@hasna/skills 0.8.2 → 0.8.3

package/bin/server.js

@@ -2064,7 +2064,7 @@ var require_client = __commonJS((exports) => {
 var require_config = __commonJS((exports) => {
   var { homedir } = __require("os");
   var { sep, join } = __require("path");
-  var { createHash } = __require("crypto");
+  var { createHash: createHash2 } = __require("crypto");
   var { readFile: readFile$1 } = __require("fs/promises");
   var { IniSectionType } = require_dist_cjs();
   var { normalizeProvider } = require_client();
@@ -2219,7 +2219,7 @@ var require_config = __commonJS((exports) => {
   var DEFAULT_PROFILE = "default";
   var getProfileName = (init) => init.profile || process.env[ENV_PROFILE] || DEFAULT_PROFILE;
   var getSSOTokenFilepath = (id) => {
-    const hasher = createHash("sha1");
+    const hasher = createHash2("sha1");
     const cacheName = hasher.update(id).digest("hex");
     return join(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
   };
@@ -3571,7 +3571,7 @@ var require_endpoints = __commonJS((exports) => {
 
 // node_modules/@aws-sdk/core/node_modules/@smithy/core/dist-cjs/submodules/serde/index.js
 var require_serde = __commonJS((exports) => {
-  var { createHmac: createHmac2, createHash, getRandomValues } = __require("crypto");
+  var { createHmac: createHmac2, createHash: createHash2, getRandomValues } = __require("crypto");
   var { hasOwn, HttpResponse } = require_transport();
   exports.hasOwn = hasOwn;
   var { ReadStream, lstatSync, fstatSync } = __require("fs");
@@ -4476,7 +4476,7 @@ var require_serde = __commonJS((exports) => {
       return Promise.resolve(this.hash.digest());
     }
     reset() {
-      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash(this.algorithmIdentifier);
+      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash2(this.algorithmIdentifier);
     }
   }
   function castSourceData(toCast, encoding) {
@@ -5215,7 +5215,7 @@ var require_checksum = __commonJS((exports) => {
   var { createReadStream } = __require("fs");
   var { Writable } = __require("stream");
   var { toUint8Array, concatBytes } = require_serde();
-  var { createHash, createHmac: createHmac2 } = __require("crypto");
+  var { createHash: createHash2, createHmac: createHmac2 } = __require("crypto");
   var zlib = __require("zlib");
   async function blobReader(blob, onChunk, chunkSize = 1024 * 1024) {
     const size = blob.size;
@@ -5380,7 +5380,7 @@ var require_checksum = __commonJS((exports) => {
   }
   var hasNativeCrypto$1 = (() => {
     try {
-      createHash("md5");
+      createHash2("md5");
       return true;
     } catch {
       return false;
@@ -5390,7 +5390,7 @@ var require_checksum = __commonJS((exports) => {
   function buildNativeClass$2() {
     return class Md5Node2 {
       digestLength = 16;
-      hash = createHash("md5");
+      hash = createHash2("md5");
       update(data) {
         this.hash.update(toUint8Array(data));
       }
@@ -5399,7 +5399,7 @@ var require_checksum = __commonJS((exports) => {
         return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
       }
       reset() {
-        this.hash = createHash("md5");
+        this.hash = createHash2("md5");
       }
     };
   }
@@ -5689,7 +5689,7 @@ var require_checksum = __commonJS((exports) => {
   ]);
   var hasNativeCrypto = (() => {
     try {
-      createHash("sha256");
+      createHash2("sha256");
       return true;
     } catch {
       return false;
@@ -5729,7 +5729,7 @@ var require_checksum = __commonJS((exports) => {
         this.finished = false;
       }
       createHash() {
-        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash("sha256");
+        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash2("sha256");
       }
     };
   }
@@ -12683,7 +12683,7 @@ var require_client3 = __commonJS((exports) => {
 var require_config2 = __commonJS((exports) => {
   var { homedir } = __require("os");
   var { sep, join } = __require("path");
-  var { createHash } = __require("crypto");
+  var { createHash: createHash2 } = __require("crypto");
   var { readFile: readFile$1 } = __require("fs/promises");
   var { IniSectionType } = require_dist_cjs();
   var { normalizeProvider } = require_client3();
@@ -12838,7 +12838,7 @@ var require_config2 = __commonJS((exports) => {
   var DEFAULT_PROFILE = "default";
   var getProfileName = (init) => init.profile || process.env[ENV_PROFILE] || DEFAULT_PROFILE;
   var getSSOTokenFilepath = (id) => {
-    const hasher = createHash("sha1");
+    const hasher = createHash2("sha1");
     const cacheName = hasher.update(id).digest("hex");
     return join(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
   };
@@ -14190,7 +14190,7 @@ var require_endpoints2 = __commonJS((exports) => {
 
 // node_modules/@aws-sdk/checksums/node_modules/@smithy/core/dist-cjs/submodules/serde/index.js
 var require_serde2 = __commonJS((exports) => {
-  var { createHmac: createHmac2, createHash, getRandomValues } = __require("crypto");
+  var { createHmac: createHmac2, createHash: createHash2, getRandomValues } = __require("crypto");
   var { hasOwn, HttpResponse } = require_transport2();
   exports.hasOwn = hasOwn;
   var { ReadStream, lstatSync, fstatSync } = __require("fs");
@@ -15095,7 +15095,7 @@ var require_serde2 = __commonJS((exports) => {
       return Promise.resolve(this.hash.digest());
     }
     reset() {
-      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash(this.algorithmIdentifier);
+      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash2(this.algorithmIdentifier);
     }
   }
   function castSourceData(toCast, encoding) {
@@ -15834,7 +15834,7 @@ var require_checksum2 = __commonJS((exports) => {
   var { createReadStream } = __require("fs");
   var { Writable } = __require("stream");
   var { toUint8Array, concatBytes } = require_serde2();
-  var { createHash, createHmac: createHmac2 } = __require("crypto");
+  var { createHash: createHash2, createHmac: createHmac2 } = __require("crypto");
   var zlib = __require("zlib");
   async function blobReader(blob, onChunk, chunkSize = 1024 * 1024) {
     const size = blob.size;
@@ -15999,7 +15999,7 @@ var require_checksum2 = __commonJS((exports) => {
   }
   var hasNativeCrypto$1 = (() => {
     try {
-      createHash("md5");
+      createHash2("md5");
       return true;
     } catch {
       return false;
@@ -16009,7 +16009,7 @@ var require_checksum2 = __commonJS((exports) => {
   function buildNativeClass$2() {
     return class Md5Node2 {
       digestLength = 16;
-      hash = createHash("md5");
+      hash = createHash2("md5");
       update(data) {
         this.hash.update(toUint8Array(data));
       }
@@ -16018,7 +16018,7 @@ var require_checksum2 = __commonJS((exports) => {
         return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
       }
       reset() {
-        this.hash = createHash("md5");
+        this.hash = createHash2("md5");
       }
     };
   }
@@ -16308,7 +16308,7 @@ var require_checksum2 = __commonJS((exports) => {
   ]);
   var hasNativeCrypto = (() => {
     try {
-      createHash("sha256");
+      createHash2("sha256");
       return true;
     } catch {
       return false;
@@ -16348,7 +16348,7 @@ var require_checksum2 = __commonJS((exports) => {
         this.finished = false;
       }
       createHash() {
-        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash("sha256");
+        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash2("sha256");
       }
     };
   }
@@ -20424,7 +20424,7 @@ var require_client4 = __commonJS((exports) => {
 var require_config3 = __commonJS((exports) => {
   var { homedir } = __require("os");
   var { sep, join } = __require("path");
-  var { createHash } = __require("crypto");
+  var { createHash: createHash2 } = __require("crypto");
   var { readFile: readFile$1 } = __require("fs/promises");
   var { IniSectionType } = require_dist_cjs();
   var { normalizeProvider: normalizeProvider2 } = require_client4();
@@ -20579,7 +20579,7 @@ var require_config3 = __commonJS((exports) => {
   var DEFAULT_PROFILE = "default";
   var getProfileName = (init) => init.profile || process.env[ENV_PROFILE] || DEFAULT_PROFILE;
   var getSSOTokenFilepath = (id) => {
-    const hasher = createHash("sha1");
+    const hasher = createHash2("sha1");
     const cacheName = hasher.update(id).digest("hex");
     return join(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
   };
@@ -21931,7 +21931,7 @@ var require_endpoints3 = __commonJS((exports) => {
 
 // node_modules/@aws-sdk/middleware-sdk-s3/node_modules/@smithy/core/dist-cjs/submodules/serde/index.js
 var require_serde3 = __commonJS((exports) => {
-  var { createHmac: createHmac2, createHash, getRandomValues } = __require("crypto");
+  var { createHmac: createHmac2, createHash: createHash2, getRandomValues } = __require("crypto");
   var { hasOwn, HttpResponse } = require_transport3();
   exports.hasOwn = hasOwn;
   var { ReadStream, lstatSync, fstatSync } = __require("fs");
@@ -22836,7 +22836,7 @@ var require_serde3 = __commonJS((exports) => {
       return Promise.resolve(this.hash.digest());
     }
     reset() {
-      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash(this.algorithmIdentifier);
+      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash2(this.algorithmIdentifier);
     }
   }
   function castSourceData(toCast, encoding) {
@@ -23575,7 +23575,7 @@ var require_checksum3 = __commonJS((exports) => {
   var { createReadStream } = __require("fs");
   var { Writable } = __require("stream");
   var { toUint8Array: toUint8Array2, concatBytes } = require_serde3();
-  var { createHash, createHmac: createHmac2 } = __require("crypto");
+  var { createHash: createHash2, createHmac: createHmac2 } = __require("crypto");
   var zlib = __require("zlib");
   async function blobReader(blob, onChunk, chunkSize = 1024 * 1024) {
     const size = blob.size;
@@ -23740,7 +23740,7 @@ var require_checksum3 = __commonJS((exports) => {
   }
   var hasNativeCrypto$1 = (() => {
     try {
-      createHash("md5");
+      createHash2("md5");
       return true;
     } catch {
       return false;
@@ -23750,7 +23750,7 @@ var require_checksum3 = __commonJS((exports) => {
   function buildNativeClass$2() {
     return class Md5Node2 {
       digestLength = 16;
-      hash = createHash("md5");
+      hash = createHash2("md5");
       update(data) {
         this.hash.update(toUint8Array2(data));
       }
@@ -23759,7 +23759,7 @@ var require_checksum3 = __commonJS((exports) => {
         return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
       }
       reset() {
-        this.hash = createHash("md5");
+        this.hash = createHash2("md5");
       }
     };
   }
@@ -24049,7 +24049,7 @@ var require_checksum3 = __commonJS((exports) => {
   ]);
   var hasNativeCrypto = (() => {
     try {
-      createHash("sha256");
+      createHash2("sha256");
       return true;
     } catch {
       return false;
@@ -24089,7 +24089,7 @@ var require_checksum3 = __commonJS((exports) => {
         this.finished = false;
       }
       createHash() {
-        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash("sha256");
+        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash2("sha256");
       }
     };
   }
@@ -28008,7 +28008,7 @@ var require_client5 = __commonJS((exports) => {
 var require_config4 = __commonJS((exports) => {
   var { homedir } = __require("os");
   var { sep, join } = __require("path");
-  var { createHash } = __require("crypto");
+  var { createHash: createHash2 } = __require("crypto");
   var { readFile: readFile$1 } = __require("fs/promises");
   var { IniSectionType } = require_dist_cjs();
   var { normalizeProvider: normalizeProvider2 } = require_client5();
@@ -28163,7 +28163,7 @@ var require_config4 = __commonJS((exports) => {
   var DEFAULT_PROFILE = "default";
   var getProfileName = (init) => init.profile || process.env[ENV_PROFILE] || DEFAULT_PROFILE;
   var getSSOTokenFilepath = (id) => {
-    const hasher = createHash("sha1");
+    const hasher = createHash2("sha1");
     const cacheName = hasher.update(id).digest("hex");
     return join(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
   };
@@ -29515,7 +29515,7 @@ var require_endpoints4 = __commonJS((exports) => {
 
 // node_modules/@smithy/signature-v4/node_modules/@smithy/core/dist-cjs/submodules/serde/index.js
 var require_serde4 = __commonJS((exports) => {
-  var { createHmac: createHmac2, createHash, getRandomValues } = __require("crypto");
+  var { createHmac: createHmac2, createHash: createHash2, getRandomValues } = __require("crypto");
   var { hasOwn, HttpResponse } = require_transport4();
   exports.hasOwn = hasOwn;
   var { ReadStream, lstatSync, fstatSync } = __require("fs");
@@ -30420,7 +30420,7 @@ var require_serde4 = __commonJS((exports) => {
       return Promise.resolve(this.hash.digest());
     }
     reset() {
-      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash(this.algorithmIdentifier);
+      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash2(this.algorithmIdentifier);
     }
   }
   function castSourceData(toCast, encoding) {
@@ -31159,7 +31159,7 @@ var require_checksum4 = __commonJS((exports) => {
   var { createReadStream } = __require("fs");
   var { Writable } = __require("stream");
   var { toUint8Array: toUint8Array2, concatBytes } = require_serde4();
-  var { createHash, createHmac: createHmac2 } = __require("crypto");
+  var { createHash: createHash2, createHmac: createHmac2 } = __require("crypto");
   var zlib = __require("zlib");
   async function blobReader(blob, onChunk, chunkSize = 1024 * 1024) {
     const size = blob.size;
@@ -31324,7 +31324,7 @@ var require_checksum4 = __commonJS((exports) => {
   }
   var hasNativeCrypto$1 = (() => {
     try {
-      createHash("md5");
+      createHash2("md5");
       return true;
     } catch {
       return false;
@@ -31334,7 +31334,7 @@ var require_checksum4 = __commonJS((exports) => {
   function buildNativeClass$2() {
     return class Md5Node2 {
       digestLength = 16;
-      hash = createHash("md5");
+      hash = createHash2("md5");
       update(data) {
         this.hash.update(toUint8Array2(data));
       }
@@ -31343,7 +31343,7 @@ var require_checksum4 = __commonJS((exports) => {
         return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
       }
       reset() {
-        this.hash = createHash("md5");
+        this.hash = createHash2("md5");
       }
     };
   }
@@ -31633,7 +31633,7 @@ var require_checksum4 = __commonJS((exports) => {
   ]);
   var hasNativeCrypto = (() => {
     try {
-      createHash("sha256");
+      createHash2("sha256");
       return true;
     } catch {
       return false;
@@ -31673,7 +31673,7 @@ var require_checksum4 = __commonJS((exports) => {
         this.finished = false;
       }
       createHash() {
-        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash("sha256");
+        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash2("sha256");
       }
     };
   }
@@ -42321,7 +42321,7 @@ var require_client6 = __commonJS((exports) => {
 var require_config5 = __commonJS((exports) => {
   var { homedir } = __require("os");
   var { sep, join } = __require("path");
-  var { createHash } = __require("crypto");
+  var { createHash: createHash2 } = __require("crypto");
   var { readFile: readFile$1 } = __require("fs/promises");
   var { IniSectionType } = require_dist_cjs();
   var { normalizeProvider: normalizeProvider2 } = require_client6();
@@ -42476,7 +42476,7 @@ var require_config5 = __commonJS((exports) => {
   var DEFAULT_PROFILE = "default";
   var getProfileName = (init) => init.profile || process.env[ENV_PROFILE] || DEFAULT_PROFILE;
   var getSSOTokenFilepath = (id) => {
-    const hasher = createHash("sha1");
+    const hasher = createHash2("sha1");
     const cacheName = hasher.update(id).digest("hex");
     return join(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
   };
@@ -43828,7 +43828,7 @@ var require_endpoints5 = __commonJS((exports) => {
 
 // node_modules/@aws-sdk/client-s3/node_modules/@smithy/core/dist-cjs/submodules/serde/index.js
 var require_serde5 = __commonJS((exports) => {
-  var { createHmac: createHmac2, createHash, getRandomValues } = __require("crypto");
+  var { createHmac: createHmac2, createHash: createHash2, getRandomValues } = __require("crypto");
   var { hasOwn, HttpResponse: HttpResponse2 } = require_transport5();
   exports.hasOwn = hasOwn;
   var { ReadStream, lstatSync, fstatSync } = __require("fs");
@@ -44733,7 +44733,7 @@ var require_serde5 = __commonJS((exports) => {
       return Promise.resolve(this.hash.digest());
     }
     reset() {
-      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash(this.algorithmIdentifier);
+      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash2(this.algorithmIdentifier);
     }
   }
   function castSourceData(toCast, encoding) {
@@ -45472,7 +45472,7 @@ var require_checksum5 = __commonJS((exports) => {
   var { createReadStream } = __require("fs");
   var { Writable } = __require("stream");
   var { toUint8Array: toUint8Array2, concatBytes } = require_serde5();
-  var { createHash, createHmac: createHmac2 } = __require("crypto");
+  var { createHash: createHash2, createHmac: createHmac2 } = __require("crypto");
   var zlib = __require("zlib");
   async function blobReader(blob, onChunk, chunkSize = 1024 * 1024) {
     const size = blob.size;
@@ -45637,7 +45637,7 @@ var require_checksum5 = __commonJS((exports) => {
   }
   var hasNativeCrypto$1 = (() => {
     try {
-      createHash("md5");
+      createHash2("md5");
       return true;
     } catch {
       return false;
@@ -45647,7 +45647,7 @@ var require_checksum5 = __commonJS((exports) => {
   function buildNativeClass$2() {
     return class Md5Node2 {
       digestLength = 16;
-      hash = createHash("md5");
+      hash = createHash2("md5");
       update(data) {
         this.hash.update(toUint8Array2(data));
       }
@@ -45656,7 +45656,7 @@ var require_checksum5 = __commonJS((exports) => {
         return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
       }
       reset() {
-        this.hash = createHash("md5");
+        this.hash = createHash2("md5");
       }
     };
   }
@@ -45946,7 +45946,7 @@ var require_checksum5 = __commonJS((exports) => {
   ]);
   var hasNativeCrypto = (() => {
     try {
-      createHash("sha256");
+      createHash2("sha256");
       return true;
     } catch {
       return false;
@@ -45986,7 +45986,7 @@ var require_checksum5 = __commonJS((exports) => {
         this.finished = false;
       }
       createHash() {
-        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash("sha256");
+        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash2("sha256");
       }
     };
   }
@@ -50235,7 +50235,7 @@ var require_client7 = __commonJS((exports) => {
 var require_config6 = __commonJS((exports) => {
   var { homedir } = __require("os");
   var { sep, join } = __require("path");
-  var { createHash } = __require("crypto");
+  var { createHash: createHash2 } = __require("crypto");
   var { readFile: readFile$1 } = __require("fs/promises");
   var { IniSectionType } = require_dist_cjs();
   var { normalizeProvider: normalizeProvider4 } = require_client7();
@@ -50390,7 +50390,7 @@ var require_config6 = __commonJS((exports) => {
   var DEFAULT_PROFILE = "default";
   var getProfileName = (init) => init.profile || process.env[ENV_PROFILE] || DEFAULT_PROFILE;
   var getSSOTokenFilepath = (id) => {
-    const hasher = createHash("sha1");
+    const hasher = createHash2("sha1");
     const cacheName = hasher.update(id).digest("hex");
     return join(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
   };
@@ -52895,7 +52895,7 @@ var require_client8 = __commonJS((exports) => {
 var require_config7 = __commonJS((exports) => {
   var { homedir } = __require("os");
   var { sep, join } = __require("path");
-  var { createHash } = __require("crypto");
+  var { createHash: createHash2 } = __require("crypto");
   var { readFile: readFile$1 } = __require("fs/promises");
   var { IniSectionType } = require_dist_cjs();
   var { normalizeProvider: normalizeProvider4 } = require_client8();
@@ -53050,7 +53050,7 @@ var require_config7 = __commonJS((exports) => {
   var DEFAULT_PROFILE = "default";
   var getProfileName = (init) => init.profile || process.env[ENV_PROFILE] || DEFAULT_PROFILE;
   var getSSOTokenFilepath = (id) => {
-    const hasher = createHash("sha1");
+    const hasher = createHash2("sha1");
     const cacheName = hasher.update(id).digest("hex");
     return join(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
   };
@@ -54552,7 +54552,7 @@ var require_endpoints6 = __commonJS((exports) => {
 
