@hasna/skills 0.8.9 → 0.8.10

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.8.9",
+    version: "0.8.10",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -20057,6 +20057,7 @@ var init_package = __esm(() => {
       "bin/",
       "migrations/",
       "docs/skill-standard.md",
+      "docs/plugin-admission.md",
       "schemas/",
       "LICENSE",
       "README.md",
@@ -39811,7 +39812,18 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode !== "path-bytes" || source.sha256 !== null));
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "claude-plugin-registry") {
+        requireBound(agent === "claude");
+        const managed = array3(source.managedPlugins, 64);
+        requireBound(managed.length > 0);
+        for (const entry of managed) {
+          requireBound(object4(entry) && Object.keys(entry).every((key) => ["bindingId", "storeRoot"].includes(key)));
+          text(entry.storeRoot);
+          requireBound(typeof entry.bindingId === "string" && /^[a-f0-9]{64}$/.test(entry.bindingId));
+        }
+      } else
+        requireBound(source.managedPlugins === undefined);
       if (source.format !== undefined)
         requireBound(["json", "toml", "yaml"].includes(source.format));
       if (source.fields !== undefined)
@@ -40036,10 +40048,10 @@ class HttpProfileClient {
     this.origin = normalizeSkillsApiOrigin(origin);
     this.authority = skillsApiRequestUrl(this.origin, "/api/v1/").replace(/\/+$/, "");
   }
-  async request(path, init = {}) {
+  async requestRoute(route, init = {}) {
     let response;
     try {
-      response = await fetch(skillsApiRequestUrl(this.origin, `/api/v1${path}`), {
+      response = await fetch(skillsApiRequestUrl(this.origin, route), {
         ...init,
         redirect: "error",
         credentials: "omit",
@@ -40060,6 +40072,9 @@ class HttpProfileClient {
     }
     return response;
   }
+  request(path, init = {}) {
+    return this.requestRoute(`/api/v1${path}`, init);
+  }
   async read(response, limit = MAX_PROFILE_DOCUMENT_BYTES) {
     try {
       return JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, limit)));
@@ -40085,6 +40100,12 @@ class HttpProfileClient {
       invalid();
     return result;
   }
+  async resolvePrincipal() {
+    const result = await this.read(await this.requestRoute("/api/auth/whoami"), 16 * 1024);
+    if (!object5(result) || Object.keys(result).sort().join(",") !== "organization,user" || !object5(result.user) || Object.keys(result.user).sort().join(",") !== "email,id,role" || !object5(result.organization) || Object.keys(result.organization).sort().join(",") !== "id,name,slug" || !identifier(result.user.id) || typeof result.user.email !== "string" || !result.user.email.trim() || !["owner", "admin", "member", "viewer"].includes(String(result.user.role)) || !identifier(result.organization.id) || !identifier(result.organization.slug) || typeof result.organization.name !== "string" || !result.organization.name.trim())
+      invalid();
+    return { userId: result.user.id, accountId: result.organization.id, role: result.user.role };
+  }
   async recordStation(id, input2) {
     if (!identifier(id) || !identifier(input2.profileId) || !identifier(input2.profileRevision) || !Array.isArray(input2.selections) || input2.selections.length > MAX_PROFILE_SELECTIONS)
       throw new Error("Invalid station state");
@@ -47371,6 +47392,66 @@ var init_agent_discovery_path_bytes = __esm(() => {
   init_agent_discovery_bytes();
 });
 
+// src/lib/plugin-projection.ts
+var PLUGIN_PROJECTION_LIMITS;
+var init_plugin_projection = __esm(() => {
+  init_selection_cache();
+  PLUGIN_PROJECTION_LIMITS = Object.freeze({ files: 1024, bytes: 64 * 1024 * 1024, fileBytes: 16 * 1024 * 1024, metadataBytes: 512 * 1024, registrations: 64, history: 128 });
+});
+
+// src/lib/plugin-projection-store.ts
+import { constants as constants5, closeSync as closeSync8, fchmodSync, fstatSync as fstatSync8, fsyncSync, linkSync, lstatSync as lstatSync8, mkdirSync as mkdirSync6, openSync as openSync8, opendirSync, readSync as readSync4, renameSync as renameSync3, rmdirSync as rmdirSync2, rmSync as rmSync2, unlinkSync as unlinkSync3, writeSync as writeSync2 } from "fs";
+var READ_FLAGS, WRITE_FLAGS;
+var init_plugin_projection_store = __esm(() => {
+  init_plugin_projection();
+  READ_FLAGS = constants5.O_RDONLY | constants5.O_NOFOLLOW | constants5.O_NONBLOCK;
+  WRITE_FLAGS = constants5.O_WRONLY | constants5.O_CREAT | constants5.O_EXCL | constants5.O_NOFOLLOW | constants5.O_NONBLOCK;
+});
+
+// src/lib/selected-manifest.ts
+function jsonEntry(entries, path) {
+  const entry = entries.find((candidate) => candidate.path === path);
+  if (!entry)
+    return {};
+  try {
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(entry.bytes));
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new Error;
+    return value;
+  } catch {
+    throw new SkillSelectionError("INVALID_SKILL_MANIFEST", "The selected skill has an invalid execution manifest.");
+  }
+}
+function describeEntries(entries) {
+  const manifest = jsonEntry(entries, "skill.json"), packageJson = jsonEntry(entries, "package.json");
+  const docs = entries.find((entry) => entry.path === "SKILL.md");
+  const frontmatter = docs ? parseSkillFrontmatter(new TextDecoder().decode(docs.bytes)) : null;
+  const kind = frontmatter?.kind === "instruction" || manifest.kind === "instruction" || packageJson.skills?.kind === "instruction" ? "instruction" : "executable";
+  return { kind, manifest, packageJson };
+}
+var init_selected_manifest = __esm(() => {
+  init_skill_validation();
+  init_selection_cache();
+});
+
+// src/lib/plugin-admission.ts
+var init_plugin_admission = __esm(() => {
+  init_profile_client();
+  init_skill_bundle();
+  init_selection_cache();
+  init_selection_resolver();
+  init_plugin_projection();
+  init_plugin_projection_store();
+  init_selected_manifest();
+});
+
+// src/lib/plugin-discovery.ts
+var init_plugin_discovery = __esm(() => {
+  init_plugin_admission();
+  init_plugin_projection();
+  init_plugin_projection_store();
+});
+
 // src/lib/agent-discovery.ts
 var init_agent_discovery = __esm(() => {
   init_agent_policy_limits();
@@ -47378,6 +47459,8 @@ var init_agent_discovery = __esm(() => {
   init_agent_discovery_directories();
   init_agent_discovery_bytes();
   init_agent_discovery_path_bytes();
+  init_plugin_discovery();
+  init_plugin_admission();
   init_agent_discovery_directories();
 });
 
