ZodRecord: () => ZodRecord,
-  ZodSchema: () => ZodType,
-  ZodSet: () => ZodSet,
-  ZodString: () => ZodString,
-  ZodSymbol: () => ZodSymbol,
-  ZodTransformer: () => ZodEffects,
-  ZodTuple: () => ZodTuple,
-  ZodType: () => ZodType,
-  ZodUndefined: () => ZodUndefined,
-  ZodUnion: () => ZodUnion,
-  ZodUnknown: () => ZodUnknown,
-  ZodVoid: () => ZodVoid,
-  addIssueToContext: () => addIssueToContext,
-  any: () => anyType,
-  array: () => arrayType,
-  bigint: () => bigIntType,
-  boolean: () => booleanType,
-  coerce: () => coerce,
-  custom: () => custom,
-  date: () => dateType,
-  datetimeRegex: () => datetimeRegex,
-  defaultErrorMap: () => en_default,
-  discriminatedUnion: () => discriminatedUnionType,
-  effect: () => effectsType,
-  enum: () => enumType,
-  function: () => functionType,
-  getErrorMap: () => getErrorMap,
-  getParsedType: () => getParsedType,
-  instanceof: () => instanceOfType,
-  intersection: () => intersectionType,
-  isAborted: () => isAborted,
-  isAsync: () => isAsync,
-  isDirty: () => isDirty,
-  isValid: () => isValid,
-  late: () => late,
-  lazy: () => lazyType,
-  literal: () => literalType,
-  makeIssue: () => makeIssue,
-  map: () => mapType,
-  nan: () => nanType,
-  nativeEnum: () => nativeEnumType,
-  never: () => neverType,
-  null: () => nullType,
-  nullable: () => nullableType,
-  number: () => numberType,
-  object: () => objectType,
-  objectUtil: () => objectUtil,
-  oboolean: () => oboolean,
-  onumber: () => onumber,
-  optional: () => optionalType,
-  ostring: () => ostring,
-  pipeline: () => pipelineType,
-  preprocess: () => preprocessType,
-  promise: () => promiseType,
-  quotelessJson: () => quotelessJson,
-  record: () => recordType,
-  set: () => setType,
-  setErrorMap: () => setErrorMap,
-  strictObject: () => strictObjectType,
-  string: () => stringType,
-  symbol: () => symbolType,
-  transformer: () => effectsType,
-  tuple: () => tupleType,
-  undefined: () => undefinedType,
-  union: () => unionType,
-  unknown: () => unknownType,
+  void: () => voidType,
   util: () => util,
-  void: () => voidType
+  unknown: () => unknownType,
+  union: () => unionType,
+  undefined: () => undefinedType,
+  tuple: () => tupleType,
+  transformer: () => effectsType,
+  symbol: () => symbolType,
+  string: () => stringType,
+  strictObject: () => strictObjectType,
+  setErrorMap: () => setErrorMap,
+  set: () => setType,
+  record: () => recordType,
+  quotelessJson: () => quotelessJson,
+  promise: () => promiseType,
+  preprocess: () => preprocessType,
+  pipeline: () => pipelineType,
+  ostring: () => ostring,
+  optional: () => optionalType,
+  onumber: () => onumber,
+  oboolean: () => oboolean,
+  objectUtil: () => objectUtil,
+  object: () => objectType,
+  number: () => numberType,
+  nullable: () => nullableType,
+  null: () => nullType,
+  never: () => neverType,
+  nativeEnum: () => nativeEnumType,
+  nan: () => nanType,
+  map: () => mapType,
+  makeIssue: () => makeIssue,
+  literal: () => literalType,
+  lazy: () => lazyType,
+  late: () => late,
+  isValid: () => isValid,
+  isDirty: () => isDirty,
+  isAsync: () => isAsync,
+  isAborted: () => isAborted,
+  intersection: () => intersectionType,
+  instanceof: () => instanceOfType,
+  getParsedType: () => getParsedType,
+  getErrorMap: () => getErrorMap,
+  function: () => functionType,
+  enum: () => enumType,
+  effect: () => effectsType,
+  discriminatedUnion: () => discriminatedUnionType,
+  defaultErrorMap: () => en_default,
+  datetimeRegex: () => datetimeRegex,
+  date: () => dateType,
+  custom: () => custom,
+  coerce: () => coerce,
+  boolean: () => booleanType,
+  bigint: () => bigIntType,
+  array: () => arrayType,
+  any: () => anyType,
+  addIssueToContext: () => addIssueToContext,
+  ZodVoid: () => ZodVoid,
+  ZodUnknown: () => ZodUnknown,
+  ZodUnion: () => ZodUnion,
+  ZodUndefined: () => ZodUndefined,
+  ZodType: () => ZodType,
+  ZodTuple: () => ZodTuple,
+  ZodTransformer: () => ZodEffects,
+  ZodSymbol: () => ZodSymbol,
+  ZodString: () => ZodString,
+  ZodSet: () => ZodSet,
+  ZodSchema: () => ZodType,
+  ZodRecord: () => ZodRecord,
+  ZodReadonly: () => ZodReadonly,
+  ZodPromise: () => ZodPromise,
+  ZodPipeline: () => ZodPipeline,
+  ZodParsedType: () => ZodParsedType,
+  ZodOptional: () => ZodOptional,
+  ZodObject: () => ZodObject,
+  ZodNumber: () => ZodNumber,
+  ZodNullable: () => ZodNullable,
+  ZodNull: () => ZodNull,
+  ZodNever: () => ZodNever,
+  ZodNativeEnum: () => ZodNativeEnum,
+  ZodNaN: () => ZodNaN,
+  ZodMap: () => ZodMap,
+  ZodLiteral: () => ZodLiteral,
+  ZodLazy: () => ZodLazy,
+  ZodIssueCode: () => ZodIssueCode,
+  ZodIntersection: () => ZodIntersection,
+  ZodFunction: () => ZodFunction,
+  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
+  ZodError: () => ZodError,
+  ZodEnum: () => ZodEnum,
+  ZodEffects: () => ZodEffects,
+  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
+  ZodDefault: () => ZodDefault,
+  ZodDate: () => ZodDate,
+  ZodCatch: () => ZodCatch,
+  ZodBranded: () => ZodBranded,
+  ZodBoolean: () => ZodBoolean,
+  ZodBigInt: () => ZodBigInt,
+  ZodArray: () => ZodArray,
+  ZodAny: () => ZodAny,
+  Schema: () => ZodType,
+  ParseStatus: () => ParseStatus,
+  OK: () => OK,
+  NEVER: () => NEVER,
+  INVALID: () => INVALID,
+  EMPTY_PATH: () => EMPTY_PATH,
+  DIRTY: () => DIRTY,
+  BRAND: () => BRAND
 });
-// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+// ../../../skills-release-055-20260909/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {};
@@ -44298,7 +44375,7 @@ var getParsedType = (data) => {
   }
 };
-// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
+// ../../../skills-release-055-20260909/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode = util.arrayToEnum([
   "invalid_type",
   "invalid_literal",
@@ -44417,7 +44494,7 @@ ZodError.create = (issues) => {
   return error;
 };
-// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
+// ../../../skills-release-055-20260909/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -44520,7 +44597,7 @@ var errorMap = (issue, _ctx) => {
 };
 var en_default = errorMap;
-// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
+// ../../../skills-release-055-20260909/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
 var overrideErrorMap = en_default;
 function setErrorMap(map) {
   overrideErrorMap = map;
@@ -44528,7 +44605,7 @@ function setErrorMap(map) {
 function getErrorMap() {
   return overrideErrorMap;
 }
-// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
+// ../../../skills-release-055-20260909/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
   const { data, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -44634,14 +44711,14 @@ var isAborted = (x2) => x2.status === "aborted";
 var isDirty = (x2) => x2.status === "dirty";
 var isValid = (x2) => x2.status === "valid";
 var isAsync = (x2) => typeof Promise !== "undefined" && x2 instanceof Promise;
-// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
+// ../../../skills-release-055-20260909/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
   errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
 })(errorUtil || (errorUtil = {}));
-// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
+// ../../../skills-release-055-20260909/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -48889,7 +48966,7 @@ function createReceiptService(store) {
 // src/sdk/execution/dispatchers/ecs.ts
 import { createHash as createHash11 } from "crypto";
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
 var import_client36 = __toESM(require_client2(), 1);
 var import_core2 = __toESM(require_dist_cjs2(), 1);
 var import_client37 = __toESM(require_client(), 1);
@@ -48899,7 +48976,7 @@ var import_protocols10 = __toESM(require_protocols(), 1);
 var import_retry6 = __toESM(require_retry(), 1);
 var import_schema4 = __toESM(require_schema(), 1);
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/auth/httpAuthSchemeProvider.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/auth/httpAuthSchemeProvider.js
 var import_httpAuthSchemes4 = __toESM(require_httpAuthSchemes(), 1);
 var import_client28 = __toESM(require_client(), 1);
 var defaultECSHttpAuthSchemeParametersProvider = async (config, context, input) => {
@@ -48941,7 +49018,7 @@ var resolveHttpAuthSchemeConfig3 = (config) => {
   });
 };
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/EndpointParameters.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/EndpointParameters.js
 var resolveClientEndpointParameters3 = (options) => {
   return Object.assign(options, {
     useDualstackEndpoint: options.useDualstackEndpoint ?? false,
@@ -48955,7 +49032,7 @@ var commonParams3 = {
   Region: { type: "builtInParams", name: "region" },
   UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
 };
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/package.json
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/package.json
 var package_default3 = {
   name: "@aws-sdk/client-ecs",
   version: "3.1127.0",
@@ -49028,7 +49105,7 @@ var package_default3 = {
   }
 };
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
 var import_client32 = __toESM(require_client2(), 1);
 var import_httpAuthSchemes6 = __toESM(require_httpAuthSchemes(), 1);
 var import_client33 = __toESM(require_client(), 1);
@@ -49037,7 +49114,7 @@ var import_retry5 = __toESM(require_retry(), 1);
 var import_serde6 = __toESM(require_serde(), 1);
 var import_node_http_handler3 = __toESM(require_dist_cjs6(), 1);
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.shared.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.shared.js
 var import_httpAuthSchemes5 = __toESM(require_httpAuthSchemes(), 1);
 var import_protocols7 = __toESM(require_protocols2(), 1);
 var import_checksum3 = __toESM(require_checksum(), 1);
@@ -49045,11 +49122,11 @@ var import_client31 = __toESM(require_client(), 1);
 var import_protocols8 = __toESM(require_protocols(), 1);
 var import_serde5 = __toESM(require_serde(), 1);
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/endpointResolver.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/endpointResolver.js
 var import_client29 = __toESM(require_client2(), 1);
 var import_endpoints7 = __toESM(require_endpoints(), 1);
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/bdd.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/bdd.js
 var import_endpoints6 = __toESM(require_endpoints(), 1);
 var k3 = "ref";
 var a3 = -1;
@@ -49132,7 +49209,7 @@ var nodes3 = new Int32Array([
 ]);
 var bdd3 = import_endpoints6.BinaryDecisionDiagram.from(nodes3, root3, _data3.conditions, _data3.results);
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/endpointResolver.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/endpointResolver.js
 var cache3 = new import_endpoints7.EndpointCache({
   size: 50,