 // node_modules/@smithy/credential-provider-imds/node_modules/@smithy/core/dist-cjs/submodules/serde/index.js
 var require_serde6 = __commonJS((exports) => {
-  var { createHmac: createHmac2, createHash, getRandomValues } = __require("crypto");
+  var { createHmac: createHmac2, createHash: createHash2, getRandomValues } = __require("crypto");
   var { hasOwn: hasOwn3, HttpResponse: HttpResponse3 } = require_transport7();
   exports.hasOwn = hasOwn3;
   var { ReadStream, lstatSync, fstatSync } = __require("fs");
@@ -55457,7 +55457,7 @@ var require_serde6 = __commonJS((exports) => {
       return Promise.resolve(this.hash.digest());
     }
     reset() {
-      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash(this.algorithmIdentifier);
+      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash2(this.algorithmIdentifier);
     }
   }
   function castSourceData(toCast, encoding) {
@@ -58376,7 +58376,7 @@ var require_client9 = __commonJS((exports) => {
 var require_config8 = __commonJS((exports) => {
   var { homedir } = __require("os");
   var { sep, join } = __require("path");
-  var { createHash } = __require("crypto");
+  var { createHash: createHash2 } = __require("crypto");
   var { readFile: readFile$1 } = __require("fs/promises");
   var { IniSectionType } = require_dist_cjs();
   var { normalizeProvider: normalizeProvider4 } = require_client9();
@@ -58531,7 +58531,7 @@ var require_config8 = __commonJS((exports) => {
   var DEFAULT_PROFILE = "default";
   var getProfileName = (init) => init.profile || process.env[ENV_PROFILE] || DEFAULT_PROFILE;
   var getSSOTokenFilepath = (id) => {
-    const hasher = createHash("sha1");
+    const hasher = createHash2("sha1");
     const cacheName = hasher.update(id).digest("hex");
     return join(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
   };
@@ -59883,7 +59883,7 @@ var require_endpoints7 = __commonJS((exports) => {
 
 // node_modules/@smithy/node-http-handler/node_modules/@smithy/core/dist-cjs/submodules/serde/index.js
 var require_serde7 = __commonJS((exports) => {
-  var { createHmac: createHmac2, createHash, getRandomValues } = __require("crypto");
+  var { createHmac: createHmac2, createHash: createHash2, getRandomValues } = __require("crypto");
   var { hasOwn: hasOwn4, HttpResponse: HttpResponse4 } = require_transport8();
   exports.hasOwn = hasOwn4;
   var { ReadStream, lstatSync, fstatSync } = __require("fs");
@@ -60788,7 +60788,7 @@ var require_serde7 = __commonJS((exports) => {
       return Promise.resolve(this.hash.digest());
     }
     reset() {
-      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash(this.algorithmIdentifier);
+      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash2(this.algorithmIdentifier);
     }
   }
   function castSourceData(toCast, encoding) {
@@ -61527,7 +61527,7 @@ var require_checksum6 = __commonJS((exports) => {
   var { createReadStream } = __require("fs");
   var { Writable } = __require("stream");
   var { toUint8Array: toUint8Array2, concatBytes } = require_serde7();
-  var { createHash, createHmac: createHmac2 } = __require("crypto");
+  var { createHash: createHash2, createHmac: createHmac2 } = __require("crypto");
   var zlib = __require("zlib");
   async function blobReader(blob, onChunk, chunkSize = 1024 * 1024) {
     const size = blob.size;
@@ -61692,7 +61692,7 @@ var require_checksum6 = __commonJS((exports) => {
   }
   var hasNativeCrypto$1 = (() => {
     try {
-      createHash("md5");
+      createHash2("md5");
       return true;
     } catch {
       return false;
@@ -61702,7 +61702,7 @@ var require_checksum6 = __commonJS((exports) => {
   function buildNativeClass$2() {
     return class Md5Node2 {
       digestLength = 16;
-      hash = createHash("md5");
+      hash = createHash2("md5");
       update(data) {
         this.hash.update(toUint8Array2(data));
       }
@@ -61711,7 +61711,7 @@ var require_checksum6 = __commonJS((exports) => {
         return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
       }
       reset() {
-        this.hash = createHash("md5");
+        this.hash = createHash2("md5");
       }
     };
   }
@@ -62001,7 +62001,7 @@ var require_checksum6 = __commonJS((exports) => {
   ]);
   var hasNativeCrypto = (() => {
     try {
-      createHash("sha256");
+      createHash2("sha256");
       return true;
     } catch {
       return false;
@@ -62041,7 +62041,7 @@ var require_checksum6 = __commonJS((exports) => {
         this.finished = false;
       }
       createHash() {
-        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash("sha256");
+        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash2("sha256");
       }
     };
   }
@@ -65710,7 +65710,7 @@ var require_endpoints8 = __commonJS((exports) => {
 
 // node_modules/@aws-sdk/credential-provider-node/node_modules/@smithy/core/dist-cjs/submodules/serde/index.js
 var require_serde8 = __commonJS((exports) => {
-  var { createHmac: createHmac2, createHash, getRandomValues } = __require("crypto");
+  var { createHmac: createHmac2, createHash: createHash2, getRandomValues } = __require("crypto");
   var { hasOwn: hasOwn4, HttpResponse: HttpResponse4 } = require_transport6();
   exports.hasOwn = hasOwn4;
   var { ReadStream, lstatSync, fstatSync } = __require("fs");
@@ -66615,7 +66615,7 @@ var require_serde8 = __commonJS((exports) => {
       return Promise.resolve(this.hash.digest());
     }
     reset() {
-      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash(this.algorithmIdentifier);
+      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash2(this.algorithmIdentifier);
     }
   }
   function castSourceData(toCast, encoding) {
@@ -67354,7 +67354,7 @@ var require_checksum7 = __commonJS((exports) => {
   var { createReadStream } = __require("fs");
   var { Writable } = __require("stream");
   var { toUint8Array: toUint8Array2, concatBytes } = require_serde8();
-  var { createHash, createHmac: createHmac2 } = __require("crypto");
+  var { createHash: createHash2, createHmac: createHmac2 } = __require("crypto");
   var zlib = __require("zlib");
   async function blobReader(blob, onChunk, chunkSize = 1024 * 1024) {
     const size = blob.size;
@@ -67519,7 +67519,7 @@ var require_checksum7 = __commonJS((exports) => {
   }
   var hasNativeCrypto$1 = (() => {
     try {
-      createHash("md5");
+      createHash2("md5");
       return true;
     } catch {
       return false;
@@ -67529,7 +67529,7 @@ var require_checksum7 = __commonJS((exports) => {
   function buildNativeClass$2() {
     return class Md5Node2 {
       digestLength = 16;
-      hash = createHash("md5");
+      hash = createHash2("md5");
       update(data) {
         this.hash.update(toUint8Array2(data));
       }
@@ -67538,7 +67538,7 @@ var require_checksum7 = __commonJS((exports) => {
         return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
       }
       reset() {
-        this.hash = createHash("md5");
+        this.hash = createHash2("md5");
       }
     };
   }
@@ -67828,7 +67828,7 @@ var require_checksum7 = __commonJS((exports) => {
   ]);
   var hasNativeCrypto = (() => {
     try {
-      createHash("sha256");
+      createHash2("sha256");
       return true;
     } catch {
       return false;
@@ -67868,7 +67868,7 @@ var require_checksum7 = __commonJS((exports) => {
         this.finished = false;
       }
       createHash() {
-        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash("sha256");
+        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash2("sha256");
       }
     };
   }
@@ -74546,7 +74546,7 @@ var require_signin = __commonJS((exports) => {
 });
 
 // node_modules/@aws-sdk/credential-provider-node/node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.js
-import { createHash, createPrivateKey, createPublicKey, sign } from "crypto";
+import { createHash as createHash2, createPrivateKey, createPublicKey, sign } from "crypto";
 import { promises as fs2 } from "fs";
 import { homedir } from "os";
 import { dirname, join } from "path";
@@ -74718,7 +74718,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
     getTokenFilePath() {
       const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join(homedir(), ".aws", "login", "cache");
       const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
-      const loginSessionSha256 = createHash("sha256").update(loginSessionBytes).digest("hex");
+      const loginSessionSha256 = createHash2("sha256").update(loginSessionBytes).digest("hex");
       return join(directory, `${loginSessionSha256}.json`);
     }
     derToRawSignature(derSignature) {
@@ -76352,8 +76352,8 @@ var require_schema9 = __commonJS((exports) => {
     input,
     output
   });
-  var schemaDeserializationMiddleware = (config) => (next, context) => async (args) => {
-    const { response } = await next(args);
+  var schemaDeserializationMiddleware = (config) => (next2, context) => async (args) => {
+    const { response } = await next2(args);
     const { operationSchema } = getSmithyContext5(context);
     const [, ns, n2, t2, i3, o2] = operationSchema ?? [];
     try {
@@ -76410,7 +76410,7 @@ var require_schema9 = __commonJS((exports) => {
       return k3.match(pattern);
     }) || [undefined, undefined])[1];
   };
-  var schemaSerializationMiddleware = (config) => (next, context) => async (args) => {
+  var schemaSerializationMiddleware = (config) => (next2, context) => async (args) => {
     const { operationSchema } = getSmithyContext5(context);
     const [, ns, n2, t2, i3, o2] = operationSchema ?? [];
     const endpoint = context.endpointV2 ? async () => toEndpointV1(context.endpointV2) : config.endpoint;
@@ -76419,7 +76419,7 @@ var require_schema9 = __commonJS((exports) => {
       ...context,
       endpoint
     });
-    return next({
+    return next2({
       ...args,
       request
     });
@@ -78089,7 +78089,7 @@ var require_client10 = __commonJS((exports) => {
 var require_config9 = __commonJS((exports) => {
   var { homedir: homedir3 } = __require("os");
   var { sep, join: join6 } = __require("path");
-  var { createHash: createHash8 } = __require("crypto");
+  var { createHash: createHash9 } = __require("crypto");
   var { readFile: readFile$1 } = __require("fs/promises");
   var { IniSectionType } = require_dist_cjs();
   var { normalizeProvider: normalizeProvider5 } = require_client10();
@@ -78244,7 +78244,7 @@ var require_config9 = __commonJS((exports) => {
   var DEFAULT_PROFILE = "default";
   var getProfileName7 = (init) => init.profile || process.env[ENV_PROFILE2] || DEFAULT_PROFILE;
   var getSSOTokenFilepath2 = (id) => {
-    const hasher = createHash8("sha1");
+    const hasher = createHash9("sha1");
     const cacheName = hasher.update(id).digest("hex");
     return join6(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
   };
@@ -78987,7 +78987,7 @@ var require_endpoints9 = __commonJS((exports) => {
   function bindEndpointMiddleware(getEndpointFromConfig2) {
     const getEndpointFromInstructions2 = bindGetEndpointFromInstructions(getEndpointFromConfig2);
     return ({ config, instructions }) => {
-      return (next, context) => async (args) => {
+      return (next2, context) => async (args) => {
         if (config.isCustomEndpoint) {
           setFeature3(context, "ENDPOINT_OVERRIDE", "N");
         }
@@ -79014,7 +79014,7 @@ var require_endpoints9 = __commonJS((exports) => {
             }, authScheme.properties);
           }
         }
-        return next({
+        return next2({
           ...args
         });
       };
@@ -79100,10 +79100,10 @@ var require_endpoints9 = __commonJS((exports) => {
       }
       if (!this.data.has(key)) {
         if (this.data.size > this.capacity + 10) {
-          const keys = this.data.keys();
+          const keys2 = this.data.keys();
           let i3 = 0;
           while (true) {
-            const { value, done } = keys.next();
+            const { value, done } = keys2.next();
             this.data.delete(value);
             if (done || ++i3 > 10) {
               break;
@@ -79238,10 +79238,10 @@ var require_endpoints9 = __commonJS((exports) => {
     }
     const isIp = isIpAddress(hostname);
     const inputContainsDefaultPort = urlString.includes(`${host}:${DEFAULT_PORTS[scheme]}`) || typeof value === "string" && value.includes(`${host}:${DEFAULT_PORTS[scheme]}`);
-    const authority = `${host}${inputContainsDefaultPort ? `:${DEFAULT_PORTS[scheme]}` : ``}`;
+    const authority2 = `${host}${inputContainsDefaultPort ? `:${DEFAULT_PORTS[scheme]}` : ``}`;
     return {
       scheme,
-      authority,
+      authority: authority2,
       path: pathname,
       normalizedPath: pathname.endsWith("/") ? pathname : `${pathname}/`,
       isIp
@@ -79596,7 +79596,7 @@ var require_endpoints9 = __commonJS((exports) => {
 
