@hasna/skills 0.8.2 → 0.8.3

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.8.2",
+    version: "0.8.3",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -81403,18 +81403,213 @@ var init_execution_secrets = __esm(() => {
   init_selection_cache();
 });
 
-// src/lib/selected-run.ts
-var exports_selected_run = {};
-__export(exports_selected_run, {
-  resolveSelectedRun: () => resolveSelectedRun,
-  prepareSelectedSecretBindings: () => prepareSelectedSecretBindings,
-  executeSelectedLocal: () => executeSelectedLocal
+// src/lib/execution-grants.ts
+import { posix, win32 } from "path";
+function grantIdentifier(v) {
+  return typeof v === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(v) && !v.includes("..");
+}
+function grantRecord(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function keys2(v, required2, optional2 = []) {
+  return required2.every((k) => Object.hasOwn(v, k)) && Object.keys(v).every((k) => required2.includes(k) || optional2.includes(k));
+}
+function invalid4() {
+  throw new Error("Invalid execution grant policy: use exact selections, named actors and consumers, and vault reference names only.");
+}
+function authority(v) {
+  if (typeof v !== "string" || v.length > 2048 || /[\x00-\x20\x7f]/.test(v))
+    return false;
+  try {
+    const u = new URL(v);
+    return (u.protocol === "https:" || u.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(u.hostname)) && !u.username && !u.password && !u.search && !u.hash && u.pathname.endsWith("/v1") && u.href === v;
+  } catch {
+    return false;
+  }
+}
+function pathFlavor(value) {
+  return value.startsWith("/") ? posix : win32;
+}
+function grantWorkspace(v) {
+  if (typeof v !== "string" || !v || v.length > 4096 || /[\x00-\x1f\x7f]/.test(v))
+    return false;
+  const flavor = pathFlavor(v);
+  if (flavor === win32 && !/^(?:[A-Za-z]:\\|\\\\[^\\]+\\[^\\]+)/.test(v))
+    return false;
+  return flavor.isAbsolute(v) && flavor.normalize(v) === v;
+}
+function selection(v) {
+  return grantRecord(v) && keys2(v, ["slug", "version", "bundleDigest"]) && grantIdentifier(v.slug) && isValidSkillVersion(v.version) && typeof v.bundleDigest === "string" && /^sha256:[a-f0-9]{64}$/.test(v.bundleDigest);
+}
+function validateExecutionGrants(value) {
+  if (!Array.isArray(value) || value.length > MAX_EXECUTION_GRANTS)
+    invalid4();
+  const ids = new Set;
+  for (const g of value) {
+    if (!grantRecord(g) || !keys2(g, [
+      "id",
+      "target",
+      "selection",
+      "actors",
+      "consumers",
+      "secretsAuthority",
+      "bindings"
+    ], ["expiresAt"]) || !grantIdentifier(g.id) || ids.has(g.id) || g.target !== "local" || !selection(g.selection) || !authority(g.secretsAuthority))
+      invalid4();
+    ids.add(g.id);
+    if (!Array.isArray(g.actors) || !g.actors.length || g.actors.length > 256 || !g.actors.every(grantIdentifier) || new Set(g.actors).size !== g.actors.length)
+      invalid4();
+    if (!Array.isArray(g.consumers) || !g.consumers.length || g.consumers.length > 256)
+      invalid4();
+    const consumers = new Set;
+    for (const c of g.consumers) {
+      if (!grantRecord(c) || !keys2(c, ["stationId", "workspaceDirectory"], ["includeDescendants"]) || !grantIdentifier(c.stationId) || !grantWorkspace(c.workspaceDirectory) || c.includeDescendants !== undefined && typeof c.includeDescendants !== "boolean")
+        invalid4();
+      const key = JSON.stringify([
+        c.stationId,
+        c.workspaceDirectory,
+        c.includeDescendants === true
+      ]);
+      if (consumers.has(key))
+        invalid4();
+      consumers.add(key);
+    }
+    if (!grantRecord(g.bindings) || !Object.keys(g.bindings).length)
+      invalid4();
+    try {
+      declaredSecretNames(Object.keys(g.bindings));
+    } catch {
+      invalid4();
+    }
+    for (const ref of Object.values(g.bindings))
+      if (typeof ref !== "string" || ref.length > 2048 || !/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(ref) || ref.split("/").some((p) => !p || p === "." || p === ".."))
+        invalid4();
+    if (g.expiresAt !== undefined && (typeof g.expiresAt !== "string" || !Number.isFinite(Date.parse(g.expiresAt)) || new Date(g.expiresAt).toISOString() !== g.expiresAt))
+      invalid4();
+  }
+  if (Buffer.byteLength(JSON.stringify(value)) > MAX_EXECUTION_GRANT_BYTES - 2048)
+    invalid4();
+  return structuredClone(value);
+}
+function validateExecutionGrantPolicy(value) {
+  if (!grantRecord(value) || !keys2(value, [
+    "schema",
+    "profileId",
+    "workspaceId",
+    "revision",
+    "previousRevision",
+    "updatedAt",
+    "actorId",
+    "grants"
+  ]) || value.schema !== "hasna.skills-execution-grants.v1" || ![value.profileId, value.workspaceId, value.revision, value.actorId].every(grantIdentifier) || value.previousRevision !== null && !grantIdentifier(value.previousRevision) || typeof value.updatedAt !== "string" || !Number.isFinite(Date.parse(value.updatedAt)))
+    invalid4();
+  validateExecutionGrants(value.grants);
+  return structuredClone(value);
+}
+function validateExecutionGrantRequest(value) {
+  if (!grantRecord(value) || !keys2(value, ["selection", "consumer"]) || !grantRecord(value.selection) || !keys2(value.selection, [
+    "authority",
+    "workspaceId",
+    "profileId",
+    "profileRevision",
+    "slug",
+    "version",
+    "bundleDigest"
+  ]) || !grantRecord(value.consumer) || !keys2(value.consumer, ["stationId", "workspaceDirectory"]))
+    invalid4();
+  const { selection: s, consumer: c } = value;
+  if (!selection({
+    slug: s.slug,
+    version: s.version,
+    bundleDigest: s.bundleDigest
+  }) || !authority(s.authority) || ![s.workspaceId, s.profileId, s.profileRevision, c.stationId].every(grantIdentifier) || !grantWorkspace(c.workspaceDirectory))
+    invalid4();
+  return structuredClone(value);
+}
+var MAX_EXECUTION_GRANTS = 256, MAX_EXECUTION_GRANT_BYTES;
+var init_execution_grants = __esm(() => {
+  init_execution_secrets();
+  init_skill_version();
+  MAX_EXECUTION_GRANT_BYTES = 2 * 1024 * 1024;
 });
-import { createHash as createHash14 } from "crypto";
-import { spawn as spawn2 } from "child_process";
-import { mkdirSync as mkdirSync13, mkdtempSync as mkdtempSync4, writeFileSync as writeFileSync13 } from "fs";
-import { dirname as dirname15, join as join39, resolve as resolve12 } from "path";
-import { tmpdir } from "os";
+
+// src/lib/execution-grant-client.ts
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+function id(value) {
+  if (!grantIdentifier(value))
+    throw new Error("Invalid execution grant profile or revision identifier.");
+  return encodeURIComponent(value);
+}
+async function request(path, init = {}, authority2) {
+  try {
+    const connection = await resolveSkillsConnection();
+    if (!connection)
+      throw new Error;
+    const configured = skillsApiRequestUrl(connection.apiOrigin, "/api/v1/").replace(/\/+$/, "");
+    if (authority2 !== undefined && authority2 !== configured)
+      throw new Error;
+    const response = await fetch(skillsApiRequestUrl(connection.apiOrigin, `/api/v1${path}`), {
+      ...init,
+      redirect: "error",
+      credentials: "omit",
+      signal: AbortSignal.timeout(15000),
+      headers: {
+        "Content-Type": "application/json",
+        "User-Agent": "hasna-skills",
+        Authorization: `Bearer ${connection.apiKey}`,
+        ...init.headers
+      }
+    });
+    if (!response.ok) {
+      response.body?.cancel().catch(() => {});
+      throw new SkillSelectionError("EXECUTION_GRANT_UNAVAILABLE", `Skills execution grant request failed (HTTP ${response.status}); no fallback was attempted.`);
+    }
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, MAX_EXECUTION_GRANT_BYTES)));
+  } catch (error61) {
+    if (error61 instanceof SkillSelectionError)
+      throw error61;
+    throw new SkillSelectionError("EXECUTION_GRANT_UNAVAILABLE", "The configured Skills execution grant service could not be reached or returned an invalid response; no fallback was attempted.");
+  }
+}
+async function readExecutionGrantPolicy(profileId, revision) {
+  const policy = validateExecutionGrantPolicy(await request(`/execution-grants/${id(profileId)}${revision === undefined ? "" : `/versions/${id(revision)}`}`));
+  if (policy.profileId !== profileId || revision !== undefined && policy.revision !== revision)
+    throw new Error("Execution grant policy response scope mismatch.");
+  return policy;
+}
+async function saveExecutionGrantPolicy(profileId, grants, revision) {
+  const snapshot = validateExecutionGrants(grants);
+  if (revision !== undefined)
+    id(revision);
+  const policy = validateExecutionGrantPolicy(await request(`/execution-grants/${id(profileId)}`, {
+    method: "PUT",
+    headers: revision === undefined ? { "If-None-Match": "*" } : { "If-Match": `"${revision}"` },
+    body: JSON.stringify({ grants: snapshot })
+  }));
+  if (policy.profileId !== profileId || policy.previousRevision !== (revision ?? null) || !isDeepStrictEqual2(policy.grants, snapshot)) {
+    throw new Error("The API did not preserve the reviewed execution grant policy; read it before retrying.");
+  }
+  return policy;
+}
+async function resolveExecutionGrant(input2) {
+  const snapshot = validateExecutionGrantRequest(input2);
+  const value = await request(`/execution-grants/${id(snapshot.selection.profileId)}/resolve`, { method: "POST", body: JSON.stringify(snapshot) }, snapshot.selection.authority);
+  if (!grantRecord(value) || Object.keys(value).length !== 3 || !grantIdentifier(value.policyRevision) || !grantIdentifier(value.grantId) || !grantRecord(value.bindings)) {
+    throw new SkillSelectionError("INVALID_EXECUTION_GRANT", "The Skills API returned an invalid execution grant.");
+  }
+  if (!isDeepStrictEqual2(value.bindings.selection, snapshot.selection) || !isDeepStrictEqual2(value.bindings.consumer, snapshot.consumer)) {
+    throw new SkillSelectionError("EXECUTION_GRANT_SCOPE_MISMATCH", "The Skills API returned a grant for a different selection or consumer.");
+  }
+  return value;
+}
+var init_execution_grant_client = __esm(() => {
+  init_fleet_credentials();
+  init_remote_files();
+  init_selection_cache();
+  init_execution_grants();
+});
+
+// src/lib/selected-manifest.ts
 function jsonEntry(entries, path) {
   const entry = entries.find((candidate) => candidate.path === path);
   if (!entry)
@@ -81435,11 +81630,28 @@ function describeEntries(entries) {
   const kind = frontmatter?.kind === "instruction" || manifest.kind === "instruction" || packageJson.skills?.kind === "instruction" ? "instruction" : "executable";
   return { kind, manifest, packageJson };
 }
+var init_selected_manifest = __esm(() => {
+  init_skill_validation();
+  init_selection_cache();
+});
+
+// src/lib/selected-run.ts
+var exports_selected_run = {};
+__export(exports_selected_run, {
+  resolveSelectedRun: () => resolveSelectedRun,
+  prepareSelectedSecretBindings: () => prepareSelectedSecretBindings,
+  executeSelectedLocal: () => executeSelectedLocal
+});
+import { createHash as createHash14 } from "crypto";
+import { spawn as spawn2 } from "child_process";
+import { mkdirSync as mkdirSync13, mkdtempSync as mkdtempSync4, writeFileSync as writeFileSync13, realpathSync as realpathSync7 } from "fs";
+import { dirname as dirname15, join as join39, resolve as resolve12 } from "path";
+import { tmpdir, hostname as stationHostname2 } from "os";
 async function resolveSelectedRun(spec, profileId, options = {}) {
   const context = await resolveSelectionContext(profileId, options);
-  const selection = exactProfileSelection(spec, context.receipt.profile);
-  const entries = await readSelectedEntries(selection, context, options);
-  return { selection, profileId: context.receipt.profile.profileId, entries, ...describeEntries(entries), cacheDir: selectionCacheRoot(options) };
+  const selection2 = exactProfileSelection(spec, context.receipt.profile);
+  const entries = await readSelectedEntries(selection2, context, options);
+  return { selection: selection2, profileId: context.receipt.profile.profileId, entries, ...describeEntries(entries), cacheDir: selectionCacheRoot(options) };
 }
 async function prepareSelectedSecretBindings(selected, cwd2 = process.cwd()) {
   const entries = await readCachedSelection(selected.selection, { cacheDir: selected.cacheDir });
@@ -81454,8 +81666,8 @@ async function prepareSelectedSecretBindings(selected, cwd2 = process.cwd()) {
   return selectedSecretBindingsTemplate({ selection: selected.selection, profileId: selected.profileId, cwd: cwd2 }, names);
 }
 async function executeSelectedLocal(selected, options = {}) {
-  const selection = structuredClone(selected.selection), profileId = selected.profileId;
-  const entries = await readCachedSelection(selection, { cacheDir: selected.cacheDir });
+  const selection2 = structuredClone(selected.selection), profileId = selected.profileId;
+  const entries = await readCachedSelection(selection2, { cacheDir: selected.cacheDir });
   if (!entries)
     throw new SkillSelectionError("CACHED_BUNDLE_MISSING", "The selected local execution bundle is not cached.");
   const { kind, manifest, packageJson } = describeEntries(entries);
@@ -81499,9 +81711,12 @@ async function executeSelectedLocal(selected, options = {}) {
   const names = declaredSecretNames(runtime.env);
   if (options.secretBindings !== undefined && options.env !== undefined)
     throw new SkillSelectionError("INVALID_SECRET_BINDINGS", "Choose explicit vault bindings or SDK environment values, never both.");
-  const bindings = options.secretBindings === undefined ? undefined : validateSelectedSecretBindings(options.secretBindings, { selection, profileId, cwd: options.cwd ?? process.cwd() }, names);
+  let bindings = options.secretBindings === undefined ? undefined : validateSelectedSecretBindings(options.secretBindings, { selection: selection2, profileId, cwd: options.cwd ?? process.cwd() }, names);
   let secretEnv = {};
-  if (!bindings)
+  const shared = names.length > 0 && options.secretBindings === undefined && options.env === undefined;