   params: ["Endpoint", "Region", "UseDualStack", "UseFIPS"]
@@ -49145,10 +49222,10 @@ var defaultEndpointResolver3 = (endpointParams, context = {}) => {
 };
 import_endpoints7.customEndpointFunctions.aws = import_client29.awsEndpointFunctions;
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/schemas/schemas_0.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/schemas/schemas_0.js
 var import_schema3 = __toESM(require_schema(), 1);
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/models/ECSServiceException.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/models/ECSServiceException.js
 var import_client30 = __toESM(require_client(), 1);
 class ECSServiceException extends import_client30.ServiceException {
   constructor(options) {
@@ -49157,7 +49234,7 @@ class ECSServiceException extends import_client30.ServiceException {
   }
 }
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/models/errors.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/models/errors.js
 class AccessDeniedException extends ECSServiceException {
   name = "AccessDeniedException";
   $fault = "client";
@@ -49550,7 +49627,7 @@ class BlockedException extends ECSServiceException {
   }
 }
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/schemas/schemas_0.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/schemas/schemas_0.js
 var _A2 = "Attachment";
 var _ACR = "AcceleratorCountRequest";
 var _AD2 = "AttachmentDetails";
@@ -51937,7 +52014,7 @@ var StopTask$ = [
   () => StopTaskResponse$
 ];
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.shared.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.shared.js
 var getRuntimeConfig4 = (config) => {
   return {
     apiVersion: "2014-11-13",
@@ -51971,7 +52048,7 @@ var getRuntimeConfig4 = (config) => {
   };
 };
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
 var getRuntimeConfig5 = (config) => {
   import_client33.emitWarningIfUnsupportedVersion(process.version);
   const defaultsMode = import_config38.resolveDefaultsModeConfig(config);
@@ -52005,12 +52082,12 @@ var getRuntimeConfig5 = (config) => {
   };
 };
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeExtensions.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeExtensions.js
 var import_client34 = __toESM(require_client2(), 1);
 var import_client35 = __toESM(require_client(), 1);
 var import_protocols9 = __toESM(require_protocols(), 1);
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/auth/httpAuthExtensionConfiguration.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/auth/httpAuthExtensionConfiguration.js
 var getHttpAuthExtensionConfiguration3 = (runtimeConfig) => {
   const _httpAuthSchemes = runtimeConfig.httpAuthSchemes;
   let _httpAuthSchemeProvider = runtimeConfig.httpAuthSchemeProvider;
@@ -52049,14 +52126,14 @@ var resolveHttpAuthRuntimeConfig3 = (config) => {
   };
 };
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeExtensions.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeExtensions.js
 var resolveRuntimeExtensions3 = (runtimeConfig, extensions) => {
   const extensionConfiguration = Object.assign(import_client34.getAwsRegionExtensionConfiguration(runtimeConfig), import_client35.getDefaultExtensionConfiguration(runtimeConfig), import_protocols9.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration3(runtimeConfig));
   extensions.forEach((extension) => extension.configure(extensionConfiguration));
   return Object.assign(runtimeConfig, import_client34.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client35.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols9.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig3(extensionConfiguration));
 };
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
 class ECSClient extends import_client37.Client {
   config;
   constructor(...[configuration]) {
@@ -52092,32 +52169,38 @@ class ECSClient extends import_client37.Client {
   }
 }
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/commandBuilder.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/commandBuilder.js
 var import_client38 = __toESM(require_client(), 1);
 var import_endpoints9 = __toESM(require_endpoints(), 1);
 var command3 = import_client38.makeBuilder(commonParams3, "AmazonEC2ContainerServiceV20141113", "ECSClient", import_endpoints9.getEndpointPlugin);
 var _ep03 = {};
 var _mw03 = (Command, cs, config, o2) => [];
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/DescribeTasksCommand.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/DescribeTasksCommand.js
 class DescribeTasksCommand extends command3(_ep03, _mw03, "DescribeTasks", DescribeTasks$) {
 }
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/ListTasksCommand.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/ListTasksCommand.js
 class ListTasksCommand extends command3(_ep03, _mw03, "ListTasks", ListTasks$) {
 }
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/RunTaskCommand.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/RunTaskCommand.js
 class RunTaskCommand extends command3(_ep03, _mw03, "RunTask", RunTask$) {
 }
-// ../../node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/StopTaskCommand.js
+// ../../../skills-release-055-20260909/node_modules/.bun/@aws-sdk+client-ecs@3.1127.0/node_modules/@aws-sdk/client-ecs/dist-es/commands/StopTaskCommand.js
 class StopTaskCommand extends command3(_ep03, _mw03, "StopTask", StopTask$) {
 }
 // src/sdk/execution/dispatchers/ecs.ts
 var CLIENT_TOKEN_BYTES = 16;
-var TERMINAL_TASK_STATUSES = new Set(["STOPPED"]);
+var LIVE_TASK_STATUSES = new Set(["PROVISIONING", "PENDING", "ACTIVATING", "RUNNING", "DEACTIVATING", "STOPPING", "DEPROVISIONING"]);
+function observedTask(states, taskArn) {
+  if (states.length !== 1 || states[0]?.taskArn !== taskArn)
+    return;
+  const state = states[0];
+  return state.lastStatus === "STOPPED" || LIVE_TASK_STATUSES.has(state.lastStatus) ? state : undefined;
+}
 function clientTokenFor(runId2, attemptId) {
   return createHash11("sha256").update(`${runId2}\x00${attemptId}`).digest("hex").slice(0, CLIENT_TOKEN_BYTES * 2);
 }
@@ -52169,28 +52252,47 @@ class EcsDispatcher {
     const run = await this.store.getRun(runId2);
     if (!run)
       return { accepted: false, detail: "no such run" };
-    if (run.status === "cancelled")
-      return { accepted: true, detail: "already cancelled" };
     if (run.status === "succeeded" || run.status === "failed") {
       return { accepted: false, detail: `run already ${run.status}` };
     }
     const attempts = await this.store.listAttempts(runId2);
     const current = attempts[attempts.length - 1];
     if (!current) {
-      const cancelled2 = await this.stateMachine.cancel(runId2);
-      return cancelled2.ok ? { accepted: true, detail: "cancelled (no attempt launched)" } : { accepted: false, detail: cancelled2.reason };
+      if (run.status === "cancelled")
+        return { accepted: true, detail: "already cancelled (no attempt launched)" };
+      const cancelled = await this.stateMachine.cancel(runId2);
+      return cancelled.ok ? { accepted: true, detail: "cancelled (no attempt launched)" } : { accepted: false, detail: cancelled.reason };
     }
-    const taskArn = await this.resolveTaskArn(run.admission, current);
-    if (taskArn) {
+    if (!this.cancellationReceipt(await this.receipts.get(runId2, current.attemptId), run.admission, current)) {
+      return { accepted: false, detail: "matching cancellation receipt is unavailable or contradictory" };
+    }
+    const observation = await this.reconcile(run.admission, current);
+    if (observation.kind !== "already-launched" && observation.kind !== "previous-terminal") {
+      return { accepted: false, detail: "task state unknown; cancellation is not yet confirmed" };
+    }
+    const taskArn = observation.kind === "already-launched" ? observation.taskId : (await this.store.listAttempts(runId2)).find((row) => row.attemptId === current.attemptId)?.taskId ?? null;
+    if (!taskArn)
+      return { accepted: false, detail: "stopped task identity is not confirmed" };
+    if (observation.kind === "already-launched") {
       try {
-        await this.client.stopTask(taskArn);
+        await this.client.stopTask(observation.taskId);
       } catch {}
+      const stopped = await this.reconcile(run.admission, { ...current, taskId: observation.taskId });
+      if (stopped.kind !== "previous-terminal") {
+        return { accepted: false, target: observation.taskId, detail: "task stop is not yet confirmed; reconcile before retrying cancellation" };
+      }
     }
-    const cancelled = await this.stateMachine.cancel(runId2);
-    if (!cancelled.ok)
-      return { accepted: false, detail: cancelled.reason };
-    await this.writeCancellationReceipt(run.admission, current, taskArn);
-    return { accepted: true, target: taskArn ?? undefined, detail: "cancelled and fenced" };
+    if (run.status !== "cancelled") {
+      const cancelled = await this.stateMachine.cancel(runId2);
+      if (!cancelled.ok)
+        return { accepted: false, detail: cancelled.reason };
+    }
+    try {
+      await this.writeCancellationReceipt(run.admission, current, taskArn);
+    } catch {
+      return { accepted: false, target: taskArn, detail: "task stopped; cancellation receipt is not yet confirmed" };
+    }
+    return { accepted: true, target: taskArn, detail: "cancelled after confirmed task stop and receipt" };
   }
   async launchAttempt(runId2) {
     const run = await this.store.getRun(runId2);
@@ -52201,16 +52303,10 @@ class EcsDispatcher {
     }
     const attempts = await this.store.listAttempts(runId2);
     const previous = attempts[attempts.length - 1];
-    if (previous && previous.status !== "terminal" && !isProvenAbsentOrTerminal(previous.launchState)) {
-      const reconciled = await this.reconcile(run.admission, previous);
-      if (reconciled.kind === "already-launched" || reconciled.kind === "previous-terminal") {
-        return reconciled;
-      }
-      if (reconciled.kind === "ambiguous") {
-        return reconciled;
-      }
+    if (previous) {
+      return this.reconcile(run.admission, previous);
     }
-    const attemptNumber = previous ? previous.attemptNumber + 1 : 1;
+    const attemptNumber = 1;
     const attempt = await this.store.createAttempt({ runId: runId2, attemptNumber });
     const claimed = await this.stateMachine.claim({
       runId: runId2,
@@ -52245,68 +52341,43 @@ class EcsDispatcher {
     } catch {
       await this.store.recordLaunchState({ runId: runId2, attemptId: attempt.attemptId, launchState: "ambiguous" });
       const reconciled = await this.reconcile(run.admission, intent.attempt);
-      if (reconciled.kind === "already-launched")
-        return reconciled;
-      return reconciled.kind === "previous-terminal" ? reconciled : { kind: "launch-failed-absent", attemptId: attempt.attemptId };
