@hasna/skills 0.8.11 → 0.8.12

package/dist/sdk/index.js

@@ -8209,7 +8209,7 @@ var require_client = __commonJS((exports) => {
     };
   };
   var sleep = (seconds) => {
-    return new Promise((resolve16) => setTimeout(resolve16, seconds * 1000));
+    return new Promise((resolve17) => setTimeout(resolve17, seconds * 1000));
   };
   var waiterServiceDefaults = {
     minDelay: 2,
@@ -8338,8 +8338,8 @@ var require_client = __commonJS((exports) => {
   };
   var abortTimeout = (abortSignal) => {
     let onAbort;
-    const promise = new Promise((resolve16) => {
-      onAbort = () => resolve16({ state: WaiterState.ABORTED });
+    const promise = new Promise((resolve17) => {
+      onAbort = () => resolve17({ state: WaiterState.ABORTED });
       if (typeof abortSignal.addEventListener === "function") {
         abortSignal.addEventListener("abort", onAbort);
       } else {
@@ -9004,7 +9004,7 @@ var require_client = __commonJS((exports) => {
 var require_config = __commonJS((exports) => {
   var { homedir: homedir6 } = __require("os");
   var { sep: sep7, join: join4 } = __require("path");
-  var { createHash: createHash16 } = __require("crypto");
+  var { createHash: createHash17 } = __require("crypto");
   var { readFile: readFile$1 } = __require("fs/promises");
   var { IniSectionType } = require_dist_cjs();
   var { normalizeProvider } = require_client();
@@ -9159,7 +9159,7 @@ var require_config = __commonJS((exports) => {
   var DEFAULT_PROFILE = "default";
   var getProfileName = (init) => init.profile || process.env[ENV_PROFILE] || DEFAULT_PROFILE;
   var getSSOTokenFilepath = (id2) => {
-    const hasher = createHash16("sha1");
+    const hasher = createHash17("sha1");
     const cacheName = hasher.update(id2).digest("hex");
     return join4(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
   };
@@ -9311,11 +9311,11 @@ var require_config = __commonJS((exports) => {
   };
   function getSelectorName(functionString) {
     try {
-      const constants11 = new Set(Array.from(functionString.match(/([A-Z_]){3,}/g) ?? []));
-      constants11.delete("CONFIG");
-      constants11.delete("CONFIG_PREFIX_SEPARATOR");
-      constants11.delete("ENV");
-      return [...constants11].join(", ");
+      const constants12 = new Set(Array.from(functionString.match(/([A-Z_]){3,}/g) ?? []));
+      constants12.delete("CONFIG");
+      constants12.delete("CONFIG_PREFIX_SEPARATOR");
+      constants12.delete("ENV");
+      return [...constants12].join(", ");
     } catch (ignored) {
       return functionString;
     }
@@ -9477,7 +9477,7 @@ var require_config = __commonJS((exports) => {
   };
   var imdsRequest = async (options) => {
     const { request: request2 } = __require("http");
-    return new Promise((resolve16, reject) => {
+    return new Promise((resolve17, reject) => {
       const req = request2({
         hostname: options.hostname,
         port: options.port,
@@ -9505,7 +9505,7 @@ var require_config = __commonJS((exports) => {
         const chunks = [];
         res.on("data", (chunk) => chunks.push(chunk));
         res.on("end", () => {
-          resolve16(Buffer.concat(chunks));
+          resolve17(Buffer.concat(chunks));
           req.destroy();
         });
       });
@@ -10511,10 +10511,10 @@ var require_endpoints = __commonJS((exports) => {
 
 // node_modules/@smithy/core/dist-cjs/submodules/serde/index.js
 var require_serde = __commonJS((exports) => {
-  var { createHmac: createHmac2, createHash: createHash16, getRandomValues } = __require("crypto");
+  var { createHmac: createHmac2, createHash: createHash17, getRandomValues } = __require("crypto");
   var { hasOwn: hasOwn2, HttpResponse } = require_transport();
   exports.hasOwn = hasOwn2;
-  var { ReadStream, lstatSync: lstatSync19, fstatSync: fstatSync4 } = __require("fs");
+  var { ReadStream, lstatSync: lstatSync20, fstatSync: fstatSync4 } = __require("fs");
   var { toEndpointV1 } = require_endpoints();
   var { Readable, Writable, PassThrough } = __require("stream");
   var isArrayBuffer = (arg) => typeof ArrayBuffer === "function" && arg instanceof ArrayBuffer || Object.prototype.toString.call(arg) === "[object ArrayBuffer]";
@@ -11280,7 +11280,7 @@ var require_serde = __commonJS((exports) => {
       return body.end + 1 - body.start;
     } else if (body instanceof ReadStream) {
       if (body.path != null) {
-        return lstatSync19(body.path).size;
+        return lstatSync20(body.path).size;
       } else if (typeof body.fd === "number") {
         return fstatSync4(body.fd).size;
       }
@@ -11416,7 +11416,7 @@ var require_serde = __commonJS((exports) => {
       return Promise.resolve(this.hash.digest());
     }
     reset() {
-      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash16(this.algorithmIdentifier);
+      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash17(this.algorithmIdentifier);
     }
   }
   function castSourceData(toCast, encoding) {
@@ -11861,7 +11861,7 @@ ${value}\r
     if (isReadableStream(stream)) {
       return headStream$1(stream, bytes);
     }
-    return new Promise((resolve16, reject) => {
+    return new Promise((resolve17, reject) => {
       const collector = new Collector$1;
       collector.limit = bytes;
       stream.pipe(collector);
@@ -11872,7 +11872,7 @@ ${value}\r
       collector.on("error", reject);
       collector.on("finish", function() {
         const bytes2 = concatBytes(this.buffers);
-        resolve16(bytes2);
+        resolve17(bytes2);
       });
     });
   };
@@ -11986,7 +11986,7 @@ ${value}\r
     if (isReadableStream(stream)) {
       return collectReadableStream(stream);
     }
-    return new Promise((resolve16, reject) => {
+    return new Promise((resolve17, reject) => {
       const collector = new Collector;
       const nodeStream = stream;
       nodeStream.pipe(collector);
@@ -11997,7 +11997,7 @@ ${value}\r
       collector.on("error", reject);
       collector.on("finish", function() {
         const bytes = concatBytes(this.bufferedBytes);
-        resolve16(bytes);
+        resolve17(bytes);
       });
     });
   };
@@ -12155,7 +12155,7 @@ var require_checksum = __commonJS((exports) => {
   var { createReadStream } = __require("fs");
   var { Writable } = __require("stream");
   var { toUint8Array, concatBytes } = require_serde();
-  var { createHash: createHash16, createHmac: createHmac2 } = __require("crypto");
+  var { createHash: createHash17, createHmac: createHmac2 } = __require("crypto");
   var zlib = __require("zlib");
   async function blobReader(blob, onChunk, chunkSize = 1024 * 1024) {
     const size = blob.size;
@@ -12189,7 +12189,7 @@ var require_checksum = __commonJS((exports) => {
       callback();
     }
   }
-  var fileStreamHasher = (hashCtor, fileStream) => new Promise((resolve16, reject) => {
+  var fileStreamHasher = (hashCtor, fileStream) => new Promise((resolve17, reject) => {
     if (!isReadStream(fileStream)) {
       reject(new Error("Unable to calculate hash for non-file streams."));
       return;
@@ -12207,7 +12207,7 @@ var require_checksum = __commonJS((exports) => {
     });
     hashCalculator.on("error", reject);
     hashCalculator.on("finish", function() {
-      hash2.digest().then(resolve16).catch(reject);
+      hash2.digest().then(resolve17).catch(reject);
     });
   });
   var isReadStream = (stream) => typeof stream.path === "string";
@@ -12218,14 +12218,14 @@ var require_checksum = __commonJS((exports) => {
     const hash2 = new hashCtor;
     const hashCalculator = new HashCalculator(hash2);
     readableStream.pipe(hashCalculator);
-    return new Promise((resolve16, reject) => {
+    return new Promise((resolve17, reject) => {
       readableStream.on("error", (err) => {
         hashCalculator.end();
         reject(err);
       });
       hashCalculator.on("error", reject);
       hashCalculator.on("finish", () => {
-        hash2.digest().then(resolve16).catch(reject);
+        hash2.digest().then(resolve17).catch(reject);
       });
     });
   };
@@ -12320,7 +12320,7 @@ var require_checksum = __commonJS((exports) => {
   }
   var hasNativeCrypto$1 = (() => {
     try {
-      createHash16("md5");
+      createHash17("md5");
       return true;
     } catch {
       return false;
@@ -12330,7 +12330,7 @@ var require_checksum = __commonJS((exports) => {
   function buildNativeClass$2() {
     return class Md5Node2 {
       digestLength = 16;
-      hash = createHash16("md5");
+      hash = createHash17("md5");
       update(data) {
         this.hash.update(toUint8Array(data));
       }
@@ -12339,7 +12339,7 @@ var require_checksum = __commonJS((exports) => {
         return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
       }
       reset() {
-        this.hash = createHash16("md5");
+        this.hash = createHash17("md5");
       }
     };
   }
@@ -12629,7 +12629,7 @@ var require_checksum = __commonJS((exports) => {
   ]);
   var hasNativeCrypto = (() => {
     try {
-      createHash16("sha256");
+      createHash17("sha256");
       return true;
     } catch {
       return false;
@@ -12669,7 +12669,7 @@ var require_checksum = __commonJS((exports) => {
         this.finished = false;
       }
       createHash() {
-        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash16("sha256");
+        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash17("sha256");
       }
     };
   }
@@ -13334,7 +13334,7 @@ var require_event_streams = __commonJS((exports) => {
       streamEnded = true;
     });
     while (!generationEnded) {
-      const value = await new Promise((resolve16) => setTimeout(() => resolve16(records.shift()), 0));
+      const value = await new Promise((resolve17) => setTimeout(() => resolve17(records.shift()), 0));
       if (value) {
         yield value;
       }
@@ -14852,7 +14852,7 @@ var require_retry = __commonJS((exports) => {
       }
     };
   }
-  var cooldown = (ms) => new Promise((resolve16) => setTimeout(resolve16, ms));
+  var cooldown = (ms) => new Promise((resolve17) => setTimeout(resolve17, ms));
   var isRetryStrategyV2 = (retryStrategy) => typeof retryStrategy.acquireInitialRetryToken !== "undefined" && typeof retryStrategy.refreshRetryTokenForRetry !== "undefined" && typeof retryStrategy.recordSuccess !== "undefined";
   var getRetryErrorInfo = (error, logger) => {
     const errorInfo = {
@@ -14951,7 +14951,7 @@ var require_retry = __commonJS((exports) => {
       this.refillTokenBucket();
       while (amount > this.availableTokens) {
         const delay = (amount - this.availableTokens) / this.fillRate * 1000;
-        await new Promise((resolve16) => DefaultRateLimiter.setTimeoutFn(resolve16, delay));
+        await new Promise((resolve17) => DefaultRateLimiter.setTimeoutFn(resolve17, delay));
         this.refillTokenBucket();
       }
       this.availableTokens = this.availableTokens - amount;
@@ -15293,7 +15293,7 @@ var require_retry = __commonJS((exports) => {
             const delayFromResponse = getDelayFromRetryAfterHeader(err.$response);
             const delay = Math.max(delayFromResponse || 0, delayFromDecider);
             totalDelay += delay;
-            await new Promise((resolve16) => setTimeout(resolve16, delay));
+            await new Promise((resolve17) => setTimeout(resolve17, delay));
             continue;
           }
           if (!err.$metadata) {
@@ -17515,8 +17515,8 @@ More information can be found at: https://a.co/c895JFp`);
   };
   var createUserAgentStringParsingProvider = ({ serviceId, clientVersion }) => async (config) => {
     const module2 = require_es5();
-    const parse6 = module2.parse ?? module2.default.parse ?? (() => "");
-    const parsedUA = typeof window !== "undefined" && window?.navigator?.userAgent ? parse6(window.navigator.userAgent) : undefined;
+    const parse7 = module2.parse ?? module2.default.parse ?? (() => "");
+    const parsedUA = typeof window !== "undefined" && window?.navigator?.userAgent ? parse7(window.navigator.userAgent) : undefined;
     const sections = [
       ["aws-sdk-js", clientVersion],
       ["ua", "2.1"],
@@ -18166,7 +18166,7 @@ ${toHex(hashedRequest)}`;
     return hash2.digest();
   };
   var getCanonicalHeaders = ({ headers }, unsignableHeaders, signableHeaders) => {
-    const canonical3 = {};
+    const canonical4 = {};
     for (const headerName of Object.keys(headers).sort()) {
       if (headers[headerName] == undefined) {
         continue;
@@ -18177,9 +18177,9 @@ ${toHex(hashedRequest)}`;
           continue;
         }
       }
-      canonical3[canonicalHeaderName] = headers[headerName].trim().replace(/\s+/g, " ");
+      canonical4[canonicalHeaderName] = headers[headerName].trim().replace(/\s+/g, " ");
     }
-    return canonical3;
+    return canonical4;
   };
   var getPayloadHash = async ({ headers, body }, hashConstructor) => {
     for (const headerName in headers) {
@@ -18542,7 +18542,7 @@ var require_dist_cjs4 = __commonJS((exports) => {
 var require_util = __commonJS((exports) => {
   var { buildQueryString } = require_protocols();
   var validate = (str) => typeof str === "string" && str.indexOf("arn:") === 0 && str.split(":").length >= 6;
-  var parse6 = (arn) => {
+  var parse7 = (arn) => {
     const segments = arn.split(":");
     if (segments.length < 6 || segments[0] !== "arn")
       throw new Error("Malformed ARN");
@@ -18592,7 +18592,7 @@ var require_util = __commonJS((exports) => {
   }
   exports.build = build;
   exports.formatUrl = formatUrl;
-  exports.parse = parse6;
+  exports.parse = parse7;
   exports.validate = validate;
 });
 