@@ -47418,7 +47501,7 @@ function normalizeSkillName(name) {
 }
 
 // src/lib/project-state.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "fs";
 import { join as join16 } from "path";
 function getProjectStateDir(targetDir = process.cwd()) {
   return join16(targetDir, SKILLS_PROJECT_DIR);
@@ -47452,7 +47535,7 @@ function ensureProjectConfig(targetDir = process.cwd()) {
 }
 function saveProjectConfig(config2, targetDir = process.cwd()) {
   const dir = getProjectStateDir(targetDir);
-  mkdirSync6(dir, { recursive: true });
+  mkdirSync7(dir, { recursive: true });
   const normalized = normalizeProjectConfig({ ...config2, updatedAt: new Date().toISOString() });
   writeFileSync5(getProjectConfigPath(targetDir), JSON.stringify(normalized, null, 2) + `
 `);
@@ -47539,7 +47622,7 @@ var init_project_state = __esm(() => {
 });
 
 // src/lib/installer.ts
-import { existsSync as existsSync11, readFileSync as readFileSync13, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync13, rmSync as rmSync3 } from "fs";
 import { join as join17 } from "path";
 import { homedir as homedir2 } from "os";
 function getSkillPath(name) {
@@ -48877,7 +48960,7 @@ var init_remote_workspace_leave = __esm(() => {
 });
 
 // src/lib/auth-store.ts
-import { chmodSync, existsSync as existsSync13, mkdirSync as mkdirSync7, readFileSync as readFileSync15, renameSync as renameSync3, statSync as statSync8, unlinkSync as unlinkSync3, writeFileSync as writeFileSync6 } from "fs";
+import { chmodSync, existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync15, renameSync as renameSync4, statSync as statSync8, unlinkSync as unlinkSync4, writeFileSync as writeFileSync6 } from "fs";
 import { basename as basename4, dirname as dirname6, join as join19 } from "path";
 function getAuthFilePath(env = process.env) {
   return skillsCredentialFilePath(env);
@@ -49135,6 +49218,61 @@ var init_remote_quote_errors = __esm(() => {
   });
 });
 