+      return reconciled;
     }
     await this.store.recordLaunchState({ runId: runId2, attemptId: attempt.attemptId, launchState: "launched", taskId: result.taskArn });
     return { kind: "launched", attemptId: attempt.attemptId, taskId: result.taskArn };
   }
   async reconcile(admission, attempt) {
-    if (attempt.taskId) {
-      let states2;
+    const ambiguous = () => ({ kind: "ambiguous", attemptId: attempt.attemptId });
+    let taskArn = attempt.taskId;
+    if (!taskArn) {
+      if (!attempt.startedBy)
+        return ambiguous();
+      let taskArns;
       try {
-        states2 = await this.client.describeTasks([attempt.taskId]);
+        taskArns = await this.client.listTasksByStartedBy(attempt.startedBy);
       } catch {
-        return { kind: "ambiguous", attemptId: attempt.attemptId };
-      }
-      const live2 = states2.filter((state) => !TERMINAL_TASK_STATUSES.has(state.lastStatus));
-      if (live2.length > 0) {
-        return { kind: "already-launched", attemptId: attempt.attemptId, taskId: attempt.taskId };
+        return ambiguous();
       }
-      await this.store.recordLaunchState({ runId: admission.runId, attemptId: attempt.attemptId, launchState: "terminal" });
-      return { kind: "previous-terminal", attemptId: attempt.attemptId };
-    }
-    const token = attempt.startedBy;
-    if (!token) {
-      await this.store.recordLaunchState({ runId: admission.runId, attemptId: attempt.attemptId, launchState: "absent" });
-      return { kind: "launch-failed-absent", attemptId: attempt.attemptId };
-    }
-    let taskArns;
-    try {
-      taskArns = await this.client.listTasksByStartedBy(token);
-    } catch {
-      return { kind: "ambiguous", attemptId: attempt.attemptId };
-    }
-    if (taskArns.length === 0) {
-      await this.store.recordLaunchState({ runId: admission.runId, attemptId: attempt.attemptId, launchState: "absent" });
-      return { kind: "launch-failed-absent", attemptId: attempt.attemptId };
+      if (taskArns.length !== 1 || !taskArns[0])
+        return ambiguous();
+      taskArn = taskArns[0];
     }
     let states;
     try {
-      states = await this.client.describeTasks(taskArns);
+      states = await this.client.describeTasks([taskArn]);
     } catch {
-      return { kind: "ambiguous", attemptId: attempt.attemptId };
+      return ambiguous();
     }
-    const live = states.filter((state) => !TERMINAL_TASK_STATUSES.has(state.lastStatus));
-    if (live.length > 0) {
-      const taskId = live[0].taskArn;
-      await this.store.recordLaunchState({ runId: admission.runId, attemptId: attempt.attemptId, launchState: "launched", taskId });
-      return { kind: "already-launched", attemptId: attempt.attemptId, taskId };
+    const state = observedTask(states, taskArn);
+    if (!state)
+      return ambiguous();
+    if (state.lastStatus !== "STOPPED") {
+      await this.store.recordLaunchState({ runId: admission.runId, attemptId: attempt.attemptId, launchState: "launched", taskId: taskArn });
+      return { kind: "already-launched", attemptId: attempt.attemptId, taskId: taskArn };
     }
-    await this.store.recordLaunchState({ runId: admission.runId, attemptId: attempt.attemptId, launchState: "terminal", taskId: taskArns[0] });
+    await this.store.recordLaunchState({ runId: admission.runId, attemptId: attempt.attemptId, launchState: "terminal", taskId: taskArn });
     return { kind: "previous-terminal", attemptId: attempt.attemptId };
   }
-  async resolveTaskArn(admission, attempt) {
-    if (attempt.taskId)
-      return attempt.taskId;
-    if (attempt.launchState === "launching" || attempt.launchState === "ambiguous") {
-      const outcome = await this.reconcile(admission, attempt);
-      if (outcome.kind === "already-launched")
-        return outcome.taskId;
-    }
-    return null;
-  }
   runTaskInput(admission, attempt, clientToken, startedBy, requestDigest) {
     const limits = admission.limits;
     const cpuUnits = Math.max(256, Math.round(limits.maxCpuUnits / 256) * 256);
@@ -52331,81 +52402,103 @@ class EcsDispatcher {
       ]
     };
   }
-  async writeCancellationReceipt(admission, attempt, taskArn) {
-    const launch = await this.receipts.get(admission.runId, attempt.attemptId);
-    if (!launch) {
-      await this.receipts.recordLaunch({
-        admission,
-        attempt: { ...attempt, clientToken: attempt.clientToken ?? clientTokenFor(admission.runId, attempt.attemptId), requestDigest: attempt.requestDigest ?? "", startedBy: attempt.startedBy ?? "" },
-        taskId: taskArn,
-        launchedAt: this.now().toISOString()
-      });
+  cancellationReceipt(receipt, admission, attempt) {
+    try {
+      return !!receipt && receipt.runId === admission.runId && receipt.attemptId === attempt.attemptId && !!attempt.clientToken && receipt.clientToken === attempt.clientToken && !!attempt.requestDigest && receipt.requestDigest === attempt.requestDigest && !!attempt.startedBy && receipt.startedBy === attempt.startedBy && receipt.bundleDigest === admission.bundleDigest && receipt.runtimeImageDigest === admission.runtimeImageDigest && receipt.dependencyLayerTag === admission.dependencyLayerTag && canonicalJson(receipt.policy) === canonicalJson(admission.policy) && canonicalJson(receipt.limits) === canonicalJson(admission.limits) && (receipt.taskId === null || receipt.taskId === attempt.taskId) && (receipt.status === null && receipt.completedAt === null || receipt.status === "cancelled" && typeof receipt.completedAt === "string" && Number.isFinite(Date.parse(receipt.completedAt)));
+    } catch {
+      return false;
     }
-    await this.receipts.finalize({
-      runId: admission.runId,
-      attemptId: attempt.attemptId,
-      status: "cancelled",
-      exitCode: null,
-      completedAt: this.now().toISOString()
-    });
   }
-}
-function isProvenAbsentOrTerminal(launchState) {
-  return launchState === "absent" || launchState === "terminal";
-}
-function createAwsEcsClient(region) {
-  const client = new ECSClient({ region });
+  async writeCancellationReceipt(admission, attempt, taskArn) {
+    const existing = await this.receipts.get(admission.runId, attempt.attemptId);
+    if (!this.cancellationReceipt(existing, admission, { ...attempt, taskId: taskArn }))
+      throw Error("Cancellation receipt authority unavailable");
+    const completedAt = existing.completedAt ?? this.now().toISOString();
+    const expected = { ...existing, status: "cancelled", completedAt, exitCode: existing.status === "cancelled" ? existing.exitCode : null };
+    const run = await this.store.getRun(admission.runId);
+    if (existing.status !== "cancelled" || run?.status !== "cancelled" || run.terminalReceiptId !== attempt.attemptId) {
+      await this.receipts.finalize({ runId: admission.runId, attemptId: attempt.attemptId, status: "cancelled", exitCode: expected.exitCode, completedAt });
+    }
+    const persisted = await this.receipts.get(admission.runId, attempt.attemptId);
+    const finalized = await this.store.getRun(admission.runId);
+    if (!persisted || canonicalJson(persisted) !== canonicalJson(expected) || finalized?.status !== "cancelled" || finalized.terminalReceiptId !== attempt.attemptId) {
+      throw Error("Cancellation receipt persistence is unconfirmed");
+    }
+  }
+}
+function createAwsEcsClient(region, options = {}) {
+  if (options.cluster !== undefined && !validText(options.cluster))
+    throw Error("An explicit nonempty ECS cluster is required");
+  const client = options.transport ?? new ECSClient({ region });
+  let boundCluster = options.cluster;
+  const cluster = (requested) => {
+    const next = requested ?? boundCluster ?? "default";
+    if (!validText(next) || boundCluster !== undefined && next !== boundCluster)
+      throw Error("ECS client cluster binding changed");
+    return boundCluster ??= next;
+  };
+  const response = (value) => {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw Error("Incomplete ECS response");
+    const result = value;
+    if (result.failures !== undefined && (!Array.isArray(result.failures) || result.failures.length > 0))
+      throw Error("ECS response contains failures");
+    return result;
+  };
   return {
     async runTask(input) {
-      const response = await client.send(new RunTaskCommand({
-        cluster: input.cluster,
+      const result = response(await client.send(new RunTaskCommand({
+        cluster: cluster(input.cluster),
         taskDefinition: input.taskDefinition,
         launchType: input.launchType,
         clientToken: input.clientToken,
         startedBy: input.startedBy,
-        networkConfiguration: {
-          awsvpcConfiguration: {
-            subnets: input.subnets,
-            securityGroups: input.securityGroups,
-            assignPublicIp: "DISABLED"
-          }
-        },
-        overrides: {
-          containerOverrides: [
-            {
-              name: input.containerName,
-              environment: input.environment,
-              cpu: Number(input.cpu),
-              memory: Number(input.memory)
-            }
-          ]
-        }
-      }));
-      const taskArn = response.tasks?.[0]?.taskArn ?? null;
-      if (!taskArn) {
-        const failure = response.failures?.[0];
-        throw new Error(`RunTask refused: ${failure?.reason ?? "no task and no failure detail"}`);
-      }
-      return { taskArn };
+        networkConfiguration: { awsvpcConfiguration: { subnets: input.subnets, securityGroups: input.securityGroups, assignPublicIp: "DISABLED" } },
+        overrides: { containerOverrides: [{ name: input.containerName, environment: input.environment, cpu: Number(input.cpu), memory: Number(input.memory) }] }
+      })));
+      if (!Array.isArray(result.tasks) || result.tasks.length !== 1 || !validText(result.tasks[0]?.taskArn))
+        throw Error("RunTask did not return one exact task");
+      return { taskArn: result.tasks[0].taskArn };
     },
     async listTasksByStartedBy(startedBy) {
-      const response = await client.send(new ListTasksCommand({ startedBy }));
-      return response.taskArns ?? [];
+      const configuredCluster = cluster(), arns = [], tokens = new Set;
+      let nextToken;
+      for (let page = 0;page < 20; page++) {
+        const result = response(await client.send(new ListTasksCommand({ cluster: configuredCluster, startedBy, ...nextToken ? { nextToken } : {} })));
+        if (!Array.isArray(result.taskArns) || result.taskArns.length > 100 || !result.taskArns.every(validText))
+          throw Error("Incomplete ECS task listing");
+        arns.push(...result.taskArns);
+        if (new Set(arns).size !== arns.length)
+          throw Error("Repeated ECS task identity in listing");
+        if (result.nextToken === undefined)
+          return arns;
+        if (!validText(result.nextToken) || tokens.has(result.nextToken))