@@ -21700,12 +21700,12 @@ var require_protocols2 = __commonJS((exports) => {
       return expandToDecimal(numericString) === expandToDecimal(String(value));
     }
     const normalized = numericString.replace(/(\.\d*?)0+$/, "$1").replace(/\.$/, "");
-    const canonical3 = String(value);
-    if (normalized === canonical3) {
+    const canonical4 = String(value);
+    if (normalized === canonical4) {
       return true;
     }
-    if (/[eE]/.test(canonical3)) {
-      return normalized === expandToDecimal(canonical3);
+    if (/[eE]/.test(canonical4)) {
+      return normalized === expandToDecimal(canonical4);
     }
     return false;
   }
@@ -24646,7 +24646,7 @@ var init_node_http = () => {};
 
 // node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/httpRequest.js
 function httpRequest(options) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const req = node_http.request({
       method: "GET",
       ...options,
@@ -24671,7 +24671,7 @@ function httpRequest(options) {
         chunks.push(chunk);
       });
       res.on("end", () => {
-        resolve16(Buffer.concat(chunks));
+        resolve17(Buffer.concat(chunks));
         req.destroy();
       });
     });
@@ -25168,21 +25168,21 @@ var require_dist_cjs6 = __commonJS((exports) => {
     let sendBody = true;
     if (!externalAgent && expect === "100-continue") {
       sendBody = await Promise.race([
-        new Promise((resolve16) => {
-          timeoutId = Number(timing.setTimeout(() => resolve16(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
+        new Promise((resolve17) => {
+          timeoutId = Number(timing.setTimeout(() => resolve17(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
         }),
-        new Promise((resolve16) => {
+        new Promise((resolve17) => {
           httpRequest2.on("continue", () => {
             timing.clearTimeout(timeoutId);
-            resolve16(true);
+            resolve17(true);
           });
           httpRequest2.on("response", () => {
             timing.clearTimeout(timeoutId);
-            resolve16(false);
+            resolve17(false);
           });
           httpRequest2.on("error", () => {
             timing.clearTimeout(timeoutId);
-            resolve16(false);
+            resolve17(false);
           });
         })
       ]);
@@ -25259,13 +25259,13 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return socketWarningTimestamp;
     }
     constructor(options) {
-      this.configProvider = new Promise((resolve16, reject) => {
+      this.configProvider = new Promise((resolve17, reject) => {
         if (typeof options === "function") {
           options().then((_options) => {
-            resolve16(this.resolveDefaultConfig(_options));
+            resolve17(this.resolveDefaultConfig(_options));
           }).catch(reject);
         } else {
-          resolve16(this.resolveDefaultConfig(options));
+          resolve17(this.resolveDefaultConfig(options));
         }
       });
     }
@@ -25297,7 +25297,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
           timing.clearTimeout(socketTimeoutId);
           timing.clearTimeout(keepAliveTimeoutId);
         };
-        const resolve16 = async (arg) => {
+        const resolve17 = async (arg) => {
           await writeRequestBodyPromise;
           clearTimeouts();
           _resolve(arg);
@@ -25361,7 +25361,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             headers: getTransformedHeaders(res.headers),
             body: res
           });
-          resolve16({ response: httpResponse });
+          resolve17({ response: httpResponse });
         });
         req.on("error", (err) => {
           if (NODEJS_TIMEOUT_ERROR_CODES.includes(err.code)) {
@@ -25679,7 +25679,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return this.connectOptions === undefined ? http2.connect(url) : http2.connect(url, this.connectOptions);
     }
   }
-  var { constants: constants11 } = http2;
+  var { constants: constants12 } = http2;
 
   class NodeHttp2Handler {
     config;
@@ -25693,13 +25693,13 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return new NodeHttp2Handler(instanceOrOptions);
     }
     constructor(options) {
-      this.configProvider = new Promise((resolve16, reject) => {
+      this.configProvider = new Promise((resolve17, reject) => {
         if (typeof options === "function") {
           options().then((opts) => {
-            resolve16(opts || {});
+            resolve17(opts || {});
           }).catch(reject);
         } else {
-          resolve16(options || {});
+          resolve17(options || {});
         }
       });
     }
@@ -25724,7 +25724,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return new Promise((_resolve, _reject) => {
         let fulfilled = false;
         let writeRequestBodyPromise = undefined;
-        const resolve16 = async (arg) => {
+        const resolve17 = async (arg) => {
           await writeRequestBodyPromise;
           _resolve(arg);
         };
@@ -25770,8 +25770,8 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
         }
         const clientHttp2Stream = session.request({
           ...request2.headers,
-          [constants11.HTTP2_HEADER_PATH]: path,
-          [constants11.HTTP2_HEADER_METHOD]: method
+          [constants12.HTTP2_HEADER_PATH]: path,
+          [constants12.HTTP2_HEADER_METHOD]: method
         });
         if (effectiveRequestTimeout) {
           clientHttp2Stream.setTimeout(effectiveRequestTimeout, () => {
@@ -25809,7 +25809,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             body: clientHttp2Stream
           });
           fulfilled = true;
-          resolve16({ response: httpResponse });
+          resolve17({ response: httpResponse });
           if (useIsolatedSession) {
             session.close();
             clientHttp2Stream.on("end", () => {
@@ -25942,7 +25942,7 @@ var retryWrapper = (toRetry, maxRetries, delayMs) => {
       try {
         return await toRetry();
       } catch (e3) {
-        await new Promise((resolve16) => setTimeout(resolve16, delayMs));
+        await new Promise((resolve17) => setTimeout(resolve17, delayMs));
       }
     }
     return await toRetry();
@@ -29443,10 +29443,10 @@ var require_signin = __commonJS((exports) => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.js
-import { createHash as createHash16, createPrivateKey, createPublicKey, sign } from "crypto";
+import { createHash as createHash17, createPrivateKey, createPublicKey, sign } from "crypto";
 import { promises as fs2 } from "fs";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname17, join as join31 } from "path";
+import { dirname as dirname18, join as join31 } from "path";
 var import_config27, import_protocols3, LoginCredentialsFetcher;
 var init_LoginCredentialsFetcher = __esm(() => {
   import_config27 = __toESM(require_config(), 1);
@@ -29606,7 +29606,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
     }
     async saveToken(token) {
       const tokenFilePath = this.getTokenFilePath();
-      const directory = dirname17(tokenFilePath);
+      const directory = dirname18(tokenFilePath);
       try {
         await fs2.mkdir(directory, { recursive: true });
       } catch (error) {}
@@ -29615,7 +29615,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
     getTokenFilePath() {
       const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join31(homedir6(), ".aws", "login", "cache");
       const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
-      const loginSessionSha256 = createHash16("sha256").update(loginSessionBytes).digest("hex");
+      const loginSessionSha256 = createHash17("sha256").update(loginSessionBytes).digest("hex");
       return join31(directory, `${loginSessionSha256}.json`);
     }
     derToRawSignature(derSignature) {
@@ -31067,7 +31067,7 @@ import { existsSync as existsSync22 } from "fs";
 import { join as join210 } from "path";
 import { existsSync as existsSync16 } from "fs";
 import { homedir as homedir7 } from "os";
-import { join as join35, resolve as resolve16 } from "path";
+import { join as join35, resolve as resolve17 } from "path";
 import { homedir as pathsResolverHomedir2 } from "os";
 import { join as pathsResolverJoin2 } from "path";
 import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual3 } from "crypto";
@@ -31251,9 +31251,9 @@ function exactEventsHome() {
 function getEventsHome() {
   const exact = exactEventsHome();
   if (exact)
-    return resolve16(exact);
+    return resolve17(exact);
   const resolved = resolverHome();
-  return adoptResolverHome(resolved) ? resolve16(resolved) : resolve16(legacyHomeDir());
+  return adoptResolverHome(resolved) ? resolve17(resolved) : resolve17(legacyHomeDir());
 }
 function getEventsDataDir(override) {
   return override || getEventsHome();
@@ -36704,7 +36704,7 @@ async function resolveExecutionGrant(input) {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.11",
+  version: "0.8.12",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -37066,10 +37066,10 @@ async function reconcileSkillSession(input, options = {}) {
   return { applied: true, plan, planDigest, ...result };
 }
 // src/lib/selected-run.ts
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 import { spawn } from "child_process";
 import { mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync8, realpathSync as realpathSync7 } from "fs";
-import { dirname as dirname16, join as join30, resolve as resolve15 } from "path";
+import { dirname as dirname17, join as join30, resolve as resolve16 } from "path";
 import { tmpdir, hostname as stationHostname2 } from "os";
 
 // src/lib/dependency-preparation.ts
@@ -37292,7 +37292,7 @@ import { homedir as homedir5 } from "os";
 import {
   cpSync as cpSync2,
   existsSync as existsSync10,
-  lstatSync as lstatSync18,
+  lstatSync as lstatSync19,
   mkdirSync as mkdirSync8,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync16,
@@ -37303,12 +37303,12 @@ import {
   writeFileSync as writeFileSync6
 } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename as basename7, dirname as dirname15, join as join25 } from "path";
+import { basename as basename9, dirname as dirname16, join as join25 } from "path";
 
 // src/lib/agent-integration.ts
-import { createHash as createHash13, randomUUID as randomUUID3 } from "crypto";
-import { existsSync as existsSync6, lstatSync as lstatSync16, statSync as statSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync13, readdirSync as readdirSync7, opendirSync as opendirSync5, readlinkSync as readlinkSync2, realpathSync as realpathSync4, renameSync as renameSync3, rmdirSync as rmdirSync3, writeFileSync as writeFileSync3, unlinkSync as unlinkSync4, chmodSync, openSync as openSync14, closeSync as closeSync14, fsyncSync as fsyncSync3, fstatSync as fstatSync14, readSync as readSync9, constants as constants10, linkSync as linkSync2 } from "fs";
-import { dirname as dirname12, join as join21, resolve as resolve13, relative as relative3, isAbsolute as isAbsolute14, sep as sep4 } from "path";
+import { createHash as createHash14, randomUUID as randomUUID3 } from "crypto";
+import { existsSync as existsSync6, lstatSync as lstatSync17, statSync as statSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync13, readdirSync as readdirSync7, opendirSync as opendirSync5, readlinkSync as readlinkSync2, realpathSync as realpathSync4, renameSync as renameSync3, rmdirSync as rmdirSync3, writeFileSync as writeFileSync3, unlinkSync as unlinkSync4, chmodSync, openSync as openSync15, closeSync as closeSync15, fsyncSync as fsyncSync3, fstatSync as fstatSync15, readSync as readSync10, constants as constants11, linkSync as linkSync2 } from "fs";
+import { dirname as dirname13, join as join21, resolve as resolve14, relative as relative3, isAbsolute as isAbsolute15, sep as sep4 } from "path";
 import { homedir as homedir3 } from "os";
 
 // src/lib/managed-policy.ts
@@ -37382,7 +37382,9 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "claude-settings-v1")
+        requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve3(source.path) === source.path && basename2(source.path) === "settings.json");
       if (source.hashMode === "claude-marketplace-registry")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve3(source.path) === source.path && basename2(source.path) === "known_marketplaces.json");
       if (source.hashMode === "claude-plugin-registry") {
@@ -37536,9 +37538,9 @@ function isOwnedCliBridge(path, expectedPaths) {
 }
 
 // src/lib/agent-discovery.ts
-import { createHash as createHash12 } from "crypto";
-import { lstatSync as lstatSync15, readFileSync as readFileSync12, readdirSync as readdirSync6, realpathSync as realpathSync3 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute13, join as join20, resolve as resolve12, sep as sep3 } from "path";
+import { createHash as createHash13 } from "crypto";
+import { lstatSync as lstatSync16, readFileSync as readFileSync12, readdirSync as readdirSync6, realpathSync as realpathSync3 } from "fs";
+import { basename as basename6, dirname as dirname12, isAbsolute as isAbsolute14, join as join20, resolve as resolve13, sep as sep3 } from "path";
 