 // node_modules/@aws-sdk/client-ecs/node_modules/@smithy/core/dist-cjs/submodules/serde/index.js
 var require_serde9 = __commonJS((exports) => {
-  var { createHmac: createHmac3, createHash: createHash8, getRandomValues } = __require("crypto");
+  var { createHmac: createHmac3, createHash: createHash9, getRandomValues } = __require("crypto");
   var { hasOwn: hasOwn4, HttpResponse: HttpResponse4 } = require_transport9();
   exports.hasOwn = hasOwn4;
   var { ReadStream, lstatSync, fstatSync } = __require("fs");
@@ -80351,26 +80351,26 @@ var require_serde9 = __commonJS((exports) => {
     }
     return out;
   }
-  var calculateBodyLength3 = (body2) => {
-    if (!body2) {
+  var calculateBodyLength3 = (body3) => {
+    if (!body3) {
       return 0;
     }
-    if (typeof body2 === "string") {
-      return Buffer.byteLength(body2);
-    } else if (typeof body2.byteLength === "number") {
-      return body2.byteLength;
-    } else if (typeof body2.size === "number") {
-      return body2.size;
-    } else if (typeof body2.start === "number" && typeof body2.end === "number") {
-      return body2.end + 1 - body2.start;
-    } else if (body2 instanceof ReadStream) {
-      if (body2.path != null) {
-        return lstatSync(body2.path).size;
-      } else if (typeof body2.fd === "number") {
-        return fstatSync(body2.fd).size;
+    if (typeof body3 === "string") {
+      return Buffer.byteLength(body3);
+    } else if (typeof body3.byteLength === "number") {
+      return body3.byteLength;
+    } else if (typeof body3.size === "number") {
+      return body3.size;
+    } else if (typeof body3.start === "number" && typeof body3.end === "number") {
+      return body3.end + 1 - body3.start;
+    } else if (body3 instanceof ReadStream) {
+      if (body3.path != null) {
+        return lstatSync(body3.path).size;
+      } else if (typeof body3.fd === "number") {
+        return fstatSync(body3.fd).size;
       }
     }
-    throw new Error(`Body Length computation failed for ${body2}`);
+    throw new Error(`Body Length computation failed for ${body3}`);
   };
   var toUint8Array3 = (data) => {
     if (data instanceof Uint8Array) {
@@ -80399,8 +80399,8 @@ var require_serde9 = __commonJS((exports) => {
     }
     return result;
   }
-  var deserializerMiddleware = (options, deserializer) => (next, context) => async (args) => {
-    const { response } = await next(args);
+  var deserializerMiddleware = (options, deserializer) => (next2, context) => async (args) => {
+    const { response } = await next2(args);
     try {
       const parsed = await deserializer(response, options);
       return {
@@ -80452,14 +80452,14 @@ var require_serde9 = __commonJS((exports) => {
       return k3.match(pattern);
     }) || [undefined, undefined])[1];
   };
-  var serializerMiddleware = (options, serializer) => (next, context) => async (args) => {
+  var serializerMiddleware = (options, serializer) => (next2, context) => async (args) => {
     const endpointConfig = options;
     const endpoint = context.endpointV2 ? async () => toEndpointV1(context.endpointV2) : endpointConfig.endpoint;
     if (!endpoint) {
       throw new Error("No valid endpoint provider available.");
     }
     const request = await serializer(args.input, { ...options, endpoint });
-    return next({
+    return next2({
       ...args,
       request
     });
@@ -80501,7 +80501,7 @@ var require_serde9 = __commonJS((exports) => {
       return Promise.resolve(this.hash.digest());
     }
     reset() {
-      this.hash = this.secret ? createHmac3(this.algorithmIdentifier, castSourceData(this.secret)) : createHash8(this.algorithmIdentifier);
+      this.hash = this.secret ? createHmac3(this.algorithmIdentifier, castSourceData(this.secret)) : createHash9(this.algorithmIdentifier);
     }
   }
   function castSourceData(toCast, encoding) {
@@ -81240,7 +81240,7 @@ var require_checksum8 = __commonJS((exports) => {
   var { createReadStream } = __require("fs");
   var { Writable } = __require("stream");
   var { toUint8Array: toUint8Array3, concatBytes: concatBytes2 } = require_serde9();
-  var { createHash: createHash8, createHmac: createHmac3 } = __require("crypto");
+  var { createHash: createHash9, createHmac: createHmac3 } = __require("crypto");
   var zlib = __require("zlib");
   async function blobReader(blob, onChunk, chunkSize = 1024 * 1024) {
     const size = blob.size;
@@ -81405,7 +81405,7 @@ var require_checksum8 = __commonJS((exports) => {
   }
   var hasNativeCrypto$1 = (() => {
     try {
-      createHash8("md5");
+      createHash9("md5");
       return true;
     } catch {
       return false;
@@ -81415,7 +81415,7 @@ var require_checksum8 = __commonJS((exports) => {
   function buildNativeClass$2() {
     return class Md5Node2 {
       digestLength = 16;
-      hash = createHash8("md5");
+      hash = createHash9("md5");
       update(data) {
         this.hash.update(toUint8Array3(data));
       }
@@ -81424,7 +81424,7 @@ var require_checksum8 = __commonJS((exports) => {
         return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
       }
       reset() {
-        this.hash = createHash8("md5");
+        this.hash = createHash9("md5");
       }
     };
   }
@@ -81714,7 +81714,7 @@ var require_checksum8 = __commonJS((exports) => {
   ]);
   var hasNativeCrypto2 = (() => {
     try {
-      createHash8("sha256");
+      createHash9("sha256");
       return true;
     } catch {
       return false;
@@ -81754,7 +81754,7 @@ var require_checksum8 = __commonJS((exports) => {
         this.finished = false;
       }
       createHash() {
-        return this.secret ? createHmac3("sha256", toBuffer2(this.secret)) : createHash8("sha256");
+        return this.secret ? createHmac3("sha256", toBuffer2(this.secret)) : createHash9("sha256");
       }
     };
   }
@@ -82158,9 +82158,9 @@ var require_event_streams8 = __commonJS((exports) => {
         }
       };
     }
-    encode({ headers: rawHeaders, body: body2 }) {
+    encode({ headers: rawHeaders, body: body3 }) {
       const headers = this.headerMarshaller.format(rawHeaders);
-      const length = headers.byteLength + body2.byteLength + 16;
+      const length = headers.byteLength + body3.byteLength + 16;
       const out = new Uint8Array(length);
       const view = new DataView(out.buffer, out.byteOffset, out.byteLength);
       const checksum = new Crc322;
@@ -82169,14 +82169,14 @@ var require_event_streams8 = __commonJS((exports) => {
       checksum.update(out.subarray(0, 8));
       view.setUint32(8, checksum.digestSync(), false);
       out.set(headers, 12);
-      out.set(body2, headers.byteLength + 12);
+      out.set(body3, headers.byteLength + 12);
       checksum.update(out.subarray(8, length - 4));
       view.setUint32(length - 4, checksum.digestSync(), false);
       return out;
     }
     decode(message) {
-      const { headers, body: body2 } = splitMessage(message);
-      return { headers: this.headerMarshaller.parse(headers), body: body2 };
+      const { headers, body: body3 } = splitMessage(message);
+      return { headers: this.headerMarshaller.parse(headers), body: body3 };
     }
     formatHeaders(rawHeaders) {
       return this.headerMarshaller.format(rawHeaders);
@@ -82366,8 +82366,8 @@ var require_event_streams8 = __commonJS((exports) => {
       this.eventStreamCodec = new EventStreamCodec(utf8Encoder, utf8Decoder);
       this.utfEncoder = utf8Encoder;
     }
-    deserialize(body2, deserializer) {
-      const inputStream = getChunkedStream(body2);
+    deserialize(body3, deserializer) {
+      const inputStream = getChunkedStream(body3);
       return new SmithyMessageDecoderStream({
         messageStream: new MessageDecoderStream({ inputStream, decoder: this.eventStreamCodec }),
         deserializer: getMessageUnmarshaller(deserializer, this.utfEncoder)
@@ -82391,8 +82391,8 @@ var require_event_streams8 = __commonJS((exports) => {
         utf8Encoder
       });
     }
-    deserialize(body2, deserializer) {
-      const bodyIterable = typeof body2[Symbol.asyncIterator] === "function" ? body2 : readableToIterable(body2);
+    deserialize(body3, deserializer) {
+      const bodyIterable = typeof body3[Symbol.asyncIterator] === "function" ? body3 : readableToIterable(body3);
       return this.universalMarshaller.deserialize(bodyIterable, deserializer);
     }
     serialize(input, serializer) {
@@ -82488,11 +82488,11 @@ var require_event_streams8 = __commonJS((exports) => {
               ":content-type": { type: "string", value: defaultContentType }
             };
             serializer.write(requestSchema, initialRequest);
-            const body2 = serializer.flush();
+            const body3 = serializer.flush();
             yield {
               [initialRequestMarker]: true,
               headers,
-              body: body2
+              body: body3
             };
           }
           for await (const page of eventStream) {
@@ -82516,7 +82516,7 @@ var require_event_streams8 = __commonJS((exports) => {
             break;
           }
         }
-        const { additionalHeaders, body: body2, eventType, explicitPayloadContentType } = this.writeEventBody(unionMember, unionSchema, event);
+        const { additionalHeaders, body: body3, eventType, explicitPayloadContentType } = this.writeEventBody(unionMember, unionSchema, event);
         const headers = {
           ":event-type": { type: "string", value: eventType },
           ":message-type": { type: "string", value: "event" },
@@ -82525,7 +82525,7 @@ var require_event_streams8 = __commonJS((exports) => {
         };
         return {
           headers,
-          body: body2
+          body: body3
         };
       });
     }
@@ -82545,9 +82545,9 @@ var require_event_streams8 = __commonJS((exports) => {
             break;
           }
         }
-        const body2 = event[unionMember].body;
+        const body3 = event[unionMember].body;
         if (unionMember === (initialMessageType ?? "initial-response")) {
-          const dataObject = await this.deserializer.read(responseSchema, body2);
+          const dataObject = await this.deserializer.read(responseSchema, body3);
           delete dataObject[eventStreamMember];
           return {
             [initialResponseMarker]: true,
@@ -82563,11 +82563,11 @@ var require_event_streams8 = __commonJS((exports) => {
               hasBindings = hasBindings || Boolean(eventHeader || eventPayload);
               if (eventPayload) {
                 if (member.isBlobSchema()) {
-                  out[name] = body2;
+                  out[name] = body3;
                 } else if (member.isStringSchema()) {
-                  out[name] = (this.serdeContext?.utf8Encoder ?? toUtf84)(body2);
+                  out[name] = (this.serdeContext?.utf8Encoder ?? toUtf84)(body3);
                 } else if (member.isStructSchema()) {
-                  out[name] = await this.deserializer.read(member, body2);
+                  out[name] = await this.deserializer.read(member, body3);
                 }
               } else if (eventHeader) {
                 const value = event[unionMember].headers[name]?.value;
@@ -82585,11 +82585,11 @@ var require_event_streams8 = __commonJS((exports) => {
               }
             }
             return {
-              [unionMember]: await this.readEventMember(eventStreamSchema, body2, hasBindings, out)
+              [unionMember]: await this.readEventMember(eventStreamSchema, body3, hasBindings, out)
             };
           }
           return {
-            [unionMember]: await this.deserializer.read(eventStreamSchema, body2)
+            [unionMember]: await this.deserializer.read(eventStreamSchema, body3)
           };
         } else {
           return {
@@ -82627,7 +82627,7 @@ var require_event_streams8 = __commonJS((exports) => {
         }
       };
     }
-    async readEventMember(eventStreamSchema, body2, hasBindings, out) {
+    async readEventMember(eventStreamSchema, body3, hasBindings, out) {
       let ErrCtor;
       const staticStructuralSchema = eventStreamSchema.getSchema();
       if (Array.isArray(staticStructuralSchema) && staticStructuralSchema[0] === -3) {
@@ -82636,7 +82636,7 @@ var require_event_streams8 = __commonJS((exports) => {
         this.compositeErrorRegistry?.copyFrom(nsRegistry);
         ErrCtor = (this.compositeErrorRegistry ?? nsRegistry)?.getErrorCtor(staticStructuralSchema);
       }
-      const dataObject = hasBindings ? out : body2.byteLength === 0 ? {} : await this.deserializer.read(eventStreamSchema, body2);
+      const dataObject = hasBindings ? out : body3.byteLength === 0 ? {} : await this.deserializer.read(eventStreamSchema, body3);
       if (ErrCtor) {
         const message = dataObject.message ?? dataObject.Message ?? "Unknown";
         const metadata = {};
@@ -82714,9 +82714,9 @@ var require_event_streams8 = __commonJS((exports) => {
         }
       }
       const messageSerialization = serializer.flush() ?? new Uint8Array;
-      const body2 = typeof messageSerialization === "string" ? (this.serdeContext?.utf8Decoder ?? fromUtf84)(messageSerialization) : messageSerialization;
+      const body3 = typeof messageSerialization === "string" ? (this.serdeContext?.utf8Decoder ?? fromUtf84)(messageSerialization) : messageSerialization;
       return {
-        body: body2,
+        body: body3,
         eventType,
         explicitPayloadContentType,
         additionalHeaders
@@ -83357,8 +83357,8 @@ var require_protocols9 = __commonJS((exports) => {
       this.query = query;
       return this;
     }
-    b(body2) {
-      this.body = body2;
+    b(body3) {
+      this.body = body3;
       return this;
     }
     m(method) {
@@ -83666,13 +83666,13 @@ var require_protocols9 = __commonJS((exports) => {
   };
   var CONTENT_LENGTH_HEADER2 = "content-length";
   function contentLengthMiddleware(bodyLengthChecker) {
-    return (next) => async (args) => {
+    return (next2) => async (args) => {
       const request = args.request;
       if (HttpRequest8.isInstance(request)) {
-        const { body: body2, headers } = request;
-        if (body2 && Object.keys(headers).map((str) => str.toLowerCase()).indexOf(CONTENT_LENGTH_HEADER2) === -1) {
+        const { body: body3, headers } = request;
+        if (body3 && Object.keys(headers).map((str) => str.toLowerCase()).indexOf(CONTENT_LENGTH_HEADER2) === -1) {
           try {
-            const length = bodyLengthChecker(body2);
+            const length = bodyLengthChecker(body3);
             if (length != null) {
               request.headers = {
                 ...request.headers,
@@ -83682,7 +83682,7 @@ var require_protocols9 = __commonJS((exports) => {
           } catch (ignored) {}
         }
       }
-      return next({
+      return next2({
         ...args,
         request
       });
@@ -83749,7 +83749,7 @@ var require_protocols9 = __commonJS((exports) => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.2",
+  version: "0.8.3",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -83882,6 +83882,10 @@ var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
 // src/lib/skill-bundles.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
+// src/lib/skill-bundle.ts
+import { createHash } from "crypto";
+import { createGunzip } from "zlib";
+
 // src/lib/skill-entry-path.ts
 class SkillEntryPaths {
   files = new Set;
@@ -84043,6 +84047,9 @@ function ownBytes(view) {
   out.set(source);
   return out;
 }
+function sha256Hex(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
 var SKILL_BUNDLE_INSPECTION_LIMITS = Object.freeze({
   compressedBytes: 16 * 1024 * 1024,
   decompressedBytes: 64 * 1024 * 1024,
@@ -84063,6 +84070,89 @@ class SkillBundleInspectionError extends Error {
 function invalidBundle(message) {
   throw new SkillBundleInspectionError("BUNDLE_INVALID", message);
 }
+function inspectionLimits(options) {
+  const limits = { ...SKILL_BUNDLE_INSPECTION_LIMITS };
+  for (const key of Object.keys(options.limits ?? {})) {
+    if (!Object.hasOwn(limits, key))
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Unknown bundle limit");
+    const field = key;
+    const value = options.limits[field];
+    if (!Number.isSafeInteger(value) || value <= 0 || value > limits[field]) {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle limits must be positive integers within the hard ceilings");
+    }
+    limits[field] = value;
+  }
+  return limits;
+}
+async function inspectSkillBundle(bundle, options = {}) {
+  const signal = options.signal;
+  const limits = inspectionLimits(options);
+  const deadline = performance.now() + limits.timeoutMs;
+  const check = () => {
+    if (signal?.aborted)
+      throw new SkillBundleInspectionError("BUNDLE_ABORTED", "Bundle inspection aborted");
+    if (performance.now() >= deadline)
+      throw new SkillBundleInspectionError("BUNDLE_TIMEOUT", "Bundle inspection deadline exceeded");
+  };
+  check();
+  if (bundle.byteLength > limits.compressedBytes)
+    throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Compressed bundle exceeds byte limit");
+  const snapshot = ownBytes(bundle);
+  check();
+  const sha256 = sha256Hex(snapshot);
+  check();
+  const parser = new BoundedTarReader(limits, check);
+  const streamOptions = { chunkSize: 16 * 1024, highWaterMark: 16 * 1024 };
+  const decoder = createGunzip(streamOptions);
+  let terminalError;
+  const stop = (code) => {
+    terminalError ??= new SkillBundleInspectionError(code, code === "BUNDLE_ABORTED" ? "Bundle inspection aborted" : "Bundle inspection deadline exceeded");
+    decoder.destroy(terminalError);
+  };
+  const onAbort = () => stop("BUNDLE_ABORTED");
+  const timer = setTimeout(() => stop("BUNDLE_TIMEOUT"), Math.max(1, deadline - performance.now()));
+  signal?.addEventListener("abort", onAbort, { once: true });
+  let decompressedByteSize = 0;
+  let bytesSinceYield = 0;
+  try {
+    check();
+    decoder.end(snapshot);
+    for await (const chunk of decoder) {
+      check();
+      decompressedByteSize += chunk.byteLength;
+      if (decompressedByteSize > limits.decompressedBytes)
+        throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Decompressed bundle exceeds byte limit");
+      parser.push(chunk);
+      bytesSinceYield += chunk.byteLength;
+      if (bytesSinceYield >= 256 * 1024) {
+        await new Promise((resolve) => setTimeout(resolve, 0));
+        bytesSinceYield = 0;
+        check();
+      }
+    }
+    check();
+    const entries = parser.finish();
+    return {
+      entries,
+      sha256,
+      compressedByteSize: snapshot.byteLength,
+      decompressedByteSize,
+      unpackedByteSize: parser.fileBytes,
+      fileCount: entries.length
+    };
+  } catch (error) {
+    if (terminalError)
+      throw terminalError;
+    if (error instanceof SkillBundleInspectionError)
+      throw error;
+    throw new SkillBundleInspectionError("BUNDLE_INVALID", "Invalid or truncated gzip bundle");
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", onAbort);
+    decoder.destroy();
+  }
+}
+
 class BoundedTarReader {
   limits;
   check;
@@ -94200,7 +94290,7 @@ var import_node_http_handler2 = __toESM(require_dist_cjs7(), 1);
 
 // node_modules/@aws-sdk/checksums/dist-cjs/submodules/sha/index.js
 var { toUint8Array: toUint8Array2, concatBytes } = require_serde2();
-var { createHmac: createHmac2, createHash: createHash2 } = __require("crypto");
+var { createHmac: createHmac2, createHash: createHash3 } = __require("crypto");
 var { Sha256: Sha2562, Sha256Js, Sha256Node } = require_checksum2();
 var BLOCK2 = 64;
 var DIGEST_LENGTH = 20;
@@ -94369,7 +94459,7 @@ class Sha1Js {
 }
 var hasNativeCrypto = (() => {
   try {
-    createHash2("sha1");
+    createHash3("sha1");
     return true;
   } catch {
     return false;
@@ -94409,7 +94499,7 @@ function buildNativeClass() {
       this.finished = false;
     }
     createHash() {
-      return this.secret ? createHmac2("sha1", toBuffer(this.secret)) : createHash2("sha1");
+      return this.secret ? createHmac2("sha1", toBuffer(this.secret)) : createHash3("sha1");
     }
   };
 }
@@ -94971,7 +95061,7 @@ function assertReservationCents(value, field) {
 
 // src/sdk/governance-store.ts
 import { Database as Database2 } from "bun:sqlite";
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import { mkdirSync as mkdirSync3 } from "fs";
 import { dirname as dirname4 } from "path";
 
@@ -95163,11 +95253,82 @@ function looksLikeSqlitePath(value) {
   return SQLITE_EXTENSIONS.some((extension) => value.toLowerCase().endsWith(extension));
 }
 
+// src/server/execution-grant-store.ts
+import { randomUUID } from "crypto";
+function next(p2, id, grants, expected) {
+  return {
+    schema: "hasna.skills-execution-grants.v1",
+    profileId: id,
+    workspaceId: p2.orgId,
+    revision: randomUUID(),
+    previousRevision: expected,
+    updatedAt: new Date().toISOString(),
+    actorId: p2.userId,
+    grants: structuredClone(grants)
+  };
+}
+function document(row) {
+  return row ? typeof row.document_json === "string" ? JSON.parse(row.document_json) : structuredClone(row.document_json) : null;
+}
+
+class MemoryExecutionGrantStore {
+  current = new Map;
+  history = new Map;
+  async get(p2, id, revision) {
+    return structuredClone((revision ? this.history.get(JSON.stringify([p2.orgId, id, revision])) : this.current.get(JSON.stringify([p2.orgId, id]))) ?? null);
+  }
+  async save(p2, id, grants, expected) {
+    const key = JSON.stringify([p2.orgId, id]);
+    if ((this.current.get(key)?.revision ?? null) !== expected)
+      return null;
+    const value = next(p2, id, grants, expected);
+    this.current.set(key, value);
+    this.history.set(JSON.stringify([p2.orgId, id, value.revision]), value);
+    return structuredClone(value);
+  }
+}
+
+class SqliteExecutionGrantStore {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async get(p2, id, revision) {
+    return document(revision ? this.db.query("SELECT document_json FROM skills_execution_grant_revisions WHERE org_id=? AND profile_id=? AND revision=?").get(p2.orgId, id, revision) : this.db.query("SELECT document_json FROM skills_execution_grants WHERE org_id=? AND profile_id=?").get(p2.orgId, id));
+  }
+  async save(p2, id, grants, expected) {
+    return this.db.transaction(() => {
+      const value = next(p2, id, grants, expected), json = JSON.stringify(value);
+      const row = expected === null ? this.db.query("INSERT INTO skills_execution_grants(org_id,profile_id,revision,document_json) VALUES(?,?,?,?) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING document_json").get(p2.orgId, id, value.revision, json) : this.db.query("UPDATE skills_execution_grants SET revision=?,document_json=? WHERE org_id=? AND profile_id=? AND revision=? RETURNING document_json").get(value.revision, json, p2.orgId, id, expected);
+      if (!row)
+        return null;
+      this.db.query("INSERT INTO skills_execution_grant_revisions(org_id,profile_id,revision,document_json) VALUES(?,?,?,?)").run(p2.orgId, id, value.revision, json);
+      return document(row);
+    })();
+  }
+}
+
+class PostgresExecutionGrantStore {
+  sql;
+  constructor(sql) {
+    this.sql = sql;
+  }
+  async get(p2, id, revision) {
+    const rows = revision ? await this.sql`SELECT document_json FROM skills_execution_grant_revisions WHERE org_id=${p2.orgId} AND profile_id=${id} AND revision=${revision}` : await this.sql`SELECT document_json FROM skills_execution_grants WHERE org_id=${p2.orgId} AND profile_id=${id}`;
+    return document(rows[0]);
+  }
+  async save(p2, id, grants, expected) {
+    const value = next(p2, id, grants, expected), json = JSON.stringify(value);
+    const rows = expected === null ? await this.sql`WITH changed AS (INSERT INTO skills_execution_grants(org_id,profile_id,revision,document_json) VALUES(${p2.orgId},${id},${value.revision},${json}::jsonb) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *) INSERT INTO skills_execution_grant_revisions(org_id,profile_id,revision,document_json) SELECT org_id,profile_id,revision,document_json FROM changed RETURNING document_json` : await this.sql`WITH changed AS (UPDATE skills_execution_grants SET revision=${value.revision},document_json=${json}::jsonb WHERE org_id=${p2.orgId} AND profile_id=${id} AND revision=${expected} RETURNING *) INSERT INTO skills_execution_grant_revisions(org_id,profile_id,revision,document_json) SELECT org_id,profile_id,revision,document_json FROM changed RETURNING document_json`;
+    return document(rows[0]);
+  }
+}
+
 // src/server/sqlite-store.ts
 import { Database } from "bun:sqlite";
 
 // src/server/selection-store.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 function selections(value) {
   return typeof value === "string" ? JSON.parse(value) : structuredClone(value);
 }
@@ -95208,15 +95369,15 @@ class MemorySkillSelectionStore {
     const key = this.key(p2.orgId, id), previous = this.profiles.get(key);
     if ((previous?.revision ?? null) !== expected)
       return null;
-    const next = {
+    const next2 = {
       id,
       workspaceId: p2.orgId,
-      revision: randomUUID(),
+      revision: randomUUID2(),
       selections: structuredClone(selected),
       updatedAt: new Date().toISOString()
     };
-    this.profiles.set(key, next);
-    return structuredClone(next);
+    this.profiles.set(key, next2);
+    return structuredClone(next2);
   }
   async getStationState(p2, id) {
     return structuredClone(this.states.get(this.key(p2.orgId, p2.userId, id)) ?? null);
@@ -95224,15 +95385,15 @@ class MemorySkillSelectionStore {
   async saveStationState(p2, id, input) {
     if (this.profiles.get(this.key(p2.orgId, input.profileId))?.revision !== input.profileRevision)
       return null;
-    const next = {
+    const next2 = {
       ...structuredClone(input),
       stationId: id,
       workspaceId: p2.orgId,
       actorId: p2.userId,
       appliedAt: new Date().toISOString()
     };
-    this.states.set(this.key(p2.orgId, p2.userId, id), next);
-    return structuredClone(next);
+    this.states.set(this.key(p2.orgId, p2.userId, id), next2);
+    return structuredClone(next2);
   }
 }
 