+          throw Error("Invalid ECS pagination cursor");
+        tokens.add(result.nextToken);
+        nextToken = result.nextToken;
+      }
+      throw Error("ECS task listing exceeded the bounded page limit");
     },
     async describeTasks(taskArns) {
-      const response = await client.send(new DescribeTasksCommand({ tasks: taskArns }));
-      return (response.tasks ?? []).map((task) => ({
-        taskArn: task.taskArn ?? "",
-        lastStatus: task.lastStatus ?? "UNKNOWN",
-        stopCode: task.stopCode ?? null,
-        exitCode: task.containers?.[0]?.exitCode ?? null
-      }));
+      if (!taskArns.length || taskArns.length > 100 || !taskArns.every(validText) || new Set(taskArns).size !== taskArns.length)
+        throw Error("Invalid ECS task identities");
+      const result = response(await client.send(new DescribeTasksCommand({ cluster: cluster(), tasks: taskArns })));
+      if (!Array.isArray(result.tasks) || result.tasks.length !== taskArns.length || new Set(result.tasks.map((task) => task?.taskArn)).size !== taskArns.length || result.tasks.some((task) => !taskArns.includes(task?.taskArn) || !validText(task?.lastStatus)))
+        throw Error("Incomplete ECS task descriptions");
+      return result.tasks.map((task) => ({ taskArn: task.taskArn, lastStatus: task.lastStatus, stopCode: task.stopCode ?? null, exitCode: task.containers?.[0]?.exitCode ?? null }));
     },
     async stopTask(taskArn) {
-      await client.send(new StopTaskCommand({ task: taskArn }));
+      if (!validText(taskArn))
+        throw Error("Invalid ECS task identity");
+      const result = response(await client.send(new StopTaskCommand({ cluster: cluster(), task: taskArn })));
+      if (result.task?.taskArn !== taskArn || !validText(result.task?.lastStatus))
+        throw Error("Incomplete ECS stop response");
     }
   };
 }
+function validText(value) {
+  return typeof value === "string" && value.length > 0 && value.trim() === value && value.length <= 2048;
+}
 // src/sdk/execution/dispatchers/e2b.ts
 var E2B_LANE_STATUS = "e2b-lane-todo-infinity";
@@ -53097,8 +53190,17 @@ function creditCount(value) {
   }
   return value;
 }
+function runQuoteReceipt(value) {
+  if (value === undefined)
+    return;
+  if (typeof value !== "string" || !value.length || Buffer.byteLength(value, "utf8") > 4096) {
+    throw new Error("Invalid quote receipt");
+  }
+  return value;
+}
 function parseRemoteRunQuote(value) {
   const quote = object(value);
+  runQuoteReceipt(quote.quoteReceipt);
   const pricing = object(quote.pricing);
   if (typeof quote.skill !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(quote.skill))
     throw new Error("Invalid quoted skill");
@@ -53164,7 +53266,7 @@ function describeRemoteFiles(files) {
   const names = new Set;
   let total = 0;
   return files.map((file) => {
-    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(file.name) || file.name === "." || file.name === ".." || names.has(file.name))
+    if (typeof file.name !== "string" || file.name.length === 0 || file.name.length > 255 || /[/\\\x00-\x1f\x7f]/.test(file.name) || /[\ud800-\udfff]/u.test(file.name) || file.name === "." || file.name === ".." || names.has(file.name))
       throw new Error("Input file names must be unique safe basenames");
     names.add(file.name);
     total += file.bytes.byteLength;
@@ -53383,7 +53485,7 @@ class RemoteSkillsClient {
     this.apiUrl = normalizeSkillsApiOrigin(apiUrl);
   }
   async request(path, options) {
-    return fetch(`${this.apiUrl}${path}`, {
+    return fetch(skillsApiRequestUrl(this.apiUrl, path), {
       ...options,
       redirect: "error",
       credentials: "omit",
@@ -53443,6 +53545,7 @@ class RemoteSkillsClient {
     return { status: res.status, body };
   }
   async submitRun(slug, input, args, approval = {}) {
+    const quoteReceipt = runQuoteReceipt(approval.quoteReceipt);
     if (approval.idempotencyKey !== undefined && !/^[A-Za-z0-9._:-]{1,128}$/.test(approval.idempotencyKey))
       throw new Error("Idempotency key must be 1-128 URL-safe characters");
     if (approval.maxCostCents !== undefined)
@@ -53459,15 +53562,20 @@ class RemoteSkillsClient {
         ...approval.maxCredits !== undefined ? { maxCredits: approval.maxCredits } : {},
         ...approval.maxCostCents !== undefined ? { maxCostCents: approval.maxCostCents } : {},
         ...approval.idempotencyKey !== undefined ? { idempotencyKey: approval.idempotencyKey } : {},
-        ...approval.inputFiles !== undefined ? { files: approval.inputFiles } : {}
+        ...approval.inputFiles !== undefined ? { files: approval.inputFiles } : {},
+        ...quoteReceipt !== undefined ? { quoteReceipt } : {}
       })
     });
+    if (!res.ok) {
+      res.body?.cancel().catch(() => {});
+      throw new RemoteRequestError(`/api/v1/runs/${encodeURIComponent(slug)}`, res.status);
+    }
     return normalizeRemoteSkillRunContract(await res.json(), slug);
   }
-  async quoteRun(slug, input = {}, args = []) {
+  async quoteRun(slug, input = {}, args = [], files) {
     const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/quote`, {
       method: "POST",
-      body: JSON.stringify({ input, args })
+      body: JSON.stringify({ input, args, ...files === undefined ? {} : { files } })
     }, { quoteRefusal: true });
     return parseRemoteRunQuote(await response.json());
   }
@@ -53483,17 +53591,24 @@ class RemoteSkillsClient {
     return this.capabilities;
   }
   async submitQuotedRun(slug, input = {}, args = [], approval = {}) {
+    runQuoteReceipt(approval.quoteReceipt);
+    ({ input, args, approval } = JSON.parse(JSON.stringify({ input, args, approval })));
     const maximum = creditCount(approval.maxCredits ?? approval.maxCostCents ?? 0);
     if (approval.maxCostCents !== undefined && approval.maxCostCents !== maximum)
       throw new Error("Credit approval fields disagree");
-    const quote = await this.quoteRun(slug, input, args);
-    if (quote.pricing.costCents > maximum)
+    const quote = approval.quoteReceipt === undefined ? await this.quoteRun(slug, input, args, approval.inputFiles?.length ? approval.inputFiles : undefined) : undefined;
+    if (quote && quote.pricing.costCents > maximum)
       throw new RemoteCreditApprovalError(quote.pricing.costCents, maximum);
     const capabilities = await this.getCapabilities();
     if (!capabilities.capabilities.includes("runs.submit") || capabilities.billing?.boundedRunApproval !== true || capabilities.billing.unit !== "credits") {
       throw new Error("The configured server does not support bounded credit approval; refusing remote submission");
     }
-    return this.submitRun(quote.skill, input, args, { ...approval, maxCredits: maximum, maxCostCents: maximum });
+    return this.submitRun(quote?.skill ?? slug, input, args, {
+      ...approval,
+      maxCredits: maximum,
+      maxCostCents: maximum,
+      ...(quote?.quoteReceipt ?? approval.quoteReceipt) === undefined ? {} : { quoteReceipt: quote?.quoteReceipt ?? approval.quoteReceipt }
+    });
   }
   async getIdentity() {
     return (await this.requestNewRoute("/api/auth/whoami")).json();
@@ -53781,6 +53896,10 @@ class RemoteSkillsClient {
     return { id: artifactId2, fileName: String(artifact.fileName ?? artifactId2), bytes, byteSize: bytes.byteLength, sha256: artifact.sha256 };
   }
   async submitQuotedRunWithFiles(slug, input, args, files, approval = {}) {
+    runQuoteReceipt(approval.quoteReceipt);
+    ({ input, args, approval } = JSON.parse(JSON.stringify({ input, args, approval })));
+    describeRemoteFiles(files);
+    files = files.map((file) => ({ name: file.name, contentType: file.contentType, bytes: new Uint8Array(file.bytes) }));
     const inputFiles = describeRemoteFiles(files);
     if (files.length && !(await this.getCapabilities()).capabilities.includes("runs.uploads"))
       throw new Error("The configured server does not support input uploads");
@@ -53844,7 +53963,7 @@ class RemoteSkillsClient {
     const headers = { Authorization: `Bearer ${this.apiKey}` };
     if (ifMatch)
       headers["If-Match"] = ifMatch;
-    return fetch(`${this.apiUrl}/api/v1/skills`, {
+    return fetch(skillsApiRequestUrl(this.apiUrl, "/api/v1/skills"), {
       method: "POST",
       headers,
       body: form,
@@ -54129,7 +54248,7 @@ async function requestInvitationEmail(origin, action, input) {
   }
   const body = JSON.stringify({ invitationId: value.invitationId, token: value.token, challengeId: value.challengeId, ...action === "accept" ? { code: value.code } : {} });
   try {
-    const response = await fetch(`${target}/api/v1/account/invitations/email-${action}`, {
+    const response = await fetch(skillsApiRequestUrl(target, `/api/v1/account/invitations/email-${action}`), {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body,
@@ -54160,6 +54279,312 @@ async function requestInvitationEmail(origin, action, input) {
   throw new RemoteInvitationEmailUnconfirmedError(action);
 }
+// src/lib/remote-private-publications.ts
+import { createHash as createHash14 } from "crypto";
+var PRIVATE_PUBLICATION_MAX_BYTES = 16 * 1024 * 1024;
+var failures = {
+  INVALID_REQUEST: [400, "The publication request is invalid."],
+  SESSION_EXPIRED: [401, "Sign in again to manage this publication."],
+  ACCOUNT_UNAVAILABLE: [403, "The account is unavailable."],
+  INTERACTIVE_SESSION_REQUIRED: [403, "An interactive account session is required."],
+  PUBLICATION_FORBIDDEN: [403, "This session cannot manage the publication."],
+  PUBLICATION_ENTITLEMENT_REQUIRED: [403, "The workspace is not entitled to publish private skills."],
+  PUBLICATION_UNAVAILABLE: [404, "The publication is unavailable to this session."],
+  MANIFEST_NAME_MISMATCH: [409, "The manifest name does not match the selected skill."],
+  IDEMPOTENCY_CONFLICT: [409, "This request key already identifies different publication bytes. Use the saved recovery directory."],
+  CURRENT_VERSION_CHANGED: [409, "The current version changed. Inspect it before explicitly starting another publication."],
+  VERSION_EXISTS: [409, "This version already exists."],
+  VERSION_RESERVED: [409, "This version is reserved by another publication."],
+  PUBLICATION_COMMITTED: [409, "The publication is already committed."],
+  PUBLICATION_UPLOAD_UNAVAILABLE: [409, "This publication cannot receive another upload."],
+  PUBLICATION_LIMIT: [429, "The workspace publication limit has been reached."],
+  PUBLICATION_BUSY: [503, "The publication is busy. Reconcile the saved intent before retrying."],
+  PUBLICATION_UNCERTAIN: [503, "The publication outcome is uncertain. Reconcile the saved intent."],
+  PUBLICATION_CAPABILITY_UNAVAILABLE: [503, "Private publishing is not enabled on this server."],
+  PUBLICATION_SIGNING_UNAVAILABLE: [503, "Upload authorization is temporarily unavailable. Keep the same intent."]