 // node_modules/yaml/dist/index.js
 var composer = require_composer();
@@ -39718,8 +39720,228 @@ function captureClaudeMarketplaceRegistry(path, budget = { remaining: 256 * 1024
   return { path, hashMode: "claude-marketplace-registry", sha256: sha2562 };
 }
 
+// src/lib/claude-settings-witness.ts
+import { createHash as createHash12 } from "crypto";
+import { closeSync as closeSync14, constants as constants10, fstatSync as fstatSync14, lstatSync as lstatSync15, openSync as openSync14, readSync as readSync9 } from "fs";
+import { basename as basename5, dirname as dirname11, isAbsolute as isAbsolute13, resolve as resolve12 } from "path";
+var CLAUDE_SETTINGS_WITNESS_LIMITS = Object.freeze({ bytes: 1024 * 1024, rows: 1024, depth: 32, nodes: 65536, stringCharacters: 16384, pathCharacters: 4096 });
+function need3(value, reason) {
+  if (!value)
+    throw new Error(`Claude settings witness ${reason}`);
+}
+function absolutePath2(value) {
+  need3(typeof value === "string" && value.length > 0 && value.length <= CLAUDE_SETTINGS_WITNESS_LIMITS.pathCharacters && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute13(value) && resolve12(value) === value, "requires a normalized absolute path");
+}
+var sameFile2 = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.uid === b.uid && a.gid === b.gid && a.nlink === b.nlink && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs;
+function parents2(path) {
+  const result = [];
+  for (let at = dirname11(path);; at = dirname11(at)) {
+    const stat2 = lstatSync15(at, { bigint: true });
+    need3(stat2.isDirectory() && !stat2.isSymbolicLink(), "path traverses a symlink or non-directory");
+    result.push([at, stat2]);
+    if (at === dirname11(at))
+      return result;
+  }
+}
+function readSettings(path, budget) {
+  absolutePath2(path);
+  need3(basename5(path) === "settings.json", "requires settings.json");
+  need3(Number.isSafeInteger(budget.remaining) && budget.remaining >= 0, "has an invalid byte budget");
+  const ancestors2 = parents2(path), initial = lstatSync15(path, { bigint: true });
+  need3(initial.isFile() && !initial.isSymbolicLink() && initial.size <= BigInt(CLAUDE_SETTINGS_WITNESS_LIMITS.bytes), "is not a bounded regular file");
+  need3(initial.size <= BigInt(budget.remaining), "exceeds its aggregate byte limit");
+  const fd = openSync14(path, constants10.O_RDONLY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
+  try {
+    const opened = fstatSync14(fd, { bigint: true });
+    need3(opened.isFile() && sameFile2(initial, opened), "changed during open");
+    const bytes = Buffer.alloc(Number(opened.size) + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const count = readSync9(fd, bytes, length, bytes.length - length, null);
+      if (!count)
+        break;
+      length += count;
+    }
+    const after = fstatSync14(fd, { bigint: true }), current = lstatSync15(path, { bigint: true });
+    need3(current.isFile() && sameFile2(opened, after) && sameFile2(after, current) && BigInt(length) === opened.size, "changed during read");
+    for (const [ancestor, before] of ancestors2) {
+      const now = lstatSync15(ancestor, { bigint: true });
+      need3(now.isDirectory() && before.dev === now.dev && before.ino === now.ino && before.mode === now.mode, "parent changed during read");
+    }
+    budget.remaining -= length;
+    try {
+      return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes.subarray(0, length));
+    } catch {
+      throw new Error("Claude settings witness is not strict UTF-8");
+    }
+  } finally {
+    closeSync14(fd);
+  }
+}
+function parse6(text2) {
+  let at = 0, nodes = 0;
+  const numberPattern = /-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/y;
+  const space = () => {
+    while (at < text2.length && /[\x20\t\r\n]/.test(text2[at]))
+      at++;
+  };
+  function string() {
+    need3(text2[at] === '"', "contains invalid JSON");
+    const start = at++;
+    while (at < text2.length) {
+      const character = text2[at++];
+      if (character === '"') {
+        let value2;
+        try {
+          value2 = JSON.parse(text2.slice(start, at));
+        } catch {
+          throw new Error("Claude settings witness contains invalid JSON string");
+        }
+        need3(value2.length <= CLAUDE_SETTINGS_WITNESS_LIMITS.stringCharacters, "exceeds its string limit");
+        return value2;
+      }
+      if (character === "\\")
+        at++;
+    }
+    throw new Error("Claude settings witness contains an unterminated JSON string");
+  }
+  function value(depth) {
+    need3(depth <= CLAUDE_SETTINGS_WITNESS_LIMITS.depth && ++nodes <= CLAUDE_SETTINGS_WITNESS_LIMITS.nodes, "exceeds its nesting or node limit");
+    space();
+    const character = text2[at];
+    if (character === '"')
+      return { kind: "string", value: string() };
+    if (character === "{" || character === "[") {
+      at++;
+      space();
+      const object4 = character === "{", end = object4 ? "}" : "]", entries = [], items = [], keys2 = new Set;
+      if (text2[at] !== end)
+        while (true) {
+          if (object4) {
+            space();
+            const key = string();
+            need3(!keys2.has(key), "contains a duplicate JSON key");
+            keys2.add(key);
+            space();
+            need3(text2[at++] === ":", "contains invalid JSON");
+            entries.push([key, value(depth + 1)]);
+          } else
+            items.push(value(depth + 1));
+          space();
+          if (text2[at] === end)
+            break;
+          need3(text2[at++] === ",", "contains invalid JSON");
+        }
+      at++;
+      return object4 ? { kind: "object", entries } : { kind: "array", items };
+    }
+    for (const literal of ["true", "false", "null"])
+      if (text2.startsWith(literal, at)) {
+        at += literal.length;
+        return { kind: "literal", value: literal };
+      }
+    numberPattern.lastIndex = at;
+    const number = numberPattern.exec(text2);
+    need3(number, "contains invalid JSON");
+    at += number[0].length;
+    return { kind: "number", value: number[0] };
+  }
+  const root2 = value(0);
+  space();
+  need3(at === text2.length && root2.kind === "object", "requires a JSON object without trailing content");
+  need3(root2.entries.length <= CLAUDE_SETTINGS_WITNESS_LIMITS.rows, "exceeds its settings field limit");
+  return root2;
+}
+var BOOLEAN_PREFERENCES = new Set([
+  "autoScrollEnabled",
+  "axScreenReader",
+  "emojiCompletionEnabled",
+  "prefersReducedMotion",
+  "showTurnDuration",
+  "spinnerTipsEnabled",
+  "syntaxHighlightingDisabled",
+  "terminalProgressBarEnabled",
+  "terminalTitleFromRename",
+  "verbose",
+  "wheelScrollAccelerationEnabled"
+]);
+var ENUM_PREFERENCES = Object.freeze({
+  editorMode: ["normal", "vim"],
+  tui: ["default", "fullscreen"],
+  viewMode: ["default", "verbose", "focus"]
+});
+var BUILTIN_MODEL_SELECTIONS = new Set([
+  "default",
+  "best",
+  "fable",
+  "fable[1m]",
+  "sonnet",
+  "sonnet[1m]",
+  "opus",
+  "opus[1m]",
+  "haiku",
+  "opusplan",
+  "claude-fable-5-1",
+  "claude-fable-5",
+  "claude-fable-5[1m]",
+  "claude-opus-5",
+  "claude-sonnet-5",
+  "claude-haiku-4-5-20251001",
+  "claude-opus-4-6",
+  "claude-sonnet-4-5",
+  "claude-sonnet-4-5-20250929",
+  "claude-opus-4-8",
+  "claude-opus-4-8[1m]",
+  "claude-opus-4-7",
+  "claude-sonnet-4-6",
+  "claude-opus-4-5-20251101",
+  "claude-opus-4-5",
+  "claude-haiku-4-5",
+  "claude-fable-5-1[1m]",
+  "claude-opus-5[1m]",
+  "claude-opus-4-7[1m]",
+  "claude-opus-4-6[1m]",
+  "claude-sonnet-4-6[1m]"
+]);
+function canonical3(value) {
+  if (value.kind === "object")
+    return { kind: "object", entries: value.entries.map(([key, child]) => [key, canonical3(child)]).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0) };
+  if (value.kind === "array")
+    return { kind: "array", items: value.items.map(canonical3) };
+  return value;
+}
+function settingsDigest(text2) {
+  const value = parse6(text2);
+  value.entries = value.entries.filter(([key, child]) => {
+    if (key === "model") {
+      need3(child.kind === "string", "contains an invalid model selection");
+      return !BUILTIN_MODEL_SELECTIONS.has(child.value);
+    }
+    if (BOOLEAN_PREFERENCES.has(key)) {
+      need3(child.kind === "literal" && (child.value === "true" || child.value === "false"), "contains an invalid display preference");
+      return false;
+    }
+    if (Object.hasOwn(ENUM_PREFERENCES, key)) {
+      need3(child.kind === "string" && ENUM_PREFERENCES[key].includes(child.value), "contains an invalid display preference");
+      return false;
+    }
+    return true;
+  });
+  return createHash12("sha256").update("hasna.skills.claude-settings.v1\x00").update(JSON.stringify(canonical3(value))).digest("hex");
+}
+function hashClaudeSettingsReplacement(text2, budget) {
+  need3(typeof text2 === "string", "requires settings text");
+  const bytes = Buffer.byteLength(text2);
+  need3(bytes <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes && Number.isSafeInteger(budget.remaining) && budget.remaining >= bytes, "exceeds its byte limit");
+  budget.remaining -= bytes;
+  return settingsDigest(text2);
+}
+function captureClaudeSettings(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "claude-settings-v1", sha256: settingsDigest(readSettings(path, budget)) };
+}
+
 // src/lib/agent-discovery.ts
-var digest2 = (text2) => createHash12("sha256").update(text2).digest("hex");
+var digest2 = (text2) => createHash13("sha256").update(text2).digest("hex");
 function parseConfig(text2, path, toml = false) {
   try {
     const value = toml ? Bun.TOML.parse(text2) : JSON.parse(text2);
@@ -39731,12 +39953,12 @@ function parseConfig(text2, path, toml = false) {
   }
 }
 function safe4(path) {
-  if (!isAbsolute13(path) || path.includes("\x00"))
+  if (!isAbsolute14(path) || path.includes("\x00"))
     throw new Error("Expected an absolute native discovery path");
-  for (let cursor = path;; cursor = dirname11(cursor)) {
-    if (lstatSync15(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+  for (let cursor = path;; cursor = dirname12(cursor)) {
+    if (lstatSync16(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink native discovery input: ${cursor}`);
-    if (dirname11(cursor) === cursor)
+    if (dirname12(cursor) === cursor)
       break;
   }
 }
@@ -39744,7 +39966,7 @@ function read(path, changes) {
   safe4(path);
   if (changes?.has(path))
     return changes.get(path);
-  const stat2 = lstatSync15(path, { throwIfNoEntry: false });
+  const stat2 = lstatSync16(path, { throwIfNoEntry: false });
   if (!stat2)
     return null;
   if (!stat2.isFile() || stat2.size > 16 * 1024 * 1024)
@@ -39752,6 +39974,14 @@ function read(path, changes) {
   return readFileSync12(path, "utf8");
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
+  if (source.hashMode === "claude-settings-v1") {
+    if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
+      throw new Error("Claude settings witnesses require exact typed metadata");