+  if (shared && options.sharedExecutionGrants === false)
+    throw new SkillSelectionError("EXECUTION_GRANT_FRESH_SELECTION_REQUIRED", "Shared secret grants require a fresh API selection; cached execution is refused.");
+  if (!bindings && !shared)
     for (const name of names) {
       const value = options.env && Object.hasOwn(options.env, name) ? options.env[name] : undefined;
       if (value === undefined)
@@ -81531,17 +81746,31 @@ async function executeSelectedLocal(selected, options = {}) {
     if (version2.exitCode !== 0 || actual !== runtime.version)
       throw new SkillSelectionError("LOCAL_RUNTIME_VERSION_MISMATCH", "The installed runtime version differs from the version selected by the skill.");
   }
+  let executionGrant;
+  if (shared) {
+    const { authority: authority2, workspaceId, profileRevision, slug: slug2, version: version2, bundleDigest } = selection2;
+    const request2 = {
+      selection: { authority: authority2, workspaceId, profileId, profileRevision, slug: slug2, version: version2, bundleDigest },
+      consumer: { stationId: process.env.HASNA_STATION || stationHostname2(), workspaceDirectory: realpathSync7(options.cwd ?? process.cwd()) }
+    };
+    const grant = await (options.resolveExecutionGrant ?? resolveExecutionGrant)(request2);
+    if (!grant || !grantIdentifier(grant.policyRevision) || !grantIdentifier(grant.grantId))
+      throw new SkillSelectionError("INVALID_EXECUTION_GRANT", "The Skills API returned an invalid execution grant.");
+    bindings = validateSelectedSecretBindings(grant.bindings, { selection: selection2, profileId, cwd: options.cwd ?? process.cwd() }, names);
+    executionGrant = { policyRevision: grant.policyRevision, grantId: grant.grantId };
+  }
   if (bindings)
     secretEnv = await resolveSelectedSecrets(bindings, options.createSecretsClient);
   const result2 = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], join39(runDirectory, declaredEntry), ...args], runDirectory, { ...env3, ...secretEnv }, input2, timeoutMs);
   result2.stdout = redactExecutionSecrets(result2.stdout, secretEnv);
   result2.stderr = redactExecutionSecrets(result2.stderr, secretEnv);
   const receipt = {
-    selection,
+    selection: selection2,
     target: "local",
     runtime: runtimeName,
     inputDigest: `sha256:${createHash14("sha256").update(input2).digest("hex")}`,
     runDirectory,
+    ...executionGrant ? { executionGrant } : {},
     ...bindings ? { secretBinding: { schema: bindings.schema, selection: bindings.selection, consumer: bindings.consumer, secretsAuthority: bindings.secretsAuthority, bindings: bindings.bindings } } : {},
     ...result2
   };
@@ -81595,9 +81824,11 @@ async function subprocess(command, cwd2, env3, input2, timeoutMs) {
   });
 }
 var init_selected_run = __esm(() => {
+  init_execution_grant_client();
+  init_execution_grants();
   init_selection_resolver();
   init_selection_cache();
-  init_skill_validation();
+  init_selected_manifest();
   init_execution_secrets();
 });
 
@@ -81802,13 +82033,13 @@ var init_util2 = __esm(() => {
       });
     };
     util2.objectKeys = typeof Object.keys === "function" ? (obj) => Object.keys(obj) : (object6) => {
-      const keys2 = [];
+      const keys3 = [];
       for (const key in object6) {
         if (Object.prototype.hasOwnProperty.call(object6, key)) {
-          keys2.push(key);
+          keys3.push(key);
         }
       }
-      return keys2;
+      return keys3;
     };
     util2.find = (arr, checker) => {
       for (const item of arr) {
@@ -84129,8 +84360,8 @@ var init_types = __esm(() => {
       if (this._cached !== null)
         return this._cached;
       const shape = this._def.shape();
-      const keys2 = util.objectKeys(shape);
-      this._cached = { shape, keys: keys2 };
+      const keys3 = util.objectKeys(shape);
+      this._cached = { shape, keys: keys3 };
       return this._cached;
     }
     _parse(input2) {
@@ -85759,18 +85990,18 @@ import { existsSync as existsSync27, mkdirSync as mkdirSync14, readFileSync as r
 import { extname, join as join40, relative as relative6 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now3 = new Date;
-  const id = createRunId(now3);
+  const id2 = createRunId(now3);
   const day = now3.toISOString().slice(0, 10);
   const skillName = normalizeSkillName(params.skill);
   const root = getProjectStateDir(targetDir);
-  const runDir = join40(root, "runs", day, id);
+  const runDir = join40(root, "runs", day, id2);
   const logsDir = join40(runDir, "logs");
-  const exportDir = join40(root, "exports", skillName, id);
+  const exportDir = join40(root, "exports", skillName, id2);
   mkdirSync14(logsDir, { recursive: true });
   mkdirSync14(exportDir, { recursive: true });
   mkdirSync14(join40(root, "tmp"), { recursive: true });
   const record7 = {
-    id,
+    id: id2,
     skill: skillName,
     status: params.status ?? "running",
     ...params.prompt ? { prompt: params.prompt } : {},
@@ -85960,14 +86191,14 @@ var init_run_state = __esm(() => {
 });
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
-function assertCompleteRequestPrompt(request) {
-  if (request.params.ref.type !== "ref/prompt") {
-    throw new TypeError(`Expected CompleteRequestPrompt, but got ${request.params.ref.type}`);
+function assertCompleteRequestPrompt(request2) {
+  if (request2.params.ref.type !== "ref/prompt") {
+    throw new TypeError(`Expected CompleteRequestPrompt, but got ${request2.params.ref.type}`);
   }
 }
-function assertCompleteRequestResourceTemplate(request) {
-  if (request.params.ref.type !== "ref/resource") {
-    throw new TypeError(`Expected CompleteRequestResourceTemplate, but got ${request.params.ref.type}`);
+function assertCompleteRequestResourceTemplate(request2) {
+  if (request2.params.ref.type !== "ref/resource") {
+    throw new TypeError(`Expected CompleteRequestResourceTemplate, but got ${request2.params.ref.type}`);
   }
 }
 var LATEST_PROTOCOL_VERSION = "2025-11-25", SUPPORTED_PROTOCOL_VERSIONS, RELATED_TASK_META_KEY = "io.modelcontextprotocol/related-task", JSONRPC_VERSION = "2.0", AssertObjectSchema, ProgressTokenSchema, CursorSchema, TaskCreationParamsSchema, TaskMetadataSchema, RelatedTaskMetadataSchema, RequestMetaSchema, BaseRequestParamsSchema, TaskAugmentedRequestParamsSchema, isTaskAugmentedRequestParams = (value) => TaskAugmentedRequestParamsSchema.safeParse(value).success, RequestSchema, NotificationsParamsSchema, NotificationSchema, ResultSchema, RequestIdSchema, JSONRPCRequestSchema, isJSONRPCRequest = (value) => JSONRPCRequestSchema.safeParse(value).success, JSONRPCNotificationSchema, isJSONRPCNotification = (value) => JSONRPCNotificationSchema.safeParse(value).success, JSONRPCResultResponseSchema, isJSONRPCResultResponse = (value) => JSONRPCResultResponseSchema.safeParse(value).success, ErrorCode, JSONRPCErrorResponseSchema, isJSONRPCErrorResponse = (value) => JSONRPCErrorResponseSchema.safeParse(value).success, JSONRPCMessageSchema, JSONRPCResponseSchema, EmptyResultSchema, CancelledNotificationParamsSchema, CancelledNotificationSchema, IconSchema, IconsSchema, BaseMetadataSchema, ImplementationSchema, FormElicitationCapabilitySchema, ElicitationCapabilitySchema, ClientTasksCapabilitySchema, ServerTasksCapabilitySchema, ClientCapabilitiesSchema, InitializeRequestParamsSchema, InitializeRequestSchema, ServerCapabilitiesSchema, InitializeResultSchema, InitializedNotificationSchema, PingRequestSchema, ProgressSchema, ProgressNotificationParamsSchema, ProgressNotificationSchema, PaginatedRequestParamsSchema, PaginatedRequestSchema, PaginatedResultSchema, TaskStatusSchema, TaskSchema, CreateTaskResultSchema, TaskStatusNotificationParamsSchema, TaskStatusNotificationSchema, GetTaskRequestSchema, GetTaskResultSchema, GetTaskPayloadRequestSchema, GetTaskPayloadResultSchema, ListTasksRequestSchema, ListTasksResultSchema, CancelTaskRequestSchema, CancelTaskResultSchema, ResourceContentsSchema, TextResourceContentsSchema, Base64Schema, BlobResourceContentsSchema, RoleSchema, AnnotationsSchema, ResourceSchema, ResourceTemplateSchema, ListResourcesRequestSchema, ListResourcesResultSchema, ListResourceTemplatesRequestSchema, ListResourceTemplatesResultSchema, ResourceRequestParamsSchema, ReadResourceRequestParamsSchema, ReadResourceRequestSchema, ReadResourceResultSchema, ResourceListChangedNotificationSchema, SubscribeRequestParamsSchema, SubscribeRequestSchema, UnsubscribeRequestParamsSchema, UnsubscribeRequestSchema, ResourceUpdatedNotificationParamsSchema, ResourceUpdatedNotificationSchema, PromptArgumentSchema, PromptSchema, ListPromptsRequestSchema, ListPromptsResultSchema, GetPromptRequestParamsSchema, GetPromptRequestSchema, TextContentSchema, ImageContentSchema, AudioContentSchema, ToolUseContentSchema, EmbeddedResourceSchema, ResourceLinkSchema, ContentBlockSchema, PromptMessageSchema, GetPromptResultSchema, PromptListChangedNotificationSchema, ToolAnnotationsSchema, ToolExecutionSchema, ToolSchema, ListToolsRequestSchema, ListToolsResultSchema, CallToolResultSchema, CompatibilityCallToolResultSchema, CallToolRequestParamsSchema, CallToolRequestSchema, ToolListChangedNotificationSchema, ListChangedOptionsBaseSchema, LoggingLevelSchema, SetLevelRequestParamsSchema, SetLevelRequestSchema, LoggingMessageNotificationParamsSchema, LoggingMessageNotificationSchema, ModelHintSchema, ModelPreferencesSchema, ToolChoiceSchema, ToolResultContentSchema, SamplingContentSchema, SamplingMessageContentBlockSchema, SamplingMessageSchema, CreateMessageRequestParamsSchema, CreateMessageRequestSchema, CreateMessageResultSchema, CreateMessageResultWithToolsSchema, BooleanSchemaSchema, StringSchemaSchema, NumberSchemaSchema, UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema, LegacyTitledEnumSchemaSchema, SingleSelectEnumSchemaSchema, UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema, MultiSelectEnumSchemaSchema, EnumSchemaSchema, PrimitiveSchemaDefinitionSchema, ElicitRequestFormParamsSchema, ElicitRequestURLParamsSchema, ElicitRequestParamsSchema, ElicitRequestSchema, ElicitationCompleteNotificationParamsSchema, ElicitationCompleteNotificationSchema, ElicitResultSchema, ResourceTemplateReferenceSchema, PromptReferenceSchema, CompleteRequestParamsSchema, CompleteRequestSchema, CompleteResultSchema, RootSchema, ListRootsRequestSchema, ListRootsResultSchema, RootsListChangedNotificationSchema, ClientRequestSchema, ClientNotificationSchema, ClientResultSchema, ServerRequestSchema, ServerNotificationSchema, ServerResultSchema, McpError, UrlElicitationRequiredError;
@@ -87881,7 +88112,7 @@ function parseMapDef(def, refs) {
   if (refs.mapStrategy === "record") {
     return parseRecordDef(def, refs);
   }
-  const keys2 = parseDef(def.keyType._def, {
+  const keys3 = parseDef(def.keyType._def, {
     ...refs,
     currentPath: [...refs.currentPath, "items", "items", "0"]
   }) || parseAnyDef(refs);
@@ -87894,7 +88125,7 @@ function parseMapDef(def, refs) {
     maxItems: 125,
     items: {
       type: "array",
-      items: [keys2, values2],
+      items: [keys3, values2],
       minItems: 2,
       maxItems: 2
     }
@@ -88649,8 +88880,8 @@ class Protocol {
     this._taskStore = _options?.taskStore;
     this._taskMessageQueue = _options?.taskMessageQueue;
     if (this._taskStore) {
-      this.setRequestHandler(GetTaskRequestSchema, async (request, extra) => {
-        const task = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
+      this.setRequestHandler(GetTaskRequestSchema, async (request2, extra) => {
+        const task = await this._taskStore.getTask(request2.params.taskId, extra.sessionId);
         if (!task) {
           throw new McpError(ErrorCode.InvalidParams, "Failed to retrieve task: Task not found");
         }
@@ -88658,9 +88889,9 @@ class Protocol {
           ...task
         };
       });
-      this.setRequestHandler(GetTaskPayloadRequestSchema, async (request, extra) => {
+      this.setRequestHandler(GetTaskPayloadRequestSchema, async (request2, extra) => {
         const handleTaskResult = async () => {
-          const taskId = request.params.taskId;
+          const taskId = request2.params.taskId;
           if (this._taskMessageQueue) {
             let queuedMessage;
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -88711,9 +88942,9 @@ class Protocol {
         };
         return await handleTaskResult();
       });
-      this.setRequestHandler(ListTasksRequestSchema, async (request, extra) => {
+      this.setRequestHandler(ListTasksRequestSchema, async (request2, extra) => {
         try {
-          const { tasks, nextCursor } = await this._taskStore.listTasks(request.params?.cursor, extra.sessionId);
+          const { tasks, nextCursor } = await this._taskStore.listTasks(request2.params?.cursor, extra.sessionId);
           return {
             tasks,
             nextCursor,
@@ -88723,20 +88954,20 @@ class Protocol {
           throw new McpError(ErrorCode.InvalidParams, `Failed to list tasks: ${error61 instanceof Error ? error61.message : String(error61)}`);
         }
       });
-      this.setRequestHandler(CancelTaskRequestSchema, async (request, extra) => {
+      this.setRequestHandler(CancelTaskRequestSchema, async (request2, extra) => {
         try {
-          const task = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
+          const task = await this._taskStore.getTask(request2.params.taskId, extra.sessionId);
           if (!task) {
-            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${request.params.taskId}`);
+            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${request2.params.taskId}`);
           }
           if (isTerminal(task.status)) {
             throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
           }
-          await this._taskStore.updateTaskStatus(request.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-          this._clearTaskQueue(request.params.taskId);
-          const cancelledTask = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