@@ -95246,7 +95407,7 @@ class SqliteSkillSelectionStore {
     return row ? profile(row) : null;
   }
   async saveProfile(p2, id, selected, expected) {
-    const revision = randomUUID(), timestamp = new Date().toISOString();
+    const revision = randomUUID2(), timestamp = new Date().toISOString();
     const row = expected === null ? this.db.query("INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(?,?,?,?,?) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *").get(p2.orgId, id, revision, JSON.stringify(selected), timestamp) : this.db.query("UPDATE skills_profiles SET revision=?,selections_json=?,updated_at=? WHERE org_id=? AND profile_id=? AND revision=? RETURNING *").get(revision, JSON.stringify(selected), timestamp, p2.orgId, id, expected);
     return row ? profile(row) : null;
   }
@@ -95272,7 +95433,7 @@ class PostgresSkillSelectionStore {
     return rows[0] ? profile(rows[0]) : null;
   }
   async saveProfile(p2, id, selected, expected) {
-    const revision = randomUUID(), timestamp = new Date().toISOString();
+    const revision = randomUUID2(), timestamp = new Date().toISOString();
     const rows = expected === null ? await this.sql`INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(${p2.orgId},${id},${revision},${JSON.stringify(selected)}::jsonb,${timestamp}) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *` : await this.sql`UPDATE skills_profiles SET revision=${revision},selections_json=${JSON.stringify(selected)}::jsonb,updated_at=${timestamp} WHERE org_id=${p2.orgId} AND profile_id=${id} AND revision=${expected} RETURNING *`;
     return rows[0] ? profile(rows[0]) : null;
   }
@@ -95290,14 +95451,14 @@ class PostgresSkillSelectionStore {
 }
 
 // src/server/sqlite-store.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync } from "fs";
 import { dirname as dirname3, join as join5 } from "path";
 
 // src/server/auth.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 function hashApiKey(token) {
-  return createHash3("sha256").update(token).digest("hex");
+  return createHash4("sha256").update(token).digest("hex");
 }
 function bearerToken(request) {
   const header = request.headers.get("authorization") || "";
@@ -95325,6 +95486,13 @@ function publicPrincipal(partial = {}) {
 }
 function permitsSkillsRoute(principal, method, resource) {
   const scopes = new Set(principal.scopes);
+  if (resource === "execution-grants") {
+    const read2 = method === "GET" || method === "HEAD";
+    if (!read2 && method !== "POST" && !["owner", "admin"].includes(principal.role))
+      return false;
+    const allowed2 = read2 ? ["*", "execution-grants:*", "execution-grants:read"] : method === "POST" ? ["*", "execution-grants:*", "execution-grants:resolve", "skills:read", "skills:*"] : ["*", "execution-grants:*", "execution-grants:write"];
+    return allowed2.some((scope) => scopes.has(scope));
+  }
   if (scopes.has("*"))
     return true;
   const read = method === "GET" || method === "HEAD";
@@ -95381,7 +95549,7 @@ function defaultStartDirs() {
 }
 
 // src/server/rows.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 function nowIso() {
   return new Date().toISOString();
 }
@@ -95389,7 +95557,7 @@ function normalizeLimit(limit) {
   return Number.isFinite(limit) ? Math.max(0, Math.trunc(limit)) : 0;
 }
 function runId() {
-  return `run_${Date.now().toString(36)}_${randomUUID2().slice(0, 8)}`;
+  return `run_${Date.now().toString(36)}_${randomUUID3().slice(0, 8)}`;
 }
 function rowToRun(row) {
   return {
@@ -95581,7 +95749,7 @@ class SkillVersionExistsError extends Error {
 }
 
 // src/lib/revision.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 var REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
 function revisionIdOf(content) {
   const canonical = JSON.stringify({
@@ -95597,7 +95765,7 @@ function revisionIdOf(content) {
     bundleSha256: content.bundleSha256 ?? null,
     bundleByteSize: content.bundleByteSize ?? null
   });
-  return createHash4("sha256").update(canonical).digest("hex");
+  return createHash5("sha256").update(canonical).digest("hex");
 }
 function revisionIdOfRecord(record) {
   return revisionIdOf(record);
@@ -95613,6 +95781,9 @@ class SqliteSkillsStore {
   get selectionStore() {
     return new SqliteSkillSelectionStore(this.db);
   }
+  get executionGrantStore() {
+    return new SqliteExecutionGrantStore(this.db);
+  }
   backend;
   db;
   closed = false;
@@ -95714,7 +95885,7 @@ class SqliteSkillsStore {
       JSON.stringify(input.input),
       JSON.stringify(input.args),
       input.idempotencyKey ?? null,
-      randomUUID3(),
+      randomUUID4(),
       nowIso()
     ]);
     return rowToRun(row);
@@ -96024,21 +96195,21 @@ class SqliteSkillsStore {
     if (expectedRevisionId !== current.revisionId) {
       throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
     }
-    const next = { ...current, ...patch };
+    const next2 = { ...current, ...patch };
     return this.db.transaction(() => {
-      const revisionId = revisionIdOfRecord(next);
+      const revisionId = revisionIdOfRecord(next2);
       const row = this.get(`UPDATE skills_registry
          SET display_name = ?, description = ?, category = ?, tags_json = ?, kind = ?, version = ?, skill_md = ?,
              revision_id = ?, revision_number = revision_number + 1, updated_at = ?
          WHERE org_id = ? AND slug = ? AND tombstoned_at IS NULL AND revision_id = ?
          RETURNING *`, [
-        next.displayName,
-        next.description,
-        next.category,
-        JSON.stringify(next.tags),
-        next.kind,
-        next.version ?? null,
-        next.skillMd ?? null,
+        next2.displayName,
+        next2.description,
+        next2.category,
+        JSON.stringify(next2.tags),
+        next2.kind,
+        next2.version ?? null,
+        next2.skillMd ?? null,
         revisionId,
         nowIso(),
         principal.orgId,
@@ -96058,7 +96229,7 @@ class SqliteSkillsStore {
       }
       this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
       const insertTag = this.db.prepare("INSERT OR IGNORE INTO skills_tags (org_id, slug, tag) VALUES (?, ?, ?)");
-      for (const tag of next.tags) {
+      for (const tag of next2.tags) {
         if (!tag.trim())
           continue;
         insertTag.run(principal.orgId, slug, tag);
@@ -96236,10 +96407,10 @@ function parseScopes(value) {
 
 // src/sdk/governance-store.ts
 function receiptId() {
-  return `rcpt_${Date.now().toString(36)}_${randomUUID4().replace(/-/g, "").slice(0, 10)}`;
+  return `rcpt_${Date.now().toString(36)}_${randomUUID5().replace(/-/g, "").slice(0, 10)}`;
 }
 function reservationId() {
-  return `res_${Date.now().toString(36)}_${randomUUID4().replace(/-/g, "").slice(0, 10)}`;
+  return `res_${Date.now().toString(36)}_${randomUUID5().replace(/-/g, "").slice(0, 10)}`;
 }
 var EXPIRED_ARTIFACT_SQL = `
   SELECT a.* FROM skills_artifacts a
@@ -96274,10 +96445,10 @@ class SqliteGovernanceStore {
     return this.db;
   }
   async appendReceipt(receipt) {
-    const next = { ...receipt, id: receiptId(), createdAt: nowIso() };
+    const next2 = { ...receipt, id: receiptId(), createdAt: nowIso() };
     this.db.run(`INSERT INTO skills_lifecycle_receipts (id, kind, org_id, run_id, artifact_id, requested_by, metadata_json, created_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [next.id, next.kind, next.orgId, next.runId, next.artifactId ?? null, next.requestedBy, JSON.stringify(next.metadata), next.createdAt]);
-    return next;
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [next2.id, next2.kind, next2.orgId, next2.runId, next2.artifactId ?? null, next2.requestedBy, JSON.stringify(next2.metadata), next2.createdAt]);
+    return next2;
   }
   async listReceipts(orgId, runId2) {
     const rows = this.db.query("SELECT * FROM skills_lifecycle_receipts WHERE org_id = ? AND run_id = ? ORDER BY created_at ASC, rowid ASC").all(orgId, runId2);
@@ -96368,12 +96539,12 @@ class PostgresGovernanceStore {
     });
   }
   async appendReceipt(receipt) {
-    const next = { ...receipt, id: receiptId(), createdAt: nowIso() };
+    const next2 = { ...receipt, id: receiptId(), createdAt: nowIso() };
     await this.sql`
       INSERT INTO skills_lifecycle_receipts (id, kind, org_id, run_id, artifact_id, requested_by, metadata_json)
-      VALUES (${next.id}, ${next.kind}, ${next.orgId}, ${next.runId}, ${next.artifactId ?? null}, ${next.requestedBy}, ${JSON.stringify(next.metadata)}::jsonb)
+      VALUES (${next2.id}, ${next2.kind}, ${next2.orgId}, ${next2.runId}, ${next2.artifactId ?? null}, ${next2.requestedBy}, ${JSON.stringify(next2.metadata)}::jsonb)
     `;
-    return next;
+    return next2;
   }
   async listReceipts(orgId, runId2) {
     const rows = await this.sql`
@@ -96489,8 +96660,506 @@ function nextMonthPrefix(monthPrefix) {
   return month === 12 ? `${year + 1}-01` : `${year}-${String(month + 1).padStart(2, "0")}`;
 }
 