+    const current = captureClaudeSettings(source.path, budget).sha256;
+    if (current !== source.sha256)
+      throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
+    return changes?.has(source.path) ? hashClaudeSettingsReplacement(changes.get(source.path), budget) : current;
+  }
   if (source.hashMode === "claude-marketplace-registry") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256) || changes?.has(source.path))
       throw new Error("Claude marketplace witnesses require an exact reviewed registry without synthetic changes");
@@ -39809,6 +40039,8 @@ function verifyAgentDiscovery(binding) {
     safe4(root2);
 }
 function assertMarketplaceBinding(binding, source) {
+  if (source.hashMode === "claude-settings-v1" && (binding.agent !== "claude" || binding.method !== "reviewed" || basename6(source.path) !== "settings.json"))
+    throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
   if (source.hashMode === "claude-marketplace-registry" && (binding.agent !== "claude" || binding.method !== "reviewed"))
     throw new Error("Claude marketplace witnesses require explicit reviewed Claude discovery");
 }
@@ -39832,10 +40064,10 @@ function captureDiscoveryPathSources(paths) {
   return paths.map((path) => ({ path, hashMode: "path-bytes", sha256: hashDiscoveryPathFile(path, budget) }));
 }
 function resolveAgentDiscovery(options) {
-  const canonical3 = options.canonical ?? resolve12, home = resolve12(options.home), agent = options.agent;
+  const canonical4 = options.canonical ?? resolve13, home = resolve13(options.home), agent = options.agent;
   const sources = [], roots = new Set, builtinNames = [];
   const witness = (path, format, fields) => {
-    const source = { path: canonical3(path), sha256: null, ...format ? { format, fields } : {} };
+    const source = { path: canonical4(path), sha256: null, ...format ? { format, fields } : {} };
     source.sha256 = projected(source);
     sources.push(source);
     return read(source.path);
@@ -39863,7 +40095,7 @@ function resolveAgentDiscovery(options) {
         continue;
       if (normalized.startsWith("~") && normalized !== "~" && !normalized.startsWith("~/"))
         unresolved("user-specific tilde expansion requires a separate discovery adapter");
-      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join20(home, normalized.slice(2)) : resolve12(home, ".hermes", normalized);
+      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join20(home, normalized.slice(2)) : resolve13(home, ".hermes", normalized);
       safe4(path);
       roots.add(path);
     }
@@ -39872,21 +40104,21 @@ function resolveAgentDiscovery(options) {
     const executable = Bun.which("gemini");
     if (executable) {
       let packageRoot;
-      for (let directory = dirname11(realpathSync3(executable)), depth = 0;depth < 8; directory = dirname11(directory), depth++) {
+      for (let directory = dirname12(realpathSync3(executable)), depth = 0;depth < 8; directory = dirname12(directory), depth++) {
         const path = join20(directory, "package.json"), raw = read(path);
         if (raw !== null && parseConfig(raw, path).name === "@google/gemini-cli") {
           packageRoot = directory;
           witness(path);
           break;
         }
-        if (dirname11(directory) === directory)
+        if (dirname12(directory) === directory)
           break;
       }
       if (!packageRoot)
         unresolved("installed Gemini package layout is not recognized");
       const builtinRoot = join20(packageRoot, "bundle/builtin");
       safe4(builtinRoot);
-      if (!lstatSync15(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
+      if (!lstatSync16(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
         unresolved("installed Gemini builtin root is missing");
       for (const name of readdirSync6(builtinRoot).sort()) {
         const text2 = witness(join20(builtinRoot, name, "SKILL.md"));
@@ -39907,12 +40139,14 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (!review.sources.some((source) => source.path === canonical3(configPath)))
+    if (review.sources.some((source) => source.hashMode === "claude-settings-v1" && source.path !== canonical4(configPath)))
+      throw new Error("Semantic settings witnesses must name the configured Claude configuration source");
+    if (!review.sources.some((source) => source.path === canonical4(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
     return { ...supplied, roots: [...new Set([...roots, ...supplied.roots])].sort(), sources: [...sources, ...review.sources], ...agent === "gemini" ? { builtinNames } : {} };
   }
   function plugin(root2) {
-    root2 = canonical3(root2);
+    root2 = canonical4(root2);
     safe4(root2);
     const manifestPath = join20(root2, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
     const raw = witness(manifestPath);
@@ -39924,7 +40158,7 @@ function resolveAgentDiscovery(options) {
       unresolved("plugin hooks require a separate no-skill-injection review");
     const commands = join20(root2, "commands");
     safe4(commands);
-    if (agent === "claude" && (manifest.commands !== undefined || lstatSync15(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync6(commands).length))
+    if (agent === "claude" && (manifest.commands !== undefined || lstatSync16(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync6(commands).length))
       unresolved("legacy command discovery requires retirement or a dedicated format adapter");
     const rootSkill = witness(join20(root2, "SKILL.md"));
     if (rootSkill !== null)
@@ -39935,18 +40169,18 @@ function resolveAgentDiscovery(options) {
     if (agent === "claude")
       roots.add(join20(root2, "skills"));
     for (const value of declared) {
-      const path = resolve12(root2, value);
+      const path = resolve13(root2, value);
       if (path !== root2 && !path.startsWith(root2 + sep3))
         unresolved("plugin skill path escapes its root");
-      roots.add(path.endsWith(`${sep3}SKILL.md`) ? dirname11(path) : path);
+      roots.add(path.endsWith(`${sep3}SKILL.md`) ? dirname12(path) : path);
     }
   }
   if (agent === "claude") {
     const registrations = witness(join20(home, ".claude/plugins/installed_plugins.json"));
     const installed = registrations === null ? {} : parseConfig(registrations, join20(home, ".claude/plugins/installed_plugins.json")).plugins;
-    const commands = canonical3(join20(home, ".claude/commands"));
+    const commands = canonical4(join20(home, ".claude/commands"));
     safe4(commands);
-    if (lstatSync15(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync6(commands).length)
+    if (lstatSync16(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync6(commands).length)
       unresolved("legacy home command discovery requires a dedicated format adapter");
     for (const [id2, enabled] of Object.entries(config.enabledPlugins ?? {})) {
       if (enabled === false)
@@ -39966,7 +40200,7 @@ function resolveAgentDiscovery(options) {
         unresolved("unsupported plugin enablement");
       const split = id2.lastIndexOf("@"), name = id2.slice(0, split), marketplace = id2.slice(split + 1);
       const market = config.marketplaces?.[marketplace] ?? (marketplace === "personal" ? { source_type: "local", source: home } : undefined);
-      if (split < 1 || market?.source_type !== "local" || typeof market.source !== "string" || !isAbsolute13(market.source))
+      if (split < 1 || market?.source_type !== "local" || typeof market.source !== "string" || !isAbsolute14(market.source))
         unresolved("enabled plugin marketplace is not an explicit local source");
       const catalogText = witness(join20(market.source, ".agents/plugins/marketplace.json"));
       if (catalogText === null)
@@ -39974,7 +40208,7 @@ function resolveAgentDiscovery(options) {
       const catalog = parseConfig(catalogText, join20(market.source, ".agents/plugins/marketplace.json")), matches = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
       if (matches.length !== 1 || matches[0]?.source?.source !== "local" || typeof matches[0]?.source?.path !== "string")
         unresolved("plugin catalog source is missing or ambiguous");
-      plugin(resolve12(market.source, matches[0].source.path));
+      plugin(resolve13(market.source, matches[0].source.path));
     }
   } else if (agent === "opencode") {
     if (witness(join20(home, ".config/opencode/opencode.jsonc")) !== null || witness(join20(home, ".config/opencode/config.json")) !== null)
@@ -39982,18 +40216,18 @@ function resolveAgentDiscovery(options) {
     if ((config.plugin?.length ?? 0) > 0 || config.skills?.urls?.length)
       unresolved("external plugin or remote skill source");
     for (const path of config.skills?.paths ?? []) {
-      if (typeof path !== "string" || !isAbsolute13(path))
+      if (typeof path !== "string" || !isAbsolute14(path))
         unresolved("relative or malformed added skill root");
       roots.add(path);
     }
     const localPlugins = join20(home, ".config/opencode/plugins");
     safe4(localPlugins);
-    if (lstatSync15(localPlugins, { throwIfNoEntry: false }) && readdirSync6(localPlugins).some((name) => name !== "skills-cli.js"))
+    if (lstatSync16(localPlugins, { throwIfNoEntry: false }) && readdirSync6(localPlugins).some((name) => name !== "skills-cli.js"))
       unresolved("additional local plugin hooks require review");
   } else if (agent === "hermes") {
     for (const directory of [join20(home, ".hermes/plugins"), join20(home, ".hermes/hermes-agent")]) {
       safe4(directory);
-      if (lstatSync15(directory, { throwIfNoEntry: false }))
+      if (lstatSync16(directory, { throwIfNoEntry: false }))
         unresolved("installed runtime/plugin discovery requires reviewed source bindings");
     }
     if (Bun.which("hermes") || Object.keys(config.plugins ?? {}).length)
@@ -40003,11 +40237,11 @@ function resolveAgentDiscovery(options) {
       unresolved("custom extension or skill paths");
     const directory = join20(home, ".gemini/extensions");
     safe4(directory);
-    if (lstatSync15(directory, { throwIfNoEntry: false }))
+    if (lstatSync16(directory, { throwIfNoEntry: false }))
       for (const name of readdirSync6(directory)) {
         const root2 = join20(directory, name);
         safe4(root2);
-        if (!lstatSync15(root2)?.isDirectory())
+        if (!lstatSync16(root2)?.isDirectory())
           continue;
         const raw = witness(join20(root2, "gemini-extension.json"));
         if (raw === null)
@@ -40018,7 +40252,7 @@ function resolveAgentDiscovery(options) {
         roots.add(join20(root2, "skills"));
       }
   }
-  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join20(home, ".hermes/plugins"), join20(home, ".hermes/hermes-agent")].map((path) => canonical3(path))) } : {} };
+  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join20(home, ".hermes/plugins"), join20(home, ".hermes/hermes-agent")].map((path) => canonical4(path))) } : {} };
 }
 