+};
+class PrivatePublicationError extends Error {
+  code;
+  uncertain;
+  status;
+  constructor(code, message, uncertain = false, status) {
+    super(message);
+    this.code = code;
+    this.uncertain = uncertain;
+    this.status = status;
+    this.name = "PrivatePublicationError";
+  }
+}
+var bad = () => {
+  throw new PrivatePublicationError("INVALID_PUBLICATION_INPUT", "Invalid publication input or recovery data.");
+};
+var invalid3 = () => {
+  throw new PrivatePublicationError("INVALID_PUBLICATION_RESPONSE", "The server returned an invalid publication result.");
+};
+var publicationUuid = (v2) => typeof v2 === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v2);
+var hash = (v2) => typeof v2 === "string" && /^[a-f0-9]{64}$/.test(v2);
+var record5 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
+var exact = (v2, keys) => record5(v2) && Object.keys(v2).sort().join(",") === keys.sort().join(",");
+var date = (v2) => typeof v2 === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v2) && Number.isFinite(Date.parse(v2));
+var publicationSha256 = (bytes) => createHash14("sha256").update(bytes).digest("hex");
+function checkedPublicationDeclaration(value) {
+  if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
+    return bad();
+  try {
+    const manifest = JSON.parse(value.manifestText);
+    if (!record5(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash(manifest.provenance?.content_hash))
+      return bad();
+  } catch {
+    return bad();
+  }
+  return Object.freeze({ ...value });
+}
+function checkedPublicationView(value, skillId, intentId, declaration) {
+  if (!exact(value, ["id", "skillId", "version", "expectedCurrentVersionId", "archiveSha256", "archiveByteSize", "state", "expiresAt", "createdAt", "versionId"]) || !publicationUuid(value.id) || value.skillId !== skillId || intentId !== undefined && value.id !== intentId || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || !hash(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES || typeof value.state !== "string" || !["awaiting_upload", "queued", "verifying", "needs_attention", "committed", "rejected", "cancelled", "expired"].includes(value.state) || !date(value.expiresAt) || !date(value.createdAt) || !(value.versionId === null || publicationUuid(value.versionId)) || value.state === "committed" && value.versionId === null)
+    return invalid3();
+  if (declaration && ["version", "expectedCurrentVersionId", "archiveSha256", "archiveByteSize"].some((k4) => value[k4] !== declaration[k4]))
+    return invalid3();
+  return Object.freeze({ ...value });
+}
+async function boundedJson(url, init, token, mutation, budget = 15000, signal) {
+  const controller = new AbortController;
+  let reader;
+  let response;
+  const timeout = new PrivatePublicationError("PUBLICATION_UNCONFIRMED", "No confirmed publication result. Inspect the saved intent before retrying.", mutation);
+  let timer;
+  let abort;
+  try {
+    return await Promise.race([(async () => {
+      if (signal?.aborted)
+        throw timeout;
+      response = await fetch(url, {
+        ...init,
+        redirect: "error",
+        credentials: "omit",
+        signal: controller.signal,
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` }
+      });
+      const length = response.headers.get("content-length");
+      if (length !== null && (!/^\d+$/.test(length) || Number(length) > 65536))
+        return invalid3();
+      reader = response.body?.getReader();
+      const chunks = [];
+      let size = 0;
+      if (reader)
+        while (true) {
+          const part = await reader.read();
+          if (part.done)
+            break;
+          size += part.value.byteLength;
+          if (size > 65536)
+            return invalid3();
+          chunks.push(part.value);
+        }
+      if (controller.signal.aborted)
+        throw timeout;
+      const bytes = Buffer.concat(chunks);
+      let body;
+      try {
+        body = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+      } catch {
+        return invalid3();
+      }
+      if (!response.ok) {
+        const code = record5(body) && typeof body.code === "string" && Object.hasOwn(failures, body.code) ? body.code : null;
+        if (code && failures[code][0] === response.status)
+          throw new PrivatePublicationError(code, failures[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
+        throw new PrivatePublicationError("PUBLICATION_REQUEST_FAILED", "The publication request was refused. Inspect its status before retrying.", mutation && response.status >= 500, response.status);
+      }
+      return body;
+    })(), new Promise((_, reject) => {
+      abort = () => {
+        controller.abort();
+        reject(timeout);
+      };
+      timer = setTimeout(abort, Math.max(1, Math.min(15000, budget)));
+      signal?.addEventListener("abort", abort, { once: true });
+    })]);
+  } catch (error) {
+    if (error instanceof PrivatePublicationError) {
+      if (mutation && error.code === "INVALID_PUBLICATION_RESPONSE")
+        throw timeout;
+      throw error;
+    }
+    throw timeout;
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+    if (abort)
+      signal?.removeEventListener("abort", abort);
+    controller.abort();
+    if (reader)
+      reader.cancel().catch(() => {});
+    else
+      response?.body?.cancel().catch(() => {});
+  }
+}
+class RemotePrivatePublicationsClient {
+  apiOrigin;
+  organizationId;
+  userId;
+  membershipId;
+  #token;
+  constructor(apiUrl, session) {
+    const checked = parseWorkspaceSession(session, { userId: session?.user?.id, membershipId: session?.user?.membershipId });
+    if (checked.user.role === "viewer")
+      throw new PrivatePublicationError("PUBLICATION_FORBIDDEN", failures.PUBLICATION_FORBIDDEN[1]);
+    this.apiOrigin = normalizeSkillsApiOrigin(apiUrl);
+    this.#token = checked.token;
+    this.organizationId = checked.organization.id;
+    this.userId = checked.user.id;
+    this.membershipId = checked.user.membershipId;
+    Object.freeze(this);
+  }
+  async getCapability(options = {}) {
+    if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
+      return bad();
+    const response = await boundedJson(skillsApiRequestUrl(this.apiOrigin, "/api/v1/capabilities"), {}, this.#token, false, options.timeoutMs, options.signal);
+    const p2 = record5(response) && response.privatePublishing;
+    if (!record5(response) || response.contractVersion !== 1 || response.apiVersion !== 1 || !exact(p2, ["contractVersion", "enabled", "authentication", "maxArchiveBytes", "uploadMaxTtlSeconds", "executionEnabled"]) || p2.contractVersion !== 1 || typeof p2.enabled !== "boolean" || p2.authentication !== "interactive-session" || p2.maxArchiveBytes !== PRIVATE_PUBLICATION_MAX_BYTES || p2.uploadMaxTtlSeconds !== 300 || p2.executionEnabled !== false)
+      throw new PrivatePublicationError("PUBLICATION_CONTRACT_UNAVAILABLE", "This server does not support the hosted private publication contract.");
+    return Object.freeze({ ...p2 });
+  }
+  async#gate(enabled, options = {}) {
+    if (!(await this.getCapability(options)).enabled && enabled)
+      throw new PrivatePublicationError("PUBLICATION_CAPABILITY_UNAVAILABLE", failures.PUBLICATION_CAPABILITY_UNAVAILABLE[1]);
+  }
+  #path(skillId, intentId) {
+    if (!publicationUuid(skillId) || intentId !== undefined && !publicationUuid(intentId))
+      return bad();
+    return skillsApiRequestUrl(this.apiOrigin, `/api/v1/skills/${skillId}/publication-uploads${intentId ? `/${intentId}` : ""}`);
+  }
+  async#view(path, method, skillId, intentId, declaration, options = {}) {
+    const value = await boundedJson(path, { method, ...method === "GET" ? {} : { body: JSON.stringify(declaration ?? {}) } }, this.#token, method !== "GET", options.timeoutMs, options.signal);
+    try {
+      if (!record5(value) || !Object.keys(value).every((k4) => k4 === "upload" || k4 === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
+        return invalid3();
+      return checkedPublicationView(value.upload, skillId, intentId, declaration);
+    } catch (error) {
+      if (method !== "GET")
+        throw new PrivatePublicationError("PUBLICATION_UNCONFIRMED", "The publication result could not be confirmed. Reconcile the saved intent before another action.", true);
+      throw error;
+    }
+  }
+  async begin(skillId, input) {
+    const path = this.#path(skillId), declaration = checkedPublicationDeclaration(input);
+    await this.#gate(true);
+    return this.#view(path, "POST", skillId, undefined, declaration);
+  }
+  async get(skillId, intentId, options = {}) {
+    const path = this.#path(skillId, intentId), until = Date.now() + (options.timeoutMs ?? 15000);
+    await this.#gate(false, options);
+    return this.#view(path, "GET", skillId, intentId, undefined, { ...options, timeoutMs: Math.max(1, until - Date.now()) });
+  }
+  async finalize(skillId, intentId) {
+    const path = this.#path(skillId, intentId);
+    await this.#gate(true);
+    return this.#view(`${path}/finalize`, "POST", skillId, intentId);
+  }
+  async cancel(skillId, intentId) {
+    const path = this.#path(skillId, intentId);
+    await this.#gate(false);
+    return this.#view(path, "DELETE", skillId, intentId);
+  }
+  async upload(skillId, intent, bytes) {
+    const captured = checkedPublicationView(intent, skillId), path = this.#path(skillId, captured.id);