+// src/lib/remote-permissions.ts
+function parseSkillsAccess(value) {
+  if (value === undefined)
+    return {};
+  if (!record7(value))
+    throw new Error("Invalid Skills permission contract");
+  const result = {};
+  if (value.scopes !== undefined) {
+    if (!Array.isArray(value.scopes) || value.scopes.length > 256 || value.scopes.some((scope) => typeof scope !== "string" || scope.length > 128 || !/^(?:\*|[a-z][a-z0-9.-]*:[a-z0-9.*-]+)$/.test(scope)))
+      throw new Error("Invalid Skills scope contract");
+    result.scopes = [...value.scopes];
+  }
+  if (value.permissions !== undefined) {
+    if (!record7(value.permissions))
+      throw new Error("Invalid Skills permission contract");
+    result.permissions = {};
+    for (const name of permissionNames) {
+      const permission = value.permissions[name];
+      if (permission === undefined)
+        continue;
+      if (typeof permission !== "boolean")
+        throw new Error("Invalid Skills permission contract");
+      result.permissions[name] = permission;
+    }
+  }
+  return result;
+}
+function assertSkillsPermission(access, permission) {
+  if (access.permissions?.[permission] === false)
+    throw new RemoteSkillsPermissionError(permission);
+}
+var permissionNames, record7 = (value) => value !== null && typeof value === "object" && !Array.isArray(value), RemoteSkillsPermissionError;
+var init_remote_permissions = __esm(() => {
+  permissionNames = [
+    "read",
+    "publish",
+    "profilesWrite",
+    "stationStateWrite",
+    "cloudSubmit",
+    "executionGrantsRead",
+    "executionGrantsWrite",
+    "executionGrantsResolve"
+  ];
+  RemoteSkillsPermissionError = class RemoteSkillsPermissionError extends Error {
+    permission;
+    code = "SKILLS_PERMISSION_DENIED";
+    status = 403;
+    constructor(permission) {
+      super(`The current Skills credential cannot ${permission === "publish" ? "publish skills" : "write shared profiles"}. ` + "Workspace role does not override credential permissions. Ask the workspace administrator to authorize this credential, " + "then check skills auth whoami or skills capabilities. This write request was not sent.");
+      this.permission = permission;
+      this.name = "RemoteSkillsPermissionError";
+    }
+  };
+});
+
 // src/lib/remote-client.ts
 var exports_remote_client = {};
 __export(exports_remote_client, {
@@ -49253,15 +49391,23 @@ class RemoteSkillsClient {
     }, { quoteRefusal: true });
     return parseRemoteRunQuote(await response.json());
   }
-  getCapabilities() {
-    if (!this.capabilities)
+  getCapabilities(options = {}) {
+    if (!this.capabilities || options.refresh)
       this.capabilities = (async () => {
-        const value = await (await this.requestNewRoute("/api/v1/capabilities")).json();
+        const response = await this.requestNewRoute("/api/v1/capabilities");
+        let value;
+        try {
+          value = await response.json();
+          if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error;
+        } catch {
+          throw new Error("Invalid Skills capability response");
+        }
         if (value.contractVersion !== 1 || value.apiVersion !== 1 || !Array.isArray(value.capabilities) || value.capabilities.some((item) => typeof item !== "string"))
           throw new Error("Unsupported Skills server capability contract");
         const billing = value.billing;
         const recurringConsents = parseRecurringCapability(value.recurringConsents);
-        return { contractVersion: 1, apiVersion: 1, capabilities: value.capabilities, ...billing ? { billing } : {}, ...recurringConsents ? { recurringConsents } : {} };
+        return { contractVersion: 1, apiVersion: 1, capabilities: value.capabilities, ...parseSkillsAccess(value), ...billing ? { billing } : {}, ...recurringConsents ? { recurringConsents } : {} };
       })();
     return this.capabilities;
   }
@@ -49728,6 +49874,12 @@ class RemoteSkillsClient {
     }
   }
   async publishSkill(manifest, bundle, ifMatch) {
+    try {
+      assertSkillsPermission(await this.getCapabilities({ refresh: true }), "publish");
+    } catch (error61) {
+      if (!(error61 instanceof RemoteRouteUnsupportedError))
+        throw error61;
+    }
     const form = new FormData;
     form.set("manifest", JSON.stringify(manifest));
     if (bundle) {
@@ -49822,13 +49974,13 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record7, field) {
-  if (record7[field] === undefined)
+function requireOptionalString(record8, field) {
+  if (record8[field] === undefined)
     return;
-  if (typeof record7[field] !== "string") {
+  if (typeof record8[field] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field} must be a string when present)`);
   }
-  return record7[field];
+  return record8[field];
 }
 function isVersionRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -49850,19 +50002,19 @@ function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record7 = entry;
-  const slug2 = typeof record7.slug === "string" && record7.slug.trim() ? record7.slug.trim() : undefined;
+  const record8 = entry;
+  const slug2 = typeof record8.slug === "string" && record8.slug.trim() ? record8.slug.trim() : undefined;
   if (!slug2) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record7.metadata !== undefined) {
-    if (!record7.metadata || typeof record7.metadata !== "object" || Array.isArray(record7.metadata)) {
+  if (record8.metadata !== undefined) {
+    if (!record8.metadata || typeof record8.metadata !== "object" || Array.isArray(record8.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record7.metadata;
+    metadata = record8.metadata;
   }
-  const pinnedAt = requireOptionalString(record7, "pinnedAt");
+  const pinnedAt = requireOptionalString(record8, "pinnedAt");
   return {
     slug: slug2,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -49879,16 +50031,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record7 = entry;
-  const slug2 = typeof record7.slug === "string" && record7.slug.trim() ? record7.slug.trim() : undefined;
+  const record8 = entry;
+  const slug2 = typeof record8.slug === "string" && record8.slug.trim() ? record8.slug.trim() : undefined;
   if (!slug2) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug: slug2,
-    ...requireOptionalString(record7, "name") !== undefined ? { name: requireOptionalString(record7, "name") } : {},
-    ...requireOptionalString(record7, "version") !== undefined ? { version: requireOptionalString(record7, "version") } : {},
-    ...requireOptionalString(record7, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record7, "updatedAt") } : {}
+    ...requireOptionalString(record8, "name") !== undefined ? { name: requireOptionalString(record8, "name") } : {},
+    ...requireOptionalString(record8, "version") !== undefined ? { version: requireOptionalString(record8, "version") } : {},
+    ...requireOptionalString(record8, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record8, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -49941,12 +50093,12 @@ function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record7 = payload;
-  if (!Array.isArray(record7.skills)) {
+  const record8 = payload;
+  if (!Array.isArray(record8.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record7.skills.map(normalizeSkillSummary);
-  const nextCursor = record7.nextCursor === undefined || record7.nextCursor === null ? null : record7.nextCursor;
+  const skills = record8.skills.map(normalizeSkillSummary);
+  const nextCursor = record8.nextCursor === undefined || record8.nextCursor === null ? null : record8.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -49972,6 +50124,7 @@ var init_remote_client = __esm(() => {
   init_remote_account();
   init_remote_files();
   init_remote_quote_errors();
+  init_remote_permissions();
   RemoteRouteUnsupportedError = class RemoteRouteUnsupportedError extends Error {
     path;
     status;
@@ -50041,7 +50194,7 @@ function invitationEmailIds(invitationId, challengeId) {
 }
 function invitationEmailInput(action, input2) {
   const keys = ["invitationId", "token", "challengeId", "confirm", ...action === "accept" ? ["code"] : []];
-  if (!record7(input2) || Object.keys(input2).length !== keys.length || keys.some((key) => !Object.hasOwn(input2, key)))
+  if (!record8(input2) || Object.keys(input2).length !== keys.length || keys.some((key) => !Object.hasOwn(input2, key)))
     throw new InvitationEmailInputError;
   const value = { ...input2 };
   const ids = invitationEmailIds(value.invitationId, value.challengeId);
@@ -50070,12 +50223,12 @@ async function requestInvitationEmail(origin, action, input2) {
       signal: AbortSignal.timeout(15000)
     });
     const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 4096)));
-    if (!response.ok && record7(parsed) && typeof parsed.code === "string" && Object.hasOwn(refusals, parsed.code)) {
+    if (!response.ok && record8(parsed) && typeof parsed.code === "string" && Object.hasOwn(refusals, parsed.code)) {
       const code = parsed.code;
       if (response.status === refusals[code][0])
         throw new RemoteInvitationEmailError(code);
     }
-    if (!record7(parsed))
+    if (!record8(parsed))
       throw new RemoteInvitationEmailUnconfirmedError(action);
     if (action === "challenge" && response.status === 202 && parsed.challengeId === value.challengeId && parsed.expiresIn === 600 && typeof parsed.message === "string" && parsed.message.length <= 256) {
       return { challengeId: value.challengeId, message: "If this invitation is eligible, a verification code will arrive. Delivery is not confirmed.", expiresIn: 600 };
@@ -50094,7 +50247,7 @@ function invitationEmailCustomerError(error61) {
     return { code: error61.code, error: error61.message };
   return { code: "INVITATION_EMAIL_UNAVAILABLE", error: "Unable to prepare this recovery action. Check the explicit server and stable profile. No credential was saved." };
 }
-var InvitationEmailInputError, refusals, RemoteInvitationEmailError, RemoteInvitationEmailUnconfirmedError, record7 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid11 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
+var InvitationEmailInputError, refusals, RemoteInvitationEmailError, RemoteInvitationEmailUnconfirmedError, record8 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid11 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
 var init_remote_invitation_recovery = __esm(() => {
   init_fleet_credentials();
   init_remote_files();
@@ -50141,7 +50294,7 @@ function checkedPublicationDeclaration(value) {
     return bad();
   try {
     const manifest = JSON.parse(value.manifestText);
-    if (!record8(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash3(manifest.provenance?.content_hash))
+    if (!record9(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash3(manifest.provenance?.content_hash))
       return bad();
   } catch {
     return bad();
@@ -50199,7 +50352,7 @@ async function boundedJson(url2, init, token, mutation, budget2 = 15000, signal)
         return invalid4();
       }
       if (!response.ok) {
-        const code = record8(body) && typeof body.code === "string" && Object.hasOwn(failures2, body.code) ? body.code : null;
+        const code = record9(body) && typeof body.code === "string" && Object.hasOwn(failures2, body.code) ? body.code : null;
         if (code && failures2[code][0] === response.status)
           throw new PrivatePublicationError(code, failures2[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
         throw new PrivatePublicationError("PUBLICATION_REQUEST_FAILED", "The publication request was refused. Inspect its status before retrying.", mutation && response.status >= 500, response.status);
@@ -50254,8 +50407,8 @@ class RemotePrivatePublicationsClient {
     if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
       return bad();
     const response = await boundedJson(skillsApiRequestUrl(this.apiOrigin, "/api/v1/capabilities"), {}, this.#token, false, options.timeoutMs, options.signal);
-    const p = record8(response) && response.privatePublishing;
-    if (!record8(response) || response.contractVersion !== 1 || response.apiVersion !== 1 || !exact(p, ["contractVersion", "enabled", "authentication", "maxArchiveBytes", "uploadMaxTtlSeconds", "executionEnabled"]) || p.contractVersion !== 1 || typeof p.enabled !== "boolean" || p.authentication !== "interactive-session" || p.maxArchiveBytes !== PRIVATE_PUBLICATION_MAX_BYTES || p.uploadMaxTtlSeconds !== 300 || typeof p.executionEnabled !== "boolean")
+    const p = record9(response) && response.privatePublishing;
+    if (!record9(response) || response.contractVersion !== 1 || response.apiVersion !== 1 || !exact(p, ["contractVersion", "enabled", "authentication", "maxArchiveBytes", "uploadMaxTtlSeconds", "executionEnabled"]) || p.contractVersion !== 1 || typeof p.enabled !== "boolean" || p.authentication !== "interactive-session" || p.maxArchiveBytes !== PRIVATE_PUBLICATION_MAX_BYTES || p.uploadMaxTtlSeconds !== 300 || typeof p.executionEnabled !== "boolean")
       throw new PrivatePublicationError("PUBLICATION_CONTRACT_UNAVAILABLE", "This server does not support the hosted private publication contract.");
     return Object.freeze({ ...p });
   }
@@ -50271,7 +50424,7 @@ class RemotePrivatePublicationsClient {
   async#view(path, method, skillId, intentId, declaration, options = {}) {
     const value = await boundedJson(path, { method, ...method === "GET" ? {} : { body: JSON.stringify(declaration ?? {}) } }, this.#token, method !== "GET", options.timeoutMs, options.signal);
     try {
-      if (!record8(value) || !Object.keys(value).every((k) => k === "upload" || k === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
+      if (!record9(value) || !Object.keys(value).every((k) => k === "upload" || k === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
         return invalid4();
       return checkedPublicationView(value.upload, skillId, intentId, declaration);
     } catch (error61) {
@@ -50396,7 +50549,7 @@ var PRIVATE_PUBLICATION_MAX_BYTES, failures2, PrivatePublicationError, bad = ()
   throw new PrivatePublicationError("INVALID_PUBLICATION_INPUT", "Invalid publication input or recovery data.");
 }, invalid4 = () => {
   throw new PrivatePublicationError("INVALID_PUBLICATION_RESPONSE", "The server returned an invalid publication result.");
-}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash3 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record8 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys) => record8(v) && Object.keys(v).sort().join(",") === keys.sort().join(","), date6 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash7("sha256").update(bytes).digest("hex");
+}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash3 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record9 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys) => record9(v) && Object.keys(v).sort().join(",") === keys.sort().join(","), date6 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash7("sha256").update(bytes).digest("hex");
 var init_remote_private_publications = __esm(() => {
   init_fleet_credentials();
   init_remote_workspace_selection();
@@ -50460,10 +50613,10 @@ async function requestAuthApi(instance, path, options) {
   const text3 = await res.text();
   const body = text3 ? parseJsonBody(text3) : {};
   if (!res.ok) {
-    const record9 = isRecord5(body) ? body : {};
-    const detail = typeof record9.detail === "string" ? record9.detail : undefined;
-    const error61 = typeof record9.error === "string" ? record9.error : undefined;
-    const code = typeof record9.code === "string" ? record9.code : undefined;
+    const record10 = isRecord5(body) ? body : {};
+    const detail = typeof record10.detail === "string" ? record10.detail : undefined;
+    const error61 = typeof record10.error === "string" ? record10.error : undefined;
+    const code = typeof record10.code === "string" ? record10.code : undefined;
     throw new HostedApiError(detail || error61 || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -50673,10 +50826,10 @@ var init_remote_auth = __esm(() => {
 });
 