 // src/lib/agent-adapters.ts
@@ -40162,7 +40396,7 @@ function disableCodexBundledSkills(text2) {
 }
 
 // src/lib/agent-integration.ts
-var sha = (data) => createHash13("sha256").update(data).digest("hex");
+var sha = (data) => createHash14("sha256").update(data).digest("hex");
 var ROOTS = [
   ["claude", ".claude/skills"],
   ["codex", ".codex/skills"],
@@ -40181,11 +40415,11 @@ var ROOTS = [
   ["copilot", ".github/skills"]
 ];
 function assertSafePath(path) {
-  let cursor = resolve13(path);
+  let cursor = resolve14(path);
   while (true) {
-    if (lstatSync16(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync17(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink path: ${cursor}`);
-    const parent = dirname12(cursor);
+    const parent = dirname13(cursor);
     if (parent === cursor)
       return;
     cursor = parent;
@@ -40194,16 +40428,16 @@ function assertSafePath(path) {
 function readRootAlias(home, agent) {
   assertSafePath(home);
   const realHome = realpathSync4(home), alias = join21(realHome, `.${agent}`);
-  const stat2 = lstatSync16(alias, { throwIfNoEntry: false, bigint: true });
+  const stat2 = lstatSync17(alias, { throwIfNoEntry: false, bigint: true });
   if (!stat2?.isSymbolicLink())
     throw new Error(`Agent root alias changed after planning: ${alias}`);
-  const link = readlinkSync2(alias), targetPath = resolve13(dirname12(alias), link);
+  const link = readlinkSync2(alias), targetPath = resolve14(dirname13(alias), link);
   assertSafePath(targetPath);
-  const targetStat = lstatSync16(targetPath, { throwIfNoEntry: false });
+  const targetStat = lstatSync17(targetPath, { throwIfNoEntry: false });
   if (!targetStat?.isDirectory())
     throw new Error(`Agent root alias must target an existing directory: ${alias}`);
   const target = realpathSync4(targetPath), inside = relative3(realHome, target);
-  if (!inside || inside === ".." || inside.startsWith(`..${sep4}`) || isAbsolute14(inside))
+  if (!inside || inside === ".." || inside.startsWith(`..${sep4}`) || isAbsolute15(inside))
     throw new Error(`Agent root alias target must be inside the real home: ${alias}`);
   return { agent, home: realHome, alias, target, link, aliasIdentity: `${stat2.dev}:${stat2.ino}:${stat2.ctimeNs}`, targetIdentity: `${targetStat.dev}:${targetStat.ino}` };
 }
@@ -40212,14 +40446,14 @@ function rootAliases(home, allowed = false) {
     return [];
   const result = [];
   for (const agent of ["claude", "codex"])
-    if (lstatSync16(join21(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync17(join21(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
       result.push(readRootAlias(home, agent));
   if (result.some((item, index) => result.slice(index + 1).some((other) => item.target === other.target || item.target.startsWith(other.target + sep4) || other.target.startsWith(item.target + sep4))))
     throw new Error("Agent root alias targets must not overlap");
   return result;
 }
 function canonicalAgentPath(path, aliases) {
-  const absolute = resolve13(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep4));
+  const absolute = resolve14(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep4));
   return binding ? join21(binding.target, relative3(binding.alias, absolute)) : absolute;
 }
 function recheckRootAliases(aliases) {
@@ -40233,35 +40467,35 @@ function recheckRootAliases(aliases) {
 }
 function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
   assertSafePath(path);
-  const before = lstatSync16(path);
+  const before = lstatSync17(path);
   if (!before.isFile() || before.size > maximum)
     throw new Error("Unsupported or oversized native skill file");
-  const descriptor = openSync14(path, constants10.O_RDONLY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
+  const descriptor = openSync15(path, constants11.O_RDONLY | constants11.O_NOFOLLOW | constants11.O_NONBLOCK);
   try {
-    const opened = fstatSync14(descriptor);
+    const opened = fstatSync15(descriptor);
     if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size)
       throw new Error("Native skill file changed while reading");
     const bytes = Buffer.allocUnsafe(before.size + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync9(descriptor, bytes, length, bytes.length - length, null);
+      const count = readSync10(descriptor, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    const after = fstatSync14(descriptor);
+    const after = fstatSync15(descriptor);
     if (length !== before.size || after.size !== before.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs)
       throw new Error("Native skill file changed while reading");
     return bytes.subarray(0, length);
   } finally {
-    closeSync14(descriptor);
+    closeSync15(descriptor);
   }
 }
 function treeHash(root2) {
-  const hash2 = createHash13("sha256");
+  const hash2 = createHash14("sha256");
   let bytes = 0, files = 0;
   function visit2(path) {
-    const stat2 = lstatSync16(path);
+    const stat2 = lstatSync17(path);
     if (stat2.isSymbolicLink())
       throw new Error(`Refusing symlink in skill: ${path}`);
     const rel = relative3(root2, path);
@@ -40287,11 +40521,11 @@ function treeHash(root2) {
 function projectAncestorDirectories(projects) {
   const directories = new Set;
   for (const project of projects) {
-    for (let path = resolve13(project), depth = 0;; depth++) {
+    for (let path = resolve14(project), depth = 0;; depth++) {
       if (depth >= 100)
         throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
       directories.add(path);
-      const parent = dirname12(path);
+      const parent = dirname13(path);
       if (parent === path)
         break;
       path = parent;
@@ -40318,10 +40552,10 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       throw new Error("Native skill discovery metadata limit exceeded");
   }
   function emptySiblingCacheAlias(path, parent) {
-    const link = readlinkSync2(path), target = resolve13(parent, link);
-    if (dirname12(target) !== parent || (isAbsolute14(link) ? link !== target : dirname12(link) !== "."))
+    const link = readlinkSync2(path), target = resolve14(parent, link);
+    if (dirname13(target) !== parent || (isAbsolute15(link) ? link !== target : dirname13(link) !== "."))
       return false;
-    if (!lstatSync16(target, { throwIfNoEntry: false })?.isDirectory())
+    if (!lstatSync17(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
     const scan = cacheScans.get(target);
     return Boolean(scan?.complete && !scan.hasSkills && scan.entries <= maxAliasProofEntries);
@@ -40333,7 +40567,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     assertSafePath(path);
     if (!existsSync6(path))
       return scan;
-    const stat2 = lstatSync16(path);
+    const stat2 = lstatSync17(path);
     if (stat2.isFile())
       return scan;
     if (!stat2.isDirectory())
@@ -40352,7 +40586,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       }
       const bridge = !vendor && isOwnedCliBridge(path, bridgePaths);
       const rootAlias = aliases.find((item) => path === item.target || path.startsWith(item.target + sep4));
-      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join21(home, ".codex", "skills", ".system"), aliases) + sep4) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve13(home) } : {}, ...rootAlias ? { rootAlias } : {} });
+      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join21(home, ".codex", "skills", ".system"), aliases) + sep4) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve14(home) } : {}, ...rootAlias ? { rootAlias } : {} });
       return scan;
     }
     if (depth > (vendor ? 32 : 3))
@@ -40379,7 +40613,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       if (isVendor && !options.includeVendor)
         continue;
       const child = join21(path, name);
-      if (isVendor && lstatSync16(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      if (isVendor && lstatSync17(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
         const target = statSync5(child, { throwIfNoEntry: false });
         if (target?.isFile() || pluginCache && target?.isDirectory() && emptySiblingCacheAlias(child, path)) {
           scan.entries++;
@@ -40501,7 +40735,7 @@ function configureHooks(config, agent, command, profileId, nativeReady) {
 function disableCodexSkills(text2, skills, aliases, bridgePath) {
   const bundled = disableCodexBundledSkills(text2);
   let result = bundled;
-  const bridgeSelector = (entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME || typeof entry.path === "string" && [resolve13(bridgePath), resolve13(join21(bridgePath, "SKILL.md"))].includes(canonicalAgentPath(entry.path, aliases));
+  const bridgeSelector = (entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME || typeof entry.path === "string" && [resolve14(bridgePath), resolve14(join21(bridgePath, "SKILL.md"))].includes(canonicalAgentPath(entry.path, aliases));
   const previousConfig = Bun.TOML.parse(bundled).skills?.config;
   if (previousConfig !== undefined && (!Array.isArray(previousConfig) || previousConfig.some((entry) => !entry || typeof entry !== "object" || entry.path !== undefined && entry.name !== undefined)))
     throw new Error("Codex skill controls require one path or name selector per [[skills.config]] entry; review ambiguous entries before running skills hook install");
@@ -40513,7 +40747,7 @@ function disableCodexSkills(text2, skills, aliases, bridgePath) {
     result = result.replace(CODEX_SKILL_CONFIG_SECTIONS, (section) => {
       const parsed = Bun.TOML.parse(section);
       const declared = parsed.skills?.config?.[0];
-      if (!declared || !(skill.enabled && bridgeSelector(declared)) && !(typeof declared.path === "string" && [resolve13(path), resolve13(skill.path)].includes(canonicalAgentPath(declared.path, aliases))))
+      if (!declared || !(skill.enabled && bridgeSelector(declared)) && !(typeof declared.path === "string" && [resolve14(path), resolve14(skill.path)].includes(canonicalAgentPath(declared.path, aliases))))
         return section;
       found = true;
       return /^\s*enabled\s*=/m.test(section) ? section.replace(/^\s*enabled\s*=.*$/m, `enabled = ${skill.enabled}`) : `${section.trimEnd()}
@@ -40631,7 +40865,7 @@ function planAgentIntegration(options) {
     version: CLI_BRIDGE_VERSION,
     digest: CLI_BRIDGE_DIGEST,
     agents: [...new Set([...priorAgents, ...options.agents])].sort(),
-    home: resolve13(home),
+    home: resolve14(home),
     includeVendor: true,
     ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join21(dataDir2, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha(renderHermesSupervisor(bindings.get("hermes").command, bindings.get("hermes").profileId)) } } } : {},
     commands: { ...policy.bridge?.commands, ...Object.fromEntries([...bindings].map(([agent, binding]) => [agent, binding.command])) },
@@ -40648,7 +40882,7 @@ function planAgentIntegration(options) {
 }
 function atomicWrite2(path, content) {
   assertSafePath(path);
-  mkdirSync5(dirname12(path), { recursive: true, mode: 448 });
+  mkdirSync5(dirname13(path), { recursive: true, mode: 448 });
   const temporary = `${path}.skills-${randomUUID3()}`;
   try {
     writeFileSync3(temporary, content, { mode: 384, flag: "wx" });
@@ -40661,10 +40895,10 @@ function atomicWrite2(path, content) {
 function applyAgentIntegration(plan) {
   const policyPath = join21(plan.dataDir, "agent-policy.json");
   assertSafePath(policyPath);
-  const currentText = (path) => resolve13(path) === resolve13(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
+  const currentText = (path) => resolve14(path) === resolve14(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
   readManagedSkillPolicySnapshot(plan.dataDir);
   for (const change of plan.changes)
-    if (resolve13(change.path) === resolve13(policyPath))
+    if (resolve14(change.path) === resolve14(policyPath))
       parseManagedSkillPolicy(change.after);
   const aliases = plan.rootAliases ?? [];
   recheckRootAliases(aliases);
@@ -40694,7 +40928,7 @@ function applyAgentIntegration(plan) {
       recheckRootAliases(aliases);
       if (currentText(change.path) !== change.before)
         throw new Error(`Configuration changed after planning: ${change.path}`);
-      for (let directory = dirname12(change.path);!existsSync6(directory); directory = dirname12(directory))
+      for (let directory = dirname13(change.path);!existsSync6(directory); directory = dirname13(directory))
         createdDirectories.add(directory);
       const after = change.after;
       atomicWrite2(change.path, after);
@@ -40734,11 +40968,11 @@ function applyAgentIntegration(plan) {
 }
 function syncArchiveDirectory(path) {
   assertSafePath(path);
-  const descriptor = openSync14(path, constants10.O_RDONLY | constants10.O_DIRECTORY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
+  const descriptor = openSync15(path, constants11.O_RDONLY | constants11.O_DIRECTORY | constants11.O_NOFOLLOW | constants11.O_NONBLOCK);
   try {
     fsyncSync3(descriptor);
   } finally {
-    closeSync14(descriptor);
+    closeSync15(descriptor);
   }
 }
 function writeArchiveJournal(path, value) {
@@ -40746,18 +40980,18 @@ function writeArchiveJournal(path, value) {
   const temporary = `${path}.skills-${randomUUID3()}`;
   let descriptor;
   try {
-    descriptor = openSync14(temporary, constants10.O_WRONLY | constants10.O_CREAT | constants10.O_EXCL | constants10.O_NOFOLLOW, 384);
+    descriptor = openSync15(temporary, constants11.O_WRONLY | constants11.O_CREAT | constants11.O_EXCL | constants11.O_NOFOLLOW, 384);
     writeFileSync3(descriptor, `${JSON.stringify(value)}
 `);
     fsyncSync3(descriptor);
-    closeSync14(descriptor);
+    closeSync15(descriptor);
     descriptor = undefined;
     renameSync3(temporary, path);
-    syncArchiveDirectory(dirname12(path));
+    syncArchiveDirectory(dirname13(path));
   } finally {
     if (descriptor !== undefined)
-      closeSync14(descriptor);
-    if (lstatSync16(temporary, { throwIfNoEntry: false }))
+      closeSync15(descriptor);
+    if (lstatSync17(temporary, { throwIfNoEntry: false }))
       unlinkSync4(temporary);
   }
 }
@@ -40790,7 +41024,7 @@ function archiveNativeSkills(inventory, options) {
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
-    const stat2 = lstatSync16(entry.archive);
+    const stat2 = lstatSync17(entry.archive);
     if (entry.discoveryOnly ? !stat2.isFile() : !stat2.isDirectory())
       throw new Error("Archive type changed");
     if ((entry.discoveryOnly ? sha(readNativeBytes(entry.archive)) : treeHash(entry.archive)) !== entry.hash)
@@ -40798,14 +41032,14 @@ function archiveNativeSkills(inventory, options) {
   };
   assertSafePath(archiveRoot);
   const created = [];
-  for (let path = archiveRoot;!existsSync6(path); path = dirname12(path))
+  for (let path = archiveRoot;!existsSync6(path); path = dirname13(path))
     created.push(path);
   mkdirSync5(archiveRoot, { recursive: true, mode: 448 });
   try {
     for (const directory of created)
       syncArchiveDirectory(directory);
     if (created.length)
-      syncArchiveDirectory(dirname12(created.at(-1)));
+      syncArchiveDirectory(dirname13(created.at(-1)));
     writeArchiveJournal(receiptPath, journal);
     for (const [index, entry] of selected.entries()) {
       recheckRootAliases(aliases);
@@ -40817,7 +41051,7 @@ function archiveNativeSkills(inventory, options) {
       writeArchiveJournal(receiptPath, journal);
       renameSync3(move.source, move.archive);
       moved.push(move);
-      syncArchiveDirectory(dirname12(move.source));
+      syncArchiveDirectory(dirname13(move.source));
       syncArchiveDirectory(archiveRoot);
       verifyArchive(move);
       move.status = "archived";
@@ -40838,7 +41072,7 @@ function archiveNativeSkills(inventory, options) {
         recheckRootAliases(aliases);
         assertSafePath(entry.source);
         assertSafePath(entry.archive);
-        if (lstatSync16(entry.source, { throwIfNoEntry: false })) {
+        if (lstatSync17(entry.source, { throwIfNoEntry: false })) {
           entry.status = "recovery-required";
           entry.conflict = "source-occupied";
           continue;
@@ -40852,10 +41086,10 @@ function archiveNativeSkills(inventory, options) {
         }
         if (entry.discoveryOnly) {
           linkSync2(entry.archive, entry.source);
-          syncArchiveDirectory(dirname12(entry.source));
+          syncArchiveDirectory(dirname13(entry.source));
           unlinkSync4(entry.archive);
         } else {
-          if (lstatSync16(entry.source, { throwIfNoEntry: false })) {
+          if (lstatSync17(entry.source, { throwIfNoEntry: false })) {
             entry.status = "recovery-required";
             entry.conflict = "source-occupied";
             continue;
@@ -40863,7 +41097,7 @@ function archiveNativeSkills(inventory, options) {
           renameSync3(entry.archive, entry.source);
         }
         entry.status = "restored";
-        syncArchiveDirectory(dirname12(entry.source));
+        syncArchiveDirectory(dirname13(entry.source));
         syncArchiveDirectory(archiveRoot);
       } catch {
         entry.status = "recovery-required";
@@ -40899,13 +41133,13 @@ import {
   statSync as statSync8,
   writeFileSync as writeFileSync5
 } from "fs";
-import { basename as basename6, dirname as dirname14, isAbsolute as isAbsolute15, join as join24, normalize as normalize2, relative as relative5, resolve as resolve14, sep as sep6 } from "path";
+import { basename as basename8, dirname as dirname15, isAbsolute as isAbsolute16, join as join24, normalize as normalize2, relative as relative5, resolve as resolve15, sep as sep6 } from "path";
 
 // src/lib/registry-data/index.ts
 var SKILLS = [];
 