+          await this._taskStore.updateTaskStatus(request2.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
+          this._clearTaskQueue(request2.params.taskId);
+          const cancelledTask = await this._taskStore.getTask(request2.params.taskId, extra.sessionId);
           if (!cancelledTask) {
-            throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request.params.taskId}`);
+            throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request2.params.taskId}`);
           }
           return {
             _meta: {},
@@ -88852,14 +89083,14 @@ class Protocol {
     }
     Promise.resolve().then(() => handler(notification)).catch((error61) => this._onerror(new Error(`Uncaught error in notification handler: ${error61}`)));
   }
-  _onrequest(request, extra) {
-    const handler = this._requestHandlers.get(request.method) ?? this.fallbackRequestHandler;
+  _onrequest(request2, extra) {
+    const handler = this._requestHandlers.get(request2.method) ?? this.fallbackRequestHandler;
     const capturedTransport = this._transport;
-    const relatedTaskId = request.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+    const relatedTaskId = request2.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
     if (handler === undefined) {
       const errorResponse = {
         jsonrpc: "2.0",
-        id: request.id,
+        id: request2.id,
         error: {
           code: ErrorCode.MethodNotFound,
           message: "Method not found"
@@ -88877,17 +89108,17 @@ class Protocol {
       return;
     }
     const abortController = new AbortController;
-    this._requestHandlerAbortControllers.set(request.id, abortController);
-    const taskCreationParams = isTaskAugmentedRequestParams(request.params) ? request.params.task : undefined;
-    const taskStore = this._taskStore ? this.requestTaskStore(request, capturedTransport?.sessionId) : undefined;
+    this._requestHandlerAbortControllers.set(request2.id, abortController);
+    const taskCreationParams = isTaskAugmentedRequestParams(request2.params) ? request2.params.task : undefined;
+    const taskStore = this._taskStore ? this.requestTaskStore(request2, capturedTransport?.sessionId) : undefined;
     const fullExtra = {
       signal: abortController.signal,
       sessionId: capturedTransport?.sessionId,
-      _meta: request.params?._meta,
+      _meta: request2.params?._meta,
       sendNotification: async (notification) => {
         if (abortController.signal.aborted)
           return;
-        const notificationOptions = { relatedRequestId: request.id };
+        const notificationOptions = { relatedRequestId: request2.id };
         if (relatedTaskId) {
           notificationOptions.relatedTask = { taskId: relatedTaskId };
         }
@@ -88897,7 +89128,7 @@ class Protocol {
         if (abortController.signal.aborted) {
           throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
         }
-        const requestOptions = { ...options, relatedRequestId: request.id };
+        const requestOptions = { ...options, relatedRequestId: request2.id };
         if (relatedTaskId && !requestOptions.relatedTask) {
           requestOptions.relatedTask = { taskId: relatedTaskId };
         }
@@ -88908,7 +89139,7 @@ class Protocol {
         return await this.request(r2, resultSchema, requestOptions);
       },
       authInfo: extra?.authInfo,
-      requestId: request.id,
+      requestId: request2.id,
       requestInfo: extra?.requestInfo,
       taskId: relatedTaskId,
       taskStore,
@@ -88918,16 +89149,16 @@ class Protocol {
     };
     Promise.resolve().then(() => {
       if (taskCreationParams) {
-        this.assertTaskHandlerCapability(request.method);
+        this.assertTaskHandlerCapability(request2.method);
       }
-    }).then(() => handler(request, fullExtra)).then(async (result2) => {
+    }).then(() => handler(request2, fullExtra)).then(async (result2) => {
       if (abortController.signal.aborted) {
         return;
       }
       const response = {
         result: result2,
         jsonrpc: "2.0",
-        id: request.id
+        id: request2.id
       };
       if (relatedTaskId && this._taskMessageQueue) {
         await this._enqueueTaskMessage(relatedTaskId, {
@@ -88944,7 +89175,7 @@ class Protocol {
       }
       const errorResponse = {
         jsonrpc: "2.0",
-        id: request.id,
+        id: request2.id,
         error: {
           code: Number.isSafeInteger(error61["code"]) ? error61["code"] : ErrorCode.InternalError,
           message: error61.message ?? "Internal error",
@@ -88961,8 +89192,8 @@ class Protocol {
         await capturedTransport?.send(errorResponse);
       }
     }).catch((error61) => this._onerror(new Error(`Failed to send response: ${error61}`))).finally(() => {
-      if (this._requestHandlerAbortControllers.get(request.id) === abortController) {
-        this._requestHandlerAbortControllers.delete(request.id);
+      if (this._requestHandlerAbortControllers.get(request2.id) === abortController) {
+        this._requestHandlerAbortControllers.delete(request2.id);
       }
     });
   }
@@ -89036,11 +89267,11 @@ class Protocol {
   async close() {
     await this._transport?.close();
   }
-  async* requestStream(request, resultSchema, options) {
+  async* requestStream(request2, resultSchema, options) {
     const { task } = options ?? {};
     if (!task) {
       try {
-        const result2 = await this.request(request, resultSchema, options);
+        const result2 = await this.request(request2, resultSchema, options);
         yield { type: "result", result: result2 };
       } catch (error61) {
         yield {
@@ -89052,7 +89283,7 @@ class Protocol {
     }
     let taskId;
     try {
-      const createResult = await this.request(request, CreateTaskResultSchema, options);
+      const createResult = await this.request(request2, CreateTaskResultSchema, options);
       if (createResult.task) {
         taskId = createResult.task.taskId;
         yield { type: "taskCreated", task: createResult.task };
@@ -89095,7 +89326,7 @@ class Protocol {
       };
     }
   }
-  request(request, resultSchema, options) {
+  request(request2, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
     return new Promise((resolve13, reject2) => {
       const earlyReject = (error61) => {
@@ -89107,9 +89338,9 @@ class Protocol {
       }
       if (this._options?.enforceStrictCapabilities === true) {
         try {
-          this.assertCapabilityForMethod(request.method);
+          this.assertCapabilityForMethod(request2.method);
           if (task) {
-            this.assertTaskCapability(request.method);
+            this.assertTaskCapability(request2.method);
           }
         } catch (e2) {
           earlyReject(e2);
@@ -89119,16 +89350,16 @@ class Protocol {
       options?.signal?.throwIfAborted();
       const messageId = this._requestMessageId++;
       const jsonrpcRequest = {
-        ...request,
+        ...request2,
         jsonrpc: "2.0",
         id: messageId
       };
       if (options?.onprogress) {
         this._progressHandlers.set(messageId, options.onprogress);
         jsonrpcRequest.params = {
-          ...request.params,
+          ...request2.params,
           _meta: {
-            ...request.params?._meta || {},
+            ...request2.params?._meta || {},
             progressToken: messageId
           }
         };
@@ -89304,8 +89535,8 @@ class Protocol {
   setRequestHandler(requestSchema, handler) {
     const method2 = getMethodLiteral(requestSchema);
     this.assertRequestHandlerCapability(method2);
-    this._requestHandlers.set(method2, (request, extra) => {
-      const parsed = parseWithCompat(requestSchema, request);
+    this._requestHandlers.set(method2, (request2, extra) => {
+      const parsed = parseWithCompat(requestSchema, request2);
       return Promise.resolve(handler(parsed, extra));
     });
   }
@@ -89378,19 +89609,19 @@ class Protocol {
       }, { once: true });
     });
   }
-  requestTaskStore(request, sessionId) {
+  requestTaskStore(request2, sessionId) {
     const taskStore = this._taskStore;
     if (!taskStore) {
       throw new Error("No task store configured");
     }
     return {
       createTask: async (taskParams) => {
-        if (!request) {
+        if (!request2) {
           throw new Error("No request provided");
         }
-        return await taskStore.createTask(taskParams, request.id, {
-          method: request.method,
-          params: request.params
+        return await taskStore.createTask(taskParams, request2.id, {
+          method: request2.method,
+          params: request2.params
         }, sessionId);
       },
       getTask: async (taskId) => {
@@ -91430,7 +91661,7 @@ var require_fast_deep_equal = __commonJS((exports, module) => {
     if (a && b && typeof a == "object" && typeof b == "object") {
       if (a.constructor !== b.constructor)
         return false;
-      var length, i, keys2;
+      var length, i, keys3;
       if (Array.isArray(a)) {
         length = a.length;
         if (length != b.length)
@@ -91446,15 +91677,15 @@ var require_fast_deep_equal = __commonJS((exports, module) => {
         return a.valueOf() === b.valueOf();
       if (a.toString !== Object.prototype.toString)
         return a.toString() === b.toString();
-      keys2 = Object.keys(a);
-      length = keys2.length;
+      keys3 = Object.keys(a);
+      length = keys3.length;
       if (length !== Object.keys(b).length)
         return false;
       for (i = length;i-- !== 0; )
-        if (!Object.prototype.hasOwnProperty.call(b, keys2[i]))
+        if (!Object.prototype.hasOwnProperty.call(b, keys3[i]))
           return false;
       for (i = length;i-- !== 0; ) {
-        var key = keys2[i];
+        var key = keys3[i];
         if (!equal(a[key], b[key]))
           return false;
       }
@@ -91617,10 +91848,10 @@ var require_resolve = __commonJS((exports) => {
     }
     return count;
   }
-  function getFullPath(resolver, id = "", normalize3) {
+  function getFullPath(resolver, id2 = "", normalize3) {
     if (normalize3 !== false)
-      id = normalizeId(id);
-    const p = resolver.parse(id);
+      id2 = normalizeId(id2);
+    const p = resolver.parse(id2);
     return _getFullPath(resolver, p);
   }
   exports.getFullPath = getFullPath;
@@ -91630,13 +91861,13 @@ var require_resolve = __commonJS((exports) => {
   }
   exports._getFullPath = _getFullPath;
   var TRAILING_SLASH_HASH = /#\/?$/;
-  function normalizeId(id) {
-    return id ? id.replace(TRAILING_SLASH_HASH, "") : "";
+  function normalizeId(id2) {
+    return id2 ? id2.replace(TRAILING_SLASH_HASH, "") : "";
   }
   exports.normalizeId = normalizeId;
-  function resolveUrl(resolver, baseId, id) {
-    id = normalizeId(id);
-    return resolver.resolve(baseId, id);
+  function resolveUrl(resolver, baseId, id2) {
+    id2 = normalizeId(id2);
+    return resolver.resolve(baseId, id2);
   }
   exports.resolveUrl = resolveUrl;
   var ANCHOR = /^[a-z_][-a-z0-9._]*$/i;
@@ -92396,8 +92627,8 @@ var require_compile = __commonJS((exports) => {
     if (Object.keys(root.schema).length > 0 && refPath === baseId) {
       return getJsonPointer.call(this, p, root);
     }
-    const id = (0, resolve_1.normalizeId)(refPath);
-    const schOrRef = this.refs[id] || this.schemas[id];
+    const id2 = (0, resolve_1.normalizeId)(refPath);
+    const schOrRef = this.refs[id2] || this.schemas[id2];
     if (typeof schOrRef == "string") {
       const sch = resolveSchema.call(this, root, schOrRef);
       if (typeof (sch === null || sch === undefined ? undefined : sch.schema) !== "object")
@@ -92408,7 +92639,7 @@ var require_compile = __commonJS((exports) => {
       return;
     if (!schOrRef.validate)
       compileSchema.call(this, schOrRef);
-    if (id === (0, resolve_1.normalizeId)(ref)) {
+    if (id2 === (0, resolve_1.normalizeId)(ref)) {
       const { schema } = schOrRef;
       const { schemaId } = this.opts;
       const schId = schema[schemaId];
@@ -93314,12 +93545,12 @@ var require_fast_uri = __commonJS((exports, module) => {
       component.scheme = decodeValidScheme(component.scheme);
       uriTokens.push(component.scheme, ":");
     }
-    const authority = recomposeAuthority(component);
-    if (authority !== undefined) {
+    const authority2 = recomposeAuthority(component);
+    if (authority2 !== undefined) {
       if (options.reference !== "suffix") {
         uriTokens.push("//");
       }
-      uriTokens.push(authority);
+      uriTokens.push(authority2);
       if (component.path && component.path[0] !== "/") {
         uriTokens.push("/");
       }
@@ -93332,7 +93563,7 @@ var require_fast_uri = __commonJS((exports, module) => {
       if (pathNoScheme) {
         s = serializePathEncoding(s, true);
       }
-      if (authority === undefined && s[0] === "/" && s[1] === "/") {
+      if (authority2 === undefined && s[0] === "/" && s[1] === "/") {
         s = "/%2F" + s.slice(2);
       }
       uriTokens.push(s);
@@ -93802,15 +94033,15 @@ var require_core = __commonJS((exports) => {
           this.addSchema(sch, undefined, _meta, _validateSchema);
         return this;
       }
-      let id;
+      let id2;
       if (typeof schema === "object") {
         const { schemaId } = this.opts;
-        id = schema[schemaId];
-        if (id !== undefined && typeof id != "string") {
+        id2 = schema[schemaId];
+        if (id2 !== undefined && typeof id2 != "string") {
           throw new Error(`schema ${schemaId} must be string`);
         }
       }
-      key = (0, resolve_1.normalizeId)(key || id);
+      key = (0, resolve_1.normalizeId)(key || id2);
       this._checkUnique(key);
       this.schemas[key] = this._addSchema(schema, _meta, key, _validateSchema, true);
       return this;
@@ -93880,11 +94111,11 @@ var require_core = __commonJS((exports) => {
         case "object": {
           const cacheKey = schemaKeyRef;
           this._cache.delete(cacheKey);
-          let id = schemaKeyRef[this.opts.schemaId];
-          if (id) {
-            id = (0, resolve_1.normalizeId)(id);