 // src/lib/workspace-profile.ts
-import { constants as constants5, closeSync as closeSync8, fstatSync as fstatSync8, lstatSync as lstatSync8, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync2, openSync as openSync8, readFileSync as readFileSync16, renameSync as renameSync4, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "fs";
+import { constants as constants6, closeSync as closeSync9, fstatSync as fstatSync9, lstatSync as lstatSync9, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync2, openSync as openSync9, readFileSync as readFileSync16, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync7 } from "fs";
 function stat(path) {
   try {
-    return lstatSync8(path);
+    return lstatSync9(path);
   } catch (error61) {
     if (error61.code === "ENOENT")
       return null;
@@ -50686,14 +50839,14 @@ function stat(path) {
 function safeText(file2) {
   if (stat(file2) === null)
     return null;
-  const fd = openSync8(file2, constants5.O_RDONLY | constants5.O_NOFOLLOW | constants5.O_NONBLOCK);
+  const fd = openSync9(file2, constants6.O_RDONLY | constants6.O_NOFOLLOW | constants6.O_NONBLOCK);
   try {
-    const s = fstatSync8(fd);
+    const s = fstatSync9(fd);
     if (!s.isFile() || s.size > 65536 || ![256, 384].includes(s.mode & 4095) || process.getuid && s.uid !== process.getuid())
       return fail("The selected profile must use bounded owner-only regular files.");
     return readFileSync16(fd, "utf8");
   } finally {
-    closeSync8(fd);
+    closeSync9(fd);
   }
 }
 function checkIdentityMetadata(file2, identity2) {
@@ -50905,7 +51058,7 @@ var init_recurring_customer = __esm(() => {
 });
 