+    if (!(bytes instanceof Uint8Array) || bytes.byteLength !== captured.archiveByteSize)
+      return bad();
+    const owned = Buffer.from(bytes);
+    if (captured.state !== "awaiting_upload" || owned.byteLength !== captured.archiveByteSize || publicationSha256(owned) !== captured.archiveSha256)
+      return bad();
+    await this.#gate(true);
+    const value = await boundedJson(`${path}/upload-url`, { method: "POST", body: "{}" }, this.#token, false);
+    const upload = this.#upload(value, captured);
+    const controller = new AbortController;
+    let timer;
+    const uncertain = () => new PrivatePublicationError("PUBLICATION_UPLOAD_UNCONFIRMED", "Upload acceptance is uncertain. Resume this saved intent to finalize and inspect it; do not upload again.", true);
+    try {
+      await Promise.race([(async () => {
+        const response = await fetch(upload.uploadUrl, { method: "PUT", headers: upload.headers, body: owned, redirect: "error", credentials: "omit", signal: controller.signal });
+        response.body?.cancel().catch(() => {});
+        if (response.status !== 200 || controller.signal.aborted)
+          throw uncertain();
+      })(), new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          controller.abort();
+          reject(uncertain());
+        }, 30000);
+      })]);
+    } catch {
+      throw uncertain();
+    } finally {
+      if (timer)
+        clearTimeout(timer);
+      controller.abort();
+    }
+  }
+  #upload(value, intent) {
+    if (!exact(value, ["upload"]) || !exact(value.upload, ["method", "uploadUrl", "headers", "expiresAt"]))
+      return invalid3();
+    const p2 = value.upload;
+    if (p2.method !== "PUT" || typeof p2.uploadUrl !== "string" || p2.uploadUrl.length > 8192 || /[\x00-\x20\x7f]/.test(p2.uploadUrl) || !date(p2.expiresAt) || Date.parse(p2.expiresAt) - Date.now() < 1000 || Date.parse(p2.expiresAt) - Date.now() > 300000 || Date.parse(p2.expiresAt) > Date.parse(intent.expiresAt) || !exact(p2.headers, ["content-type", "content-length", "x-amz-checksum-sha256", "x-amz-expected-bucket-owner"]) || p2.headers["content-type"] !== "application/gzip" || p2.headers["content-length"] !== String(intent.archiveByteSize) || p2.headers["x-amz-checksum-sha256"] !== Buffer.from(intent.archiveSha256, "hex").toString("base64") || typeof p2.headers["x-amz-expected-bucket-owner"] !== "string" || !/^\d{12}$/.test(p2.headers["x-amz-expected-bucket-owner"]))
+      return invalid3();
+    let url;
+    try {
+      url = new URL(p2.uploadUrl);
+    } catch {
+      return invalid3();
+    }
+    if (url.protocol !== "https:" || url.port || url.username || url.password || url.hash || !/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]\.s3\.[a-z]{2}(?:-[a-z]+)+-[1-9]\.amazonaws\.com$/.test(url.hostname) || url.pathname !== `/private-publication-staging/${this.organizationId}/${intent.id}/bundle.tgz` || !url.search || url.searchParams.get("X-Amz-Algorithm") !== "AWS4-HMAC-SHA256" || url.searchParams.get("X-Amz-SignedHeaders") !== "content-length;content-type;host;x-amz-checksum-sha256;x-amz-expected-bucket-owner" || !/^[a-f0-9]{64}$/.test(url.searchParams.get("X-Amz-Signature") ?? ""))
+      return invalid3();
+    const queryKeys = ["X-Amz-Algorithm", "X-Amz-Credential", "X-Amz-Date", "X-Amz-Expires", "X-Amz-Security-Token", "X-Amz-Signature", "X-Amz-SignedHeaders"];
+    if ([...url.searchParams.keys()].sort().join(",") !== queryKeys.sort().join(","))
+      return invalid3();
+    const issued = url.searchParams.get("X-Amz-Date"), ttl = url.searchParams.get("X-Amz-Expires"), credential = url.searchParams.get("X-Amz-Credential");
+    const timestamp3 = /^(\d{4})(\d\d)(\d\d)T(\d\d)(\d\d)(\d\d)Z$/.exec(issued);
+    const region = url.hostname.split(".s3.")[1].split(".amazonaws.com")[0];
+    if (!timestamp3 || !/^[1-9]\d{0,2}$/.test(ttl) || Number(ttl) > 300 || !/^[A-Z0-9]{16,128}\//.test(credential) || credential.split("/").slice(1).join("/") !== `${issued.slice(0, 8)}/${region}/s3/aws4_request` || !/^[\x21-\x7e]{1,4096}$/.test(url.searchParams.get("X-Amz-Security-Token")))
+      return invalid3();
+    const issuedAt = Date.parse(`${timestamp3[1]}-${timestamp3[2]}-${timestamp3[3]}T${timestamp3[4]}:${timestamp3[5]}:${timestamp3[6]}Z`);
+    if (!Number.isFinite(issuedAt) || issuedAt > Date.now() + 1000 || issuedAt + Number(ttl) * 1000 !== Date.parse(p2.expiresAt))
+      return invalid3();
+    return { method: "PUT", uploadUrl: url.href, expiresAt: p2.expiresAt, headers: Object.freeze({ ...p2.headers }) };
+  }
+  async wait(skillId, intentId, options = {}) {
+    const timeout = options.timeoutMs ?? 60000;
+    if (!Number.isSafeInteger(timeout) || timeout < 0 || timeout > 300000)
+      return bad();
+    const until = Date.now() + timeout;
+    let previous;
+    while (true) {
+      if (options.signal?.aborted)
+        throw new PrivatePublicationError("PUBLICATION_WAIT_ABORTED", "Stopped waiting. The server publication continues; inspect the saved intent.");
+      let view;
+      try {
+        view = await this.get(skillId, intentId, { timeoutMs: timeout === 0 ? 15000 : Math.max(1, Math.min(15000, until - Date.now())), signal: options.signal });
+      } catch (error) {
+        if (previous && Date.now() >= until && !options.signal?.aborted)
+          return previous;
+        throw error;
+      }
+      previous = view;
+      if (!["queued", "verifying"].includes(view.state) || Date.now() >= until)
+        return view;
+      await new Promise((resolve4) => {
+        const timer = setTimeout(done, Math.min(1000, until - Date.now()));
+        function done() {
+          clearTimeout(timer);
+          options.signal?.removeEventListener("abort", done);
+          resolve4();
+        }
+        options.signal?.addEventListener("abort", done, { once: true });
+      });
+    }
+  }
+}
 // src/lib/remote-auth.ts
 var MAX_ERROR_DETAIL_LENGTH = 200;
@@ -54182,10 +54607,11 @@ class HostedApiError extends Error {
 async function requestAuthApi(instance, path, options) {
   const url = normalizeSkillsApiOrigin(instance);
   const safeUrl = url;
-  const endpoint = `${(options?.method || "GET").toUpperCase()} ${safeUrl}${path}`;
+  const requestUrl = skillsApiRequestUrl(url, path);
+  const endpoint = `${(options?.method || "GET").toUpperCase()} ${requestUrl}`;
   let res;
   try {
-    res = await fetch(`${url}${path}`, {
+    res = await fetch(requestUrl, {
       ...options,
       redirect: "error",
       signal: options?.signal ?? AbortSignal.timeout(15000),
@@ -54200,10 +54626,10 @@ async function requestAuthApi(instance, path, options) {
   const text2 = await res.text();
   const body = text2 ? parseJsonBody(text2) : {};
   if (!res.ok) {
-    const record5 = isRecord6(body) ? body : {};
-    const detail = typeof record5.detail === "string" ? record5.detail : undefined;
-    const error = typeof record5.error === "string" ? record5.error : undefined;
-    const code = typeof record5.code === "string" ? record5.code : undefined;
+    const record6 = isRecord6(body) ? body : {};
+    const detail = typeof record6.detail === "string" ? record6.detail : undefined;
+    const error = typeof record6.error === "string" ? record6.error : undefined;
+    const code = typeof record6.code === "string" ? record6.code : undefined;
     throw new HostedApiError(detail || error || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -54237,6 +54663,10 @@ class RemoteSkillsAuthClient {
   constructor(apiUrl) {
     this.apiOrigin = normalizeSkillsApiOrigin(apiUrl);
   }
+  async openPrivatePublications(email2, code, context) {
+    const origin = this.apiOrigin, captured = workspaceContext(context);
+    return new RemotePrivatePublicationsClient(origin, await this.switchWorkspace(email2, code, captured));
+  }
   requestInvitationEmailChallenge(input) {
     return requestInvitationEmail(this.apiOrigin, "challenge", input);
   }
@@ -54284,9 +54714,10 @@ class RemoteSkillsAuthClient {
     const apiOrigin = this.apiOrigin;
     if (typeof email2 !== "string" || !email2.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
+    const requestUrl = skillsApiRequestUrl(apiOrigin, "/api/auth/verify");
     let response;
     try {
-      response = await fetch(`${apiOrigin}/api/auth/verify`, {
+      response = await fetch(requestUrl, {
         method: "POST",
         redirect: "error",
         credentials: "omit",
@@ -54377,144 +54808,387 @@ class RemoteSkillsAuthClient {
     return requestAuthApi(this.apiOrigin, path, options);
   }
 }
+// src/lib/private-publication-recovery.ts
+import { constants as constants2, closeSync as closeSync3, fsyncSync, fstatSync as fstatSync3, lstatSync as lstatSync5, mkdirSync as mkdirSync8, openSync as openSync3, readSync as readSync2, realpathSync as realpathSync2, renameSync as renameSync3, unlinkSync, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname10, isAbsolute as isAbsolute5, join as join21, resolve as resolve4 } from "path";
+import { randomUUID as randomUUID6 } from "crypto";
+var fail = () => {
+  throw new PrivatePublicationError("PUBLICATION_RECOVERY_INVALID", "The recovery directory is invalid or changed. Preserve it and inspect the existing intent; do not start a replacement automatically.");
+};
+function safeDirectory(directory) {
+  if (!isAbsolute5(directory) || directory !== resolve4(directory) || realpathSync2(directory) !== directory)