-            delete this.schemas[id];
-            delete this.refs[id];
+          let id2 = schemaKeyRef[this.opts.schemaId];
+          if (id2) {
+            id2 = (0, resolve_1.normalizeId)(id2);
+            delete this.schemas[id2];
+            delete this.refs[id2];
           }
           return this;
         }
@@ -93988,10 +94219,10 @@ var require_core = __commonJS((exports) => {
       }
     }
     _addSchema(schema, meta3, baseId, validateSchema = this.opts.validateSchema, addSchema = this.opts.addUsedSchema) {
-      let id;
+      let id2;
       const { schemaId } = this.opts;
       if (typeof schema == "object") {
-        id = schema[schemaId];
+        id2 = schema[schemaId];
       } else {
         if (this.opts.jtd)
           throw new Error("schema must be object");
@@ -94001,7 +94232,7 @@ var require_core = __commonJS((exports) => {
       let sch = this._cache.get(schema);
       if (sch !== undefined)
         return sch;
-      baseId = (0, resolve_1.normalizeId)(id || baseId);
+      baseId = (0, resolve_1.normalizeId)(id2 || baseId);
       const localRefs = resolve_1.getSchemaRefs.call(this, schema, baseId);
       sch = new compile_1.SchemaEnv({ schema, schemaId, meta: meta3, baseId, localRefs });
       this._cache.set(sch.schema, sch);
@@ -94014,9 +94245,9 @@ var require_core = __commonJS((exports) => {
         this.validateSchema(schema, true);
       return sch;
     }
-    _checkUnique(id) {
-      if (this.schemas[id] || this.refs[id]) {
-        throw new Error(`schema with key or id "${id}" already exists`);
+    _checkUnique(id2) {
+      if (this.schemas[id2] || this.refs[id2]) {
+        throw new Error(`schema with key or id "${id2}" already exists`);
       }
     }
     _compileSchemaEnv(sch) {
@@ -94363,8 +94594,8 @@ var require_multipleOf = __commonJS((exports) => {
       const { gen, data, schemaCode, it } = cxt;
       const prec = it.opts.multipleOfPrecision;
       const res = gen.let("res");
-      const invalid4 = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
-      cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid4}))`);
+      const invalid5 = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
+      cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid5}))`);
     }
   };
   exports.default = def;
@@ -96404,8 +96635,8 @@ class ExperimentalServerTasks {
   constructor(_server) {
     this._server = _server;
   }
-  requestStream(request, resultSchema, options) {
-    return this._server.requestStream(request, resultSchema, options);
+  requestStream(request2, resultSchema, options) {
+    return this._server.requestStream(request2, resultSchema, options);
   }
   createMessageStream(params, options) {
     const clientCapabilities = this._server.getClientCapabilities();
@@ -96430,7 +96661,7 @@ class ExperimentalServerTasks {
       if (hasPreviousToolUse) {
         const toolUseIds = new Set(previousContent.filter((c) => c.type === "tool_use").map((c) => c.id));
         const toolResultIds = new Set(lastContent.filter((c) => c.type === "tool_result").map((c) => c.toolUseId));
-        if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every((id) => toolResultIds.has(id))) {
+        if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every((id2) => toolResultIds.has(id2))) {
           throw new Error("ids of tool_result blocks and tool_use blocks from previous message do not match");
         }
       }
@@ -96536,12 +96767,12 @@ var init_server2 = __esm(() => {
       this._capabilities = options?.capabilities ?? {};
       this._instructions = options?.instructions;
       this._jsonSchemaValidator = options?.jsonSchemaValidator ?? new AjvJsonSchemaValidator;
-      this.setRequestHandler(InitializeRequestSchema, (request) => this._oninitialize(request));
+      this.setRequestHandler(InitializeRequestSchema, (request2) => this._oninitialize(request2));
       this.setNotificationHandler(InitializedNotificationSchema, () => this.oninitialized?.());
       if (this._capabilities.logging) {
-        this.setRequestHandler(SetLevelRequestSchema, async (request, extra) => {
+        this.setRequestHandler(SetLevelRequestSchema, async (request2, extra) => {
           const transportSessionId = extra.sessionId || extra.requestInfo?.headers["mcp-session-id"] || undefined;
-          const { level } = request.params;
+          const { level } = request2.params;
           const parseResult = LoggingLevelSchema.safeParse(level);
           if (parseResult.success) {
             this._loggingLevels.set(transportSessionId, parseResult.data);
@@ -96576,14 +96807,14 @@ var init_server2 = __esm(() => {
       }
       const method2 = methodValue;
       if (method2 === "tools/call") {
-        const wrappedHandler = async (request, extra) => {
-          const validatedRequest = safeParse3(CallToolRequestSchema, request);
+        const wrappedHandler = async (request2, extra) => {
+          const validatedRequest = safeParse3(CallToolRequestSchema, request2);
           if (!validatedRequest.success) {
             const errorMessage = validatedRequest.error instanceof Error ? validatedRequest.error.message : String(validatedRequest.error);
             throw new McpError(ErrorCode.InvalidParams, `Invalid tools/call request: ${errorMessage}`);
           }
           const { params } = validatedRequest.data;
-          const result2 = await Promise.resolve(handler(request, extra));
+          const result2 = await Promise.resolve(handler(request2, extra));
           if (params.task) {
             const taskValidationResult = safeParse3(CreateTaskResultSchema, result2);
             if (!taskValidationResult.success) {
@@ -96714,10 +96945,10 @@ var init_server2 = __esm(() => {
       }
       assertToolsCallTaskCapability(this._capabilities.tasks?.requests, method2, "Server");
     }
-    async _oninitialize(request) {
-      const requestedVersion = request.params.protocolVersion;
-      this._clientCapabilities = request.params.capabilities;
-      this._clientVersion = request.params.clientInfo;
+    async _oninitialize(request2) {
+      const requestedVersion = request2.params.protocolVersion;
+      this._clientCapabilities = request2.params.capabilities;
+      this._clientVersion = request2.params.clientInfo;
       const protocolVersion = SUPPORTED_PROTOCOL_VERSIONS.includes(requestedVersion) ? requestedVersion : LATEST_PROTOCOL_VERSION;
       return {
         protocolVersion,
@@ -96762,7 +96993,7 @@ var init_server2 = __esm(() => {
         if (hasPreviousToolUse) {
           const toolUseIds = new Set(previousContent.filter((c) => c.type === "tool_use").map((c) => c.id));
           const toolResultIds = new Set(lastContent.filter((c) => c.type === "tool_result").map((c) => c.toolUseId));
-          if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every((id) => toolResultIds.has(id))) {
+          if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every((id2) => toolResultIds.has(id2))) {
             throw new Error("ids of tool_result blocks and tool_use blocks from previous message do not match");
           }
         }
@@ -97220,33 +97451,33 @@ class McpServer {
         return toolDefinition;
       })
     }));
-    this.server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+    this.server.setRequestHandler(CallToolRequestSchema, async (request2, extra) => {
       try {
-        const tool = this._registeredTools[request.params.name];
+        const tool = this._registeredTools[request2.params.name];
         if (!tool) {
-          throw new McpError(ErrorCode.InvalidParams, `Tool ${request.params.name} not found`);
+          throw new McpError(ErrorCode.InvalidParams, `Tool ${request2.params.name} not found`);
         }
         if (!tool.enabled) {
-          throw new McpError(ErrorCode.InvalidParams, `Tool ${request.params.name} disabled`);
+          throw new McpError(ErrorCode.InvalidParams, `Tool ${request2.params.name} disabled`);
         }
-        const isTaskRequest = !!request.params.task;
+        const isTaskRequest = !!request2.params.task;
         const taskSupport = tool.execution?.taskSupport;
         const isTaskHandler = "createTask" in tool.handler;
         if ((taskSupport === "required" || taskSupport === "optional") && !isTaskHandler) {
-          throw new McpError(ErrorCode.InternalError, `Tool ${request.params.name} has taskSupport '${taskSupport}' but was not registered with registerToolTask`);
+          throw new McpError(ErrorCode.InternalError, `Tool ${request2.params.name} has taskSupport '${taskSupport}' but was not registered with registerToolTask`);
         }
         if (taskSupport === "required" && !isTaskRequest) {
-          throw new McpError(ErrorCode.MethodNotFound, `Tool ${request.params.name} requires task augmentation (taskSupport: 'required')`);
+          throw new McpError(ErrorCode.MethodNotFound, `Tool ${request2.params.name} requires task augmentation (taskSupport: 'required')`);
         }
         if (taskSupport === "optional" && !isTaskRequest && isTaskHandler) {
-          return await this.handleAutomaticTaskPolling(tool, request, extra);
+          return await this.handleAutomaticTaskPolling(tool, request2, extra);
         }
-        const args = await this.validateToolInput(tool, request.params.arguments, request.params.name);
+        const args = await this.validateToolInput(tool, request2.params.arguments, request2.params.name);
         const result2 = await this.executeToolHandler(tool, args, extra);
         if (isTaskRequest) {
           return result2;
         }
-        await this.validateToolOutput(tool, result2, request.params.name);
+        await this.validateToolOutput(tool, result2, request2.params.name);
         return result2;
       } catch (error61) {
         if (error61 instanceof McpError) {
@@ -97329,11 +97560,11 @@ class McpServer {
       return await Promise.resolve(typedHandler(extra));
     }
   }
-  async handleAutomaticTaskPolling(tool, request, extra) {
+  async handleAutomaticTaskPolling(tool, request2, extra) {
     if (!extra.taskStore) {
       throw new Error("No task store provided for task-capable tool.");
     }
-    const args = await this.validateToolInput(tool, request.params.arguments, request.params.name);
+    const args = await this.validateToolInput(tool, request2.params.arguments, request2.params.name);
     const handler = tool.handler;
     const taskExtra = { ...extra, taskStore: extra.taskStore };
     const createTaskResult = args ? await Promise.resolve(handler.createTask(args, taskExtra)) : await Promise.resolve(handler.createTask(taskExtra));
@@ -97358,21 +97589,21 @@ class McpServer {
     this.server.registerCapabilities({
       completions: {}
     });
-    this.server.setRequestHandler(CompleteRequestSchema, async (request) => {
-      switch (request.params.ref.type) {
+    this.server.setRequestHandler(CompleteRequestSchema, async (request2) => {
+      switch (request2.params.ref.type) {
         case "ref/prompt":
-          assertCompleteRequestPrompt(request);
-          return this.handlePromptCompletion(request, request.params.ref);
+          assertCompleteRequestPrompt(request2);
+          return this.handlePromptCompletion(request2, request2.params.ref);
         case "ref/resource":
-          assertCompleteRequestResourceTemplate(request);
-          return this.handleResourceCompletion(request, request.params.ref);
+          assertCompleteRequestResourceTemplate(request2);
+          return this.handleResourceCompletion(request2, request2.params.ref);
         default:
-          throw new McpError(ErrorCode.InvalidParams, `Invalid completion reference: ${request.params.ref}`);
+          throw new McpError(ErrorCode.InvalidParams, `Invalid completion reference: ${request2.params.ref}`);
       }
     });
     this._completionHandlerInitialized = true;
   }
-  async handlePromptCompletion(request, ref) {
+  async handlePromptCompletion(request2, ref) {
     const prompt = this._registeredPrompts[ref.name];
     if (!prompt) {
       throw new McpError(ErrorCode.InvalidParams, `Prompt ${ref.name} not found`);
@@ -97384,7 +97615,7 @@ class McpServer {
       return EMPTY_COMPLETION_RESULT;
     }
     const promptShape = getObjectShape(prompt.argsSchema);
-    const field = promptShape?.[request.params.argument.name];
+    const field = promptShape?.[request2.params.argument.name];
     if (!isCompletable(field)) {
       return EMPTY_COMPLETION_RESULT;
     }
@@ -97392,22 +97623,22 @@ class McpServer {
     if (!completer) {
       return EMPTY_COMPLETION_RESULT;
     }
-    const suggestions = await completer(request.params.argument.value, request.params.context);
+    const suggestions = await completer(request2.params.argument.value, request2.params.context);
     return createCompletionResult(suggestions);
   }
-  async handleResourceCompletion(request, ref) {
+  async handleResourceCompletion(request2, ref) {
     const template2 = Object.values(this._registeredResourceTemplates).find((t2) => t2.resourceTemplate.uriTemplate.toString() === ref.uri);
     if (!template2) {
       if (this._registeredResources[ref.uri]) {
         return EMPTY_COMPLETION_RESULT;
       }
-      throw new McpError(ErrorCode.InvalidParams, `Resource template ${request.params.ref.uri} not found`);
+      throw new McpError(ErrorCode.InvalidParams, `Resource template ${request2.params.ref.uri} not found`);
     }
-    const completer = template2.resourceTemplate.completeCallback(request.params.argument.name);
+    const completer = template2.resourceTemplate.completeCallback(request2.params.argument.name);
     if (!completer) {
       return EMPTY_COMPLETION_RESULT;
     }
-    const suggestions = await completer(request.params.argument.value, request.params.context);
+    const suggestions = await completer(request2.params.argument.value, request2.params.context);
     return createCompletionResult(suggestions);
   }
   setResourceRequestHandlers() {
@@ -97422,7 +97653,7 @@ class McpServer {