 // src/lib/skill-hash.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 import { existsSync as existsSync7, readdirSync as readdirSync8, readFileSync as readFileSync14, statSync as statSync6 } from "fs";
 import { join as join22, sep as sep5 } from "path";
 var CONTENT_HASH_ALGORITHM = "sha256";
@@ -41029,13 +41263,13 @@ function* bundleHashParts(files) {
   yield new TextEncoder().encode("\x00");
 }
 function hashBundleFiles(files) {
-  const hash2 = createHash14(CONTENT_HASH_ALGORITHM);
+  const hash2 = createHash15(CONTENT_HASH_ALGORITHM);
   for (const part of bundleHashParts(files))
     hash2.update(part);
   return hash2.digest("hex");
 }
 async function hashBundleFilesCooperatively(files, check) {
-  const hash2 = createHash14(CONTENT_HASH_ALGORITHM);
+  const hash2 = createHash15(CONTENT_HASH_ALGORITHM);
   let bytesSinceYield = 0;
   for (const part of bundleHashParts(files)) {
     for (let offset = 0;offset < part.byteLength; offset += 64 * 1024) {
@@ -41044,7 +41278,7 @@ async function hashBundleFilesCooperatively(files, check) {
       hash2.update(chunk);
       bytesSinceYield += chunk.byteLength;
       if (bytesSinceYield >= 256 * 1024) {
-        await new Promise((resolve14) => setImmediate(resolve14));
+        await new Promise((resolve15) => setImmediate(resolve15));
         bytesSinceYield = 0;
       }
     }
@@ -41197,7 +41431,7 @@ async function hashContentEntries(entries, options) {
     const normalized = [];
     let normalizedBytes = 0;
     let manifest;
-    await new Promise((resolve14) => setImmediate(resolve14));
+    await new Promise((resolve15) => setImmediate(resolve15));
     for (const entry of snapshot) {
       check();
       if (!coveredContentPath(entry.path))
@@ -41210,7 +41444,7 @@ async function hashContentEntries(entries, options) {
         contentLimit("Content hash normalized byte limit exceeded");
       normalizedBytes += file.content.byteLength;
       normalized.push(file);
-      await new Promise((resolve14) => setImmediate(resolve14));
+      await new Promise((resolve15) => setImmediate(resolve15));
     }
     normalized.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
     check();
@@ -41418,13 +41652,13 @@ function validateRuntimeContract(manifest, issues, strict) {
 import {
   cpSync,
   existsSync as existsSync8,
-  lstatSync as lstatSync17,
+  lstatSync as lstatSync18,
   mkdirSync as mkdirSync6,
   readFileSync as readFileSync15,
   realpathSync as realpathSync5,
   writeFileSync as writeFileSync4
 } from "fs";
-import { basename as basename5, dirname as dirname13, join as join23, relative as relative4 } from "path";
+import { basename as basename7, dirname as dirname14, join as join23, relative as relative4 } from "path";
 var ANY_SEGMENT_COPY_EXCLUDES = new Set([
   ".git",
   ".DS_Store",
@@ -41474,11 +41708,11 @@ function normalizeNewPortableSkillName(name) {
     throw new Error(`Invalid skill name '${name}'. Include letters or numbers.`);
   return normalized;
 }
-function readPortableSkillManifest(skillPath, fallbackName = basename5(skillPath)) {
+function readPortableSkillManifest(skillPath, fallbackName = basename7(skillPath)) {
   return readManifest(skillPath, fallbackName, normalizePortableSkillName);
 }
 function readPortableSkillManifestForImport(skillPath) {
-  return readManifest(skillPath, basename5(skillPath), normalizeNewPortableSkillName);
+  return readManifest(skillPath, basename7(skillPath), normalizeNewPortableSkillName);
 }
 function readManifest(skillPath, fallbackName, normalizeName) {
   const skillJsonPath = join23(skillPath, "skill.json");
@@ -41671,7 +41905,7 @@ function ensurePortableSkillFiles(skillPath, manifest) {
   };
   const entry = next.commands[0]?.entry ?? "src/index.ts";
   if (entry && !existsSync8(join23(skillPath, entry))) {
-    mkdirSync6(dirname13(join23(skillPath, entry)), { recursive: true });
+    mkdirSync6(dirname14(join23(skillPath, entry)), { recursive: true });
     writeFileSync4(join23(skillPath, entry), renderEntrypoint(next));
   }
   if (!existsSync8(join23(skillPath, "SKILL.md")))
@@ -41776,7 +42010,7 @@ function renameInstructionFrontmatter(content, name) {
   return renamed + content.slice(frontmatter[0].length);
 }
 function copySkillDirectory(source, destination) {
-  const resolvedSource = lstatSync17(source).isSymbolicLink() ? realpathSync5(source) : source;
+  const resolvedSource = lstatSync18(source).isSymbolicLink() ? realpathSync5(source) : source;
   mkdirSync6(destination, { recursive: true });
   cpSync(resolvedSource, destination, {
     recursive: true,
@@ -41789,7 +42023,7 @@ function copySkillDirectory(source, destination) {
         if (isExcludedCopyEntry(segments[i], i === 0))
           return false;
       }
-      if (lstatSync17(src).isSymbolicLink())
+      if (lstatSync18(src).isSymbolicLink())
         return false;
       return true;
     }
@@ -42026,7 +42260,7 @@ function inferPackageCommands(pkg, fallbackName) {
 function readJsonObject(path) {
   const parsed = JSON.parse(readFileSync15(path, "utf-8"));
   if (!isRecord2(parsed))
-    throw new Error(`${basename5(path)} must contain a JSON object`);
+    throw new Error(`${basename7(path)} must contain a JSON object`);
   return parsed;
 }
 function hasPackageDependencies(pkgPath) {
@@ -42200,11 +42434,11 @@ function isSkillCandidate(dir) {
   return existsSync9(join24(dir, "SKILL.md")) || existsSync9(join24(dir, "skill.json")) || existsSync9(join24(dir, "package.json"));
 }
 function physicalImportPath(path) {
-  let ancestor = resolve14(path);
+  let ancestor = resolve15(path);
   const suffix = [];
   while (!existsSync9(ancestor)) {
-    suffix.unshift(basename6(ancestor));
-    ancestor = dirname14(ancestor);
+    suffix.unshift(basename8(ancestor));
+    ancestor = dirname15(ancestor);
   }
   return join24(realpathSync6(ancestor), ...suffix);
 }
@@ -42213,7 +42447,7 @@ function assertDisjointImportPaths(source, destination) {
   const destinationPath = physicalImportPath(destination);
   const contains = (parent, child) => {
     const path = relative5(parent, child);
-    return path === "" || !isAbsolute15(path) && path !== ".." && !path.startsWith(`..${sep6}`);
+    return path === "" || !isAbsolute16(path) && path !== ".." && !path.startsWith(`..${sep6}`);
   };
   if (contains(sourcePath, destinationPath) || contains(destinationPath, sourcePath)) {
     throw new Error("Source and destination skill directories must not overlap");
@@ -42228,8 +42462,8 @@ function portPortableSkill(sourcePath, options = {}) {
   const explicitName = options.name != null;
   const skillName = normalizeNewPortableSkillName(options.name ?? inferred.name);
   if (isOfficialSkillName(skillName) && !options.allowShadow) {
-    const sourceSlug = safeNormalizeName(basename6(absoluteSource));
-    const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename6(absoluteSource)}')` : ""} matches a bundled official skill.`;
+    const sourceSlug = safeNormalizeName(basename8(absoluteSource));
+    const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename8(absoluteSource)}')` : ""} matches a bundled official skill.`;
     throw new Error(`${via} Importing it would shadow the official '${skillName}'. ` + `Pass --name to choose a different name, or --allow-shadow to override deliberately.`);
   }
   assertDisjointImportPaths(absoluteSource, join24(resolvePortableSkillsRoot(options, false), skillName));
@@ -42241,7 +42475,7 @@ function portPortableSkill(sourcePath, options = {}) {
       throw new Error(`Skill '${skillName}' already exists at ${destination}`);
     rmSync2(destination, { recursive: true, force: true });
   }
-  mkdirSync7(dirname14(destination), { recursive: true });
+  mkdirSync7(dirname15(destination), { recursive: true });
   copySkillDirectory(absoluteSource, destination);
   const base = {
     ...inferred,
@@ -42485,7 +42719,7 @@ function safeIsDirectory(path) {
   }
 }
 function isSafeRelativePath2(value) {
-  if (!value.trim() || isAbsolute15(value))
+  if (!value.trim() || isAbsolute16(value))
     return false;
   const normalized = normalize2(value).replace(/\\/g, "/");
   return normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../");
@@ -42512,7 +42746,7 @@ function isSkillsOwnershipMarker(marker) {
 function hasSkillsOwnershipMarker(dir) {
   const path = join25(dir, SYNC_MARKER_FILE);
   try {
-    if (!lstatSync18(path).isFile())
+    if (!lstatSync19(path).isFile())
       return false;
     const marker = JSON.parse(readFileSync16(path, "utf8"));
     return isSkillsOwnershipMarker(marker);
@@ -42738,9 +42972,9 @@ function writeManagedSkillDir(dir, skillMd, options) {
   const action = dirExists ? "update" : "create";
   if (options.dryRun)
     return { action, path: skillMdPath };
-  const parentDir = dirname15(dir);
+  const parentDir = dirname16(dir);
   mkdirSync8(parentDir, { recursive: true });
-  const transactionDir = mkdtempSync2(join25(parentDir, `.hasna-skills-write-${basename7(dir)}-`));
+  const transactionDir = mkdtempSync2(join25(parentDir, `.hasna-skills-write-${basename9(dir)}-`));
   const candidateDir = join25(transactionDir, "candidate");
   const backupDir = join25(transactionDir, "backup");
   const candidateSkillMdPath = join25(candidateDir, "SKILL.md");
@@ -44104,11 +44338,11 @@ async function executeSelectedLocal(selected, options = {}) {
       throw new SkillSelectionError("INVALID_BUNDLE_PATH", "The execution bundle path exceeds its limit.");
     });
     const destination = join30(runDirectory, entry.path);
-    mkdirSync10(dirname16(destination), { recursive: true, mode: 448 });
+    mkdirSync10(dirname17(destination), { recursive: true, mode: 448 });
     writeFileSync8(destination, entry.bytes, { flag: "wx", mode: entry.mode & 511 });
   }
   env.SKILLS_INPUT_JSON = input;
-  env.SKILLS_WORKSPACE_DIR = resolve15(options.cwd ?? process.cwd());
+  env.SKILLS_WORKSPACE_DIR = resolve16(options.cwd ?? process.cwd());
   env.SKILLS_RUN_DIR = runDirectory;
   if (runtime.version) {
     const version = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], "--version"], runDirectory, env, "", Math.min(timeoutMs, 5000));
@@ -44138,7 +44372,7 @@ async function executeSelectedLocal(selected, options = {}) {
     selection: selection2,
     target: "local",
     runtime: runtimeName,
-    inputDigest: `sha256:${createHash15("sha256").update(input).digest("hex")}`,
+    inputDigest: `sha256:${createHash16("sha256").update(input).digest("hex")}`,
     runDirectory,
     ...executionGrant ? { executionGrant } : {},
     ...bindings ? { secretBinding: { schema: bindings.schema, selection: bindings.selection, consumer: bindings.consumer, secretsAuthority: bindings.secretsAuthority, bindings: bindings.bindings } } : {},
@@ -44664,7 +44898,7 @@ var { booleanSelector, SelectorType: SelectorType2 } = require_config();
 var { setFeature: setFeature2 } = require_client2();
 var { httpSigningMiddlewareOptions } = require_dist_cjs2();
 var { Readable } = __require("stream");
-var { validate, parse: parse6 } = require_util();
+var { validate, parse: parse7 } = require_util();
 var { AwsRestXmlProtocol } = require_protocols2();
 var { NormalizedSchema } = require_schema4();
 var CONTENT_LENGTH_HEADER = "content-length";
@@ -53428,7 +53662,7 @@ var import_node_http_handler2 = __toESM(require_dist_cjs6(), 1);
 
 // node_modules/@aws-sdk/checksums/dist-cjs/submodules/sha/index.js
 var { toUint8Array: toUint8Array2, concatBytes } = require_serde();
-var { createHmac: createHmac2, createHash: createHash17 } = __require("crypto");
+var { createHmac: createHmac2, createHash: createHash18 } = __require("crypto");
 var { Sha256: Sha2562, Sha256Js, Sha256Node } = require_checksum();
 var BLOCK2 = 64;
 var DIGEST_LENGTH = 20;
@@ -53597,7 +53831,7 @@ class Sha1Js {
 }
 var hasNativeCrypto = (() => {
   try {
-    createHash17("sha1");
+    createHash18("sha1");
     return true;
   } catch {
     return false;
@@ -53637,7 +53871,7 @@ function buildNativeClass() {
       this.finished = false;
     }
     createHash() {
-      return this.secret ? createHmac2("sha1", toBuffer(this.secret)) : createHash17("sha1");
+      return this.secret ? createHmac2("sha1", toBuffer(this.secret)) : createHash18("sha1");
     }
   };
 }
@@ -54206,10 +54440,10 @@ function assertReservationCents(value, field2) {
 import { Database as Database2 } from "bun:sqlite";
 import { randomUUID as randomUUID8 } from "crypto";
 import { mkdirSync as mkdirSync12 } from "fs";
-import { dirname as dirname20 } from "path";
+import { dirname as dirname21 } from "path";
 