-// node_modules/@hasna/contracts/dist/client/transport.js
+// src/lib/execution-grants.ts
+import { posix, win32 } from "path";
+
+// node_modules/@hasna/secrets/dist/sdk.js
 import { createRequire } from "module";
+import { createRequire as createRequire2 } from "module";
+var __esm2 = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var CredentialResolutionError;
+var CredentialFileUnsafeError;
+var MAX_CREDENTIAL_FILE_BYTES;
+var SAFE_APP_SLUG;
+var SAFE_PROFILE;
+var ILLEGAL_IN_HEADER_VALUE;
+var VAULT_POINTER_SHAPE;
+var CREDENTIAL_SHAPED_KEY;
+var INSPECT_CUSTOM;
+var CREDENTIAL_SEAL;
+var AMBIENT_ENVIRONMENT;
+var SECRETS_PACKAGE_SPECIFIER;
+var requireSecretsSdk;
+var ASCII_CONTROL_PATTERN;
+var DNS_LABEL_PATTERN;
+var ClientTransportConfigurationError;
+var HasnaHttpError;
+var DEFAULT_RETRY_STATUSES;
+var IDEMPOTENT_METHODS;
+var AUTHORITY_OVERRIDE_HEADERS;
+var init_transport = __esm2(() => {
+  CredentialResolutionError = class CredentialResolutionError2 extends Error {
+    appName;
+    attempted;
+    constructor(appName, message, attempted) {
+      super(message);
+      this.name = "CredentialResolutionError";
+      this.appName = appName;
+      this.attempted = attempted;
+    }
+  };
+  CredentialFileUnsafeError = class CredentialFileUnsafeError2 extends Error {
+    path;
+    constructor(path, reason) {
+      super(`Refusing unsafe credential/config file ${path}: ${reason}.`);
+      this.name = "CredentialFileUnsafeError";
+      this.path = path;
+    }
+  };
+  MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
+  SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+  SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+  ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+  VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
+  CREDENTIAL_SHAPED_KEY = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
+  INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+  CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
+  AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+  SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+  requireSecretsSdk = createRequire(import.meta.url);
+  ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
+  DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+  ClientTransportConfigurationError = class ClientTransportConfigurationError2 extends Error {
+    appName;
+    sources;
+    constructor(appName, message, sources = []) {
+      super(message);
+      this.name = "ClientTransportConfigurationError";
+      this.appName = appName;
+      this.sources = Object.freeze([...sources]);
+    }
+  };
+  HasnaHttpError = class HasnaHttpError2 extends Error {
+    status;
+    method;
+    path;
+    credentialSource;
+    credentialTier;
+    constructor(method, path, status, body, credential) {
+      const guidance = credential ? `. ${credential.guidance}` : "";
+      super(`Hasna cloud request failed: ${method} ${path} -> ${status}${guidance}`);
+      this.name = "HasnaHttpError";
+      this.status = status;
+      this.method = method;
+      this.path = path;
+      Object.defineProperty(this, "body", {
+        value: body,
+        enumerable: status !== 401 && status !== 403,
+        writable: false,
+        configurable: false
+      });
+      this.credentialSource = credential?.source ?? null;
+      this.credentialTier = credential?.tier ?? null;
+    }
+  };
+  DEFAULT_RETRY_STATUSES = [408, 425, 429, 500, 502, 503, 504];
+  IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+  AUTHORITY_OVERRIDE_HEADERS = new Set([
+    "host",
+    ":authority",
+    "forwarded",
+    "x-forwarded-host",
+    "x-original-host"
+  ]);
+});
+var MAX_CREDENTIAL_FILE_BYTES2;
+var INSPECT_CUSTOM2;
+var CREDENTIAL_SEAL2;
+var AMBIENT_ENVIRONMENT2;
+var SECRETS_PACKAGE_SPECIFIER2;
+var requireSecretsSdk2;
+var IDEMPOTENT_METHODS2;
+var AUTHORITY_OVERRIDE_HEADERS2;
+var init_storage = __esm2(() => {
+  MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
+  INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
+  CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
+  AMBIENT_ENVIRONMENT2 = Symbol.for("hasna:contracts:ambientClientEnvironment");
+  SECRETS_PACKAGE_SPECIFIER2 = "@hasna/" + "secrets";
+  requireSecretsSdk2 = createRequire2(import.meta.url);
+  IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+  AUTHORITY_OVERRIDE_HEADERS2 = new Set([
+    "host",
+    ":authority",
+    "forwarded",
+    "x-forwarded-host",
+    "x-original-host"
+  ]);
+});
+var PATHS_RESOLVER_APP_SLUG_RE2;
+var SQLITE_SIDECAR_FILES;
+var LEGACY_SERVICE_FILES;
+var init_data_dir = __esm2(() => {
+  PATHS_RESOLVER_APP_SLUG_RE2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+  SQLITE_SIDECAR_FILES = ["vault.db-wal", "vault.db-shm", "vault.db-journal"];
+  LEGACY_SERVICE_FILES = [
+    "vault.key",
+    "vault.key.enc",
+    "kms.json",
+    "aws.json",
+    ".serve-token"
+  ];
+});
+var SecretsTestIsolationError;
+var TEST_ENTRYPOINT_RE;
+var init_test_isolation = __esm2(() => {
+  init_data_dir();
+  SecretsTestIsolationError = class SecretsTestIsolationError2 extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "SecretsTestIsolationError";
+    }
+  };
+  TEST_ENTRYPOINT_RE = /\.(test|spec)\.[cm]?[jt]sx?$/;
+});
+var init_client = __esm2(() => {
+  init_transport();
+  init_storage();
+  init_test_isolation();
+  init_transport();
+});
+init_client();
+init_client();
+
+// src/lib/skill-version.ts
+var SKILL_VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
+function isValidSkillVersion(value) {
+  return typeof value === "string" && SKILL_VERSION_PATTERN.test(value) && !/^\.+$/.test(value) && !value.includes("..");
+}
+var SKILL_VERSION_RULE = "1-128 characters: letters, digits, '.', '_', '+', '-'; must start with a letter or digit; no '..'";
+
+// src/lib/selection-aliases.ts
+function selectionAliasError(selections2) {
+  const names = new Set(selections2.map((selection) => selection.slug));
+  for (const selection of selections2) {
+    if (selection.aliases === undefined)
+      continue;
+    if (!Array.isArray(selection.aliases) || selection.aliases.length > 32)
+      return "Selection aliases must be an array of at most 32 names.";
+    for (const alias of selection.aliases) {
+      if (typeof alias !== "string" || alias.length > 128 || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(alias))
+        return "Selection aliases must be bounded kebab-case names.";
+      if (names.has(alias))
+        return "Selection aliases must be unique and cannot shadow a selected canonical name.";
+      names.add(alias);
+    }
+  }
+}
+
+// src/lib/profile-limits.ts
+var MAX_PROFILE_SELECTIONS = 4096;
+var MAX_PROFILE_DOCUMENT_BYTES = 8 * 1024 * 1024;
+var MAX_SKILL_SESSION_ID_CHARS = 256;
+var PROFILE_SESSION_ENVELOPE_BYTES = MAX_PROFILE_SELECTIONS * 67 + MAX_SKILL_SESSION_ID_CHARS * 6 + 256;
+var MAX_RESOLVED_PROFILE_BYTES = MAX_PROFILE_DOCUMENT_BYTES - PROFILE_SESSION_ENVELOPE_BYTES;
+function profileDocumentBytes(value) {
+  return new TextEncoder().encode(JSON.stringify(value)).byteLength;
+}
+function resolvedProfileSnapshot(profile2, authority) {
+  return {
+    profileId: profile2.id,
+    workspaceId: profile2.workspaceId,
+    profileRevision: profile2.revision,
+    authority,
+    selections: profile2.selections.map((selection) => ({ ...selection, authority, workspaceId: profile2.workspaceId, profileRevision: profile2.revision }))
+  };
+}
+
+// src/lib/selection-cache.ts
+class SkillSelectionError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SkillSelectionError";
+  }
+}
+var MAX_CACHED_PROFILE_AGE_MS = 24 * 60 * 60 * 1000;
+
+// src/lib/execution-secrets.ts
+function refuse(code, message) {
+  throw new SkillSelectionError(code, message);
+}
+function declaredSecretNames(value) {
+  if (value === undefined)
+    return [];
+  if (!Array.isArray(value) || value.length > 32 || value.some((name) => typeof name !== "string" || !/^[A-Z][A-Z0-9_]{0,127}$/.test(name)) || new Set(value).size !== value.length) {
+    return refuse("INVALID_SKILL_MANIFEST", "Runtime environment references must be unique uppercase identifiers (at most 32).");
+  }
+  if (value.some((name) => /^(?:PATH|HOME|TMPDIR|TEMP|TMP|LANG|LC_ALL|TERM|SHELL|ENV|BASH_ENV|IFS|NODE_OPTIONS|NODE_PATH)$/.test(name) || /^(?:SKILLS_|BUN_|PYTHON|LD_|DYLD_)/.test(name))) {
+    return refuse("INVALID_SKILL_MANIFEST", "Runtime environment references cannot override execution controls.");
+  }
+  return value;
+}
+
+// src/lib/execution-grants.ts
+var MAX_EXECUTION_GRANTS = 256;
+var MAX_EXECUTION_GRANT_BYTES = 2 * 1024 * 1024;
+function grantIdentifier(v2) {
+  return typeof v2 === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(v2) && !v2.includes("..");
+}
+function grantRecord(v2) {
+  return !!v2 && typeof v2 === "object" && !Array.isArray(v2);
+}
+function keys(v2, required, optional = []) {
+  return required.every((k3) => Object.hasOwn(v2, k3)) && Object.keys(v2).every((k3) => required.includes(k3) || optional.includes(k3));
+}
+function invalid() {
+  throw new Error("Invalid execution grant policy: use exact selections, named actors and consumers, and vault reference names only.");
+}
+function authority(v2) {
+  if (typeof v2 !== "string" || v2.length > 2048 || /[\x00-\x20\x7f]/.test(v2))
+    return false;
+  try {
+    const u2 = new URL(v2);
+    return (u2.protocol === "https:" || u2.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(u2.hostname)) && !u2.username && !u2.password && !u2.search && !u2.hash && u2.pathname.endsWith("/v1") && u2.href === v2;
+  } catch {
+    return false;
+  }
+}
+function pathFlavor(value) {
+  return value.startsWith("/") ? posix : win32;
+}
+function grantWorkspace(v2) {
+  if (typeof v2 !== "string" || !v2 || v2.length > 4096 || /[\x00-\x1f\x7f]/.test(v2))
+    return false;
+  const flavor = pathFlavor(v2);
+  if (flavor === win32 && !/^(?:[A-Za-z]:\\|\\\\[^\\]+\\[^\\]+)/.test(v2))
+    return false;
+  return flavor.isAbsolute(v2) && flavor.normalize(v2) === v2;
+}
+function grantDirectoryContains(root3, directory, descendants = false) {
+  if (!grantWorkspace(root3) || !grantWorkspace(directory) || pathFlavor(root3) !== pathFlavor(directory))
+    return false;
+  if (root3 === directory)
+    return true;
+  const flavor = pathFlavor(root3), relative = flavor.relative(root3, directory);
+  return descendants && !!relative && relative !== ".." && !relative.startsWith(`..${flavor.sep}`) && !flavor.isAbsolute(relative);
+}
+function selection(v2) {
+  return grantRecord(v2) && keys(v2, ["slug", "version", "bundleDigest"]) && grantIdentifier(v2.slug) && isValidSkillVersion(v2.version) && typeof v2.bundleDigest === "string" && /^sha256:[a-f0-9]{64}$/.test(v2.bundleDigest);
+}
+function validateExecutionGrants(value) {
+  if (!Array.isArray(value) || value.length > MAX_EXECUTION_GRANTS)
+    invalid();
+  const ids = new Set;
+  for (const g3 of value) {
+    if (!grantRecord(g3) || !keys(g3, [
+      "id",
+      "target",
+      "selection",
+      "actors",
+      "consumers",
+      "secretsAuthority",
+      "bindings"
+    ], ["expiresAt"]) || !grantIdentifier(g3.id) || ids.has(g3.id) || g3.target !== "local" || !selection(g3.selection) || !authority(g3.secretsAuthority))
+      invalid();
+    ids.add(g3.id);
+    if (!Array.isArray(g3.actors) || !g3.actors.length || g3.actors.length > 256 || !g3.actors.every(grantIdentifier) || new Set(g3.actors).size !== g3.actors.length)
+      invalid();
+    if (!Array.isArray(g3.consumers) || !g3.consumers.length || g3.consumers.length > 256)
+      invalid();
+    const consumers = new Set;
+    for (const c3 of g3.consumers) {
+      if (!grantRecord(c3) || !keys(c3, ["stationId", "workspaceDirectory"], ["includeDescendants"]) || !grantIdentifier(c3.stationId) || !grantWorkspace(c3.workspaceDirectory) || c3.includeDescendants !== undefined && typeof c3.includeDescendants !== "boolean")
+        invalid();
+      const key = JSON.stringify([
+        c3.stationId,
+        c3.workspaceDirectory,
+        c3.includeDescendants === true
+      ]);
+      if (consumers.has(key))
+        invalid();
+      consumers.add(key);
+    }
+    if (!grantRecord(g3.bindings) || !Object.keys(g3.bindings).length)
+      invalid();
+    try {
+      declaredSecretNames(Object.keys(g3.bindings));
+    } catch {
+      invalid();
+    }
+    for (const ref of Object.values(g3.bindings))
+      if (typeof ref !== "string" || ref.length > 2048 || !/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(ref) || ref.split("/").some((p2) => !p2 || p2 === "." || p2 === ".."))
+        invalid();
+    if (g3.expiresAt !== undefined && (typeof g3.expiresAt !== "string" || !Number.isFinite(Date.parse(g3.expiresAt)) || new Date(g3.expiresAt).toISOString() !== g3.expiresAt))
+      invalid();
+  }
+  if (Buffer.byteLength(JSON.stringify(value)) > MAX_EXECUTION_GRANT_BYTES - 2048)
+    invalid();
+  return structuredClone(value);
+}
+function validateExecutionGrantRequest(value) {
+  if (!grantRecord(value) || !keys(value, ["selection", "consumer"]) || !grantRecord(value.selection) || !keys(value.selection, [
+    "authority",
+    "workspaceId",
+    "profileId",
+    "profileRevision",
+    "slug",
+    "version",
+    "bundleDigest"
+  ]) || !grantRecord(value.consumer) || !keys(value.consumer, ["stationId", "workspaceDirectory"]))
+    invalid();
+  const { selection: s2, consumer: c3 } = value;
+  if (!selection({
+    slug: s2.slug,
+    version: s2.version,
+    bundleDigest: s2.bundleDigest
+  }) || !authority(s2.authority) || ![s2.workspaceId, s2.profileId, s2.profileRevision, c3.stationId].every(grantIdentifier) || !grantWorkspace(c3.workspaceDirectory))
+    invalid();
+  return structuredClone(value);
+}
+function executionGrantMatches(g3, r3, actorId, now = Date.now()) {
+  return g3.target === "local" && g3.actors.includes(actorId) && (!g3.expiresAt || Date.parse(g3.expiresAt) > now) && g3.selection.slug === r3.selection.slug && g3.selection.version === r3.selection.version && g3.selection.bundleDigest === r3.selection.bundleDigest && g3.consumers.some((c3) => c3.stationId === r3.consumer.stationId && grantDirectoryContains(c3.workspaceDirectory, r3.consumer.workspaceDirectory, c3.includeDescendants));
+}
+
+// src/lib/hosted-skill-set.ts
+var HOSTED_RUNTIMES = new Set(["hosted"]);
+var HOSTED_SOURCES = new Set(["remote", "private-hosted"]);
+var HOSTED_METADATA_SET_EMPTY_ERROR = [
+  "The hosted metadata skill set is empty, but the packaging guards that depend on it",
+  "only mean anything while it is non-empty: an empty set makes every one of them pass",
+  "vacuously and silently removes the protection that keeps hosted implementation source",
+  "out of the published package.",
+  "",
+  "If emptying the set is intentional (every hosted skill was deleted or converted to a",
+  "runnable in-repo skill), retire the derived guards in the SAME change \u2014 do not let them",
+  "stay green and empty."
+].join(`
+`);
+var SLUG = "[^,{}/]+";
+var BRACE_SOURCE_EXCLUSION = new RegExp(`^!skills/\\{(${SLUG}(?:,${SLUG})+)\\}/src$`);
+var SINGLE_SOURCE_EXCLUSION = new RegExp(`^!skills/(${SLUG})/src$`);
+
+// src/lib/skill-validation.ts
+var RESERVED_SKILL_ENTRIES = new Set([
+  ".env",
+  ".npmrc",
+  ".pypirc",
+  ".netrc",
+  "id_rsa",
+  "id_ed25519"
+]);
+var KNOWN_TOP_LEVEL_ENTRIES = new Set([
+  ".claude",
+  ".env.example",
+  ".gitignore",
+  ".skills",
+  "CLAUDE.md",
+  "AGENTS.md",
+  "LICENSE",
+  "PROJECT_OVERVIEW.md",
+  "QUICKSTART.md",
+  "README.md",
+  "SKILL.md",
+  "api-docs-list.json",
+  "auth.ts",
+  "bun.lock",
+  "bunfig.toml",
+  "data",
+  "dist",
+  "examples",
+  "exports",
+  "http-client.ts",
+  "index.ts",
+  "install.sh",
+  "installer.ts",
+  "logs",
+  "node_modules",
+  "package.json",
+  "scripts",
+  "skill-install.ts",
+  "skill.json",
+  "src",
+  "tests",
+  "references",
+  "assets",
+  "tsconfig.json",
+  "vision.ts"
+]);
+var VALID_PROVENANCE_SOURCES = new Set(["official", "custom", "remote", "private", "private-hosted", "upstream", "extension"]);
+function frontmatterString(raw) {
+  if (raw.startsWith('"') && raw.endsWith('"')) {
+    try {
+      const decoded = JSON.parse(raw);
+      if (typeof decoded === "string")
+        return decoded;
+    } catch {}
+  }
+  return raw.replace(/^["']|["']$/g, "");
+}
+function parseSkillFrontmatter(content) {
+  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!match)
+    return null;
+  const result = {};
+  const lines = match[1].split(/\r?\n/);
+  for (let i3 = 0;i3 < lines.length; i3++) {
+    const line = lines[i3];
+    const colon = line.indexOf(":");
+    if (colon === -1)
+      continue;
+    const key = line.slice(0, colon).trim();
+    const rawValue = line.slice(colon + 1).trim();
+    if (!key)
+      continue;
+    if (key === "tags" && rawValue === "") {
+      const tags = [];
+      while (i3 + 1 < lines.length && /^\s+-\s+/.test(lines[i3 + 1])) {
+        i3++;
+        tags.push(frontmatterString(lines[i3].replace(/^\s+-\s+/, "").trim()));
+      }
+      result.tags = tags;
+      continue;
+    }
+    const value = frontmatterString(rawValue);
+    if (!value)
+      continue;
+    if (key === "name")
+      result.name = value;
+    else if (key === "description")
+      result.description = value;
+    else if (key === "displayName" || key === "display_name")
+      result.displayName = value;
+    else if (key === "category")
+      result.category = value;
+    else if (key === "version")
+      result.version = value;
+    else if (key === "source")
+      result.source = value;
+    else if (key === "kind")
+      result.kind = value;
+    else if (key === "tags") {
+      result.tags = value.replace(/[\[\]]/g, "").split(",").map((tag) => tag.trim().replace(/^["']|["']$/g, "")).filter(Boolean);
+    }
+  }
+  return Object.keys(result).length > 0 ? result : null;
+}
+
+// src/lib/selected-manifest.ts
+function jsonEntry(entries, path) {
+  const entry = entries.find((candidate) => candidate.path === path);
+  if (!entry)
+    return {};
+  try {
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(entry.bytes));
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new Error;
+    return value;
+  } catch {
+    throw new SkillSelectionError("INVALID_SKILL_MANIFEST", "The selected skill has an invalid execution manifest.");
+  }
+}
+function describeEntries(entries) {
+  const manifest = jsonEntry(entries, "skill.json"), packageJson = jsonEntry(entries, "package.json");
+  const docs = entries.find((entry) => entry.path === "SKILL.md");
+  const frontmatter = docs ? parseSkillFrontmatter(new TextDecoder().decode(docs.bytes)) : null;
+  const kind = frontmatter?.kind === "instruction" || manifest.kind === "instruction" || packageJson.skills?.kind === "instruction" ? "instruction" : "executable";
+  return { kind, manifest, packageJson };
+}
+
+// node_modules/@hasna/contracts/dist/client/transport.js
+import { createRequire as createRequire3 } from "module";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
 }
@@ -96502,13 +97171,13 @@ function clientTransportEnvKeys(name) {
   };
 }
 var MAX_PACKAGE_BYTES = 1024 * 1024;
-var MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
-var INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
-var CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
-var AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
-var requireSecretsSdk = createRequire(import.meta.url);
-var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-var AUTHORITY_OVERRIDE_HEADERS = new Set([
+var MAX_CREDENTIAL_FILE_BYTES3 = 64 * 1024;
+var INSPECT_CUSTOM3 = Symbol.for("nodejs.util.inspect.custom");
+var CREDENTIAL_SEAL3 = Symbol.for("hasna:contracts:sealedCredential");
+var AMBIENT_ENVIRONMENT3 = Symbol.for("hasna:contracts:ambientClientEnvironment");
+var requireSecretsSdk3 = createRequire3(import.meta.url);
+var IDEMPOTENT_METHODS3 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+var AUTHORITY_OVERRIDE_HEADERS3 = new Set([
   "host",
   ":authority",
   "forwarded",
@@ -96565,15 +97234,8 @@ function skillsApiRequestUrl(apiUrl, route) {
   return `${origin}${route}`;
 }
 
-// src/lib/skill-version.ts
-var SKILL_VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
-function isValidSkillVersion(value) {
-  return typeof value === "string" && SKILL_VERSION_PATTERN.test(value) && !/^\.+$/.test(value) && !value.includes("..");
-}
-var SKILL_VERSION_RULE = "1-128 characters: letters, digits, '.', '_', '+', '-'; must start with a letter or digit; no '..'";
-
 // src/server/skills-api.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
 var SHA256_HEX2 = /^[0-9a-f]{64}$/;
 var MAX_SLUG_LENGTH = 128;
@@ -96750,7 +97412,7 @@ async function parsePublishRequest(request, config) {
     if (bundleBytes.byteLength === 0) {
       throw new SkillRequestError(400, "BUNDLE_EMPTY", "the uploaded bundle is empty");
     }
-    const sha256 = createHash5("sha256").update(bundleBytes).digest("hex");
+    const sha256 = createHash6("sha256").update(bundleBytes).digest("hex");
     const claimed = optionalString(manifest.bundleSha256);
     if (claimed)
       assertSha2562(claimed);
@@ -96865,7 +97527,7 @@ async function readPublishedBundle(store, artifactStorage, principal, slug) {
   if (!bytes) {
     throw new SkillRequestError(503, "BUNDLE_BACKEND_UNAVAILABLE", "bundle storage backend unavailable");
   }
-  const actual = createHash5("sha256").update(bytes).digest("hex");
+  const actual = createHash6("sha256").update(bytes).digest("hex");
   if (actual !== record.bundleSha256) {
     throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}' hashes to ${actual} but was published as ${record.bundleSha256}`);
   }
@@ -97013,7 +97675,7 @@ async function readSkillVersionBundle(store, artifactStorage, principal, slug, v
   const bytes = await artifactStorage.readBundle(bundle);
   if (!bytes)
     throw new SkillRequestError(503, "BUNDLE_BACKEND_UNAVAILABLE", "bundle storage backend unavailable");
-  const actual = createHash5("sha256").update(bytes).digest("hex");
+  const actual = createHash6("sha256").update(bytes).digest("hex");
   if (actual !== found.bundleSha256) {
     throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}@${version2}' hashes to ${actual} but was published as ${found.bundleSha256}`);
   }
@@ -97029,41 +97691,159 @@ function publishVersionOf(manifest) {
   return version2;
 }
 
-// src/lib/selection-aliases.ts
-function selectionAliasError(selections2) {
-  const names = new Set(selections2.map((selection) => selection.slug));
-  for (const selection of selections2) {
-    if (selection.aliases === undefined)
-      continue;
-    if (!Array.isArray(selection.aliases) || selection.aliases.length > 32)
-      return "Selection aliases must be an array of at most 32 names.";
-    for (const alias of selection.aliases) {
-      if (typeof alias !== "string" || alias.length > 128 || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(alias))
-        return "Selection aliases must be bounded kebab-case names.";
-      if (names.has(alias))
-        return "Selection aliases must be unique and cannot shadow a selected canonical name.";
-      names.add(alias);
+// src/server/execution-grants-api.ts
+function refuse2(status, code, message) {
+  throw new SkillRequestError(status, code, message);
+}
+function invalid2() {
+  return refuse2(400, "INVALID_EXECUTION_GRANT", "Invalid execution grant document or consumer scope.");
+}
+function json(value, status = 200, revision) {
+  return Response.json(value, {
+    status,
+    headers: {
+      "Cache-Control": "no-store",
+      ...revision ? { ETag: `"${revision}"` } : {}
+    }
+  });
+}
+async function body(request, limit) {
+  if (!request.body)
+    invalid2();
+  const reader = request.body.getReader(), chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      size += value.byteLength;
+      if (size > limit) {
+        await reader.cancel();
+        refuse2(413, "BODY_TOO_LARGE", "Execution grant request exceeds its size limit.");
+      }
+      chunks.push(value);
     }
+  } finally {
+    reader.releaseLock();
+  }
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks)));
+  } catch {
+    return invalid2();
   }
 }
-
-// src/lib/profile-limits.ts
-var MAX_PROFILE_SELECTIONS = 4096;
-var MAX_PROFILE_DOCUMENT_BYTES = 8 * 1024 * 1024;
-var MAX_SKILL_SESSION_ID_CHARS = 256;
-var PROFILE_SESSION_ENVELOPE_BYTES = MAX_PROFILE_SELECTIONS * 67 + MAX_SKILL_SESSION_ID_CHARS * 6 + 256;
-var MAX_RESOLVED_PROFILE_BYTES = MAX_PROFILE_DOCUMENT_BYTES - PROFILE_SESSION_ENVELOPE_BYTES;
-function profileDocumentBytes(value) {
-  return new TextEncoder().encode(JSON.stringify(value)).byteLength;
+function currentSelection(profile2, grant) {
+  const selected = profile2.selections.find((s2) => s2.slug === grant.slug);
+  if (!selected || selected.version !== grant.version || selected.bundleDigest !== grant.bundleDigest) {
+    refuse2(409, "EXECUTION_SELECTION_MISMATCH", "The exact executable version and digest must still be selected in the current profile.");
+  }
 }
-function resolvedProfileSnapshot(profile2, authority) {
-  return {
-    profileId: profile2.id,
-    workspaceId: profile2.workspaceId,
-    profileRevision: profile2.revision,
-    authority,
-    selections: profile2.selections.map((selection) => ({ ...selection, authority, workspaceId: profile2.workspaceId, profileRevision: profile2.revision }))
-  };
+async function validatePublishedGrant(store, artifacts, principal, grant) {
+  const bundle = await readSkillVersionBundle(store, artifacts, principal, grant.selection.slug, grant.selection.version);
+  if (`sha256:${bundle.version.bundleSha256}` !== grant.selection.bundleDigest) {
+    refuse2(409, "EXECUTION_SELECTION_MISMATCH", "Execution grant digest does not match the published version.");
+  }
+  let names;
+  try {
+    const { entries } = await inspectSkillBundle(bundle.bytes);
+    const { kind, manifest } = describeEntries(entries);
+    if (kind !== "executable")
+      invalid2();
+    names = declaredSecretNames(manifest.runtime?.env);
+  } catch {
+    return invalid2();
+  }
+  if (!names.length || names.length !== Object.keys(grant.bindings).length || names.some((name) => !Object.hasOwn(grant.bindings, name)))
+    invalid2();
+}
+async function handleExecutionGrantApi(store, principal, request, parts, config, artifacts) {
+  const [resource, id, child, revision] = parts;
+  if (resource !== "execution-grants")
+    return null;
+  if (!grantIdentifier(id))
+    invalid2();
+  const { executionGrantStore: policies, selectionStore: profiles } = store;
+  if (!policies || !profiles)
+    refuse2(503, "EXECUTION_GRANTS_UNAVAILABLE", "This store does not support execution grants.");
+  const historical = parts.length === 4 && child === "versions" && grantIdentifier(revision);
+  if (request.method === "GET" && (parts.length === 2 || historical)) {
+    const policy = await policies.get(principal, id, historical ? revision : undefined);
+    if (!policy)
+      refuse2(404, "EXECUTION_GRANTS_NOT_FOUND", "Execution grant policy not found.");
+    return json(policy, 200, policy.revision);
+  }
+  if (request.method === "PUT" && parts.length === 2) {
+    const match = request.headers.get("if-match"), create = request.headers.get("if-none-match");
+    if (!match && create !== "*" || match && create) {
+      refuse2(428, "EXECUTION_GRANT_PRECONDITION_REQUIRED", "Use If-None-Match: * to create or If-Match with the current policy revision to update.");
+    }
+    const expected = match ? /^"([a-zA-Z0-9-]{1,128})"$/.exec(match)?.[1] : null;
+    if (match && !expected)
+      invalid2();
+    const input = await body(request, Math.min(config.requestBodyLimitBytes, MAX_EXECUTION_GRANT_BYTES));
+    if (!grantRecord(input) || Object.keys(input).length !== 1 || !Object.hasOwn(input, "grants"))
+      invalid2();
+    let grants;
+    try {
+      grants = validateExecutionGrants(input.grants);
+    } catch {
+      return invalid2();
+    }
+    const profile2 = await profiles.getProfile(principal, id);
+    if (!profile2)
+      refuse2(404, "PROFILE_NOT_FOUND", "Profile not found.");
+    for (const grant of grants) {
+      currentSelection(profile2, grant.selection);
+      await validatePublishedGrant(store, artifacts, principal, grant);
+    }
+    if ((await profiles.getProfile(principal, id))?.revision !== profile2.revision) {
+      refuse2(409, "PROFILE_REVISION_CONFLICT", "Profile changed while validating grants; resolve it again.");
+    }
+    const saved = await policies.save(principal, id, grants, expected ?? null);
+    if (!saved)
+      refuse2(409, "EXECUTION_GRANT_REVISION_CONFLICT", "Execution grant policy changed; read it before retrying.");
+    return json(saved, create ? 201 : 200, saved.revision);
+  }
+  if (request.method === "POST" && parts.length === 3 && child === "resolve") {
+    const input = await body(request, Math.min(config.requestBodyLimitBytes, 16384));
+    let consumer;
+    try {
+      consumer = validateExecutionGrantRequest(input);
+    } catch {
+      return invalid2();
+    }
+    const authority2 = skillsApiRequestUrl(normalizeSkillsApiOrigin(config.publicBaseUrl), "/api/v1/").replace(/\/+$/, "");
+    if (consumer.selection.authority !== authority2 || consumer.selection.workspaceId !== principal.orgId || consumer.selection.profileId !== id) {
+      refuse2(403, "EXECUTION_GRANT_SCOPE_MISMATCH", "The requested execution authority, workspace or profile does not match this request.");
+    }
+    const profile2 = await profiles.getProfile(principal, id);
+    if (!profile2)
+      refuse2(404, "PROFILE_NOT_FOUND", "Profile not found.");
+    if (profile2.revision !== consumer.selection.profileRevision)
+      refuse2(409, "PROFILE_REVISION_CONFLICT", "Resolve the current profile before requesting execution grants.");
+    currentSelection(profile2, consumer.selection);
+    const policy = await policies.get(principal, id);
+    const matches = policy?.grants.filter((grant2) => executionGrantMatches(grant2, consumer, principal.userId)) ?? [];
+    if (matches.length !== 1)
+      refuse2(403, "EXECUTION_GRANT_DENIED", "No unique current execution grant permits this actor, executable and consumer.");
+    const grant = matches[0];
+    await validatePublishedGrant(store, artifacts, principal, grant);
+    if ((await profiles.getProfile(principal, id))?.revision !== profile2.revision || (await policies.get(principal, id))?.revision !== policy.revision || !executionGrantMatches(grant, consumer, principal.userId)) {
+      refuse2(409, "EXECUTION_GRANT_REVISION_CONFLICT", "Execution authorization changed; resolve it again.");
+    }
+    return json({
+      policyRevision: policy.revision,
+      grantId: grant.id,
+      bindings: {
+        schema: "hasna.skills-secret-bindings.v1",
+        ...consumer,
+        secretsAuthority: grant.secretsAuthority,
+        bindings: grant.bindings
+      }
+    });
+  }
+  return null;
 }
 