         listChanged: true
       }
     });
-    this.server.setRequestHandler(ListResourcesRequestSchema, async (request, extra) => {
+    this.server.setRequestHandler(ListResourcesRequestSchema, async (request2, extra) => {
       const resources = Object.entries(this._registeredResources).filter(([_, resource]) => resource.enabled).map(([uri, resource]) => ({
         uri,
         name: resource.name,
@@ -97451,8 +97682,8 @@ class McpServer {
       }));
       return { resourceTemplates };
     });
-    this.server.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => {
-      const uri = new URL(request.params.uri);
+    this.server.setRequestHandler(ReadResourceRequestSchema, async (request2, extra) => {
+      const uri = new URL(request2.params.uri);
       const resource = this._registeredResources[uri.toString()];
       if (resource) {
         if (!resource.enabled) {
@@ -97491,21 +97722,21 @@ class McpServer {
         };
       })
     }));
-    this.server.setRequestHandler(GetPromptRequestSchema, async (request, extra) => {
-      const prompt = this._registeredPrompts[request.params.name];
+    this.server.setRequestHandler(GetPromptRequestSchema, async (request2, extra) => {
+      const prompt = this._registeredPrompts[request2.params.name];
       if (!prompt) {
-        throw new McpError(ErrorCode.InvalidParams, `Prompt ${request.params.name} not found`);
+        throw new McpError(ErrorCode.InvalidParams, `Prompt ${request2.params.name} not found`);
       }
       if (!prompt.enabled) {
-        throw new McpError(ErrorCode.InvalidParams, `Prompt ${request.params.name} disabled`);
+        throw new McpError(ErrorCode.InvalidParams, `Prompt ${request2.params.name} disabled`);
       }
       if (prompt.argsSchema) {
         const argsObj = normalizeObjectSchema(prompt.argsSchema);
-        const parseResult = await safeParseAsync3(argsObj, request.params.arguments);
+        const parseResult = await safeParseAsync3(argsObj, request2.params.arguments);
         if (!parseResult.success) {
           const error61 = "error" in parseResult ? parseResult.error : "Unknown error";
           const errorMessage = getParseErrorMessage(error61);
-          throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for prompt ${request.params.name}: ${errorMessage}`);
+          throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for prompt ${request2.params.name}: ${errorMessage}`);
         }
         const args = parseResult.data;
         const cb = prompt.callback;
@@ -97933,8 +98164,8 @@ function invitationEmailIds(invitationId2, challengeId) {
   return { invitationId: invitationId2, challengeId };
 }
 function invitationEmailInput(action, input2) {
-  const keys2 = ["invitationId", "token", "challengeId", "confirm", ...action === "accept" ? ["code"] : []];
-  if (!record8(input2) || Object.keys(input2).length !== keys2.length || keys2.some((key) => !Object.hasOwn(input2, key)))
+  const keys3 = ["invitationId", "token", "challengeId", "confirm", ...action === "accept" ? ["code"] : []];
+  if (!record8(input2) || Object.keys(input2).length !== keys3.length || keys3.some((key) => !Object.hasOwn(input2, key)))
     throw new InvitationEmailInputError;
   const value = { ...input2 };
   const ids = invitationEmailIds(value.invitationId, value.challengeId);
@@ -98043,9 +98274,9 @@ function checkedPublicationDeclaration(value) {
 }
 function checkedPublicationView(value, skillId, intentId, declaration) {
   if (!exact(value, ["id", "skillId", "version", "expectedCurrentVersionId", "archiveSha256", "archiveByteSize", "state", "expiresAt", "createdAt", "versionId"]) || !publicationUuid(value.id) || value.skillId !== skillId || intentId !== undefined && value.id !== intentId || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || !hash3(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES || typeof value.state !== "string" || !["awaiting_upload", "queued", "verifying", "needs_attention", "committed", "rejected", "cancelled", "expired"].includes(value.state) || !date6(value.expiresAt) || !date6(value.createdAt) || !(value.versionId === null || publicationUuid(value.versionId)) || value.state === "committed" && value.versionId === null)
-    return invalid4();
+    return invalid5();
   if (declaration && ["version", "expectedCurrentVersionId", "archiveSha256", "archiveByteSize"].some((k) => value[k] !== declaration[k]))
-    return invalid4();
+    return invalid5();
   return Object.freeze({ ...value });
 }
 async function boundedJson(url2, init, token, mutation, budget2 = 15000, signal) {
@@ -98068,7 +98299,7 @@ async function boundedJson(url2, init, token, mutation, budget2 = 15000, signal)
       });
       const length = response.headers.get("content-length");
       if (length !== null && (!/^\d+$/.test(length) || Number(length) > 65536))
-        return invalid4();
+        return invalid5();
       reader = response.body?.getReader();
       const chunks = [];
       let size2 = 0;
@@ -98079,7 +98310,7 @@ async function boundedJson(url2, init, token, mutation, budget2 = 15000, signal)
             break;
           size2 += part.value.byteLength;
           if (size2 > 65536)
-            return invalid4();
+            return invalid5();
           chunks.push(part.value);
         }
       if (controller.signal.aborted)
@@ -98089,7 +98320,7 @@ async function boundedJson(url2, init, token, mutation, budget2 = 15000, signal)
       try {
         body = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
       } catch {
-        return invalid4();
+        return invalid5();
       }
       if (!response.ok) {
         const code = record9(body) && typeof body.code === "string" && Object.hasOwn(failures2, body.code) ? body.code : null;
@@ -98165,7 +98396,7 @@ class RemotePrivatePublicationsClient {
     const value = await boundedJson(path, { method: method2, ...method2 === "GET" ? {} : { body: JSON.stringify(declaration ?? {}) } }, this.#token, method2 !== "GET", options.timeoutMs, options.signal);
     try {
       if (!record9(value) || !Object.keys(value).every((k) => k === "upload" || k === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
-        return invalid4();
+        return invalid5();
       return checkedPublicationView(value.upload, skillId, intentId, declaration);
     } catch (error61) {
       if (method2 !== "GET")
@@ -98228,29 +98459,29 @@ class RemotePrivatePublicationsClient {
   }
   #upload(value, intent) {
     if (!exact(value, ["upload"]) || !exact(value.upload, ["method", "uploadUrl", "headers", "expiresAt"]))
-      return invalid4();
+      return invalid5();
     const p = value.upload;
     if (p.method !== "PUT" || typeof p.uploadUrl !== "string" || p.uploadUrl.length > 8192 || /[\x00-\x20\x7f]/.test(p.uploadUrl) || !date6(p.expiresAt) || Date.parse(p.expiresAt) - Date.now() < 1000 || Date.parse(p.expiresAt) - Date.now() > 300000 || Date.parse(p.expiresAt) > Date.parse(intent.expiresAt) || !exact(p.headers, ["content-type", "content-length", "x-amz-checksum-sha256", "x-amz-expected-bucket-owner"]) || p.headers["content-type"] !== "application/gzip" || p.headers["content-length"] !== String(intent.archiveByteSize) || p.headers["x-amz-checksum-sha256"] !== Buffer.from(intent.archiveSha256, "hex").toString("base64") || typeof p.headers["x-amz-expected-bucket-owner"] !== "string" || !/^\d{12}$/.test(p.headers["x-amz-expected-bucket-owner"]))
-      return invalid4();
+      return invalid5();
     let url2;
     try {
       url2 = new URL(p.uploadUrl);
     } catch {
-      return invalid4();
+      return invalid5();
     }
     if (url2.protocol !== "https:" || url2.port || url2.username || url2.password || url2.hash || !/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]\.s3\.[a-z]{2}(?:-[a-z]+)+-[1-9]\.amazonaws\.com$/.test(url2.hostname) || url2.pathname !== `/private-publication-staging/${this.organizationId}/${intent.id}/bundle.tgz` || !url2.search || url2.searchParams.get("X-Amz-Algorithm") !== "AWS4-HMAC-SHA256" || url2.searchParams.get("X-Amz-SignedHeaders") !== "content-length;content-type;host;x-amz-checksum-sha256;x-amz-expected-bucket-owner" || !/^[a-f0-9]{64}$/.test(url2.searchParams.get("X-Amz-Signature") ?? ""))
-      return invalid4();
+      return invalid5();
     const queryKeys = ["X-Amz-Algorithm", "X-Amz-Credential", "X-Amz-Date", "X-Amz-Expires", "X-Amz-Security-Token", "X-Amz-Signature", "X-Amz-SignedHeaders"];
     if ([...url2.searchParams.keys()].sort().join(",") !== queryKeys.sort().join(","))
-      return invalid4();
+      return invalid5();
     const issued = url2.searchParams.get("X-Amz-Date"), ttl = url2.searchParams.get("X-Amz-Expires"), credential = url2.searchParams.get("X-Amz-Credential");
     const timestamp3 = /^(\d{4})(\d\d)(\d\d)T(\d\d)(\d\d)(\d\d)Z$/.exec(issued);
     const region = url2.hostname.split(".s3.")[1].split(".amazonaws.com")[0];
     if (!timestamp3 || !/^[1-9]\d{0,2}$/.test(ttl) || Number(ttl) > 300 || !/^[A-Z0-9]{16,128}\//.test(credential) || credential.split("/").slice(1).join("/") !== `${issued.slice(0, 8)}/${region}/s3/aws4_request` || !/^[\x21-\x7e]{1,4096}$/.test(url2.searchParams.get("X-Amz-Security-Token")))
-      return invalid4();
+      return invalid5();
     const issuedAt = Date.parse(`${timestamp3[1]}-${timestamp3[2]}-${timestamp3[3]}T${timestamp3[4]}:${timestamp3[5]}:${timestamp3[6]}Z`);
     if (!Number.isFinite(issuedAt) || issuedAt > Date.now() + 1000 || issuedAt + Number(ttl) * 1000 !== Date.parse(p.expiresAt))
-      return invalid4();
+      return invalid5();
     return { method: "PUT", uploadUrl: url2.href, expiresAt: p.expiresAt, headers: Object.freeze({ ...p.headers }) };
   }
   async wait(skillId, intentId, options = {}) {
@@ -98287,9 +98518,9 @@ class RemotePrivatePublicationsClient {
 }
 var PRIVATE_PUBLICATION_MAX_BYTES, failures2, PrivatePublicationError, bad = () => {
   throw new PrivatePublicationError("INVALID_PUBLICATION_INPUT", "Invalid publication input or recovery data.");
-}, invalid4 = () => {
+}, invalid5 = () => {
   throw new PrivatePublicationError("INVALID_PUBLICATION_RESPONSE", "The server returned an invalid publication result.");
-}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash3 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record9 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys2) => record9(v) && Object.keys(v).sort().join(",") === keys2.sort().join(","), date6 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash16("sha256").update(bytes).digest("hex");
+}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash3 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record9 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys3) => record9(v) && Object.keys(v).sort().join(",") === keys3.sort().join(","), date6 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash16("sha256").update(bytes).digest("hex");
 var init_remote_private_publications = __esm(() => {
   init_fleet_credentials();
   init_remote_workspace_selection();
@@ -98481,18 +98712,18 @@ class RemoteSkillsAuthClient {
   }
   async resendWorkspaceInvitation(email4, code, context, invitationId2, input2) {
     const target = workspaceContext(context), captured = invitationInput("resend", { ...input2, invitationId: invitationId2 });
-    const { invitationId: id, ...options } = captured;
-    return (await this.sessionClient(email4, code, target)).resendWorkspaceInvitation(target, id, options);
+    const { invitationId: id2, ...options } = captured;
+    return (await this.sessionClient(email4, code, target)).resendWorkspaceInvitation(target, id2, options);
   }
   async revokeWorkspaceInvitation(email4, code, context, invitationId2, input2) {
     const target = workspaceContext(context), captured = invitationInput("revoke", { ...input2, invitationId: invitationId2 });
-    const { invitationId: id, ...options } = captured;
-    return (await this.sessionClient(email4, code, target)).revokeWorkspaceInvitation(target, id, options);
+    const { invitationId: id2, ...options } = captured;
+    return (await this.sessionClient(email4, code, target)).revokeWorkspaceInvitation(target, id2, options);
   }
   async acceptWorkspaceInvitation(email4, code, context, invitationId2, input2) {
     const target = workspaceContext(context), captured = invitationInput("accept", { ...input2, invitationId: invitationId2 });
-    const { invitationId: id, ...options } = captured;
-    return (await this.sessionClient(email4, code, target)).acceptWorkspaceInvitation(target, id, options);
+    const { invitationId: id2, ...options } = captured;
+    return (await this.sessionClient(email4, code, target)).acceptWorkspaceInvitation(target, id2, options);
   }
   async createApiKey(email4, code, name, scopes, context) {
     const capturedScopes = scopes === undefined ? undefined : [...scopes];
@@ -98934,7 +99165,7 @@ var init_recurring_customer = __esm(() => {
 });
 
 // src/lib/recurring-recovery.ts
-import { constants as constants12, closeSync as closeSync13, fsyncSync as fsyncSync2, fstatSync as fstatSync13, lstatSync as lstatSync19, mkdirSync as mkdirSync16, openSync as openSync13, readSync as readSync9, realpathSync as realpathSync7, renameSync as renameSync9, unlinkSync as unlinkSync5, writeFileSync as writeFileSync16 } from "fs";
+import { constants as constants12, closeSync as closeSync13, fsyncSync as fsyncSync2, fstatSync as fstatSync13, lstatSync as lstatSync19, mkdirSync as mkdirSync16, openSync as openSync13, readSync as readSync9, realpathSync as realpathSync8, renameSync as renameSync9, unlinkSync as unlinkSync5, writeFileSync as writeFileSync16 } from "fs";
 import { dirname as dirname17, isAbsolute as isAbsolute11, join as join42, resolve as resolve13 } from "path";
 import { randomUUID as randomUUID6 } from "crypto";
 
@@ -98943,12 +99174,12 @@ class RecoveryOwner {
   parents = [];
   constructor(directory) {
     this.directory = directory;
-    if (!isAbsolute11(directory) || resolve13(directory) !== directory || realpathSync7(directory) !== directory)
-      invalid5();