+    return fail();
+  for (let path = directory;; path = dirname10(path)) {
+    const stat = lstatSync5(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+      return fail();
+    if (path === dirname10(path))
+      break;
+  }
+  const own = lstatSync5(directory);
+  if ((own.mode & 63) !== 0 || process.getuid && own.uid !== process.getuid())
+    return fail();
+  return { dev: own.dev, ino: own.ino };
+}
+function unchangedDirectory(directory, identity) {
+  const now2 = safeDirectory(directory);
+  if (now2.dev !== identity.dev || now2.ino !== identity.ino)
+    return fail();
+}
+function readOwned(directory, name, max) {
+  const identity = safeDirectory(directory), file = join21(directory, name);
+  const fd = openSync3(file, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+  try {
+    const stat = fstatSync3(fd);
+    if (!stat.isFile() || stat.nlink !== 1 || stat.size > max || stat.size < 1 || (stat.mode & 63) !== 0 || process.getuid && stat.uid !== process.getuid())
+      return fail();
+    const buffer = Buffer.alloc(Math.min(max, stat.size) + 1);
+    let length = 0;
+    while (length < buffer.length) {
+      const count = readSync2(fd, buffer, length, buffer.length - length, length);
+      if (count === 0)
+        break;
+      length += count;
+    }
+    const bytes = buffer.subarray(0, length), after = fstatSync3(fd);
+    unchangedDirectory(directory, identity);
+    if (bytes.length !== stat.size || stat.size !== after.size || stat.mtimeMs !== after.mtimeMs || stat.ctimeMs !== after.ctimeMs)
+      return fail();
+    return bytes;
+  } finally {
+    closeSync3(fd);
+  }
+}
+function writeOwned(directory, name, bytes) {
+  const fd = openSync3(join21(directory, name), constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_NOFOLLOW, 384);
+  try {
+    writeFileSync6(fd, bytes);
+    fsyncSync(fd);
+  } finally {
+    closeSync3(fd);
+  }
+}
+function save(directory, value) {
+  const identity = safeDirectory(directory), temporary = `.receipt-${randomUUID6()}.json`;
+  writeOwned(directory, temporary, JSON.stringify(value) + `
+`);
+  unchangedDirectory(directory, identity);
+  renameSync3(join21(directory, temporary), join21(directory, "receipt.json"));
+  const fd = openSync3(directory, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+  try {
+    fsyncSync(fd);
+  } finally {
+    closeSync3(fd);
+  }
+}
+function bind(client, receipt) {
+  if (["apiOrigin", "organizationId", "userId", "membershipId"].some((k4) => client[k4] !== receipt[k4]))
+    throw new PrivatePublicationError("PUBLICATION_IDENTITY_CHANGED", "The fresh session does not match the recovery directory's server, account and membership.");
+}
+async function locked(directory, action) {
+  const identity = safeDirectory(directory), file = join21(directory, "operation.lock");
+  let fd;
+  try {
+    fd = openSync3(file, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_NOFOLLOW, 384);
+  } catch {
+    throw new PrivatePublicationError("PUBLICATION_RECOVERY_BUSY", "Another operation holds this recovery directory. If it crashed, confirm that process has stopped before explicitly removing operation.lock and resuming.");
+  }
+  const lock = fstatSync3(fd);
+  try {
+    writeFileSync6(fd, JSON.stringify({ pid: process.pid }) + `
+`);
+    fsyncSync(fd);
+    return await action();
+  } finally {
+    closeSync3(fd);
+    unchangedDirectory(directory, identity);
+    const now2 = lstatSync5(file);
+    if (now2.dev !== lock.dev || now2.ino !== lock.ino || !now2.isFile() || now2.isSymbolicLink())
+      fail();
+    unlinkSync(file);
+  }
+}
+function readPrivatePublicationRecovery(directory) {
+  try {
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(readOwned(directory, "receipt.json", 65536)));
+    if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).sort().join(",") !== ["contractVersion", "apiOrigin", "organizationId", "userId", "membershipId", "skillId", "declaration", "phase", "intent"].sort().join(",") || value.contractVersion !== 1 || ![value.organizationId, value.userId, value.membershipId, value.skillId].every(publicationUuid) || typeof value.apiOrigin !== "string" || normalizeSkillsApiOrigin(value.apiOrigin) !== value.apiOrigin || !["prepared", "begin_uncertain", "awaiting_upload", "upload_uncertain", "uploaded", "finalize_uncertain", "observed"].includes(value.phase))
+      return fail();
+    value.declaration = checkedPublicationDeclaration(value.declaration);
+    if (value.intent !== null)
+      value.intent = checkedPublicationView(value.intent, value.skillId, undefined, value.declaration);
+    if (value.intent === null && !["prepared", "begin_uncertain"].includes(value.phase))
+      return fail();
+    const bytes = readOwned(directory, "bundle.tgz", PRIVATE_PUBLICATION_MAX_BYTES);
+    if (bytes.length !== value.declaration.archiveByteSize || publicationSha256(bytes) !== value.declaration.archiveSha256)
+      return fail();
+    return { receipt: value, bytes };
+  } catch {
+    return fail();
+  }
+}
+async function preparePrivatePublication(client, sourceDirectory, recoveryDirectory, input) {
+  if (!publicationUuid(input.skillId) || !(input.expectedCurrentVersionId === null || publicationUuid(input.expectedCurrentVersionId)) || input.idempotencyKey !== undefined && !publicationUuid(input.idempotencyKey))
+    return fail();
+  const packed = packSkillBundle(sourceDirectory, { maxUnpackedBytes: 32 * 1024 * 1024 });
+  const inspected = await inspectSkillBundle(packed.bytes, { limits: { compressedBytes: PRIVATE_PUBLICATION_MAX_BYTES } });
+  const manifest = inspected.entries.find((entry) => entry.path === "skill.json");
+  if (!manifest || manifest.bytes.length > 16384 || !(await verifyContentHashFromEntries(inspected.entries)).valid)
+    throw new PrivatePublicationError("PUBLICATION_BUNDLE_INVALID", "The skill must have a valid skill.json with its current content hash. Validate the skill before publishing.");
+  const manifestText = new TextDecoder("utf-8", { fatal: true }).decode(manifest.bytes);
+  const declaration = checkedPublicationDeclaration({
+    idempotencyKey: input.idempotencyKey ?? randomUUID6(),
+    version: JSON.parse(manifestText).version,
+    expectedCurrentVersionId: input.expectedCurrentVersionId,
+    manifestText,
+    archiveSha256: inspected.sha256,
+    archiveByteSize: packed.bytes.length
+  });
+  const receipt = {
+    contractVersion: 1,
+    apiOrigin: client.apiOrigin,
+    organizationId: client.organizationId,
+    userId: client.userId,
+    membershipId: client.membershipId,
+    skillId: input.skillId,
+    declaration,
+    phase: "prepared",
+    intent: null
+  };
+  if (!isAbsolute5(recoveryDirectory) || resolve4(recoveryDirectory) !== recoveryDirectory || realpathSync2(dirname10(recoveryDirectory)) !== dirname10(recoveryDirectory))
+    return fail();
+  mkdirSync8(recoveryDirectory, { mode: 448 });
+  safeDirectory(recoveryDirectory);
+  const parent = openSync3(dirname10(recoveryDirectory), constants2.O_RDONLY | constants2.O_NOFOLLOW);
+  try {
+    fsyncSync(parent);
+  } finally {
+    closeSync3(parent);
+  }
+  writeOwned(recoveryDirectory, "bundle.tgz", packed.bytes);
+  save(recoveryDirectory, receipt);
+  return receipt;
+}
+function privatePublicationResult(directory, receipt) {
+  const state = receipt.intent?.state ?? receipt.phase, committed = state === "committed";
+  const nextAction = committed ? "The version is published. Private execution remains unavailable." : ["rejected", "cancelled", "expired"].includes(state) ? "This intent is terminal. Inspect the result before explicitly preparing another version." : state === "needs_attention" ? "Keep this intent and contact the service operator; do not create a replacement or upload again." : receipt.phase === "upload_uncertain" ? "Run publication resume with this recovery directory to finalize the same intent without another upload." : receipt.intent ? "Run publication status or resume with this recovery directory; cancel explicitly if you want to stop." : "Run publication resume with this recovery directory to reconcile the identical request key and declaration.";
+  return {
+    recoveryDirectory: directory,
+    skillId: receipt.skillId,
+    intentId: receipt.intent?.id ?? null,
+    state,
+    versionId: receipt.intent?.versionId ?? null,
+    committed,
+    executionEnabled: false,
+    nextAction
+  };
+}
+async function continuePrivatePublication(client, directory, options) {
+  if (options.confirm !== true)
+    throw new PrivatePublicationError("PUBLICATION_CONFIRM_REQUIRED", "Explicit upload confirmation is required.");
+  if (options.waitMs !== undefined && (!Number.isSafeInteger(options.waitMs) || options.waitMs < 0 || options.waitMs > 300000))
+    return fail();
+  return locked(directory, () => continueLocked(client, directory, options));
+}
+async function continueLocked(client, directory, options) {
+  const { receipt, bytes } = readPrivatePublicationRecovery(directory);
+  bind(client, receipt);
+  if (!receipt.intent) {
+    receipt.phase = "begin_uncertain";
+    save(directory, receipt);
+    receipt.intent = await client.begin(receipt.skillId, receipt.declaration);
+    receipt.phase = "awaiting_upload";
+    save(directory, receipt);
+  } else {
+    receipt.intent = checkedPublicationView(await client.get(receipt.skillId, receipt.intent.id), receipt.skillId, receipt.intent.id, receipt.declaration);