 // src/lib/recurring-recovery.ts
-import { constants as constants6, closeSync as closeSync9, fsyncSync, fstatSync as fstatSync9, lstatSync as lstatSync9, mkdirSync as mkdirSync9, openSync as openSync9, readSync as readSync4, realpathSync as realpathSync4, renameSync as renameSync5, unlinkSync as unlinkSync4, writeFileSync as writeFileSync8 } from "fs";
+import { constants as constants7, closeSync as closeSync10, fsyncSync as fsyncSync2, fstatSync as fstatSync10, lstatSync as lstatSync10, mkdirSync as mkdirSync10, openSync as openSync10, readSync as readSync5, realpathSync as realpathSync4, renameSync as renameSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname7, isAbsolute as isAbsolute4, join as join20, resolve as resolve4 } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 
@@ -50917,7 +51070,7 @@ class RecoveryOwner {
     if (!isAbsolute4(directory) || resolve4(directory) !== directory || realpathSync4(directory) !== directory)
       invalid5();
     for (let path = directory;; path = dirname7(path)) {
-      const stat2 = lstatSync9(path);
+      const stat2 = lstatSync10(path);
       if (!stat2.isDirectory() || stat2.isSymbolicLink())
         invalid5();
       this.parents.push({ path, dev: stat2.dev, ino: stat2.ino });
@@ -50930,59 +51083,59 @@ class RecoveryOwner {
     if (realpathSync4(this.directory) !== this.directory)
       invalid5();
     for (const prior of this.parents) {
-      const now = lstatSync9(prior.path);
+      const now = lstatSync10(prior.path);
       if (!now.isDirectory() || now.isSymbolicLink() || now.dev !== prior.dev || now.ino !== prior.ino)
         invalid5();
     }
-    const own2 = lstatSync9(this.directory);
+    const own2 = lstatSync10(this.directory);
     if ((own2.mode & 511) !== 448 || (own2.mode & 3584) !== 0 || process.getuid && own2.uid !== process.getuid())
       invalid5();
   }
   read(name) {
     this.assert();
-    const fd = openSync9(join20(this.directory, name), constants6.O_RDONLY | constants6.O_NOFOLLOW | constants6.O_NONBLOCK);
+    const fd = openSync10(join20(this.directory, name), constants7.O_RDONLY | constants7.O_NOFOLLOW | constants7.O_NONBLOCK);
     try {
-      const before = fstatSync9(fd);
+      const before = fstatSync10(fd);
       if (!before.isFile() || before.nlink !== 1 || (before.mode & 4095) !== 384 || before.size < 1 || before.size > 8192 || process.getuid && before.uid !== process.getuid())
         invalid5();
       const bytes = Buffer.alloc(before.size + 1);
       let size = 0;
       while (size < bytes.length) {
-        const n2 = readSync4(fd, bytes, size, bytes.length - size, size);
+        const n2 = readSync5(fd, bytes, size, bytes.length - size, size);
         if (!n2)
           break;
         size += n2;
       }
-      const after = fstatSync9(fd), path = lstatSync9(join20(this.directory, name));
+      const after = fstatSync10(fd), path = lstatSync10(join20(this.directory, name));
       if (size !== before.size || after.size !== before.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || path.dev !== before.dev || path.ino !== before.ino || !path.isFile() || path.isSymbolicLink())
         invalid5();
       this.assert();
       return new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size));
     } finally {
-      closeSync9(fd);
+      closeSync10(fd);
     }
   }
   write(name, value) {
     this.assert();
     const bytes = canonicalJson(value, 8192) + `
 `;
-    const fd = openSync9(join20(this.directory, name), constants6.O_WRONLY | constants6.O_CREAT | constants6.O_EXCL | constants6.O_NOFOLLOW, 384);
+    const fd = openSync10(join20(this.directory, name), constants7.O_WRONLY | constants7.O_CREAT | constants7.O_EXCL | constants7.O_NOFOLLOW, 384);
     try {
       writeFileSync8(fd, bytes);
-      fsyncSync(fd);
+      fsyncSync2(fd);
     } finally {
-      closeSync9(fd);
+      closeSync10(fd);
     }
     this.assert();
     this.sync();
   }
   sync() {
     this.assert();
-    const fd = openSync9(this.directory, constants6.O_RDONLY | constants6.O_NOFOLLOW);
+    const fd = openSync10(this.directory, constants7.O_RDONLY | constants7.O_NOFOLLOW);
     try {
-      fsyncSync(fd);
+      fsyncSync2(fd);
     } finally {
-      closeSync9(fd);
+      closeSync10(fd);
     }
   }
   saveState(state, expected) {
@@ -50993,30 +51146,30 @@ class RecoveryOwner {
     if (this.read("state.json") !== expected)
       invalid5();
     this.assert();
-    renameSync5(join20(this.directory, name), join20(this.directory, "state.json"));
+    renameSync6(join20(this.directory, name), join20(this.directory, "state.json"));
     this.sync();
   }
   async locked(action) {
     this.assert();
     let fd;
     try {
-      fd = openSync9(join20(this.directory, "operation.lock"), constants6.O_WRONLY | constants6.O_CREAT | constants6.O_EXCL | constants6.O_NOFOLLOW, 384);
+      fd = openSync10(join20(this.directory, "operation.lock"), constants7.O_WRONLY | constants7.O_CREAT | constants7.O_EXCL | constants7.O_NOFOLLOW, 384);
     } catch {
       throw new RecurringCustomerError("RECURRING_RECOVERY_BUSY", "Recovery is locked. Confirm the original process has stopped before explicitly reconciling the retained lock; no request was retried.");
     }
-    const owner = fstatSync9(fd);
+    const owner = fstatSync10(fd);
     try {
       writeFileSync8(fd, JSON.stringify({ pid: process.pid }));
-      fsyncSync(fd);
+      fsyncSync2(fd);
       this.sync();
       return await action();
     } finally {
-      closeSync9(fd);
+      closeSync10(fd);
       this.assert();
-      const now = lstatSync9(join20(this.directory, "operation.lock"));
+      const now = lstatSync10(join20(this.directory, "operation.lock"));
       if (owner.dev !== now.dev || owner.ino !== now.ino || !now.isFile() || now.isSymbolicLink())
         invalid5();
-      unlinkSync4(join20(this.directory, "operation.lock"));
+      unlinkSync5(join20(this.directory, "operation.lock"));
       this.sync();
     }
   }
@@ -51051,7 +51204,7 @@ function base(customer, organizationId) {
 function create(directory, intent) {
   if (!isAbsolute4(directory) || resolve4(directory) !== directory || realpathSync4(dirname7(directory)) !== dirname7(directory))
     invalid5();
-  mkdirSync9(directory, { mode: 448 });
+  mkdirSync10(directory, { mode: 448 });
   const owner = new RecoveryOwner(directory), checked = intentSchema.parse(intent), intentSha256 = canonicalJsonSha256(checked);
   owner.write(`intent-${intentSha256}.json`, checked);
   owner.write("state.json", { contractVersion: 1, intentSha256, phase: "prepared", consentId: null });
@@ -53147,7 +53300,7 @@ var init_credential_state = __esm(() => {
 