+    if (!isAbsolute11(directory) || resolve13(directory) !== directory || realpathSync8(directory) !== directory)
+      invalid6();
     for (let path = directory;; path = dirname17(path)) {
       const stat2 = lstatSync19(path);
       if (!stat2.isDirectory() || stat2.isSymbolicLink())
-        invalid5();
+        invalid6();
       this.parents.push({ path, dev: stat2.dev, ino: stat2.ino });
       if (path === dirname17(path))
         break;
@@ -98956,16 +99187,16 @@ class RecoveryOwner {
     this.assert();
   }
   assert() {
-    if (realpathSync7(this.directory) !== this.directory)
-      invalid5();
+    if (realpathSync8(this.directory) !== this.directory)
+      invalid6();
     for (const prior of this.parents) {
       const now3 = lstatSync19(prior.path);
       if (!now3.isDirectory() || now3.isSymbolicLink() || now3.dev !== prior.dev || now3.ino !== prior.ino)
-        invalid5();
+        invalid6();
     }
     const own2 = lstatSync19(this.directory);
     if ((own2.mode & 511) !== 448 || (own2.mode & 3584) !== 0 || process.getuid && own2.uid !== process.getuid())
-      invalid5();
+      invalid6();
   }
   read(name) {
     this.assert();
@@ -98973,7 +99204,7 @@ class RecoveryOwner {
     try {
       const before2 = fstatSync13(fd);
       if (!before2.isFile() || before2.nlink !== 1 || (before2.mode & 4095) !== 384 || before2.size < 1 || before2.size > 8192 || process.getuid && before2.uid !== process.getuid())
-        invalid5();
+        invalid6();
       const bytes = Buffer.alloc(before2.size + 1);
       let size2 = 0;
       while (size2 < bytes.length) {
@@ -98984,7 +99215,7 @@ class RecoveryOwner {
       }
       const after2 = fstatSync13(fd), path = lstatSync19(join42(this.directory, name));
       if (size2 !== before2.size || after2.size !== before2.size || before2.mtimeMs !== after2.mtimeMs || before2.ctimeMs !== after2.ctimeMs || path.dev !== before2.dev || path.ino !== before2.ino || !path.isFile() || path.isSymbolicLink())
-        invalid5();
+        invalid6();
       this.assert();
       return new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size2));
     } finally {
@@ -99016,11 +99247,11 @@ class RecoveryOwner {
   }
   saveState(state, expected) {
     if (this.read("state.json") !== expected)
-      invalid5();
+      invalid6();
     const name = `.state-${randomUUID6()}.json`;
     this.write(name, state);
     if (this.read("state.json") !== expected)
-      invalid5();
+      invalid6();
     this.assert();
     renameSync9(join42(this.directory, name), join42(this.directory, "state.json"));
     this.sync();
@@ -99044,7 +99275,7 @@ class RecoveryOwner {
       this.assert();
       const now3 = lstatSync19(join42(this.directory, "operation.lock"));
       if (owner.dev !== now3.dev || owner.ino !== now3.ino || !now3.isFile() || now3.isSymbolicLink())
-        invalid5();
+        invalid6();
       unlinkSync5(join42(this.directory, "operation.lock"));
       this.sync();
     }
@@ -99055,10 +99286,10 @@ function load(owner) {
     const stateText = owner.read("state.json"), state = stateSchema.parse(JSON.parse(stateText));
     const intent = intentSchema.parse(JSON.parse(owner.read(`intent-${state.intentSha256}.json`)));
     if (canonicalJsonSha256(intent) !== state.intentSha256 || normalizeSkillsApiOrigin(intent.apiOrigin) !== intent.apiOrigin || intent.operation === "activate" && intent.approval.acceptedTermsSha256 !== intent.termsSha256 || (state.phase === "observed" ? state.consentId === null : state.consentId !== null) || intent.operation === "revoke" && state.consentId !== null && state.consentId !== intent.consentId)
-      invalid5();
+      invalid6();
     return { intent, state, stateText };
   } catch {
-    return invalid5();
+    return invalid6();
   }
 }
 function bindRecurringRecovery(customer, intent) {
@@ -99078,8 +99309,8 @@ function base2(customer, organizationId) {
   };
 }
 function create3(directory, intent) {
-  if (!isAbsolute11(directory) || resolve13(directory) !== directory || realpathSync7(dirname17(directory)) !== dirname17(directory))
-    invalid5();
+  if (!isAbsolute11(directory) || resolve13(directory) !== directory || realpathSync8(dirname17(directory)) !== dirname17(directory))
+    invalid6();
   mkdirSync16(directory, { mode: 448 });
   const owner = new RecoveryOwner(directory), checked = intentSchema.parse(intent), intentSha256 = canonicalJsonSha256(checked);
   owner.write(`intent-${intentSha256}.json`, checked);
@@ -99203,7 +99434,7 @@ async function continueRecurringRecovery(customer, directory, options) {
     throw error61;
   }
 }
-var uuid12, sha2, common2, intentSchema, stateSchema, invalid5 = () => {
+var uuid12, sha2, common2, intentSchema, stateSchema, invalid6 = () => {
   throw new RecurringCustomerError("RECURRING_RECOVERY_INVALID", "The original recovery directory or record is invalid or changed. Preserve it; do not create a replacement activation automatically.");
 };
 var init_recurring_recovery = __esm(() => {
@@ -100968,9 +101199,9 @@ function registerOperationTools(server) {
             return mcpError("SELECTED_INPUT_REQUIRED", "The selected cloud execution contract accepts declared JSON input, not legacy run arguments or quote receipts.");
           const { CloudExecutionClient: CloudExecutionClient2 } = await Promise.resolve().then(() => (init_cloud_executions(), exports_cloud_executions));
           const client = await CloudExecutionClient2.configured();
-          const selection = resolved.selection;
-          const run = await client.submit(selection.slug, selection.version, input2 ?? {}, idempotency_key ?? crypto.randomUUID(), selection);
-          return mcpJson({ selection, remote: true, run });
+          const selection2 = resolved.selection;
+          const run = await client.submit(selection2.slug, selection2.version, input2 ?? {}, idempotency_key ?? crypto.randomUUID(), selection2);
+          return mcpJson({ selection: selection2, remote: true, run });
         }
         const result3 = await executeSelectedLocal2(resolved, { args, input: input2, cwd: process.cwd() });
         return { ...mcpJson(result3), isError: result3.exitCode !== 0 };
@@ -101405,9 +101636,9 @@ function registerResourceMetaTools(server) {
       existing.last_seen_at = new Date().toISOString();
       return mcpJson({ ...existing, registered: false });
     }
-    const id = Math.random().toString(36).slice(2, 10);
-    const ag = { id, name: a.name, last_seen_at: new Date().toISOString() };
-    _agentReg.set(id, ag);
+    const id2 = Math.random().toString(36).slice(2, 10);
+    const ag = { id: id2, name: a.name, last_seen_at: new Date().toISOString() };
+    _agentReg.set(id2, ag);
     return mcpJson({ ...ag, registered: true });
   });
   server.tool("heartbeat", "Update last_seen_at to signal agent is active.", { agent_id: exports_external.string() }, async (a) => {
@@ -101598,11 +101829,11 @@ function addSchedule(skill, cron, options = {}) {
   if (!valid)
     return { schedule: null, error: error61 };
   const data = loadSchedules(options.targetDir);
-  const id = `${skill}-${Date.now()}`;
+  const id2 = `${skill}-${Date.now()}`;
   const now3 = new Date;
   const nextRun = getNextRun(cron, now3);
   const schedule = {
-    id,
+    id: id2,
     name: options.name || `${skill} (${cron})`,
     skill,
     cron,
@@ -101643,9 +101874,9 @@ function getDueSchedules(targetDir) {
   const now3 = new Date;
   return listSchedules(targetDir).filter((s) => s.enabled && s.nextRun && new Date(s.nextRun) <= now3);
 }
-function recordScheduleRun(id, status, targetDir) {
+function recordScheduleRun(id2, status, targetDir) {
   const data = loadSchedules(targetDir);
-  const schedule = data.schedules.find((s) => s.id === id);
+  const schedule = data.schedules.find((s) => s.id === id2);
   if (!schedule)
     return;
   const now3 = new Date;
@@ -102135,11 +102366,11 @@ var init_private_publication_customer = __esm(() => {
 });
 
 // src/lib/private-publication-recovery.ts
-import { constants as constants13, closeSync as closeSync14, fsyncSync as fsyncSync3, fstatSync as fstatSync14, lstatSync as lstatSync20, mkdirSync as mkdirSync20, openSync as openSync14, readSync as readSync10, realpathSync as realpathSync8, renameSync as renameSync10, unlinkSync as unlinkSync6, writeFileSync as writeFileSync19 } from "fs";
+import { constants as constants13, closeSync as closeSync14, fsyncSync as fsyncSync3, fstatSync as fstatSync14, lstatSync as lstatSync20, mkdirSync as mkdirSync20, openSync as openSync14, readSync as readSync10, realpathSync as realpathSync9, renameSync as renameSync10, unlinkSync as unlinkSync6, writeFileSync as writeFileSync19 } from "fs";
 import { dirname as dirname20, isAbsolute as isAbsolute13, join as join47, resolve as resolve14 } from "path";
 import { randomUUID as randomUUID7 } from "crypto";
 function safeDirectory(directory2) {
-  if (!isAbsolute13(directory2) || directory2 !== resolve14(directory2) || realpathSync8(directory2) !== directory2)
+  if (!isAbsolute13(directory2) || directory2 !== resolve14(directory2) || realpathSync9(directory2) !== directory2)
     return fail3();
   for (let path = directory2;; path = dirname20(path)) {
     const stat2 = lstatSync20(path);
@@ -102277,7 +102508,7 @@ async function preparePrivatePublication(client, sourceDirectory, recoveryDirect
     phase: "prepared",
     intent: null
   };
-  if (!isAbsolute13(recoveryDirectory) || resolve14(recoveryDirectory) !== recoveryDirectory || realpathSync8(dirname20(recoveryDirectory)) !== dirname20(recoveryDirectory))
+  if (!isAbsolute13(recoveryDirectory) || resolve14(recoveryDirectory) !== recoveryDirectory || realpathSync9(dirname20(recoveryDirectory)) !== dirname20(recoveryDirectory))
     return fail3();
   mkdirSync20(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
@@ -102992,17 +103223,17 @@ __export(exports_runtime, {
   registerRuntime: () => registerRuntime
 });
 import { createHash as createHash18, randomUUID as randomUUID8 } from "crypto";
-import { lstatSync as lstatSync21, mkdirSync as mkdirSync22, readFileSync as readFileSync35, realpathSync as realpathSync9, writeFileSync as writeFileSync21 } from "fs";
+import { lstatSync as lstatSync21, mkdirSync as mkdirSync22, readFileSync as readFileSync35, realpathSync as realpathSync10, writeFileSync as writeFileSync21 } from "fs";
 import { basename as basename6, isAbsolute as isAbsolute15, join as join49 } from "path";
 import { createInterface } from "readline";
 function registerRuntime(parent) {
   parent.command("run").argument("<skill>", "Skill name").argument("[args...]", "Arguments to pass to the skill").allowUnknownOption(true).passThroughOptions(true).option("--json", "Output result as JSON", false).option("--remote", "Run on the configured server, using its catalog and quote", false).option("--target <target>", "Execution target: local or cloud").option("--secret-bindings <path>", "Reviewed, exact-selection local execution vault bindings (JSON file)").option("--secret-bindings-template", "Print a scoped bindings template without resolving secrets or running the skill", false).option("--input <json>", "Structured cloud execution input").option("--skill-version <version>", "Exact selected skill version").option("--selection-profile <id>", "Selected Skills profile").option("--session <id>", "Pinned Skills session").option("--cached", "Use the explicit verified selected cache", false).option("--yes", "Approve the server's quoted credit cost for this run", false).option("--idempotency-key <key>", "Reuse this key when retrying the same remote submission").option("--file <path>", "Attach a local input file to a remote run (repeatable)", (value, prior) => [...prior, value], []).option("--wait", "Poll remote runs until a terminal status", false).option("--poll-interval-ms <ms>", "Remote polling interval in milliseconds", "1000").option("--poll-timeout-ms <ms>", "Maximum time to wait for a remote run", "300000").description("Run a skill directly").action(async (name, args2, options) => handleRun(name, args2, options));
   const executions = parent.command("executions").description("Inspect isolated cloud executions");
   for (const operation of ["show", "logs", "artifacts", "cancel"]) {
-    executions.command(operation).argument("<execution-id>").option("--json", "Output as JSON", false).action(async (id) => {
+    executions.command(operation).argument("<execution-id>").option("--json", "Output as JSON", false).action(async (id2) => {
       try {
         const client = await CloudExecutionClient.configured();
-        const value = operation === "show" ? await client.get(id) : await client[operation](id);
+        const value = operation === "show" ? await client.get(id2) : await client[operation](id2);
         await writeCliOutput(JSON.stringify(value, null, 2));
       } catch (error61) {
         console.error(JSON.stringify({ error: error61.message }));
@@ -103010,14 +103241,14 @@ function registerRuntime(parent) {
       }
     });
   }
-  executions.command("download").argument("<execution-id>").argument("<artifact-name>").requiredOption("--output <path>", "New output file path").action(async (id, name, options) => {
+  executions.command("download").argument("<execution-id>").argument("<artifact-name>").requiredOption("--output <path>", "New output file path").action(async (id2, name, options) => {
     try {
       const client = await CloudExecutionClient.configured();
-      const manifest = await client.artifacts(id);
+      const manifest = await client.artifacts(id2);
       const expected = manifest.find((item) => item.name === name);
       if (!expected)
         throw new Error("Cloud artifact not found");
-      const bytes = await client.download(id, name);
+      const bytes = await client.download(id2, name);
       if (bytes.length !== expected.byteSize || createHash18("sha256").update(bytes).digest("hex") !== expected.sha256)
         throw new Error("Cloud artifact integrity verification failed");
       writeFileSync21(options.output, bytes, { flag: "wx", mode: 384 });