 // src/server/database-url.ts
-import { isAbsolute as isAbsolute16, join as join32 } from "path";
+import { isAbsolute as isAbsolute17, join as join32 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var DEFAULT_SQLITE_FILENAME2 = "server.db";
 var SQLITE_MEMORY_PATH = ":memory:";
@@ -54245,7 +54479,7 @@ function resolveDatabaseTarget(raw) {
     throw new Error(`unsupported database scheme "${scheme}:". Supported: postgres://, postgresql://, sqlite:, file:, ` + `an absolute or relative path to a .db/.sqlite file, ":memory:", or "memory:" (non-durable, tests only). ` + `Leave the setting empty to use the default SQLite database at ${defaultSqlitePath()}.`);
   }
   if (looksLikeSqlitePath(value)) {
-    const path = isAbsolute16(value) ? value : join32(process.cwd(), value);
+    const path = isAbsolute17(value) ? value : join32(process.cwd(), value);
     return { kind: "sqlite", path, durable: true, label: `sqlite (${path})` };
   }
   throw new Error(`could not resolve a database backend from "${value}". Use postgres://\u2026, sqlite:\u2026, an absolute or ` + `relative path ending in ${SQLITE_EXTENSIONS.join("/")}, ":memory:", or leave it empty for the ` + `default SQLite database at ${defaultSqlitePath()}.`);
@@ -54269,7 +54503,7 @@ function sqlitePathFromUrl(value, scheme) {
     }
     return rest.slice(2).replace(/^\/\/+/, "/");
   }
-  return isAbsolute16(rest) ? rest : join32(process.cwd(), rest);
+  return isAbsolute17(rest) ? rest : join32(process.cwd(), rest);
 }
 function looksLikeSqlitePath(value) {
   if (value.includes("/"))
@@ -54477,12 +54711,12 @@ class PostgresSkillSelectionStore {
 // src/server/sqlite-store.ts
 import { randomUUID as randomUUID7 } from "crypto";
 import { mkdirSync as mkdirSync11, readFileSync as readFileSync22, readdirSync as readdirSync12 } from "fs";
-import { dirname as dirname19, join as join34 } from "path";
+import { dirname as dirname20, join as join34 } from "path";
 
 // src/server/auth.ts
-import { createHash as createHash18 } from "crypto";
+import { createHash as createHash19 } from "crypto";
 function hashApiKey(token) {
-  return createHash18("sha256").update(token).digest("hex");
+  return createHash19("sha256").update(token).digest("hex");
 }
 function bearerToken(request2) {
   const header = request2.headers.get("authorization") || "";
@@ -54536,7 +54770,7 @@ function permitsSkillsRoute(principal, method, resource) {
 
 // src/server/migrations-dir.ts
 import { existsSync as existsSync15 } from "fs";
-import { dirname as dirname18, join as join33 } from "path";
+import { dirname as dirname19, join as join33 } from "path";
 var MIGRATION_DIALECTS = ["postgres", "sqlite"];
 var MAX_WALK_UP = 6;
 function findMigrationsRoot(startDirs = defaultStartDirs()) {
@@ -54546,7 +54780,7 @@ function findMigrationsRoot(startDirs = defaultStartDirs()) {
       const candidate2 = join33(dir, "migrations");
       if (MIGRATION_DIALECTS.some((dialect) => existsSync15(join33(candidate2, dialect))))
         return candidate2;
-      const parent = dirname18(dir);
+      const parent = dirname19(dir);
       if (parent === dir)
         break;
       dir = parent;
@@ -54773,10 +55007,10 @@ class SkillVersionExistsError extends Error {
 }
 
 // src/lib/revision.ts
-import { createHash as createHash19 } from "crypto";
+import { createHash as createHash20 } from "crypto";
 var REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
 function revisionIdOf(content) {
-  const canonical3 = JSON.stringify({
+  const canonical4 = JSON.stringify({
     slug: content.slug,
     displayName: content.displayName,
     description: content.description,
@@ -54789,7 +55023,7 @@ function revisionIdOf(content) {
     bundleSha256: content.bundleSha256 ?? null,
     bundleByteSize: content.bundleByteSize ?? null
   });
-  return createHash19("sha256").update(canonical3).digest("hex");
+  return createHash20("sha256").update(canonical4).digest("hex");
 }
 function revisionIdOfRecord(record3) {
   return revisionIdOf(record3);
@@ -54814,7 +55048,7 @@ class SqliteSkillsStore {
   constructor(path = SQLITE_MEMORY_PATH, options = {}) {
     const inMemory = path === SQLITE_MEMORY_PATH;
     if (!inMemory)
-      mkdirSync11(dirname19(path), { recursive: true });
+      mkdirSync11(dirname20(path), { recursive: true });
     this.db = openDatabase(path);
     this.db.exec(`PRAGMA busy_timeout = ${Math.max(0, options.busyTimeoutMs ?? 5000)}`);
     if (!inMemory)
@@ -55521,7 +55755,7 @@ class SqliteGovernanceStore {
   closed = false;
   constructor(path = SQLITE_MEMORY_PATH, options = {}) {
     if (path !== SQLITE_MEMORY_PATH)
-      mkdirSync12(dirname20(path), { recursive: true });
+      mkdirSync12(dirname21(path), { recursive: true });
     this.db = new Database2(path, { create: true, readwrite: true });
     this.db.exec("PRAGMA busy_timeout = 5000");
     this.db.exec("PRAGMA foreign_keys = ON");
@@ -55754,7 +55988,7 @@ function nextMonthPrefix(monthPrefix) {
 }
 
 // src/server/skills-api.ts
-import { createHash as createHash20 } from "crypto";
+import { createHash as createHash21 } from "crypto";
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
 var SHA256_HEX2 = /^[0-9a-f]{64}$/;
 var MAX_SLUG_LENGTH = 128;
@@ -55931,7 +56165,7 @@ async function parsePublishRequest(request2, config) {
     if (bundleBytes.byteLength === 0) {
       throw new SkillRequestError(400, "BUNDLE_EMPTY", "the uploaded bundle is empty");
     }
-    const sha2562 = createHash20("sha256").update(bundleBytes).digest("hex");
+    const sha2562 = createHash21("sha256").update(bundleBytes).digest("hex");
     const claimed = optionalString(manifest.bundleSha256);
     if (claimed)
       assertSha2562(claimed);
@@ -56046,7 +56280,7 @@ async function readPublishedBundle(store, artifactStorage, principal, slug) {
   if (!bytes) {
     throw new SkillRequestError(503, "BUNDLE_BACKEND_UNAVAILABLE", "bundle storage backend unavailable");
   }
-  const actual = createHash20("sha256").update(bytes).digest("hex");
+  const actual = createHash21("sha256").update(bytes).digest("hex");
   if (actual !== record3.bundleSha256) {
     throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}' hashes to ${actual} but was published as ${record3.bundleSha256}`);
   }
@@ -56194,7 +56428,7 @@ async function readSkillVersionBundle(store, artifactStorage, principal, slug, v
   const bytes = await artifactStorage.readBundle(bundle2);
   if (!bytes)
     throw new SkillRequestError(503, "BUNDLE_BACKEND_UNAVAILABLE", "bundle storage backend unavailable");
-  const actual = createHash20("sha256").update(bytes).digest("hex");
+  const actual = createHash21("sha256").update(bytes).digest("hex");
   if (actual !== found.bundleSha256) {
     throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}@${version2}' hashes to ${actual} but was published as ${found.bundleSha256}`);
   }
@@ -56594,7 +56828,7 @@ async function handleProfileApi(store, principal, request2, parts, config) {
 // src/server/runtime-store.ts
 import { Database as Database3 } from "bun:sqlite";
 import { mkdirSync as mkdirSync13 } from "fs";
-import { dirname as dirname21 } from "path";
+import { dirname as dirname22 } from "path";
 
 // src/sdk/execution/types.ts
 var EXECUTION_PROTOCOL_VERSION = REMOTE_SKILL_RUN_CONTRACT_VERSION;
@@ -56650,7 +56884,7 @@ class RuntimeExecutionStore {
     }
     const path = target.kind === "sqlite" ? target.path : ":memory:";
     if (path !== ":memory:")
-      mkdirSync13(dirname21(path), { recursive: true });
+      mkdirSync13(dirname22(path), { recursive: true });
     const db = new Database3(path);
     db.run("PRAGMA busy_timeout=5000");
     db.run("PRAGMA journal_mode=WAL");
@@ -56890,7 +57124,7 @@ class RuntimeExecutionStore {
 }
 
 // src/sdk/execution/admission.ts
-import { createHash as createHash22 } from "crypto";
+import { createHash as createHash23 } from "crypto";
 
 // src/sdk/execution/image-profile.ts
 class ImageProfileResolutionError extends Error {
@@ -57488,11 +57722,11 @@ function ownedAdmission(admission) {
   };
 }
 function digestInput(input) {
-  return createHash22("sha256").update(canonicalJson2(input)).digest("hex");
+  return createHash23("sha256").update(canonicalJson2(input)).digest("hex");
 }
 
 // src/sdk/execution/dispatchers/ecs.ts
-import { createHash as createHash23 } from "crypto";
+import { createHash as createHash24 } from "crypto";
 
 // src/sdk/execution/state-machine.ts
 var LEGAL_TRANSITIONS = {
@@ -60891,13 +61125,13 @@ function observedTask(states, taskArn) {
   return state2.lastStatus === "STOPPED" || LIVE_TASK_STATUSES.has(state2.lastStatus) ? state2 : undefined;
 }
 function clientTokenFor(runId2, attemptId) {
-  return createHash23("sha256").update(`${runId2}\x00${attemptId}`).digest("hex").slice(0, CLIENT_TOKEN_BYTES * 2);
+  return createHash24("sha256").update(`${runId2}\x00${attemptId}`).digest("hex").slice(0, CLIENT_TOKEN_BYTES * 2);
 }
 function startedByFor(runId2, attemptNumber) {
   return `skills-exec/${runId2}/a${attemptNumber}`;
 }
 function requestDigestFor(admission, attemptId) {
-  return createHash23("sha256").update(canonicalJson2({ admission, attemptId })).digest("hex");
+  return createHash24("sha256").update(canonicalJson2({ admission, attemptId })).digest("hex");
 }
 
 class EcsDispatcher {
@@ -61193,7 +61427,7 @@ function validText(value) {
 }
 
 // src/server/runtime-policy.ts
-import { createHash as createHash24, createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash25, createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var RUNTIME_MAX_INPUT_BYTES = 1e5;
 var RUNTIME_MAX_BUNDLE_BYTES = 1e6;
 var RUNTIME_MAX_ARTIFACT_BYTES = 2000000;
@@ -61265,7 +61499,7 @@ function verifyRuntimeToken(token, key, admission, attempt, now = Date.now()) {
   const actual = Buffer.from(token);
   return actual.length === expected.length && timingSafeEqual2(actual, expected);
 }
-var hashBytes = (bytes) => createHash24("sha256").update(bytes).digest("hex");
+var hashBytes = (bytes) => createHash25("sha256").update(bytes).digest("hex");
 