 // src/lib/run-state.ts
 import { createHash as createHash8, randomBytes } from "crypto";
-import { existsSync as existsSync14, mkdirSync as mkdirSync10, readFileSync as readFileSync17, readdirSync as readdirSync8, statSync as statSync9, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync17, readdirSync as readdirSync8, statSync as statSync9, writeFileSync as writeFileSync9 } from "fs";
 import { extname, join as join21, relative as relative5 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now = new Date;
@@ -53158,10 +53311,10 @@ function createSkillRun(params, targetDir = process.cwd()) {
   const runDir = join21(root, "runs", day, id);
   const logsDir = join21(runDir, "logs");
   const exportDir = join21(root, "exports", skillName, id);
-  mkdirSync10(logsDir, { recursive: true });
-  mkdirSync10(exportDir, { recursive: true });
-  mkdirSync10(join21(root, "tmp"), { recursive: true });
-  const record9 = {
+  mkdirSync11(logsDir, { recursive: true });
+  mkdirSync11(exportDir, { recursive: true });
+  mkdirSync11(join21(root, "tmp"), { recursive: true });
+  const record10 = {
     id,
     skill: skillName,
     status: params.status ?? "running",
@@ -53179,10 +53332,10 @@ function createSkillRun(params, targetDir = process.cwd()) {
       logsDir: toProjectRelative(targetDir, logsDir)
     }
   };
-  const context2 = { targetDir, runDir, exportDir, logsDir, record: record9 };
+  const context2 = { targetDir, runDir, exportDir, logsDir, record: record10 };
   writeRunRecord(context2);
   writeArtifactsManifest(context2, []);
-  appendRunEvent(context2, "created", { status: record9.status });
+  appendRunEvent(context2, "created", { status: record10.status });
   return context2;
 }
 function completeSkillRun(context2, patch) {
@@ -53227,9 +53380,9 @@ function findSkillRun(runId, targetDir = process.cwd()) {
   if (!existsSync14(runsRoot))
     return null;
   for (const day of readdirSync8(runsRoot)) {
-    const record9 = readRunRecord(join21(runsRoot, day, runId));
-    if (record9)
-      return record9;
+    const record10 = readRunRecord(join21(runsRoot, day, runId));
+    if (record10)
+      return record10;
   }
   return null;
 }
@@ -53378,7 +53531,7 @@ var init_run_routing = __esm(() => {
 // node_modules/@hasna/secrets/dist/sdk.js
 import { isIP as isIP2 } from "net";
 import { spawnSync as spawnSync2 } from "child_process";
-import { closeSync as closeSync10, fstatSync as fstatSync10, openSync as openSync10, readFileSync as readFileSync18 } from "fs";
+import { closeSync as closeSync11, fstatSync as fstatSync11, openSync as openSync11, readFileSync as readFileSync18 } from "fs";
 import { O_NOFOLLOW as O_NOFOLLOW3, O_NONBLOCK as O_NONBLOCK3, O_RDONLY as O_RDONLY3 } from "constants";
 import { createRequire as createRequire2 } from "module";
 import { hostname as osHostname2 } from "os";
@@ -53483,7 +53636,7 @@ function readAppConfigFile2(path) {
   };
   let fd = -1;
   try {
-    fd = openSync10(path, O_RDONLY3 | O_NOFOLLOW3 | O_NONBLOCK3);
+    fd = openSync11(path, O_RDONLY3 | O_NOFOLLOW3 | O_NONBLOCK3);
   } catch (error61) {
     const code2 = error61.code;
     if (code2 === "ENOENT" || code2 === "ENOTDIR")
@@ -53493,7 +53646,7 @@ function readAppConfigFile2(path) {
     unsafe(`the path could not be opened (${code2 ?? "unknown error"})`);
   }
   try {
-    const before = fstatSync10(fd);
+    const before = fstatSync11(fd);
     if (!before.isFile())
       unsafe("the path is not a regular file");
     if (!configFileModeAllowed2(before.mode)) {
@@ -53505,14 +53658,14 @@ function readAppConfigFile2(path) {
     if (before.size > MAX_CREDENTIAL_FILE_BYTES2)
       unsafe("the file exceeds the size limit");
     const bytes = readFileSync18(fd);
-    const after = fstatSync10(fd);
+    const after = fstatSync11(fd);
     if (!configFileReadsCoherent2(before, after)) {
       unsafe("the file changed while being read");
     }
     return parseEnvFile2(bytes.toString("utf8"));
   } finally {
     if (fd !== -1)
-      closeSync10(fd);
+      closeSync11(fd);
   }
 }
 function readCredentialFile2(path, apiKeyKeys) {
@@ -54678,7 +54831,7 @@ var init_sdk = __esm(() => {
 });
 
 // src/lib/execution-secrets.ts
-import { constants as constants7, closeSync as closeSync11, fstatSync as fstatSync11, openSync as openSync11, readSync as readSync5, realpathSync as realpathSync5 } from "fs";
+import { constants as constants8, closeSync as closeSync12, fstatSync as fstatSync12, openSync as openSync12, readSync as readSync6, realpathSync as realpathSync5 } from "fs";
 import { hostname as stationHostname } from "os";
 function selectedSecretBindingsTemplate(scope, names, createClient = createSecretsClientFromEnv) {
   let secretsAuthority;
@@ -54699,7 +54852,7 @@ function selectedSecretBindingsTemplate(scope, names, createClient = createSecre
 function refuse(code2, message) {
   throw new SkillSelectionError(code2, message);
 }
-function record9(value) {
+function record10(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function exactKeys(value, keys) {
@@ -54720,7 +54873,7 @@ function declaredSecretNames(value) {
   return value;
 }
 function validateSelectedSecretBindings(value, scope, names) {
-  if (!record9(value) || !exactKeys(value, ["schema", "selection", "consumer", "secretsAuthority", "bindings"]) || value.schema !== "hasna.skills-secret-bindings.v1" || !record9(value.selection) || !exactKeys(value.selection, ["authority", "workspaceId", "profileId", "profileRevision", "slug", "version", "bundleDigest"]) || !record9(value.consumer) || !exactKeys(value.consumer, ["stationId", "workspaceDirectory"]) || !record9(value.bindings)) {
+  if (!record10(value) || !exactKeys(value, ["schema", "selection", "consumer", "secretsAuthority", "bindings"]) || value.schema !== "hasna.skills-secret-bindings.v1" || !record10(value.selection) || !exactKeys(value.selection, ["authority", "workspaceId", "profileId", "profileRevision", "slug", "version", "bundleDigest"]) || !record10(value.consumer) || !exactKeys(value.consumer, ["stationId", "workspaceDirectory"]) || !record10(value.bindings)) {
     return refuse("INVALID_SECRET_BINDINGS", "Secret bindings do not match the hasna.skills-secret-bindings.v1 contract.");
   }
   for (const [key, expected] of Object.entries({ authority: scope.selection.authority, workspaceId: scope.selection.workspaceId, profileId: scope.profileId, profileRevision: scope.selection.profileRevision, slug: scope.selection.slug, version: scope.selection.version, bundleDigest: scope.selection.bundleDigest })) {
@@ -54913,32 +55066,6 @@ var init_execution_grant_client = __esm(() => {
   init_execution_grants();
 });
 