@@ -103029,10 +103260,10 @@ function registerRuntime(parent) {
   });
   const runs = parent.command("runs").description("Inspect local skill run records");
   runs.command("list").option("--remote", "List runs on the configured server", false).option("--json", "Output as JSON", false).option("--limit <n>", "Maximum number of runs", "20").option("--cursor <n>", "Local human-output offset; remote accepts only 0", "0").description("List recent skill runs").action((options) => options.remote ? handleRemoteRunsList(options) : handleRunsList(options));
-  runs.command("logs").argument("<run-id>").option("--json", "Output as JSON", false).action((id, options) => execute(options, (client) => client.getRunLogs(id)));
-  runs.command("cancel").argument("<run-id>").option("--json", "Output as JSON", false).action((id, options) => execute(options, (client) => client.cancelRun(id)));
-  runs.command("resume").argument("<run-id>").option("--json", "Output as JSON", false).action((id, options) => execute(options, (client) => client.resumeRun(id)));
-  runs.command("artifacts").argument("<run-id>").option("--json", "Output as JSON", false).action((id, options) => execute(options, (client) => client.getRunArtifacts(id)));
+  runs.command("logs").argument("<run-id>").option("--json", "Output as JSON", false).action((id2, options) => execute(options, (client) => client.getRunLogs(id2)));
+  runs.command("cancel").argument("<run-id>").option("--json", "Output as JSON", false).action((id2, options) => execute(options, (client) => client.cancelRun(id2)));
+  runs.command("resume").argument("<run-id>").option("--json", "Output as JSON", false).action((id2, options) => execute(options, (client) => client.resumeRun(id2)));
+  runs.command("artifacts").argument("<run-id>").option("--json", "Output as JSON", false).action((id2, options) => execute(options, (client) => client.getRunArtifacts(id2)));
   runs.command("show").argument("<run-id>", "Run id").option("--json", "Output as JSON", false).description("Show a skill run record").action((runId2, options) => handleRunsShow(runId2, options));
   runs.command("status").argument("<run-id>", "Remote run id, or local run id linked to a remote run").option("--json", "Output as JSON", false).description("Fetch remote run status").action((runId2, options) => handleRunsStatus(runId2, options));
   const exportsCommand = parent.command("exports").description("Inspect or open skill run exports");
@@ -103112,8 +103343,8 @@ async function readUpdatedVersion(bunExecutable) {
   const selected = Bun.which("skills");
   if (!installed || !selected)
     throw new Error("Updated command is unavailable");
-  const selectedPath = realpathSync9(selected);
-  if (selectedPath !== realpathSync9(installed))
+  const selectedPath = realpathSync10(selected);
+  if (selectedPath !== realpathSync10(installed))
     throw new Error("Updated command is shadowed on PATH");
   const version2 = (await readUpdateCommand([selectedPath, "--version"])).trim();
   if (!new RegExp(SEMVER_PATTERN).test(version2))
@@ -103184,9 +103415,9 @@ async function handleSetup(options) {
     }
   }
   if (!error61) {
-    const authority = resolveSkillsApiOrigin();
-    configured = authority?.origin ?? null;
-    source = authority?.source ?? null;
+    const authority2 = resolveSkillsApiOrigin();
+    configured = authority2?.origin ?? null;
+    source = authority2?.source ?? null;
   }
   const next = error61 ? ["skills auth login"] : configured ? ["skills auth login", "skills list --remote"] : ["skills list", "skills run <skill>"];
   const payload = {
@@ -103343,7 +103574,7 @@ async function handleRun(name, args2, options) {
           await writeCliOutput(JSON.stringify(await prepareSelectedSecretBindings(selected), null, 2));
           return;
         }
-        const result4 = await executeSelectedLocal(selected, { args: args2, input: input2, cwd: process.cwd(), ...options.secretBindings ? { secretBindings: readSelectedSecretBindings(options.secretBindings) } : {} });
+        const result4 = await executeSelectedLocal(selected, { args: args2, input: input2, cwd: process.cwd(), sharedExecutionGrants: !options.cached, ...options.secretBindings ? { secretBindings: readSelectedSecretBindings(options.secretBindings) } : {} });
         if (options.json)
           await writeCliOutput(JSON.stringify(result4, null, 2));
         else {
@@ -104190,7 +104421,7 @@ This grants an additional recurring budget. Each occurrence reprices within the
     rl.question(`Type ${acceptance} to approve these exact terms: `, (value) => finish(value === acceptance));
   });
 }
-function input2(action, id, options) {
+function input2(action, id2, options) {
   const value = {};
   if (options.userId !== undefined)
     value.userId = options.userId;
@@ -104199,9 +104430,9 @@ function input2(action, id, options) {
   if (action === "preview")
     value.request = readRequest(options.request);
   if (["draft", "activate", "verification"].includes(action))
-    value.draftId = id;
+    value.draftId = id2;
   if (["get", "revoke", "occurrences"].includes(action))
-    value.consentId = id;
+    value.consentId = id2;
   if (action === "list" || action === "occurrences") {
     if (options.limit !== undefined) {
       if (!/^[1-9]\d{0,2}$/.test(options.limit))
@@ -104783,12 +105014,12 @@ function registerCreateSync(parent) {
   const configCmd = parent.command("config").description("Manage skills configuration");
   configCmd.command("show", { isDefault: true }).option("--json", "Output as JSON", false).description("Show current merged configuration").action((options) => {
     const config2 = loadConfig();
-    const keys2 = Object.keys(config2);
+    const keys3 = Object.keys(config2);
     if (options.json) {
       console.log(JSON.stringify(config2, null, 2));
       return;
     }
-    if (!keys2.length) {
+    if (!keys3.length) {
       console.log(source_default.dim("No configuration set"));
       return;
     }
@@ -105334,12 +105565,12 @@ var init_agent_integration2 = __esm(() => {
 });
 
 // src/lib/profile-admin.ts
-function id(value) {
+function id2(value) {
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(value) || value.includes(".."))
     throw new Error("Invalid Skills profile or station id");
   return encodeURIComponent(value);
 }
-async function request(path, init = {}) {
+async function request2(path, init = {}) {
   const connection = await resolveSkillsConnection();
   if (!connection)
     throw new Error("Profile administration requires a configured Skills API");
@@ -105357,7 +105588,7 @@ async function request(path, init = {}) {
   return JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, MAX_PROFILE_DOCUMENT_BYTES)));
 }
 async function readSkillProfile(profileId) {
-  const value = await request(`/profiles/${id(profileId)}`);
+  const value = await request2(`/profiles/${id2(profileId)}`);
   if (value.id !== profileId || !Array.isArray(value.selections) || value.selections.length > MAX_PROFILE_SELECTIONS || typeof value.revision !== "string")
     throw new Error("Invalid Skills profile response");
   return value;
@@ -105365,25 +105596,25 @@ async function readSkillProfile(profileId) {
 async function saveSkillProfile(profileId, selections, revision) {
   if (!Array.isArray(selections) || selections.length > MAX_PROFILE_SELECTIONS)
     throw new Error(`A profile requires at most ${MAX_PROFILE_SELECTIONS} exact selections`);
-  id(profileId);
+  id2(profileId);
   const aliasError = selectionAliasError(selections);
   if (aliasError)
     throw new Error(aliasError);
   if (revision !== undefined)
-    id(revision);
+    id2(revision);
   const input3 = { selections }, bodyBytes = profileDocumentBytes(input3);
   if (bodyBytes > MAX_PROFILE_DOCUMENT_BYTES)
     throw new Error("Profile input exceeds the size limit");
   const large = requiresProfileCapacity(selections, bodyBytes);
-  const aliases = selections.some((selection) => selection.aliases?.length);
+  const aliases = selections.some((selection2) => selection2.aliases?.length);
   if (aliases || large) {
-    const capabilities = await request("/capabilities");
+    const capabilities = await request2("/capabilities");
     if (aliases && capabilities?.selectionAliases !== true)
       throw new Error("This Skills API does not advertise selection aliases. Upgrade the API before saving this profile.");
     if (large)
       assertAdvertisedProfileCapacity(capabilities, selections.length, bodyBytes);
   }
-  const value = await request(`/profiles/${id(profileId)}`, {
+  const value = await request2(`/profiles/${id2(profileId)}`, {
     method: "PUT",
     headers: revision ? { "If-Match": `"${revision}"` } : { "If-None-Match": "*" },
     body: JSON.stringify(input3)
@@ -105395,7 +105626,7 @@ async function saveSkillProfile(profileId, selections, revision) {
   return value;
 }
 async function readStationSkillState(stationId) {
-  const value = await request(`/stations/${id(stationId)}/state`);
+  const value = await request2(`/stations/${id2(stationId)}/state`);
   if (value.stationId !== stationId || !Array.isArray(value.selections) || value.selections.length > MAX_PROFILE_SELECTIONS)
     throw new Error("Invalid Skills station response");
   return value;
@@ -105435,9 +105666,9 @@ function readProfileInput(path) {
 }
 function registerProfiles(parent) {
   const profiles = parent.command("profiles").description("Manage exact, shared skill selections through the API");
-  profiles.command("show <id>").option("--json", "Output the profile as JSON", false).option("--save <path>", "Save a private snapshot for review or rollback").action(async (id2, options) => {
+  profiles.command("show <id>").option("--json", "Output the profile as JSON", false).option("--save <path>", "Save a private snapshot for review or rollback").action(async (id3, options) => {
     try {
-      const profile = await readSkillProfile(id2), text3 = JSON.stringify(profile, null, 2);
+      const profile = await readSkillProfile(id3), text3 = JSON.stringify(profile, null, 2);
       if (options.save)
         writeFileSync23(options.save, JSON.stringify(profile), { mode: 384, flag: "wx" });
       await writeCliOutput(options.json ? text3 : `${profile.id} at ${profile.revision}: ${profile.selections.map((skill) => `${skill.slug}@${skill.version}`).join(", ")}`);
@@ -105446,20 +105677,20 @@ function registerProfiles(parent) {
       process.exitCode = 1;
     }
   });
-  profiles.command("set <id>").requiredOption("--file <path>", "JSON snapshot with a selections array").option("--if-match <revision>", "Replace only this existing revision; omission creates a new profile").option("--json", "Output the saved profile as JSON", false).description("Create or update a profile; use a saved snapshot with --if-match to roll back").action(async (id2, options) => {
+  profiles.command("set <id>").requiredOption("--file <path>", "JSON snapshot with a selections array").option("--if-match <revision>", "Replace only this existing revision; omission creates a new profile").option("--json", "Output the saved profile as JSON", false).description("Create or update a profile; use a saved snapshot with --if-match to roll back").action(async (id3, options) => {
     try {
       const text3 = readProfileInput(options.file);
       const input3 = JSON.parse(text3);
-      const profile = await saveSkillProfile(id2, input3.selections, options.ifMatch);
+      const profile = await saveSkillProfile(id3, input3.selections, options.ifMatch);
       await writeCliOutput(options.json ? JSON.stringify(profile) : `Saved ${profile.id} at ${profile.revision}`);
     } catch (error61) {
       console.error(error61.message);
       process.exitCode = 1;
     }
   });
-  parent.command("station-state <id>").description("Read this actor's last applied skill selection on a station").option("--json", "Output the station receipt as JSON", false).action(async (id2) => {
+  parent.command("station-state <id>").description("Read this actor's last applied skill selection on a station").option("--json", "Output the station receipt as JSON", false).action(async (id3) => {
     try {
-      await writeCliOutput(JSON.stringify(await readStationSkillState(id2), null, 2));
+      await writeCliOutput(JSON.stringify(await readStationSkillState(id3), null, 2));
     } catch (error61) {
       console.error(error61.message);
       process.exitCode = 1;
@@ -105471,6 +105702,76 @@ var init_profiles = __esm(() => {
   init_profile_limits();
 });
 
+// src/cli/commands/grants.ts
+var exports_grants = {};
+__export(exports_grants, {
+  registerGrants: () => registerGrants
+});
+import {
+  constants as constants16,
+  closeSync as closeSync17,
+  fstatSync as fstatSync17,
+  openSync as openSync17,
+  readSync as readSync13,
+  writeFileSync as writeFileSync24
+} from "fs";
+function readInput(path) {
+  const fd = openSync17(path, constants16.O_RDONLY | constants16.O_NONBLOCK);
+  try {
+    const stat2 = fstatSync17(fd);
+    if (!stat2.isFile() || stat2.size > MAX_EXECUTION_GRANT_BYTES)
+      throw new Error("Grant input must be a regular file within the policy size limit.");
+    const bytes = Buffer.alloc(MAX_EXECUTION_GRANT_BYTES + 1);
+    let size2 = 0;
+    while (size2 < bytes.length) {
+      const count = readSync13(fd, bytes, size2, bytes.length - size2, null);
+      if (!count)
+        break;
+      size2 += count;
+    }
+    if (size2 > MAX_EXECUTION_GRANT_BYTES)
+      throw new Error("Grant input exceeds the policy size limit.");
+    try {
+      return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size2)));
+    } catch {
+      throw new Error("Grant input must be a JSON document containing a grants array.");
+    }
+  } finally {
+    closeSync17(fd);
+  }
+}
+function registerGrants(parent) {
+  const grants = parent.command("grants").description("Manage shared execution grants containing vault references through the Skills API");