 // src/server/profile-api.ts
@@ -97075,36 +97855,36 @@ function object(value) {
 function identifier(value) {
   return typeof value === "string" && ID.test(value) && !value.includes("..");
 }
-function invalid(message) {
+function invalid3(message) {
   throw new SkillRequestError(400, "INVALID_SELECTION", message);
 }
 function selected(value) {
   if (!Array.isArray(value) || value.length > MAX_PROFILE_SELECTIONS)
-    invalid(`selections must be an array with at most ${MAX_PROFILE_SELECTIONS} entries`);
+    invalid3(`selections must be an array with at most ${MAX_PROFILE_SELECTIONS} entries`);
   const seen = new Set;
   const selections2 = value.map((item) => {
     if (!object(item) || typeof item.slug !== "string" || !isValidSkillVersion(item.version) || typeof item.bundleDigest !== "string" || !DIGEST.test(item.bundleDigest))
-      invalid("Each selection requires slug, exact version, and sha256 bundleDigest");
+      invalid3("Each selection requires slug, exact version, and sha256 bundleDigest");
     assertPublishableSlug(item.slug);
     if (seen.has(item.slug))
-      invalid("A profile may select each skill only once");
+      invalid3("A profile may select each skill only once");
     seen.add(item.slug);
     let triggers;
     if (item.triggers !== undefined) {
       if (!object(item.triggers) || Object.keys(item.triggers).some((key) => !["keywords", "paths", "always"].includes(key)))
-        invalid("Invalid selection triggers");
+        invalid3("Invalid selection triggers");
       triggers = {};
       for (const key of ["keywords", "paths"]) {
         const terms = item.triggers[key];
         if (terms !== undefined) {
           if (!Array.isArray(terms) || terms.length > 32 || terms.some((term) => typeof term !== "string" || !term.trim() || term.length > 256))
-            invalid("Trigger terms must be bounded nonempty strings");
+            invalid3("Trigger terms must be bounded nonempty strings");
           triggers[key] = terms;
         }
       }
       if (item.triggers.always !== undefined) {
         if (typeof item.triggers.always !== "boolean")
-          invalid("always must be boolean");
+          invalid3("always must be boolean");
         triggers.always = item.triggers.always;
       }
     }
@@ -97118,38 +97898,38 @@ function selected(value) {
   }).sort((a3, b3) => a3.slug < b3.slug ? -1 : a3.slug > b3.slug ? 1 : 0);
   const aliasError = selectionAliasError(selections2);
   if (aliasError)
-    invalid(aliasError);
+    invalid3(aliasError);
   return selections2;
 }
 async function validatePublished(store, principal, selections2) {
-  for (const selection of selections2) {
-    const current = await store.getSkill(principal, selection.slug);
+  for (const selection2 of selections2) {
+    const current = await store.getSkill(principal, selection2.slug);
     if (!current || current.tombstonedAt)
-      throw new SkillRequestError(current?.tombstonedAt ? 410 : 404, "SELECTION_UNAVAILABLE", `Selected skill '${selection.slug}' is unavailable`);
-    const version2 = await store.getSkillVersion(principal, selection.slug, selection.version);
-    if (!version2 || `sha256:${version2.bundleSha256}` !== selection.bundleDigest)
-      throw new SkillRequestError(409, "SELECTION_VERSION_MISMATCH", `Selected version of '${selection.slug}' does not match its published digest`);
+      throw new SkillRequestError(current?.tombstonedAt ? 410 : 404, "SELECTION_UNAVAILABLE", `Selected skill '${selection2.slug}' is unavailable`);
+    const version2 = await store.getSkillVersion(principal, selection2.slug, selection2.version);
+    if (!version2 || `sha256:${version2.bundleSha256}` !== selection2.bundleDigest)
+      throw new SkillRequestError(409, "SELECTION_VERSION_MISMATCH", `Selected version of '${selection2.slug}' does not match its published digest`);
     if (!await store.getSkillBundle(principal, version2.bundleSha256))
       throw new SkillRequestError(503, "SELECTION_BUNDLE_UNAVAILABLE", "Selected bundle is unavailable");
   }
 }
-async function body(request, limit) {
+async function body2(request, limit) {
   if (!request.body)
-    invalid("JSON body required");
+    invalid3("JSON body required");
   const reader = request.body.getReader();
   let size = 0;
   const chunks = [];
   try {
     while (true) {
-      const next = await reader.read();
-      if (next.done)
+      const next2 = await reader.read();
+      if (next2.done)
         break;
-      size += next.value.byteLength;
+      size += next2.value.byteLength;
       if (size > limit) {
         await reader.cancel();
         throw new SkillRequestError(413, "BODY_TOO_LARGE", "Request body too large");
       }
-      chunks.push(next.value);
+      chunks.push(next2.value);
     }
   } finally {
     reader.releaseLock();
@@ -97164,13 +97944,13 @@ async function body(request, limit) {
     }
     parsed = JSON.parse(new TextDecoder().decode(bytes));
   } catch {
-    invalid("Malformed JSON body");
+    invalid3("Malformed JSON body");
   }
   if (!object(parsed))
-    invalid("JSON object required");
+    invalid3("JSON object required");
   return parsed;
 }
-function json(value, status = 200, revision) {
+function json2(value, status = 200, revision) {
   if (profileDocumentBytes(value) > MAX_PROFILE_DOCUMENT_BYTES)
     throw new SkillRequestError(413, "PROFILE_TOO_LARGE", "Profile document exceeds its size limit");
   return Response.json(value, {
@@ -97184,7 +97964,7 @@ function json(value, status = 200, revision) {
 async function handleProfileApi(store, principal, request, parts, config) {
   const [resource, id, child] = parts;
   if (resource === "capabilities" && request.method === "GET" && parts.length === 1)
-    return json({
+    return json2({
       contractVersion: 1,
       apiVersion: 1,
       service: "skills",
@@ -97192,8 +97972,10 @@ async function handleProfileApi(store, principal, request, parts, config) {
       capabilities: [
         "skills.registry",
         "skills.versions",
+        ...store.selectionStore && store.executionGrantStore ? ["skills.execution-grants"] : [],
         ...store.selectionStore ? ["skills.profiles", "skills.station-state"] : []
       ],
+      executionGrants: Boolean(store.selectionStore && store.executionGrantStore),
       profileResolution: Boolean(store.selectionStore),
       selectionAliases: Boolean(store.selectionStore),
       profileLimits: {
@@ -97207,6 +97989,9 @@ async function handleProfileApi(store, principal, request, parts, config) {
       incrementalSync: false,
       scopes: [...principal.scopes].sort(),
       permissions: {
+        executionGrantsRead: permitsSkillsRoute(principal, "GET", "execution-grants"),
+        executionGrantsWrite: permitsSkillsRoute(principal, "PUT", "execution-grants"),
+        executionGrantsResolve: permitsSkillsRoute(principal, "POST", "execution-grants"),
         read: permitsSkillsRoute(principal, "GET", "skills"),
         publish: permitsSkillsRoute(principal, "POST", "skills"),
         profilesWrite: permitsSkillsRoute(principal, "PUT", "profiles"),
@@ -97222,16 +98007,16 @@ async function handleProfileApi(store, principal, request, parts, config) {
   if (!adapter)
     throw new SkillRequestError(503, "PROFILES_UNAVAILABLE", "This store does not support profiles");
   if (resource === "profiles" && parts.length === 2 && request.method === "PUT") {
-    const input = await body(request, Math.min(config.requestBodyLimitBytes, MAX_PROFILE_DOCUMENT_BYTES)), selections2 = selected(input.selections);
+    const input = await body2(request, Math.min(config.requestBodyLimitBytes, MAX_PROFILE_DOCUMENT_BYTES)), selections2 = selected(input.selections);
     const match = request.headers.get("if-match"), create = request.headers.get("if-none-match");
     if (!match && create !== "*" || match && create)
       throw new SkillRequestError(428, "PROFILE_PRECONDITION_REQUIRED", "Use If-None-Match: * to create or If-Match with the current revision to update");
     const expected = match ? /^"([a-zA-Z0-9-]{1,128})"$/.exec(match)?.[1] : null;
     if (match && !expected)
       throw new SkillRequestError(400, "INVALID_PRECONDITION", "A quoted revision ETag is required");
-    const authority = skillsApiRequestUrl(normalizeSkillsApiOrigin(config.publicBaseUrl), "/api/v1/").replace(/\/+$/, "");
+    const authority2 = skillsApiRequestUrl(normalizeSkillsApiOrigin(config.publicBaseUrl), "/api/v1/").replace(/\/+$/, "");
     const revision = "x".repeat(128);
-    const projected = resolvedProfileSnapshot({ id, workspaceId: principal.orgId, revision, selections: selections2 }, authority);
+    const projected = resolvedProfileSnapshot({ id, workspaceId: principal.orgId, revision, selections: selections2 }, authority2);
     if (profileDocumentBytes(projected) > MAX_RESOLVED_PROFILE_BYTES || profileDocumentBytes({ profileId: id, profileRevision: revision, selections: selections2 }) > Math.min(config.requestBodyLimitBytes, MAX_PROFILE_DOCUMENT_BYTES)) {
       throw new SkillRequestError(413, "PROFILE_TOO_LARGE", "The complete resolved profile and station/session receipts must fit the advertised profile limits");
     }
@@ -97239,7 +98024,7 @@ async function handleProfileApi(store, principal, request, parts, config) {
     const saved = await adapter.saveProfile(principal, id, selections2, expected ?? null);
     if (!saved)
       throw new SkillRequestError(409, "PROFILE_REVISION_CONFLICT", "Profile changed; read it before retrying");
-    return json(saved, create ? 201 : 200, saved.revision);
+    return json2(saved, create ? 201 : 200, saved.revision);
   }
   if (resource === "profiles" && request.method === "GET" && (parts.length === 2 || parts.length === 3 && child === "resolve")) {
     const profile2 = await adapter.getProfile(principal, id);
@@ -97248,25 +98033,25 @@ async function handleProfileApi(store, principal, request, parts, config) {
     if (profile2.selections.length > MAX_PROFILE_SELECTIONS)
       throw new SkillRequestError(413, "PROFILE_TOO_LARGE", "Profile exceeds the advertised selection limit");
     if (!child)
-      return json(profile2, 200, profile2.revision);
-    const authority = skillsApiRequestUrl(normalizeSkillsApiOrigin(config.publicBaseUrl), "/api/v1/").replace(/\/+$/, "");
-    const result = resolvedProfileSnapshot(profile2, authority);
+      return json2(profile2, 200, profile2.revision);
+    const authority2 = skillsApiRequestUrl(normalizeSkillsApiOrigin(config.publicBaseUrl), "/api/v1/").replace(/\/+$/, "");
+    const result = resolvedProfileSnapshot(profile2, authority2);
     if (result.selections.length > MAX_PROFILE_SELECTIONS || profileDocumentBytes(result) > MAX_RESOLVED_PROFILE_BYTES)
       throw new SkillRequestError(413, "PROFILE_TOO_LARGE", "Resolved profile exceeds the advertised profile limits");
     await validatePublished(store, principal, profile2.selections);
-    return json(result, 200, profile2.revision);
+    return json2(result, 200, profile2.revision);
   }
   if (resource === "stations" && parts.length === 3 && child === "state") {
     if (request.method === "GET") {
       const state2 = await adapter.getStationState(principal, id);
       if (!state2)
         throw new SkillRequestError(404, "STATION_STATE_NOT_FOUND", "No station state reported");
-      return json(state2);
+      return json2(state2);
     }
     if (request.method === "PUT") {
-      const input = await body(request, Math.min(config.requestBodyLimitBytes, MAX_PROFILE_DOCUMENT_BYTES));
+      const input = await body2(request, Math.min(config.requestBodyLimitBytes, MAX_PROFILE_DOCUMENT_BYTES));
       if (!identifier(input.profileId) || !identifier(input.profileRevision))
-        invalid("profileId and profileRevision are required");
+        invalid3("profileId and profileRevision are required");
       const receipt = {
         profileId: input.profileId,
         profileRevision: input.profileRevision,
@@ -97281,7 +98066,7 @@ async function handleProfileApi(store, principal, request, parts, config) {
       const saved = await adapter.saveStationState(principal, id, receipt);
       if (!saved)
         throw new SkillRequestError(409, "PROFILE_REVISION_CONFLICT", "Profile changed while reporting state");
-      return json(saved);
+      return json2(saved);
     }
   }
   return null;
@@ -97583,7 +98368,7 @@ class RuntimeExecutionStore {
 }
 
 // src/sdk/execution/admission.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 
 // src/sdk/execution/image-profile.ts
 class ImageProfileResolutionError extends Error {
@@ -97730,15 +98515,15 @@ class MemoryRunExecutionStore {
     if (attempt.leaseGeneration !== input.expectedLeaseGeneration) {
       return { ok: false, reason: "STALE_GENERATION" };
     }
-    const next = {
+    const next2 = {
       ...attempt,
       leaseGeneration: attempt.leaseGeneration + 1,
       workerId: input.workerId,
       claimedAt: new Date().toISOString(),
       status: "leased"
     };
-    this.attempts.set(attempt.attemptId, next);
-    return { ok: true, attempt: next, leaseGeneration: next.leaseGeneration };
+    this.attempts.set(attempt.attemptId, next2);
+    return { ok: true, attempt: next2, leaseGeneration: next2.leaseGeneration };
   }
   async recordLaunchIntent(input) {
     const run = this.runs.get(input.runId);
@@ -97750,28 +98535,28 @@ class MemoryRunExecutionStore {
       return { ok: false, reason: "NO_SUCH_ATTEMPT" };
     if (attempt.status === "terminal")
       return { ok: false, reason: "ATTEMPT_TERMINAL" };
-    const next = {
+    const next2 = {
       ...attempt,
       clientToken: input.clientToken,
       requestDigest: input.requestDigest,
       startedBy: input.startedBy,
       launchState: "launching"
     };
-    this.attempts.set(attempt.attemptId, next);
+    this.attempts.set(attempt.attemptId, next2);
     this.runs.set(input.runId, { ...run, currentAttemptId: attempt.attemptId, updatedAt: new Date().toISOString() });
-    return { ok: true, attempt: next };
+    return { ok: true, attempt: next2 };
   }
   async recordLaunchState(input) {
     const attempt = this.attempts.get(input.attemptId);
     if (!attempt)
       return null;
-    const next = {
+    const next2 = {
       ...attempt,
       launchState: input.launchState,
       ...input.taskId === undefined ? {} : { taskId: input.taskId }
     };
-    this.attempts.set(attempt.attemptId, next);
-    return next;
+    this.attempts.set(attempt.attemptId, next2);
+    return next2;
   }
   async recordTransition(transition) {
     this.transitions.push(transition);
@@ -97780,9 +98565,9 @@ class MemoryRunExecutionStore {
     const attempt = this.attempts.get(attemptId);
     if (!attempt)
       return null;
-    const next = { ...attempt, status: "terminal" };
-    this.attempts.set(attemptId, next);
-    return next;
+    const next2 = { ...attempt, status: "terminal" };
+    this.attempts.set(attemptId, next2);
+    return next2;
   }
   async writeReceipt(receipt) {
     this.receipts.set(receipt.runId + "\x00" + receipt.attemptId, receipt);
@@ -97800,22 +98585,22 @@ class MemoryRunExecutionStore {
         this.attempts.set(attemptId, { ...attempt, status: "terminal" });
       }
     }
-    const next = {
+    const next2 = {
       ...run,
       status,
       terminalReceiptId: receiptId2,
       updatedAt: new Date().toISOString()
     };
-    this.runs.set(runId2, next);
-    return next;
+    this.runs.set(runId2, next2);
+    return next2;
   }
   async setRunStatus(runId2, status) {
     const run = this.runs.get(runId2);
     if (!run)
       return null;
-    const next = { ...run, status, updatedAt: new Date().toISOString() };
-    this.runs.set(runId2, next);
-    return next;
+    const next2 = { ...run, status, updatedAt: new Date().toISOString() };
+    this.runs.set(runId2, next2);
+    return next2;
   }
 }
 function isMemoryTerminal(status) {
@@ -97898,11 +98683,11 @@ function ownedAdmission(admission) {
   };
 }
 function digestInput(input) {
-  return createHash7("sha256").update(canonicalJson(input)).digest("hex");
+  return createHash8("sha256").update(canonicalJson(input)).digest("hex");
 }
 