-// src/lib/selected-manifest.ts
-function jsonEntry(entries, path) {
-  const entry = entries.find((candidate) => candidate.path === path);
-  if (!entry)
-    return {};
-  try {
-    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(entry.bytes));
-    if (!value || typeof value !== "object" || Array.isArray(value))
-      throw new Error;
-    return value;
-  } catch {
-    throw new SkillSelectionError("INVALID_SKILL_MANIFEST", "The selected skill has an invalid execution manifest.");
-  }
-}
-function describeEntries(entries) {
-  const manifest = jsonEntry(entries, "skill.json"), packageJson = jsonEntry(entries, "package.json");
-  const docs = entries.find((entry) => entry.path === "SKILL.md");
-  const frontmatter = docs ? parseSkillFrontmatter(new TextDecoder().decode(docs.bytes)) : null;
-  const kind = frontmatter?.kind === "instruction" || manifest.kind === "instruction" || packageJson.skills?.kind === "instruction" ? "instruction" : "executable";
-  return { kind, manifest, packageJson };
-}
-var init_selected_manifest = __esm(() => {
-  init_skill_validation();
-  init_selection_cache();
-});
-
 // src/lib/selected-run.ts
 var exports_selected_run = {};
 __export(exports_selected_run, {
@@ -54948,7 +55075,7 @@ __export(exports_selected_run, {
 });
 import { createHash as createHash9 } from "crypto";
 import { spawn } from "child_process";
-import { mkdirSync as mkdirSync11, mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync10, realpathSync as realpathSync6 } from "fs";
+import { mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync10, realpathSync as realpathSync6 } from "fs";
 import { dirname as dirname8, join as join23, resolve as resolve5 } from "path";
 import { tmpdir, hostname as stationHostname2 } from "os";
 async function resolveSelectedRun(spec, profileId, options = {}) {
@@ -55038,7 +55165,7 @@ async function executeSelectedLocal(selected, options = {}) {
       throw new SkillSelectionError("INVALID_BUNDLE_PATH", "The execution bundle path exceeds its limit.");
     });
     const destination = join23(runDirectory, entry.path);
-    mkdirSync11(dirname8(destination), { recursive: true, mode: 448 });
+    mkdirSync12(dirname8(destination), { recursive: true, mode: 448 });
     writeFileSync10(destination, entry.bytes, { flag: "wx", mode: entry.mode & 511 });
   }
   env.SKILLS_INPUT_JSON = input2;
@@ -55946,7 +56073,7 @@ var init_operation_tools = __esm(() => {
 });
 
 // src/lib/feedback.ts
-import { appendFileSync, existsSync as existsSync16, mkdirSync as mkdirSync12 } from "fs";
+import { appendFileSync, existsSync as existsSync16, mkdirSync as mkdirSync13 } from "fs";
 import { dirname as dirname9, join as join25 } from "path";
 import { Database } from "bun:sqlite";
 function getFeedbackDbPath() {
@@ -55956,7 +56083,7 @@ function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
   const dir = dirname9(dbPath);
   if (!existsSync16(dir))
-    mkdirSync12(dir, { recursive: true });
+    mkdirSync13(dir, { recursive: true });
   const db = new Database(dbPath);
   db.exec("PRAGMA journal_mode = WAL");
   db.exec([
@@ -55985,7 +56112,7 @@ function saveFeedback(input2) {
     const path = join25(getDataDir(), "feedback.jsonl");
     const dir = dirname9(path);
     if (!existsSync16(dir))
-      mkdirSync12(dir, { recursive: true });
+      mkdirSync13(dir, { recursive: true });
     appendFileSync(path, JSON.stringify({ message, category, email: input2.email ?? null, agent: input2.agent ?? null, version: input2.version ?? null, createdAt: new Date().toISOString() }) + `
 `);
     return { saved: true, category, path };
@@ -56146,7 +56273,7 @@ var init_resource_meta_tools = __esm(() => {
 });
 
 // src/lib/scheduler.ts
-import { existsSync as existsSync17, readFileSync as readFileSync19, writeFileSync as writeFileSync11, mkdirSync as mkdirSync13 } from "fs";
+import { existsSync as existsSync17, readFileSync as readFileSync19, writeFileSync as writeFileSync11, mkdirSync as mkdirSync14 } from "fs";
 import { join as join26 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
   return join26(targetDir, ".skills", "schedules.json");
@@ -56164,7 +56291,7 @@ function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
   const dir = join26(targetDir, ".skills");
   if (!existsSync17(dir))
-    mkdirSync13(dir, { recursive: true });
+    mkdirSync14(dir, { recursive: true });
   writeFileSync11(path, JSON.stringify(data, null, 2));
 }
 function validateCronField(expr, min, max, label) {
@@ -56437,7 +56564,7 @@ var init_schedule_tools = __esm(() => {
 import { createHash as createHash10, createHmac } from "crypto";
 import {
   existsSync as existsSync18,
-  mkdirSync as mkdirSync14,
+  mkdirSync as mkdirSync15,
   readFileSync as readFileSync20,
   readdirSync as readdirSync10,
   statSync as statSync11,
@@ -56803,20 +56930,20 @@ var init_private_publication_customer = __esm(() => {
 });
 