+  grants.command("show <profile>").option("--revision <revision>", "Read an immutable policy revision").option("--save <path>", "Save a private policy snapshot for review or rollback").option("--json", "Output the full policy as JSON", false).action(async (profile, options) => {
+    try {
+      const policy = await readExecutionGrantPolicy(profile, options.revision);
+      if (options.save)
+        writeFileSync24(options.save, JSON.stringify(policy, null, 2), {
+          mode: 384,
+          flag: "wx"
+        });
+      await writeCliOutput(options.json ? JSON.stringify(policy) : `${policy.profileId} at ${policy.revision}: ${policy.grants.length} execution grants`);
+    } catch (error61) {
+      console.error(error61.message);
+      process.exitCode = 1;
+    }
+  });
+  grants.command("set <profile>").requiredOption("--file <path>", "Reviewed JSON policy with a grants array; empty revokes all shared grants").option("--if-match <revision>", "Replace exactly this revision; omission creates the initial policy").option("--json", "Output the saved policy as JSON", false).action(async (profile, options) => {
+    try {
+      const input3 = readInput(options.file);
+      const policy = await saveExecutionGrantPolicy(profile, input3?.grants, options.ifMatch);
+      await writeCliOutput(options.json ? JSON.stringify(policy) : `Saved execution grants for ${policy.profileId} at ${policy.revision}`);
+    } catch (error61) {
+      console.error(error61.message);
+      process.exitCode = 1;
+    }
+  });
+}
+var init_grants = __esm(() => {
+  init_execution_grant_client();
+  init_execution_grants();
+});
+
 // src/lib/station-hydrate.ts
 import { createHash as createHash20 } from "crypto";
 import {
@@ -105479,7 +105780,7 @@ import {
   readdirSync as readdirSync20,
   readFileSync as readFileSync38,
   statSync as statSync20,
-  writeFileSync as writeFileSync24
+  writeFileSync as writeFileSync25
 } from "fs";
 import { dirname as dirname24, join as join52, resolve as resolve16, sep as sep10 } from "path";
 function fail4(code2, message, detail = []) {
@@ -105757,7 +106058,7 @@ function writeStationHydration(options) {
   };
   const hydrationManifestPath = join52(dirname24(cacheRoot), `hydration-${options.stationId}.json`);
   mkdirSync24(dirname24(hydrationManifestPath), { recursive: true });
-  writeFileSync24(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
+  writeFileSync25(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
   return {
     ...base3,
@@ -105833,7 +106134,7 @@ var init_hydrate = __esm(() => {
 
 // src/lib/prepare-skill.ts
 import { createHash as createHash21, randomUUID as randomUUID9 } from "crypto";
-import { chmodSync as chmodSync3, existsSync as existsSync34, lstatSync as lstatSync23, mkdirSync as mkdirSync25, mkdtempSync as mkdtempSync6, readFileSync as readFileSync39, readdirSync as readdirSync21, renameSync as renameSync11, rmSync as rmSync8, writeFileSync as writeFileSync25 } from "fs";
+import { chmodSync as chmodSync3, existsSync as existsSync34, lstatSync as lstatSync23, mkdirSync as mkdirSync25, mkdtempSync as mkdtempSync6, readFileSync as readFileSync39, readdirSync as readdirSync21, renameSync as renameSync11, rmSync as rmSync8, writeFileSync as writeFileSync26 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { dirname as dirname25, isAbsolute as isAbsolute18, join as join53, relative as relative9, resolve as resolve17, sep as sep11 } from "path";
 function prepareSkill(name, options) {
@@ -105881,10 +106182,10 @@ function prepareSkill(name, options) {
     for (const file2 of before2.files) {
       const destination = join53(staging, file2.path);
       mkdirSync25(dirname25(destination), { recursive: true });
-      writeFileSync25(destination, file2.bytes, { mode: file2.mode });
+      writeFileSync26(destination, file2.bytes, { mode: file2.mode });
     }
     const stagedManifest = join53(staging, "skill.json");
-    writeFileSync25(stagedManifest, `${JSON.stringify(candidate, null, 2)}
+    writeFileSync26(stagedManifest, `${JSON.stringify(candidate, null, 2)}
 `);
     const contentHash = computeContentHash(staging);
     const changed3 = options.version !== previousVersion || kind !== manifest.kind || contentHash !== provenance?.content_hash;
@@ -105894,7 +106195,7 @@ function prepareSkill(name, options) {
     candidate.provenance.content_hash = contentHash;
     const candidateBytes = `${JSON.stringify(candidate, null, 2)}
 `;
-    writeFileSync25(stagedManifest, candidateBytes);
+    writeFileSync26(stagedManifest, candidateBytes);
     validateRawCandidate(candidate);
     validateRuntimeEntrypoint(candidate, staging);
     const validation = validatePortableSkillDirectory(normalized, staging);
@@ -105908,7 +106209,7 @@ ${validation.issues.map((issue2) => `${issue2.code}: ${issue2.message}`).join(`
     if (changed3 && !options.dryRun) {
       const temporary = join53(path, `.skill-prepare-${randomUUID9()}.tmp`);
       try {
-        writeFileSync25(temporary, candidateBytes, { flag: "wx", mode: manifestFile.mode });
+        writeFileSync26(temporary, candidateBytes, { flag: "wx", mode: manifestFile.mode });
         chmodSync3(temporary, manifestFile.mode);
         renameSync11(temporary, join53(path, "skill.json"));
       } finally {
@@ -106440,7 +106741,7 @@ var init_schedule = __esm(() => {
 });
 
 // src/lib/registry-sync.ts
-import { mkdirSync as mkdirSync26, writeFileSync as writeFileSync26 } from "fs";
+import { mkdirSync as mkdirSync26, writeFileSync as writeFileSync27 } from "fs";
 import { dirname as dirname26, relative as relative10 } from "path";
 function createRegistrySyncArtifact(options = {}) {
   const profile = options.profile ?? "all";
@@ -106499,7 +106800,7 @@ function createRegistrySyncArtifact(options = {}) {
 }
 function writeRegistrySyncArtifact(path, artifact) {
   mkdirSync26(dirname26(path), { recursive: true });
-  writeFileSync26(path, `${JSON.stringify(artifact, null, 2)}
+  writeFileSync27(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
 function buildDocs(name) {
@@ -106564,10 +106865,10 @@ async function handleRegistrySync(options) {
     await writeJson2(artifact, 2);
     return;
   }
-  const invalid6 = artifact.summary.invalidSkillCount ?? "not checked";
+  const invalid7 = artifact.summary.invalidSkillCount ?? "not checked";
   console.log(source_default.green(`Registry sync artifact written to ${options.output}`));
   console.log(source_default.dim(`  Skills: ${artifact.summary.skillCount}`));
-  console.log(source_default.dim(`  Invalid: ${invalid6}`));
+  console.log(source_default.dim(`  Invalid: ${invalid7}`));
 }
 function registerPull(parent) {
   parent.command("pull").argument("[names...]", "Skills to pull from the configured instance (name or name@version)").option("--all", "Pull every skill the instance serves", false).option("--for-machine", "Prepare this machine with the instance's full catalog (implies --all)", false).option("--json", "Output results as JSON", false).option("--selection-profile <id>", "Selection profile for stations using the Skills CLI cache").description("Fetch skills from the configured Skills instance into this machine's corpus").action(async (names, options) => {
@@ -107527,8 +107828,8 @@ Waiting for authentication...`));
 }
 function registerAuth(parent) {
   const auth = parent.command("auth").description("Manage account authentication");
-  const keys2 = auth.command("keys").description("Manage API keys on the configured instance");
-  keys2.command("list").option("--json", "Output as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").action(async (options) => {
+  const keys3 = auth.command("keys").description("Manage API keys on the configured instance");
+  keys3.command("list").option("--json", "Output as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").action(async (options) => {
     try {
       const target = await captureProfileWorkspace("List API keys");
       target.unchanged();
@@ -107537,7 +107838,7 @@ function registerAuth(parent) {
       writeCommandError(error61, "Failed to list API keys", options.json);
     }
   });
-  keys2.command("create").argument("<name>").option("--scope <scope>", "Limit key scope (repeatable)", (value, all) => [...all, value], []).option("--json", "Output the newly created key as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").description("Create a key; the returned secret is shown once and must be stored securely").action(async (name, options) => {
+  keys3.command("create").argument("<name>").option("--scope <scope>", "Limit key scope (repeatable)", (value, all) => [...all, value], []).option("--json", "Output the newly created key as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").description("Create a key; the returned secret is shown once and must be stored securely").action(async (name, options) => {
     try {
       const target = await captureProfileWorkspace("Create API key");
       const client = new RemoteSkillsAuthClient(target.origin);
@@ -107548,11 +107849,11 @@ function registerAuth(parent) {
       writeCommandError(error61, "Failed to create API key", options.json);
     }
   });
-  keys2.command("revoke").argument("<key-id>").option("--json", "Output as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").action(async (id2, options) => {
+  keys3.command("revoke").argument("<key-id>").option("--json", "Output as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").action(async (id3, options) => {
     try {
       const target = await captureProfileWorkspace("Revoke API key");
       target.unchanged();
-      console.log(JSON.stringify(await new RemoteSkillsAuthClient(target.origin).revokeApiKey(options.email, options.code, id2, target.context), null, 2));
+      console.log(JSON.stringify(await new RemoteSkillsAuthClient(target.origin).revokeApiKey(options.email, options.code, id3, target.context), null, 2));
     } catch (error61) {
       writeCommandError(error61, "Failed to revoke API key", options.json);
     }
@@ -107905,13 +108206,13 @@ function registerWorkspaceInvitationCommands(workspace) {
     else
       command.option("--code-stdin", "Read a previously requested six-digit verification code from stdin");
     command.action(async (...args2) => {
-      const id2 = targeted ? String(args2[0]) : undefined, options = args2[targeted ? 1 : 0];
+      const id3 = targeted ? String(args2[0]) : undefined, options = args2[targeted ? 1 : 0];
       try {
         if (mutation && options.confirm !== true)
           throw new WorkspaceInvitationInputError;
-        let input3 = action === "list" ? { ...options.after === undefined ? {} : { after: options.after } } : action === "get" ? { invitationId: id2 } : action === "issue" ? { email: options.recipient, role: options.role, idempotencyKey: options.idempotencyKey, confirm: true } : action === "resend" ? { invitationId: id2, expectedGeneration: Number(options.expectedGeneration), idempotencyKey: options.idempotencyKey, confirm: true } : action === "revoke" ? { invitationId: id2, expectedGeneration: Number(options.expectedGeneration), confirm: true } : { invitationId: id2, token: "", confirm: true };
+        let input3 = action === "list" ? { ...options.after === undefined ? {} : { after: options.after } } : action === "get" ? { invitationId: id3 } : action === "issue" ? { email: options.recipient, role: options.role, idempotencyKey: options.idempotencyKey, confirm: true } : action === "resend" ? { invitationId: id3, expectedGeneration: Number(options.expectedGeneration), idempotencyKey: options.idempotencyKey, confirm: true } : action === "revoke" ? { invitationId: id3, expectedGeneration: Number(options.expectedGeneration), confirm: true } : { invitationId: id3, token: "", confirm: true };
         if (action === "accept")
-          invitationId(id2);
+          invitationId(id3);
         else
           input3 = invitationInput(action, input3);
         const context2 = invitationProfileContext(options.userId, options.membershipId);
@@ -107942,7 +108243,7 @@ function registerWorkspaceInvitationCommands(workspace) {
         if (code2 === null)
           return;
         if (action === "accept")
-          input3 = invitationInput("accept", { invitationId: id2, token, confirm: true });
+          input3 = invitationInput("accept", { invitationId: id3, token, confirm: true });
         target.unchanged();
         const result2 = await invokeFreshInvitation(client, options.email, code2, context2, action, input3);
         console.log(JSON.stringify(result2, null, options.json ? undefined : 2));
@@ -108332,7 +108633,7 @@ var init_storage2 = __esm(() => {
 });
 
 // src/lib/registry-reconcile.ts
-import { existsSync as existsSync36, readFileSync as readFileSync41, statSync as statSync21, writeFileSync as writeFileSync27 } from "fs";
+import { existsSync as existsSync36, readFileSync as readFileSync41, statSync as statSync21, writeFileSync as writeFileSync28 } from "fs";
 import { join as join55 } from "path";
 function isDirectory2(path) {
   try {
@@ -108647,7 +108948,7 @@ async function reconcileRegistry(options = {}) {
         runCount: readCursor(root).runCount + 1,
         summary
       };
-      writeFileSync27(join55(root, SYNC_CURSOR_FILE), `${JSON.stringify(cursor2, null, 2)}
+      writeFileSync28(join55(root, SYNC_CURSOR_FILE), `${JSON.stringify(cursor2, null, 2)}
 `);
       return {
         corpusRoot: root,
@@ -116606,6 +116907,8 @@ var { registerAgentIntegration: registerAgentIntegration2 } = await Promise.reso
 registerAgentIntegration2(program2);
 var { registerProfiles: registerProfiles2 } = await Promise.resolve().then(() => (init_profiles(), exports_profiles));
 registerProfiles2(program2);
+var { registerGrants: registerGrants2 } = await Promise.resolve().then(() => (init_grants(), exports_grants));
+registerGrants2(program2);
 var { registerHydrate: registerHydrate2 } = await Promise.resolve().then(() => (init_hydrate(), exports_hydrate));
 registerHydrate2(program2);
 var { registerPortableSkillCommands: registerPortableSkillCommands2 } = await Promise.resolve().then(() => (init_portable_skills2(), exports_portable_skills));