 // src/sdk/execution/dispatchers/ecs.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 
 // src/sdk/execution/state-machine.ts
 var LEGAL_TRANSITIONS = {
@@ -97931,8 +98716,8 @@ function createRunStateMachine(store) {
     if (!LEGAL_TRANSITIONS[from].includes(to)) {
       return { ok: false, reason: "INVALID_TRANSITION" };
     }
-    const next = await store.setRunStatus(runId2, to);
-    if (!next)
+    const next2 = await store.setRunStatus(runId2, to);
+    if (!next2)
       return { ok: false, reason: "NO_SUCH_RUN" };
     const record = {
       runId: runId2,
@@ -98100,7 +98885,7 @@ function convertHttpAuthSchemesToMap2(httpAuthSchemes) {
   }
   return map;
 }
-var httpAuthSchemeMiddleware2 = (config, mwOptions) => (next, context) => async (args) => {
+var httpAuthSchemeMiddleware2 = (config, mwOptions) => (next2, context) => async (args) => {
   const options = config.httpAuthSchemeProvider(await mwOptions.httpAuthSchemeParametersProvider(config, context, args.input));
   const authSchemePreference = config.authSchemePreference ? await config.authSchemePreference() : [];
   const resolvedOptions = resolveAuthOptions2(options, authSchemePreference);
@@ -98132,7 +98917,7 @@ var httpAuthSchemeMiddleware2 = (config, mwOptions) => (next, context) => async
     throw new Error(failureReasons.join(`
 `));
   }
-  return next(args);
+  return next2(args);
 };
 var httpAuthSchemeEndpointRuleSetMiddlewareOptions2 = {
   step: "serialize",
@@ -98154,9 +98939,9 @@ var defaultErrorHandler3 = (signingProperties) => (error) => {
   throw error;
 };
 var defaultSuccessHandler3 = (httpResponse, signingProperties) => {};
-var httpSigningMiddleware2 = (config) => (next, context) => async (args) => {
+var httpSigningMiddleware2 = (config) => (next2, context) => async (args) => {
   if (!HttpRequest8.isInstance(args.request)) {
-    return next(args);
+    return next2(args);
   }
   const smithyContext = getSmithyContext5(context);
   const scheme = smithyContext.selectedHttpAuthScheme;
@@ -98164,7 +98949,7 @@ var httpSigningMiddleware2 = (config) => (next, context) => async (args) => {
     throw new Error(`No HttpAuthScheme was selected: unable to sign request`);
   }
   const { httpAuthOption: { signingProperties = {} }, identity, signer } = scheme;
-  const output = await next({
+  const output = await next2({
     ...args,
     request: await signer.sign(args.request, identity, signingProperties)
   }).catch((signer.errorHandler || defaultErrorHandler3)(signingProperties));
@@ -98213,7 +98998,7 @@ var $getHttpSigningPlugin2 = getHttpSigningPlugin3;
 
 // node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
 var import_client37 = __toESM(require_client10(), 1);
-var import_config32 = __toESM(require_config9(), 1);
+var import_config33 = __toESM(require_config9(), 1);
 var import_endpoints8 = __toESM(require_endpoints9(), 1);
 var import_protocols10 = __toESM(require_protocols9(), 1);
 
@@ -98345,7 +99130,7 @@ var asSdkError2 = (error) => {
   return new Error(`AWS SDK error wrapper for ${error}`);
 };
 function bindRetryMiddleware2(isStreamingPayload3) {
-  return (options) => (next, context) => async (args) => {
+  return (options) => (next2, context) => async (args) => {
     let retryStrategy = await options.retryStrategy();
     const maxAttempts = await options.maxAttempts();
     if (isRetryStrategyV22(retryStrategy)) {
@@ -98364,7 +99149,7 @@ function bindRetryMiddleware2(isStreamingPayload3) {
           if (isRequest) {
             request.headers[REQUEST_HEADER2] = `attempt=${attempts + 1}; max=${maxAttempts}`;
           }
-          const { response, output } = await next(args);
+          const { response, output } = await next2(args);
           retryStrategy.recordSuccess(retryToken);
           output.$metadata.attempts = attempts + 1;
           output.$metadata.totalRetryDelay = totalRetryDelay;
@@ -98399,7 +99184,7 @@ function bindRetryMiddleware2(isStreamingPayload3) {
       if (retryStrategy?.mode) {
         context.userAgent = [...context.userAgent || [], ["cfg/retry-mode", retryStrategy.mode]];
       }
-      return retryStrategy.retry(next, args);
+      return retryStrategy.retry(next2, args);
     }
   };
 }
@@ -98794,7 +99579,7 @@ class StandardRetryStrategy4 {
     }
     return maxAttempts;
   }
-  async retry(next, args, options) {
+  async retry(next2, args, options) {
     let retryTokenAmount;
     let attempts = 0;
     let totalDelay = 0;
@@ -98811,7 +99596,7 @@ class StandardRetryStrategy4 {
         if (options?.beforeRequest) {
           await options.beforeRequest();
         }
-        const { response, output } = await next(args);
+        const { response, output } = await next2(args);
         if (options?.afterRequest) {
           options.afterRequest(response);
         }
@@ -99054,7 +99839,7 @@ var package_default3 = {
 var import_client32 = __toESM(require_client2(), 1);
 var import_httpAuthSchemes6 = __toESM(require_httpAuthSchemes(), 1);
 var import_client33 = __toESM(require_client10(), 1);
-var import_config31 = __toESM(require_config9(), 1);
+var import_config32 = __toESM(require_config9(), 1);
 var import_serde6 = __toESM(require_serde9(), 1);
 var import_node_http_handler3 = __toESM(require_dist_cjs7(), 1);
 
@@ -101995,7 +102780,7 @@ var getRuntimeConfig4 = (config) => {
 // node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
 var getRuntimeConfig5 = (config) => {
   import_client33.emitWarningIfUnsupportedVersion(process.version);
-  const defaultsMode = import_config31.resolveDefaultsModeConfig(config);
+  const defaultsMode = import_config32.resolveDefaultsModeConfig(config);
   const defaultConfigProvider = () => defaultsMode().then(import_client33.loadConfigsForDefaultMode);
   const clientSharedValues = getRuntimeConfig4(config);
   import_client32.emitWarningIfUnsupportedVersion(process.version);
@@ -102008,21 +102793,21 @@ var getRuntimeConfig5 = (config) => {
     ...config,
     runtime: "node",
     defaultsMode,
-    authSchemePreference: config?.authSchemePreference ?? import_config31.loadConfig(import_httpAuthSchemes6.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
+    authSchemePreference: config?.authSchemePreference ?? import_config32.loadConfig(import_httpAuthSchemes6.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde6.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
     defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client32.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default3.version }),
-    maxAttempts: config?.maxAttempts ?? import_config31.loadConfig($NODE_MAX_ATTEMPT_CONFIG_OPTIONS2, config),
-    region: config?.region ?? import_config31.loadConfig(import_config31.NODE_REGION_CONFIG_OPTIONS, { ...import_config31.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
+    maxAttempts: config?.maxAttempts ?? import_config32.loadConfig($NODE_MAX_ATTEMPT_CONFIG_OPTIONS2, config),
+    region: config?.region ?? import_config32.loadConfig(import_config32.NODE_REGION_CONFIG_OPTIONS, { ...import_config32.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
     requestHandler: import_node_http_handler3.NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
-    retryMode: config?.retryMode ?? import_config31.loadConfig({
+    retryMode: config?.retryMode ?? import_config32.loadConfig({
       ...$NODE_RETRY_MODE_CONFIG_OPTIONS2,
       default: async () => (await defaultConfigProvider()).retryMode || $DEFAULT_RETRY_MODE2
     }, config),
     streamCollector: config?.streamCollector ?? import_node_http_handler3.streamCollector,
-    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config31.loadConfig(import_config31.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    useFipsEndpoint: config?.useFipsEndpoint ?? import_config31.loadConfig(import_config31.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    userAgentAppId: config?.userAgentAppId ?? import_config31.loadConfig(import_client32.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config32.loadConfig(import_config32.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    useFipsEndpoint: config?.useFipsEndpoint ?? import_config32.loadConfig(import_config32.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    userAgentAppId: config?.userAgentAppId ?? import_config32.loadConfig(import_client32.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
   };
 };
 
@@ -102087,7 +102872,7 @@ class ECSClient extends import_client37.Client {
     const _config_1 = resolveClientEndpointParameters3(_config_0);
     const _config_2 = import_client36.resolveUserAgentConfig(_config_1);
     const _config_3 = $resolveRetryConfig2(_config_2);
-    const _config_4 = import_config32.resolveRegionConfig(_config_3);
+    const _config_4 = import_config33.resolveRegionConfig(_config_3);
     const _config_5 = import_client36.resolveHostHeaderConfig(_config_4);
     const _config_6 = import_endpoints8.resolveEndpointConfig(_config_5);
     const _config_7 = resolveHttpAuthSchemeConfig3(_config_6);
@@ -102146,13 +102931,13 @@ function observedTask(states, taskArn) {
   return state2.lastStatus === "STOPPED" || LIVE_TASK_STATUSES.has(state2.lastStatus) ? state2 : undefined;
 }
 function clientTokenFor(runId2, attemptId) {
-  return createHash8("sha256").update(`${runId2}\x00${attemptId}`).digest("hex").slice(0, CLIENT_TOKEN_BYTES * 2);
+  return createHash9("sha256").update(`${runId2}\x00${attemptId}`).digest("hex").slice(0, CLIENT_TOKEN_BYTES * 2);
 }
 function startedByFor(runId2, attemptNumber) {
   return `skills-exec/${runId2}/a${attemptNumber}`;
 }
 function requestDigestFor(admission, attemptId) {
-  return createHash8("sha256").update(canonicalJson({ admission, attemptId })).digest("hex");
+  return createHash9("sha256").update(canonicalJson({ admission, attemptId })).digest("hex");
 }
 
 class EcsDispatcher {
@@ -102379,10 +103164,10 @@ function createAwsEcsClient(region, options = {}) {
   const client = options.transport ?? new ECSClient({ region });
   let boundCluster = options.cluster;
   const cluster = (requested) => {
-    const next = requested ?? boundCluster ?? "default";
-    if (!validText(next) || boundCluster !== undefined && next !== boundCluster)
+    const next2 = requested ?? boundCluster ?? "default";
+    if (!validText(next2) || boundCluster !== undefined && next2 !== boundCluster)
       throw Error("ECS client cluster binding changed");
-    return boundCluster ??= next;
+    return boundCluster ??= next2;
   };
   const response = (value) => {
     if (!value || typeof value !== "object" || Array.isArray(value))
@@ -102448,7 +103233,7 @@ function validText(value) {
 }
 
 // src/server/runtime-policy.ts
-import { createHash as createHash9, createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash10, createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var RUNTIME_MAX_INPUT_BYTES = 1e5;
 var RUNTIME_MAX_BUNDLE_BYTES = 1e6;
 var RUNTIME_MAX_ARTIFACT_BYTES = 2000000;
@@ -102520,7 +103305,7 @@ function verifyRuntimeToken(token, key, admission, attempt, now = Date.now()) {
   const actual = Buffer.from(token);
   return actual.length === expected.length && timingSafeEqual2(actual, expected);
 }
-var hashBytes = (bytes) => createHash9("sha256").update(bytes).digest("hex");
+var hashBytes = (bytes) => createHash10("sha256").update(bytes).digest("hex");
 
 // src/server/runtime-api.ts
 async function createRuntimeService(options) {
@@ -102574,12 +103359,12 @@ async function createRuntimeService(options) {
   }
   return service;
 }
-var json2 = (body2, status = 200) => Response.json(body2, { status, headers: { "cache-control": "no-store" } });
-var refusal3 = (code, status, error = code) => json2({ code, error }, status);
+var json3 = (body3, status = 200) => Response.json(body3, { status, headers: { "cache-control": "no-store" } });
+var refusal3 = (code, status, error = code) => json3({ code, error }, status);
 function path(request) {
   return new URL(request.url).pathname.replace(/^\/skills\/v1(?=\/|$)/, "/api/v1").replace(/^\/v1(?=\/|$)/, "/api/v1").split("/").filter(Boolean);
 }
-async function body2(request, max) {
+async function body3(request, max) {
   if (!request.body)
     throw Error("Request body is required");
   const reader = request.body.getReader();
@@ -102633,7 +103418,7 @@ async function handleRuntimeApiRequest(request, principal, service) {
     return refusal3("INVALID_EXECUTION_PATH", 400);
   try {
     if (request.method === "POST" && !sub) {
-      const raw = await body2(request, 150000);
+      const raw = await body3(request, 150000);
       if (id !== "pdf-generate" || typeof raw.version !== "string" || !/^\d+\.\d+\.\d+$/.test(raw.version))
         return refusal3("REVIEWED_VERSION_REQUIRED", 400);
       if (Object.keys(raw).some((k4) => ![
@@ -102710,7 +103495,7 @@ async function handleRuntimeApiRequest(request, principal, service) {
       const job2 = await service.store.job(run.runId);
       if (!job2)
         throw Error("Execution admission disappeared");
-      return json2({
+      return json3({
         ...publicJob(job2),
         ...dispatched ? { dispatch: { accepted: dispatched.accepted } } : {}
       }, 202);
@@ -102720,7 +103505,7 @@ async function handleRuntimeApiRequest(request, principal, service) {
       return refusal3("EXECUTION_NOT_FOUND", 404);
     if (request.method === "POST" && sub === "cancel" && segments.length === 5) {
       const result = await service.dispatcher.cancel(id);
-      return json2({
+      return json3({
         ...publicJob(await service.store.job(id)),
         cancelAccepted: result.accepted
       }, result.accepted ? 200 : 202);
@@ -102762,17 +103547,17 @@ async function handleRuntimeApiRequest(request, principal, service) {
       if (!isTerminalStatus(job.execution.status) && Date.now() - Date.parse(job.execution.admission.createdAt) > 20 * 60 * 1000) {
         const stopped = await service.dispatcher.cancel(id);
         if (!stopped.accepted)
-          return json2({ ...publicJob(job), reconciliationRequired: true });
+          return json3({ ...publicJob(job), reconciliationRequired: true });
       }
-      return json2(publicJob(await service.store.job(id)));
+      return json3(publicJob(await service.store.job(id)));
     }
     if (sub === "logs" && segments.length === 5)
-      return json2({
+      return json3({
         stdout: job.result?.stdout ?? "",
         stderr: job.result?.stderr ?? ""
       });
     if (sub === "artifacts" && segments.length === 5)
-      return json2((job.result?.artifacts ?? []).map(({ base64, ...meta }) => meta));
+      return json3((job.result?.artifacts ?? []).map(({ base64, ...meta }) => meta));
     if (sub === "artifacts" && segments.length === 6) {
       const a4 = job.result?.artifacts.find((a5) => a5.name === segments[5]);
       if (!a4)
@@ -102811,7 +103596,7 @@ async function handleRuntimeWorkerRequest(request, service) {
     if (isTerminalStatus(job.execution.status) || !job.input || !job.bundleBase64)
       return refusal3("EXECUTION_NOT_RUNNABLE", 409);
     await service.store.setRunStatus(s2[3], "running");
-    return json2({
+    return json3({
       admission: job.execution.admission,
       input: job.input,
       bundleBase64: job.bundleBase64
@@ -102819,7 +103604,7 @@ async function handleRuntimeWorkerRequest(request, service) {
   }
   if (request.method === "POST" && s2[4] === "complete") {
     try {
-      const result = validatedResult(await body2(request, 3000000));
+      const result = validatedResult(await body3(request, 3000000));
       await service.store.mutate(s2[3], (j4) => {
         if (j4.execution.status === "cancelled")
           throw Error("Execution cancelled");
@@ -102849,7 +103634,7 @@ async function handleRuntimeWorkerRequest(request, service) {
         });
         latest.status = "terminal";
       });
-      return json2({ ok: true });
+      return json3({ ok: true });
     } catch {
       return refusal3("RUNTIME_COMPLETION_REJECTED", 409);
     }
@@ -102972,7 +103757,7 @@ var LEGACY_EXECUTION_RETIRED = "LEGACY_EXECUTION_RETIRED";
 var LEGACY_EXECUTION_GUIDANCE = "Unversioned runs have been retired. Publish and select a versioned executable, then use skills run <name>@<version> --target cloud.";
 
 // src/server/store.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 function recordFieldsOf(input, carriedBundle, carriedSkillMd) {
   return {
     slug: input.slug,
@@ -103015,6 +103800,7 @@ function instantiateStore(target, sqliteOptions) {
 