 // src/lib/private-publication-recovery.ts
-import { constants as constants8, closeSync as closeSync12, fsyncSync as fsyncSync2, fstatSync as fstatSync12, lstatSync as lstatSync10, mkdirSync as mkdirSync15, openSync as openSync12, readSync as readSync6, realpathSync as realpathSync7, renameSync as renameSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync13 } from "fs";
+import { constants as constants9, closeSync as closeSync13, fsyncSync as fsyncSync3, fstatSync as fstatSync13, lstatSync as lstatSync11, mkdirSync as mkdirSync16, openSync as openSync13, readSync as readSync7, realpathSync as realpathSync7, renameSync as renameSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync13 } from "fs";
 import { dirname as dirname11, isAbsolute as isAbsolute7, join as join28, resolve as resolve6 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function safeDirectory(directory2) {
   if (!isAbsolute7(directory2) || directory2 !== resolve6(directory2) || realpathSync7(directory2) !== directory2)
     return fail2();
   for (let path = directory2;; path = dirname11(path)) {
-    const stat2 = lstatSync10(path);
+    const stat2 = lstatSync11(path);
     if (!stat2.isDirectory() || stat2.isSymbolicLink())
       return fail2();
     if (path === dirname11(path))
       break;
   }
-  const own2 = lstatSync10(directory2);
+  const own2 = lstatSync11(directory2);
   if ((own2.mode & 63) !== 0 || process.getuid && own2.uid !== process.getuid())
     return fail2();
   return { dev: own2.dev, ino: own2.ino };
@@ -56828,35 +56955,35 @@ function unchangedDirectory(directory2, identity2) {
 }
 function readOwned(directory2, name, max) {
   const identity2 = safeDirectory(directory2), file2 = join28(directory2, name);
-  const fd = openSync12(file2, constants8.O_RDONLY | constants8.O_NOFOLLOW);
+  const fd = openSync13(file2, constants9.O_RDONLY | constants9.O_NOFOLLOW);
   try {
-    const stat2 = fstatSync12(fd);
+    const stat2 = fstatSync13(fd);
     if (!stat2.isFile() || stat2.nlink !== 1 || stat2.size > max || stat2.size < 1 || (stat2.mode & 63) !== 0 || process.getuid && stat2.uid !== process.getuid())
       return fail2();
     const buffer = Buffer.alloc(Math.min(max, stat2.size) + 1);
     let length = 0;
     while (length < buffer.length) {
-      const count = readSync6(fd, buffer, length, buffer.length - length, length);
+      const count = readSync7(fd, buffer, length, buffer.length - length, length);
       if (count === 0)
         break;
       length += count;
     }
-    const bytes = buffer.subarray(0, length), after = fstatSync12(fd);
+    const bytes = buffer.subarray(0, length), after = fstatSync13(fd);
     unchangedDirectory(directory2, identity2);
     if (bytes.length !== stat2.size || stat2.size !== after.size || stat2.mtimeMs !== after.mtimeMs || stat2.ctimeMs !== after.ctimeMs)
       return fail2();
     return bytes;
   } finally {
-    closeSync12(fd);
+    closeSync13(fd);
   }
 }
 function writeOwned(directory2, name, bytes) {
-  const fd = openSync12(join28(directory2, name), constants8.O_WRONLY | constants8.O_CREAT | constants8.O_EXCL | constants8.O_NOFOLLOW, 384);
+  const fd = openSync13(join28(directory2, name), constants9.O_WRONLY | constants9.O_CREAT | constants9.O_EXCL | constants9.O_NOFOLLOW, 384);
   try {
     writeFileSync13(fd, bytes);
-    fsyncSync2(fd);
+    fsyncSync3(fd);
   } finally {
-    closeSync12(fd);
+    closeSync13(fd);
   }
 }
 function save(directory2, value) {
@@ -56864,12 +56991,12 @@ function save(directory2, value) {
   writeOwned(directory2, temporary, JSON.stringify(value) + `
 `);
   unchangedDirectory(directory2, identity2);
-  renameSync6(join28(directory2, temporary), join28(directory2, "receipt.json"));
-  const fd = openSync12(directory2, constants8.O_RDONLY | constants8.O_NOFOLLOW);
+  renameSync7(join28(directory2, temporary), join28(directory2, "receipt.json"));
+  const fd = openSync13(directory2, constants9.O_RDONLY | constants9.O_NOFOLLOW);
   try {
-    fsyncSync2(fd);
+    fsyncSync3(fd);
   } finally {
-    closeSync12(fd);
+    closeSync13(fd);
   }
 }
 function bind(client, receipt) {
@@ -56880,23 +57007,23 @@ async function locked(directory2, action) {
   const identity2 = safeDirectory(directory2), file2 = join28(directory2, "operation.lock");
   let fd;
   try {
-    fd = openSync12(file2, constants8.O_WRONLY | constants8.O_CREAT | constants8.O_EXCL | constants8.O_NOFOLLOW, 384);
+    fd = openSync13(file2, constants9.O_WRONLY | constants9.O_CREAT | constants9.O_EXCL | constants9.O_NOFOLLOW, 384);
   } catch {
     throw new PrivatePublicationError("PUBLICATION_RECOVERY_BUSY", "Another operation holds this recovery directory. If it crashed, confirm that process has stopped before explicitly removing operation.lock and resuming.");
   }
-  const lock = fstatSync12(fd);
+  const lock = fstatSync13(fd);
   try {
     writeFileSync13(fd, JSON.stringify({ pid: process.pid }) + `
 `);
-    fsyncSync2(fd);
+    fsyncSync3(fd);
     return await action();
   } finally {
-    closeSync12(fd);
+    closeSync13(fd);
     unchangedDirectory(directory2, identity2);
-    const now = lstatSync10(file2);
+    const now = lstatSync11(file2);
     if (now.dev !== lock.dev || now.ino !== lock.ino || !now.isFile() || now.isSymbolicLink())
       fail2();
-    unlinkSync5(file2);
+    unlinkSync6(file2);
   }
 }
 function readPrivatePublicationRecovery(directory2) {
@@ -56947,13 +57074,13 @@ async function preparePrivatePublication(client, sourceDirectory, recoveryDirect
   };
   if (!isAbsolute7(recoveryDirectory) || resolve6(recoveryDirectory) !== recoveryDirectory || realpathSync7(dirname11(recoveryDirectory)) !== dirname11(recoveryDirectory))
     return fail2();
-  mkdirSync15(recoveryDirectory, { mode: 448 });
+  mkdirSync16(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
-  const parent = openSync12(dirname11(recoveryDirectory), constants8.O_RDONLY | constants8.O_NOFOLLOW);
+  const parent = openSync13(dirname11(recoveryDirectory), constants9.O_RDONLY | constants9.O_NOFOLLOW);
   try {
-    fsyncSync2(parent);
+    fsyncSync3(parent);
   } finally {
-    closeSync12(parent);
+    closeSync13(parent);
   }
   writeOwned(recoveryDirectory, "bundle.tgz", packed.bytes);
   save(recoveryDirectory, receipt);
@@ -57474,7 +57601,7 @@ var WSContext = class {
 var init_websocket = () => {};
 
 // node_modules/@hono/node-server/dist/index.mjs
-import { Http2ServerRequest, constants as constants9 } from "http2";
+import { Http2ServerRequest, constants as constants10 } from "http2";
 import { Readable } from "stream";
 async function readWithoutBlocking(readPromise) {
   return Promise.race([readPromise, Promise.resolve().then(() => Promise.resolve(undefined))]);
@@ -57889,7 +58016,7 @@ var RequestError, nonJoinedHeaders, validHeaderName, isHttpWhitespace = (code2)
   incomingWithDrainState[incomingDraining] = true;
   if (incoming instanceof Http2ServerRequest) {
     try {
-      incoming.stream?.close?.(constants9.NGHTTP2_NO_ERROR);
+      incoming.stream?.close?.(constants10.NGHTTP2_NO_ERROR);
     } catch {}
     return;
   }