 // src/server/runtime-api.ts
 async function createRuntimeService(options) {
@@ -67247,7 +67481,7 @@ var localRunExecutor = {
 // src/sdk/storage.ts
 var artifactStorageSeam = ArtifactStorage;
 // src/sdk/outputs.ts
-import { createHash as createHash25 } from "crypto";
+import { createHash as createHash26 } from "crypto";
 class DatabaseOnlyObjectStore {
   usesS3 = false;
   async materialize(run, artifact, body4) {
@@ -67294,7 +67528,7 @@ function createGovernedArtifactWriter(options) {
       const stamped = {
         ...meta,
         byteSize: outputBytes,
-        sha256: createHash25("sha256").update(persistedBytes).digest("hex"),
+        sha256: createHash26("sha256").update(persistedBytes).digest("hex"),
         visibility: options.visibility ?? config.defaultVisibility,
         ...config.artifactTtlSeconds !== undefined ? { expiresAt: expiresAtFor(createdAt, config.artifactTtlSeconds) } : {}
       };
@@ -67535,7 +67769,7 @@ __export(exports_external2, {
   pipe: () => pipe,
   partialRecord: () => partialRecord,
   parseAsync: () => parseAsync2,
-  parse: () => parse9,
+  parse: () => parse10,
   overwrite: () => _overwrite,
   output: () => output,
   optional: () => optional,
@@ -67755,7 +67989,7 @@ __export(exports_core2, {
   prettifyError: () => prettifyError,
   parseURLObject: () => parseURLObject,
   parseAsync: () => parseAsync,
-  parse: () => parse7,
+  parse: () => parse8,
   meta: () => meta,
   mergeValues: () => mergeValues2,
   memoizer: () => memoizer,
@@ -69209,7 +69443,7 @@ var _parse = (_Err) => {
   };
   return fn;
 };
-var parse7 = /* @__PURE__ */ _parse($ZodRealError);
+var parse8 = /* @__PURE__ */ _parse($ZodRealError);
 var _parseAsync = (_Err) => {
   const fn = async (schema, value, _ctx, params) => {
     const ctx = _ctx ? { ..._ctx, async: true } : { async: true };
@@ -69280,18 +69514,18 @@ var validateAsync = async (schema, value, _ctx) => {
   return result.issues.length === 0;
 };
 var _encode = (_Err) => {
-  const parse8 = _parse(_Err);
+  const parse9 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
     const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
-    return parse8(schema, value, ctx, finalizeParams(fn, _params));
+    return parse9(schema, value, ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
 var encode = /* @__PURE__ */ _encode($ZodRealError);
 var _decode = (_Err) => {
-  const parse8 = _parse(_Err);
+  const parse9 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
-    return parse8(schema, value, _ctx, finalizeParams(fn, _params));
+    return parse9(schema, value, _ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
@@ -72214,10 +72448,10 @@ var $ZodFunction = /* @__PURE__ */ $constructor("$ZodFunction", (inst, def) => {
       throw new Error("implement() must be called with a function");
     }
     return Object.defineProperty(function(...args) {
-      const parsedArgs = inst._def.input ? parse7(inst._def.input, args) : args;
+      const parsedArgs = inst._def.input ? parse8(inst._def.input, args) : args;
       const result = Reflect.apply(func, this, parsedArgs);
       if (inst._def.output) {
-        return parse7(inst._def.output, result);
+        return parse8(inst._def.output, result);
       }
       return result;
     }, "_zod", { value: inst._zod, enumerable: false });
@@ -83855,7 +84089,7 @@ var ZodRealError = /* @__PURE__ */ $constructor("ZodError", initializer2, undefi
 });
 
 // node_modules/zod/v4/classic/parse.js
-var parse9 = /* @__PURE__ */ _parse(ZodRealError);
+var parse10 = /* @__PURE__ */ _parse(ZodRealError);
 var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse3 = /* @__PURE__ */ _safeParse(ZodRealError);
 var safeParseAsync2 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
@@ -83991,7 +84225,7 @@ var ZodType2 = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
     exports_util.own(this, "~standard", value);
   },
   parse: function _parse2(data, params) {
-    return parse9(this, data, params, { callee: _parse2 });
+    return parse10(this, data, params, { callee: _parse2 });
   },
   parseAsync: async function _parseAsync2(data, params) {
     return await parseAsync2(this, data, params, { callee: _parseAsync2 });
@@ -86061,7 +86295,7 @@ function date4(params) {
   return _coercedDate(ZodDate2, params);
 }
 // src/lib/canonical-json.ts
-import { createHash as createHash26 } from "crypto";
+import { createHash as createHash27 } from "crypto";
 function canonicalJson3(value, maximumBytes = 2 * 1024 * 1024) {
   return canonicalJsonAtDepth(value, maximumBytes, 64);
 }
@@ -86105,7 +86339,7 @@ function canonicalJsonAtDepth(value, maximumBytes, maximumDepth) {
   return visit3(value, 0);
 }
 function canonicalJsonSha256(value, maximumBytes) {
-  return createHash26("sha256").update(canonicalJson3(value, maximumBytes)).digest("hex");
+  return createHash27("sha256").update(canonicalJson3(value, maximumBytes)).digest("hex");
 }
 
 // src/lib/remote-recurring-contract.ts
@@ -87022,10 +87256,10 @@ async function readQuoteUnavailableCode(response) {
   let timer;
   let deadlineExceeded = false;
   const expired = Symbol("quote body deadline");
-  const deadline = new Promise((resolve17) => {
+  const deadline = new Promise((resolve18) => {
     timer = setTimeout(() => {
       deadlineExceeded = true;
-      resolve17(expired);
+      resolve18(expired);
       reader.cancel().catch(() => {});
     }, 1500);
   });
@@ -88144,7 +88378,7 @@ async function requestInvitationEmail(origin, action, input2) {
 }
 
 // src/lib/remote-private-publications.ts
-import { createHash as createHash27 } from "crypto";
+import { createHash as createHash28 } from "crypto";
 var PRIVATE_PUBLICATION_MAX_BYTES = 16 * 1024 * 1024;
 var failures2 = {
   INVALID_REQUEST: [400, "The publication request is invalid."],
@@ -88191,7 +88425,7 @@ var hash3 = (v2) => typeof v2 === "string" && /^[a-f0-9]{64}$/.test(v2);
 var record9 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
 var exact = (v2, keys2) => record9(v2) && Object.keys(v2).sort().join(",") === keys2.sort().join(",");
 var date5 = (v2) => typeof v2 === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v2) && Number.isFinite(Date.parse(v2));
-var publicationSha256 = (bytes) => createHash27("sha256").update(bytes).digest("hex");
+var publicationSha256 = (bytes) => createHash28("sha256").update(bytes).digest("hex");
 function checkedPublicationDeclaration(value) {
   if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash3(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
     return bad();
@@ -88436,12 +88670,12 @@ class RemotePrivatePublicationsClient {
       previous = view;
       if (!["queued", "verifying"].includes(view.state) || Date.now() >= until)
         return view;
-      await new Promise((resolve17) => {
+      await new Promise((resolve18) => {
         const timer = setTimeout(done, Math.min(1000, until - Date.now()));
         function done() {
           clearTimeout(timer);
           options.signal?.removeEventListener("abort", done);
-          resolve17();
+          resolve18();
         }
         options.signal?.addEventListener("abort", done, { once: true });
       });
@@ -88673,23 +88907,23 @@ class RemoteSkillsAuthClient {
   }
 }
 // src/lib/private-publication-recovery.ts
-import { constants as constants11, closeSync as closeSync15, fsyncSync as fsyncSync4, fstatSync as fstatSync15, lstatSync as lstatSync19, mkdirSync as mkdirSync14, openSync as openSync15, readSync as readSync10, realpathSync as realpathSync8, renameSync as renameSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname22, isAbsolute as isAbsolute17, join as join36, resolve as resolve17 } from "path";
+import { constants as constants12, closeSync as closeSync16, fsyncSync as fsyncSync4, fstatSync as fstatSync16, lstatSync as lstatSync20, mkdirSync as mkdirSync14, openSync as openSync16, readSync as readSync11, realpathSync as realpathSync8, renameSync as renameSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname23, isAbsolute as isAbsolute18, join as join36, resolve as resolve18 } from "path";
 import { randomUUID as randomUUID11 } from "crypto";
 var fail = () => {
   throw new PrivatePublicationError("PUBLICATION_RECOVERY_INVALID", "The recovery directory is invalid or changed. Preserve it and inspect the existing intent; do not start a replacement automatically.");
 };
 function safeDirectory(directory) {
-  if (!isAbsolute17(directory) || directory !== resolve17(directory) || realpathSync8(directory) !== directory)
+  if (!isAbsolute18(directory) || directory !== resolve18(directory) || realpathSync8(directory) !== directory)
     return fail();
-  for (let path2 = directory;; path2 = dirname22(path2)) {
-    const stat2 = lstatSync19(path2);
+  for (let path2 = directory;; path2 = dirname23(path2)) {
+    const stat2 = lstatSync20(path2);
     if (!stat2.isDirectory() || stat2.isSymbolicLink())
       return fail();
-    if (path2 === dirname22(path2))
+    if (path2 === dirname23(path2))
       break;
   }
-  const own2 = lstatSync19(directory);
+  const own2 = lstatSync20(directory);
   if ((own2.mode & 63) !== 0 || process.getuid && own2.uid !== process.getuid())
     return fail();
   return { dev: own2.dev, ino: own2.ino };
@@ -88701,35 +88935,35 @@ function unchangedDirectory(directory, identity3) {
 }
 function readOwned(directory, name, max) {
   const identity3 = safeDirectory(directory), file2 = join36(directory, name);
-  const fd = openSync15(file2, constants11.O_RDONLY | constants11.O_NOFOLLOW);
+  const fd = openSync16(file2, constants12.O_RDONLY | constants12.O_NOFOLLOW);
   try {
-    const stat2 = fstatSync15(fd);
+    const stat2 = fstatSync16(fd);
     if (!stat2.isFile() || stat2.nlink !== 1 || stat2.size > max || stat2.size < 1 || (stat2.mode & 63) !== 0 || process.getuid && stat2.uid !== process.getuid())
       return fail();
     const buffer = Buffer.alloc(Math.min(max, stat2.size) + 1);
     let length = 0;
     while (length < buffer.length) {
-      const count = readSync10(fd, buffer, length, buffer.length - length, length);
+      const count = readSync11(fd, buffer, length, buffer.length - length, length);
       if (count === 0)
         break;
       length += count;
     }
-    const bytes = buffer.subarray(0, length), after = fstatSync15(fd);
+    const bytes = buffer.subarray(0, length), after = fstatSync16(fd);
     unchangedDirectory(directory, identity3);
     if (bytes.length !== stat2.size || stat2.size !== after.size || stat2.mtimeMs !== after.mtimeMs || stat2.ctimeMs !== after.ctimeMs)
       return fail();
     return bytes;
   } finally {
-    closeSync15(fd);
+    closeSync16(fd);
   }
 }
 function writeOwned(directory, name, bytes) {
-  const fd = openSync15(join36(directory, name), constants11.O_WRONLY | constants11.O_CREAT | constants11.O_EXCL | constants11.O_NOFOLLOW, 384);
+  const fd = openSync16(join36(directory, name), constants12.O_WRONLY | constants12.O_CREAT | constants12.O_EXCL | constants12.O_NOFOLLOW, 384);
   try {
     writeFileSync9(fd, bytes);
     fsyncSync4(fd);
   } finally {
-    closeSync15(fd);
+    closeSync16(fd);
   }
 }
 function save(directory, value) {
@@ -88738,11 +88972,11 @@ function save(directory, value) {
 `);
   unchangedDirectory(directory, identity3);
   renameSync6(join36(directory, temporary), join36(directory, "receipt.json"));
-  const fd = openSync15(directory, constants11.O_RDONLY | constants11.O_NOFOLLOW);
+  const fd = openSync16(directory, constants12.O_RDONLY | constants12.O_NOFOLLOW);
   try {
     fsyncSync4(fd);
   } finally {
-    closeSync15(fd);
+    closeSync16(fd);
   }
 }
 function bind(client2, receipt) {
@@ -88753,20 +88987,20 @@ async function locked(directory, action) {
   const identity3 = safeDirectory(directory), file2 = join36(directory, "operation.lock");
   let fd;
   try {
-    fd = openSync15(file2, constants11.O_WRONLY | constants11.O_CREAT | constants11.O_EXCL | constants11.O_NOFOLLOW, 384);
+    fd = openSync16(file2, constants12.O_WRONLY | constants12.O_CREAT | constants12.O_EXCL | constants12.O_NOFOLLOW, 384);
   } catch {
     throw new PrivatePublicationError("PUBLICATION_RECOVERY_BUSY", "Another operation holds this recovery directory. If it crashed, confirm that process has stopped before explicitly removing operation.lock and resuming.");
   }
-  const lock = fstatSync15(fd);
+  const lock = fstatSync16(fd);
   try {
     writeFileSync9(fd, JSON.stringify({ pid: process.pid }) + `
 `);
     fsyncSync4(fd);
     return await action();
   } finally {
-    closeSync15(fd);
+    closeSync16(fd);
     unchangedDirectory(directory, identity3);
-    const now2 = lstatSync19(file2);
+    const now2 = lstatSync20(file2);
     if (now2.dev !== lock.dev || now2.ino !== lock.ino || !now2.isFile() || now2.isSymbolicLink())
       fail();
     unlinkSync5(file2);
@@ -88818,15 +89052,15 @@ async function preparePrivatePublication(client2, sourceDirectory, recoveryDirec
     phase: "prepared",
     intent: null
   };
-  if (!isAbsolute17(recoveryDirectory) || resolve17(recoveryDirectory) !== recoveryDirectory || realpathSync8(dirname22(recoveryDirectory)) !== dirname22(recoveryDirectory))
+  if (!isAbsolute18(recoveryDirectory) || resolve18(recoveryDirectory) !== recoveryDirectory || realpathSync8(dirname23(recoveryDirectory)) !== dirname23(recoveryDirectory))
     return fail();
   mkdirSync14(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
-  const parent = openSync15(dirname22(recoveryDirectory), constants11.O_RDONLY | constants11.O_NOFOLLOW);
+  const parent = openSync16(dirname23(recoveryDirectory), constants12.O_RDONLY | constants12.O_NOFOLLOW);
   try {
     fsyncSync4(parent);
   } finally {
-    closeSync15(parent);
+    closeSync16(parent);
   }
   writeOwned(recoveryDirectory, "bundle.tgz", packed.bytes);
   save(recoveryDirectory, receipt);