 class MemorySkillsStore {
   selectionStore = new MemorySkillSelectionStore;
+  executionGrantStore = new MemoryExecutionGrantStore;
   backend = { kind: "memory", durable: false, label: "memory (non-durable)" };
   apiKeys = new Map;
   runs = new Map;
@@ -103059,7 +103845,7 @@ class MemorySkillsStore {
       input: input.input,
       args: input.args,
       ...idemKey ? { idempotencyKey: idemKey } : {},
-      correlationId: randomUUID5(),
+      correlationId: randomUUID6(),
       costCents: 0,
       leaseGeneration: 0,
       createdAt: now
@@ -103108,11 +103894,11 @@ class MemorySkillsStore {
     return run ? [...this.logs.get(runId2) ?? []] : [];
   }
   async addArtifact(artifact) {
-    const next = { ...artifact, createdAt: nowIso() };
+    const next2 = { ...artifact, createdAt: nowIso() };
     const artifacts = this.artifacts.get(artifact.runId) ?? [];
-    artifacts.push(next);
+    artifacts.push(next2);
     this.artifacts.set(artifact.runId, artifacts);
-    return next;
+    return next2;
   }
   async listArtifacts(principal, runId2) {
     const run = await this.getRun(principal, runId2);
@@ -103218,15 +104004,15 @@ class MemorySkillsStore {
     if (latest.revisionId !== current.revisionId) {
       throw new SkillRevisionConflictError(slug, expectedRevisionId, latest.revisionId);
     }
-    const next = {
+    const next2 = {
       ...latest,
       ...patch,
       updatedAt: nowIso(),
       revisionId: revisionIdOfRecord({ ...latest, ...patch }),
       revisionNumber: latest.revisionNumber + 1
     };
-    this.skills.set(skillKey(principal.orgId, slug), next);
-    return next;
+    this.skills.set(skillKey(principal.orgId, slug), next2);
+    return next2;
   }
   async deleteSkill(principal, slug, tombstoneWindowMs) {
     const current = await this.getSkill(principal, slug);
@@ -103235,9 +104021,9 @@ class MemorySkillsStore {
     if (!current.tombstonedAt) {
       const tombstoned = nowIso();
       const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
-      const next = { ...current, tombstonedAt: tombstoned, tombstonePurgeAfter: purgeAfter, updatedAt: tombstoned };
-      this.skills.set(skillKey(principal.orgId, slug), next);
-      return next;
+      const next2 = { ...current, tombstonedAt: tombstoned, tombstonePurgeAfter: purgeAfter, updatedAt: tombstoned };
+      this.skills.set(skillKey(principal.orgId, slug), next2);
+      return next2;
     }
     return current;
   }
@@ -103309,9 +104095,9 @@ class MemorySkillsStore {
     const run = this.runs.get(runId2);
     if (!run)
       return null;
-    const next = { ...run, ...patch };
-    this.runs.set(runId2, next);
-    return next;
+    const next2 = { ...run, ...patch };
+    this.runs.set(runId2, next2);
+    return next2;
   }
 }
 function skillKey(orgId, slug) {
@@ -103328,6 +104114,9 @@ class PostgresSkillsStore {
   get selectionStore() {
     return new PostgresSkillSelectionStore(this.sql);
   }
+  get executionGrantStore() {
+    return new PostgresExecutionGrantStore(this.sql);
+  }
   backend = { kind: "postgres", durable: true, label: "postgres" };
   sql;
   constructor(databaseUrl) {
@@ -103427,7 +104216,7 @@ class PostgresSkillsStore {
       const id = runId();
       const rows = await tx`
         INSERT INTO skills_runs (id, org_id, user_id, skill_slug, requested_slug, status, input_json, args_json, idempotency_key, correlation_id)
-        VALUES (${id}, ${input.principal.orgId}, ${input.principal.userId}, ${input.slug}, ${input.slug}, ${"queued"}, ${JSON.stringify(input.input)}::jsonb, ${JSON.stringify(input.args)}::jsonb, ${input.idempotencyKey ?? null}, ${randomUUID5()})
+        VALUES (${id}, ${input.principal.orgId}, ${input.principal.userId}, ${input.slug}, ${input.slug}, ${"queued"}, ${JSON.stringify(input.input)}::jsonb, ${JSON.stringify(input.args)}::jsonb, ${input.idempotencyKey ?? null}, ${randomUUID6()})
         RETURNING *
       `;
       return rowToRun(rows[0]);
@@ -103733,14 +104522,14 @@ class PostgresSkillsStore {
     if (expectedRevisionId !== current.revisionId) {
       throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
     }
-    const next = { ...current, ...patch };
+    const next2 = { ...current, ...patch };
     return await this.sql.begin(async (tx) => {
-      const revisionId = revisionIdOfRecord(next);
+      const revisionId = revisionIdOfRecord(next2);
       const updated = await tx`
         UPDATE skills_registry
-        SET display_name = ${next.displayName}, description = ${next.description}, category = ${next.category},
-            tags_json = ${JSON.stringify(next.tags)}::jsonb, kind = ${next.kind}, version = ${next.version ?? null},
-            skill_md = ${next.skillMd ?? null}, revision_id = ${revisionId}, revision_number = revision_number + 1, updated_at = now()
+        SET display_name = ${next2.displayName}, description = ${next2.description}, category = ${next2.category},
+            tags_json = ${JSON.stringify(next2.tags)}::jsonb, kind = ${next2.kind}, version = ${next2.version ?? null},
+            skill_md = ${next2.skillMd ?? null}, revision_id = ${revisionId}, revision_number = revision_number + 1, updated_at = now()
         WHERE org_id = ${principal.orgId} AND slug = ${slug} AND tombstoned_at IS NULL AND revision_id = ${current.revisionId}
         RETURNING *
       `;
@@ -103755,7 +104544,7 @@ class PostgresSkillsStore {
         return null;
       }
       await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${slug}`;
-      for (const tag of next.tags) {
+      for (const tag of next2.tags) {
         if (!tag.trim())
           continue;
         await tx`
@@ -103961,40 +104750,40 @@ async function createSkillsFetchHandler(options = {}) {
       if (callback)
         return callback;
       if (request.method === "GET" && url.pathname === "/health") {
-        return json3({ ok: true, service: "skills", time: new Date().toISOString() });
+        return json4({ ok: true, service: "skills", time: new Date().toISOString() });
       }
       if (request.method === "GET" && url.pathname === "/ready") {
-        return json3({ ok: true, service: "skills" });
+        return json4({ ok: true, service: "skills" });
       }
       if (request.method === "GET" && url.pathname === "/version") {
-        return json3({ ok: true, service: "skills", version: package_default.version });
+        return json4({ ok: true, service: "skills", version: package_default.version });
       }
       if (url.pathname.startsWith("/api/")) {
         const principal = await authenticateRequest(store, request);
         if (!principal)
-          return json3({ error: "authentication required", code: "AUTH_REQUIRED" }, { status: 401 });
+          return json4({ error: "authentication required", code: "AUTH_REQUIRED" }, { status: 401 });
         const execution = await handleRuntimeApiRequest(request, principal, runtime);
         if (execution)
           return execution;
         if (request.method === "GET" && url.pathname === "/api/v1/capabilities") {
           const response = await handleProfileApi(store, principal, request, ["capabilities"], config);
           const payload = await response.json();
-          return json3({ ...payload, cloudExecution: Boolean(runtime), capabilities: [...payload.capabilities, ...runtime ? ["skills.cloud-execution"] : []] });
+          return json4({ ...payload, cloudExecution: Boolean(runtime), capabilities: [...payload.capabilities, ...runtime ? ["skills.cloud-execution"] : []] });
         }
         if (request.method === "GET" && url.pathname === "/api/auth/whoami") {
-          return json3(identityPayload(principal));
+          return json4(identityPayload(principal));
         }
         if (segments[0] === "api" && segments[1] === "v1") {
           return await handleApiV1(store, governanceStore, principal, request, segments.slice(2), config, artifactStorage);
         }
       }
-      return json3({ error: "not found", code: "NOT_FOUND" }, { status: 404 });
+      return json4({ error: "not found", code: "NOT_FOUND" }, { status: 404 });
     } catch (error) {
       if (error instanceof SkillRequestError) {
-        return json3({ error: error.message, code: error.code }, { status: error.status });
+        return json4({ error: error.message, code: error.code }, { status: error.status });
       }
       if (error instanceof SkillVersionExistsError) {
-        return json3({
+        return json4({
           error: error.message,
           code: "SKILL_VERSION_EXISTS",
           slug: error.slug,
@@ -104004,14 +104793,14 @@ async function createSkillsFetchHandler(options = {}) {
         }, { status: 409 });
       }
       if (error instanceof SkillRevisionConflictError) {
-        return json3({
+        return json4({
           error: error.message,
           code: "REVISION_CONFLICT",
           slug: error.slug,
           ...error.currentRevisionId ? { currentRevisionId: error.currentRevisionId } : {}
         }, { status: 409 });
       }
-      return json3({ error: "internal server error", detail: error.message }, { status: 500 });
+      return json4({ error: "internal server error", detail: error.message }, { status: 500 });
     }
   };
   let closed = false;
@@ -104039,11 +104828,14 @@ var BODY_LIMIT_HEADROOM_BYTES = 1e6;
 async function handleApiV1(store, governanceStore, principal, request, parts, config, artifactStorage) {
   const [resource, id, subresource, childId] = parts;
   if (parts.some(segmentEscapesPath)) {
-    return json3({ error: "invalid path segment", code: "INVALID_PATH" }, { status: 400 });
+    return json4({ error: "invalid path segment", code: "INVALID_PATH" }, { status: 400 });
   }
   if (!permitsSkillsRoute(principal, request.method, resource ?? "")) {
-    return json3({ error: "The API key does not allow this operation", code: "INSUFFICIENT_SCOPE" }, { status: 403 });
+    return json4({ error: "The API key does not allow this operation", code: "INSUFFICIENT_SCOPE" }, { status: 403 });
   }
+  const grantResponse = await handleExecutionGrantApi(store, principal, request, parts, config, artifactStorage);
+  if (grantResponse)
+    return grantResponse;
   const profileResponse = await handleProfileApi(store, principal, request, parts, config);
   if (profileResponse)
     return profileResponse;
@@ -104051,30 +104843,30 @@ async function handleApiV1(store, governanceStore, principal, request, parts, co
     if (request.method === "GET" && !id) {
       const tag = new URL(request.url).searchParams.get("tag");
       if (tag !== null && tag !== "")
-        return json3(await listMergedSkillsByTag(store, principal, tag));
-      return json3(await listMergedSkills(store, principal));
+        return json4(await listMergedSkillsByTag(store, principal, tag));
+      return json4(await listMergedSkills(store, principal));
     }
     if (request.method === "POST" && !id) {
       const expectedRevisionId = parseIfMatch(request.headers.get("if-match"));
       const parsed = await parsePublishRequest(request, config);
       const { record, alreadyPublished } = await storePublishedSkill(store, artifactStorage, principal, parsed, expectedRevisionId);
-      return json3(publishedPayload(record, { alreadyPublished }), { status: 201, headers: { ETag: revisionEtag(record.revisionId) } });
+      return json4(publishedPayload(record, { alreadyPublished }), { status: 201, headers: { ETag: revisionEtag(record.revisionId) } });
     }
     if (request.method === "GET" && id && subresource === "skill.md") {
       const resolved = await resolvePublishedSkill(store, artifactStorage, principal, id);
       if (resolved.kind === "tombstone") {
-        return json3({ error: "skill was deleted", ...resolved.payload }, { status: 410 });
+        return json4({ error: "skill was deleted", ...resolved.payload }, { status: 410 });
       }
       const docs = await getMergedSkillMd(store, artifactStorage, principal, id);
-      return docs ? new Response(docs, { headers: { "Content-Type": "text/markdown; charset=utf-8", "Cache-Control": "no-store" } }) : json3({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+      return docs ? new Response(docs, { headers: { "Content-Type": "text/markdown; charset=utf-8", "Cache-Control": "no-store" } }) : json4({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
     }
     if (request.method === "GET" && id && subresource === "versions" && !childId) {
-      return json3(await listSkillVersionsPayload(store, principal, id));
+      return json4(await listSkillVersionsPayload(store, principal, id));
     }
     if (request.method === "GET" && id && subresource === "versions" && childId && !parts[4]) {
       const version2 = await readSkillVersion(store, principal, id, childId);
       const current = (await store.getSkill(principal, id))?.bundleSha256;
-      return json3(skillVersionPayload(version2, current));
+      return json4(skillVersionPayload(version2, current));
     }
     if (request.method === "GET" && id && subresource === "versions" && childId && parts[4] === "bundle" && !parts[5]) {
       const { version: version2, bytes } = await readSkillVersionBundle(store, artifactStorage, principal, id, childId);
@@ -104094,10 +104886,10 @@ async function handleApiV1(store, governanceStore, principal, request, parts, co
     if (request.method === "GET" && id && subresource === "bundle") {
       const resolved = await resolvePublishedSkill(store, artifactStorage, principal, id);
       if (resolved.kind === "tombstone") {
-        return json3({ error: "skill was deleted", ...resolved.payload }, { status: 410 });
+        return json4({ error: "skill was deleted", ...resolved.payload }, { status: 410 });
       }
       if (resolved.kind === "absent") {
-        return json3({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+        return json4({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
       }
       const { record, bytes } = await readPublishedBundle(store, artifactStorage, principal, id);
       const headers = {
@@ -104118,90 +104910,90 @@ async function handleApiV1(store, governanceStore, principal, request, parts, co
     if (request.method === "GET" && id && !subresource) {
       const resolved = await resolvePublishedSkill(store, artifactStorage, principal, id);
       if (resolved.kind === "tombstone") {
-        return json3({ error: "skill was deleted", ...resolved.payload }, { status: 410 });
+        return json4({ error: "skill was deleted", ...resolved.payload }, { status: 410 });
       }
       if (resolved.kind === "published") {
-        return json3(publishedPayload(resolved.record), { headers: { ETag: revisionEtag(resolved.record.revisionId) } });
+        return json4(publishedPayload(resolved.record), { headers: { ETag: revisionEtag(resolved.record.revisionId) } });
       }
       const skill = await getMergedSkill(store, artifactStorage, principal, id);
-      return skill ? json3(skill) : json3({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+      return skill ? json4(skill) : json4({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
     }
     if ((request.method === "PUT" || request.method === "PATCH") && id && !subresource) {
       const expectedRevisionId = parseIfMatch(request.headers.get("if-match"));
-      const body3 = await readJson(request, config.requestBodyLimitBytes);
-      const updated = await store.updateSkill(principal, id, skillPatch(body3), expectedRevisionId);
-      return updated ? json3(publishedPayload(updated), { headers: { ETag: revisionEtag(updated.revisionId) } }) : json3({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+      const body4 = await readJson(request, config.requestBodyLimitBytes);
+      const updated = await store.updateSkill(principal, id, skillPatch(body4), expectedRevisionId);
+      return updated ? json4(publishedPayload(updated), { headers: { ETag: revisionEtag(updated.revisionId) } }) : json4({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
     }
     if (request.method === "DELETE" && id && !subresource) {
       const removed = await deletePublishedSkill(store, artifactStorage, principal, id, config.tombstoneWindowMs);
-      return removed ? json3({
+      return removed ? json4({
         deleted: true,
         slug: id,
         ...removed.tombstonedAt ? { tombstonedAt: removed.tombstonedAt, tombstonePurgeAfter: removed.tombstonePurgeAfter } : {}
-      }) : json3({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+      }) : json4({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
     }
   }
   if (resource === "pins") {
     if (request.method === "GET" && !id) {
       const tag = new URL(request.url).searchParams.get("tag");
       if (tag !== null && tag !== "")
-        return json3(await listPinsByTag(store, principal, tag));
-      return json3((await store.listPins(principal)).map(pinPayload));
+        return json4(await listPinsByTag(store, principal, tag));
+      return json4((await store.listPins(principal)).map(pinPayload));
     }
     if (request.method === "PUT" && id && !subresource) {
       assertPublishableSlug(id);
-      const body3 = await readJson(request, config.requestBodyLimitBytes);
-      const pin = await store.pinSkill(principal, id, pinMetadataField(body3));
-      return json3(pinPayload(pin));
+      const body4 = await readJson(request, config.requestBodyLimitBytes);
+      const pin = await store.pinSkill(principal, id, pinMetadataField(body4));
+      return json4(pinPayload(pin));
     }
     if (request.method === "DELETE" && id && !subresource) {
       assertPublishableSlug(id);
       const removed = await store.unpinSkill(principal, id);
-      return removed ? json3({ deleted: true, slug: id }) : json3({ error: "pin not found", code: "PIN_NOT_FOUND" }, { status: 404 });
+      return removed ? json4({ deleted: true, slug: id }) : json4({ error: "pin not found", code: "PIN_NOT_FOUND" }, { status: 404 });
     }
   }
   if (resource === "tags") {
     if (request.method === "GET" && !id) {
-      return json3(await listOrgTags(store, principal));
+      return json4(await listOrgTags(store, principal));
     }
     if (request.method === "GET" && id && subresource === "skills") {
-      return json3((await listMergedSkillsByTag(store, principal, id)).map(skillSummary));
+      return json4((await listMergedSkillsByTag(store, principal, id)).map(skillSummary));
     }
   }
   if (resource === "runs") {
     if (request.method === "GET" && !id) {
       const limit = clampInt(new URL(request.url).searchParams.get("limit"), 20, 100);
-      return json3((await store.listRuns(principal, limit)).map(runPayload));
+      return json4((await store.listRuns(principal, limit)).map(runPayload));
     }
     if (request.method === "POST" && id && !subresource) {
-      return json3({ error: LEGACY_EXECUTION_GUIDANCE, code: LEGACY_EXECUTION_RETIRED }, { status: 410 });
+      return json4({ error: LEGACY_EXECUTION_GUIDANCE, code: LEGACY_EXECUTION_RETIRED }, { status: 410 });
     }
     if (request.method === "GET" && id && !subresource) {
       const run = await store.getRun(principal, id);
-      return run ? json3(runPayload(run)) : json3({ error: "run not found", code: "RUN_NOT_FOUND" }, { status: 404 });
+      return run ? json4(runPayload(run)) : json4({ error: "run not found", code: "RUN_NOT_FOUND" }, { status: 404 });
     }
     if (request.method === "GET" && id && subresource === "logs") {
       const run = await store.getRun(principal, id);
       if (!run)
-        return json3({ error: "run not found", code: "RUN_NOT_FOUND" }, { status: 404 });
-      return json3(await store.listLogs(principal, id));
+        return json4({ error: "run not found", code: "RUN_NOT_FOUND" }, { status: 404 });
+      return json4(await store.listLogs(principal, id));
     }
     if (request.method === "GET" && id && subresource === "artifacts" && !childId) {
       const run = await store.getRun(principal, id);
       if (!run)
-        return json3({ error: "run not found", code: "RUN_NOT_FOUND" }, { status: 404 });
+        return json4({ error: "run not found", code: "RUN_NOT_FOUND" }, { status: 404 });
       const artifacts = await store.listArtifacts(principal, id);
-      return json3(artifacts.map(({ bodyText, ...artifact }) => artifact));
+      return json4(artifacts.map(({ bodyText, ...artifact }) => artifact));
     }
     if (request.method === "GET" && id && subresource === "artifacts" && childId) {
       const artifact = await store.getArtifact(principal, id, childId);
       if (!artifact)
-        return json3({ error: "artifact not found", code: "ARTIFACT_NOT_FOUND" }, { status: 404 });
-      const body3 = await artifactStorage.readText(artifact);
-      if (body3 === null) {
-        return json3({ error: "artifact storage backend unavailable", code: "ARTIFACT_BACKEND_UNAVAILABLE" }, { status: 503 });
+        return json4({ error: "artifact not found", code: "ARTIFACT_NOT_FOUND" }, { status: 404 });
+      const body4 = await artifactStorage.readText(artifact);
+      if (body4 === null) {
+        return json4({ error: "artifact storage backend unavailable", code: "ARTIFACT_BACKEND_UNAVAILABLE" }, { status: 503 });
       }
-      return new Response(body3, {
+      return new Response(body4, {
         headers: {
           "Content-Type": artifact.contentType,
           "Content-Disposition": `attachment; filename="${artifact.fileName.replace(/"/g, "")}"`
@@ -104211,22 +105003,22 @@ async function handleApiV1(store, governanceStore, principal, request, parts, co
     if (request.method === "POST" && id && subresource === "cancel") {
       const run = await store.getRun(principal, id);
       if (!run)
-        return json3({ error: "run not found", code: "RUN_NOT_FOUND" }, { status: 404 });
+        return json4({ error: "run not found", code: "RUN_NOT_FOUND" }, { status: 404 });
       try {
         const outcome = await createCancelService({ store, governanceStore, storage: artifactStorage }).cancel(principal, id, principal.email);
-        return json3(runPayload(outcome.run));
+        return json4(runPayload(outcome.run));
       } catch (error) {
         if (error instanceof GovernanceError && error.code === GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION) {
-          return json3({ error: error.message, code: error.code }, { status: 409 });
+          return json4({ error: error.message, code: error.code }, { status: 409 });
         }
         if (error instanceof StaleLeaseGenerationError) {
-          return json3({ error: error.message, code: GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION }, { status: 409 });
+          return json4({ error: error.message, code: GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION }, { status: 409 });
         }
         throw error;
       }
     }
   }
-  return json3({ error: "not found", code: "NOT_FOUND" }, { status: 404 });
+  return json4({ error: "not found", code: "NOT_FOUND" }, { status: 404 });
 }
 function identityPayload(principal) {
   return {
@@ -104252,22 +105044,22 @@ function runPayload(run) {
     ...run.errorMessage ? { errorMessage: run.errorMessage, error: run.errorMessage } : {}
   };
 }
-function skillPatch(body3) {
+function skillPatch(body4) {
   const patch = {};
-  if (typeof body3.displayName === "string")
-    patch.displayName = body3.displayName;
-  if (typeof body3.description === "string")
-    patch.description = body3.description;
-  if (typeof body3.category === "string")
-    patch.category = body3.category;
-  if (Array.isArray(body3.tags))
-    patch.tags = body3.tags.filter((tag) => typeof tag === "string");
-  if (typeof body3.version === "string")
-    patch.version = body3.version;
-  if (typeof body3.skillMd === "string")
-    patch.skillMd = body3.skillMd;
-  if (body3.kind === "executable" || body3.kind === "instruction")
-    patch.kind = body3.kind;
+  if (typeof body4.displayName === "string")
+    patch.displayName = body4.displayName;
+  if (typeof body4.description === "string")
+    patch.description = body4.description;
+  if (typeof body4.category === "string")
+    patch.category = body4.category;
+  if (Array.isArray(body4.tags))
+    patch.tags = body4.tags.filter((tag) => typeof tag === "string");
+  if (typeof body4.version === "string")
+    patch.version = body4.version;
+  if (typeof body4.skillMd === "string")
+    patch.skillMd = body4.skillMd;
+  if (body4.kind === "executable" || body4.kind === "instruction")
+    patch.kind = body4.kind;
   return patch;
 }
 async function readJson(request, limitBytes) {
@@ -104295,7 +105087,7 @@ function decodeSegment(segment) {
 function segmentEscapesPath(segment) {
   return segment.includes("/") || segment.includes("\\") || segment.includes("..");
 }
-function json3(payload, init = {}) {
+function json4(payload, init = {}) {
   return Response.json(payload, {
     ...init,
     headers: { "Cache-Control": "no-store", ...init.headers }