+    save(directory, receipt);
+  }
+  if (receipt.intent.state === "awaiting_upload") {
+    if (receipt.phase === "awaiting_upload") {
+      receipt.phase = "upload_uncertain";
+      save(directory, receipt);
+      try {
+        await client.upload(receipt.skillId, receipt.intent, bytes);
+      } catch (error) {
+        if (error instanceof PrivatePublicationError && !error.uncertain) {
+          receipt.phase = "awaiting_upload";
+          save(directory, receipt);
+        }
+        throw error;
+      }
+      receipt.phase = "uploaded";
+      save(directory, receipt);
+    }
+    receipt.phase = "finalize_uncertain";
+    save(directory, receipt);
+    receipt.intent = checkedPublicationView(await client.finalize(receipt.skillId, receipt.intent.id), receipt.skillId, receipt.intent.id, receipt.declaration);
+    receipt.phase = "observed";
+    save(directory, receipt);
+  }
+  if (options.waitMs !== undefined && options.waitMs > 0 && ["queued", "verifying"].includes(receipt.intent.state)) {
+    receipt.intent = checkedPublicationView(await client.wait(receipt.skillId, receipt.intent.id, { timeoutMs: options.waitMs }), receipt.skillId, receipt.intent.id, receipt.declaration);
+    receipt.phase = "observed";
+    save(directory, receipt);
+  }
+  return privatePublicationResult(directory, receipt);
+}
+async function inspectPrivatePublication(client, directory, cancel = false) {
+  return locked(directory, () => inspectLocked(client, directory, cancel));
+}
+async function inspectLocked(client, directory, cancel) {
+  const { receipt } = readPrivatePublicationRecovery(directory);
+  bind(client, receipt);
+  if (receipt.intent) {
+    receipt.intent = checkedPublicationView(await (cancel ? client.cancel(receipt.skillId, receipt.intent.id) : client.get(receipt.skillId, receipt.intent.id)), receipt.skillId, receipt.intent.id, receipt.declaration);
+    save(directory, receipt);
+  } else if (cancel)
+    throw new PrivatePublicationError("PUBLICATION_INTENT_UNKNOWN", "Reconcile the saved begin request with publication resume before cancelling its intent.");
+  return privatePublicationResult(directory, receipt);
+}
 export {
-  ArtifactStorage,
-  CLIENT_TOKEN_BYTES,
-  CONTENT_HASH_LIMITS,
-  ContentHashInputError,
-  DEFAULT_IMAGE_PROFILES,
-  DEFAULT_OUTPUT_GOVERNANCE,
-  DEFAULT_RUN_LIMITS,
-  DEFAULT_RUN_POLICY,
-  DEFAULT_RUN_QUOTA,
-  DEFAULT_SPEND_CEILINGS,
-  DispatcherNotImplementedError,
-  E2B_LANE_STATUS,
-  E2bDispatcher,
-  EXECUTION_PROTOCOL_VERSION,
-  EcsDispatcher,
-  GOVERNANCE_ERROR_CODES,
-  GovernanceError,
-  HostedApiError,
-  ImageProfileResolutionError,
-  InvitationEmailInputError,
-  LEGAL_TRANSITIONS,
-  MemoryGovernanceStore,
-  MemoryRunExecutionStore,
-  MemorySkillsStore,
-  MissingSkillsFleetError,
-  PostgresGovernanceStore,
-  PostgresSkillsStore,
-  REMOTE_SKILL_RUN_CONTRACT_VERSION,
-  RUN_LIFECYCLE_EVENT_FIELDS,
-  RUN_LIFECYCLE_EVENT_TYPES,
-  RUN_PROTOCOL_STATES,
-  RUN_PROTOCOL_VERSION,
-  RemoteCapabilityUnavailableError,
-  RemoteCreditApprovalError,
-  RemoteInvitationEmailError,
-  RemoteInvitationEmailUnconfirmedError,
-  RemoteQuoteUnavailableError,
-  RemoteRequestError,
-  RemoteRouteUnsupportedError,
-  RemoteSkillsAuthClient,
-  RemoteSkillsClient,
-  RemoteWorkspaceInvitationError,
-  RemoteWorkspaceInvitationReadError,
-  RemoteWorkspaceInvitationUnconfirmedError,
-  RemoteWorkspaceLeaveError,
-  RemoteWorkspaceLeaveUnconfirmedError,
-  RemoteWorkspaceMemberError,
-  RemoteWorkspaceSelectionError,
-  SKILLS_API_KEY_ENV,
-  SKILLS_API_URL_ENV,
-  SKILLS_APP,
-  SKILLS_LOCAL_OPT_IN_ENV_KEYS,
-  SKILL_BUNDLE_INSPECTION_LIMITS,
-  SkillBundleInspectionError,
-  SkillsFleetCredentialError,
-  SqliteGovernanceStore,
-  SqliteRunExecutionStore,
-  SqliteSkillsStore,
-  WorkspaceContextInputError,
-  WorkspaceIdentityMismatchError,
-  WorkspaceInvitationInputError,
-  WorkspaceLeaveInputError,
-  artifactStorageSeam,
-  assertDurableStore,
-  assertDurableTarget,
-  attemptIdOf,
-  buildRunLifecycleEvent,
-  bundledRegistry,
-  canonicalJson,
-  canonicalSystemDepsKey,
-  clientTokenFor,
-  computeContentHashFromEntries,
-  configuredSkillsApiUrl,
-  createAwsEcsClient,
-  createCancelService,
-  createGovernanceStore,
-  createGovernedArtifactWriter,
-  createImageProfileRegistry,
-  createOfflineGate,
-  createReceiptService,
-  createRemoteSkillsClient,
-  createRunEventEmitter,
-  createRunService,
-  createRunStateMachine,
-  createServer,
-  createSkillsFetchHandler,
-  createSpendService,
-  createStore,
-  createSubmitRunService,
-  currentVersionService,
-  dependencyLayerRule,
-  digestInput,
-  executeRun,
-  expireArtifacts,
-  expiresAtFor,
-  getServerSkill,
-  getServerSkillMd,
-  inspectSkillBundle,
-  isActiveStatus,
-  isSkillsLocalOptIn,
-  isTerminalStatus,
-  isValidSkillSlug,
-  leaseGenerationOf,
-  listServerSkills,
-  localRunExecutor,
-  newRunId,
-  normalizeRemoteSkillRunContract,
-  normalizeSkillsApiOrigin,
-  noticeLocalSkillsMode,
-  packSkillBundle,
-  protocolStateOf,
-  receiptId,
-  redactRunOutput,
-  registerRoutes,
-  requestDigestFor,
-  requireSkillsApiOrigin,
-  requireSkillsFleet,
-  reservationId,
-  resolveDatabaseTarget,
-  resolveImageProfile,
-  resolveServerConfig,
-  resolveSkillsApiOrigin,
-  resolveSkillsFleet,
-  revisionIdOf,
-  runAdmissionSchema,
-  runLeaseSchema,
-  runPointersOf,
-  runProtocolSchema,
-  runTerminalSchema,
-  selectsSkillsLocalMode,
-  settleRun,
-  skillsCredentialFilePath,
-  skillsCredentialFiles,
-  skillsCredentialOrReason,
-  skillsServeLimits,
-  startSkillsServer,
-  startedByFor,
+  verifyContentHashFromEntries,
   validateRunLifecycleEvent,
-  verifyContentHashFromEntries
+  startedByFor,
+  startSkillsServer,
+  skillsServeLimits,
+  skillsCredentialOrReason,
+  skillsCredentialFiles,
+  skillsCredentialFilePath,
+  settleRun,
+  selectsSkillsLocalMode,
+  runTerminalSchema,
+  runProtocolSchema,
+  runPointersOf,
+  runLeaseSchema,
+  runAdmissionSchema,
+  revisionIdOf,
+  resolveSkillsFleet,
+  resolveSkillsApiOrigin,
+  resolveServerConfig,
+  resolveImageProfile,
+  resolveDatabaseTarget,
+  reservationId,
+  requireSkillsFleet,
+  requireSkillsApiOrigin,
+  requestDigestFor,
+  registerRoutes,
+  redactRunOutput,
+  receiptId,
+  readPrivatePublicationRecovery,
+  protocolStateOf,
+  preparePrivatePublication,
+  packSkillBundle,
+  noticeLocalSkillsMode,
+  normalizeSkillsApiOrigin,
+  normalizeRemoteSkillRunContract,
+  newRunId,
+  localRunExecutor,
+  listServerSkills,
+  leaseGenerationOf,
+  isValidSkillSlug,
+  isTerminalStatus,
+  isSkillsLocalOptIn,
+  isActiveStatus,
+  inspectSkillBundle,
+  inspectPrivatePublication,
+  getServerSkillMd,
+  getServerSkill,
+  expiresAtFor,
+  expireArtifacts,
+  executeRun,
+  digestInput,
+  dependencyLayerRule,
+  currentVersionService,
+  createSubmitRunService,
+  createStore,
+  createSpendService,
+  createSkillsFetchHandler,
+  createServer,
+  createRunStateMachine,
+  createRunService,
+  createRunEventEmitter,
+  createRemoteSkillsClient,
+  createReceiptService,
+  createOfflineGate,
+  createImageProfileRegistry,
+  createGovernedArtifactWriter,
+  createGovernanceStore,
+  createCancelService,
+  createAwsEcsClient,
+  continuePrivatePublication,
+  configuredSkillsApiUrl,
+  computeContentHashFromEntries,
+  clientTokenFor,
+  canonicalSystemDepsKey,
+  canonicalJson,
+  bundledRegistry,
+  buildRunLifecycleEvent,
+  attemptIdOf,
+  assertDurableTarget,
+  assertDurableStore,
+  artifactStorageSeam,
+  WorkspaceLeaveInputError,
+  WorkspaceInvitationInputError,
+  WorkspaceIdentityMismatchError,
+  WorkspaceContextInputError,
+  SqliteSkillsStore,
+  SqliteRunExecutionStore,
+  SqliteGovernanceStore,
+  SkillsFleetCredentialError,
+  SkillBundleInspectionError,
+  SKILL_BUNDLE_INSPECTION_LIMITS,
+  SKILLS_LOCAL_OPT_IN_ENV_KEYS,
+  SKILLS_APP,
+  SKILLS_API_URL_ENV,
+  SKILLS_API_KEY_ENV,
+  RemoteWorkspaceSelectionError,
+  RemoteWorkspaceMemberError,
+  RemoteWorkspaceLeaveUnconfirmedError,
+  RemoteWorkspaceLeaveError,
+  RemoteWorkspaceInvitationUnconfirmedError,
+  RemoteWorkspaceInvitationReadError,
+  RemoteWorkspaceInvitationError,
+  RemoteSkillsClient,
+  RemoteSkillsAuthClient,
+  RemoteRouteUnsupportedError,
+  RemoteRequestError,
+  RemoteQuoteUnavailableError,
+  RemotePrivatePublicationsClient,
+  RemoteInvitationEmailUnconfirmedError,
+  RemoteInvitationEmailError,
+  RemoteCreditApprovalError,
+  RemoteCapabilityUnavailableError,
+  RUN_PROTOCOL_VERSION,
+  RUN_PROTOCOL_STATES,
+  RUN_LIFECYCLE_EVENT_TYPES,
+  RUN_LIFECYCLE_EVENT_FIELDS,
+  REMOTE_SKILL_RUN_CONTRACT_VERSION,
+  PrivatePublicationError,
+  PostgresSkillsStore,
+  PostgresGovernanceStore,
+  PRIVATE_PUBLICATION_MAX_BYTES,
+  MissingSkillsFleetError,
+  MemorySkillsStore,
+  MemoryRunExecutionStore,
+  MemoryGovernanceStore,
+  LEGAL_TRANSITIONS,
+  InvitationEmailInputError,
+  ImageProfileResolutionError,
+  HostedApiError,
+  GovernanceError,
+  GOVERNANCE_ERROR_CODES,
+  EcsDispatcher,
+  EXECUTION_PROTOCOL_VERSION,
+  E2bDispatcher,
+  E2B_LANE_STATUS,
+  DispatcherNotImplementedError,
+  DEFAULT_SPEND_CEILINGS,
+  DEFAULT_RUN_QUOTA,
+  DEFAULT_RUN_POLICY,
+  DEFAULT_RUN_LIMITS,
+  DEFAULT_OUTPUT_GOVERNANCE,
+  DEFAULT_IMAGE_PROFILES,
+  ContentHashInputError,
+  CONTENT_HASH_LIMITS,
+  CLIENT_TOKEN_BYTES,
+  ArtifactStorage
 };