@hasna/skills 0.9.10 → 0.9.12

package/dist/sdk/index.js

@@ -8209,7 +8209,7 @@ var require_client = __commonJS((exports) => {
     };
   };
   var sleep = (seconds) => {
-    return new Promise((resolve17) => setTimeout(resolve17, seconds * 1000));
+    return new Promise((resolve18) => setTimeout(resolve18, seconds * 1000));
   };
   var waiterServiceDefaults = {
     minDelay: 2,
@@ -8338,8 +8338,8 @@ var require_client = __commonJS((exports) => {
   };
   var abortTimeout = (abortSignal) => {
     let onAbort;
-    const promise = new Promise((resolve17) => {
-      onAbort = () => resolve17({ state: WaiterState.ABORTED });
+    const promise = new Promise((resolve18) => {
+      onAbort = () => resolve18({ state: WaiterState.ABORTED });
       if (typeof abortSignal.addEventListener === "function") {
         abortSignal.addEventListener("abort", onAbort);
       } else {
@@ -9002,9 +9002,9 @@ var require_client = __commonJS((exports) => {
 
 // node_modules/@smithy/core/dist-cjs/submodules/config/index.js
 var require_config = __commonJS((exports) => {
-  var { homedir: homedir6 } = __require("os");
-  var { sep: sep7, join: join4 } = __require("path");
-  var { createHash: createHash17 } = __require("crypto");
+  var { homedir: homedir7 } = __require("os");
+  var { sep: sep8, join: join4 } = __require("path");
+  var { createHash: createHash19 } = __require("crypto");
   var { readFile: readFile$1 } = __require("fs/promises");
   var { IniSectionType } = require_dist_cjs();
   var { normalizeProvider } = require_client();
@@ -9143,7 +9143,7 @@ var require_config = __commonJS((exports) => {
     return "DEFAULT";
   };
   var getHomeDir = () => {
-    const { HOME, USERPROFILE, HOMEPATH, HOMEDRIVE = `C:${sep7}` } = process.env;
+    const { HOME, USERPROFILE, HOMEPATH, HOMEDRIVE = `C:${sep8}` } = process.env;
     if (HOME)
       return HOME;
     if (USERPROFILE)
@@ -9152,14 +9152,14 @@ var require_config = __commonJS((exports) => {
       return `${HOMEDRIVE}${HOMEPATH}`;
     const homeDirCacheKey = getHomeDirCacheKey();
     if (!homeDirCache[homeDirCacheKey])
-      homeDirCache[homeDirCacheKey] = homedir6();
+      homeDirCache[homeDirCacheKey] = homedir7();
     return homeDirCache[homeDirCacheKey];
   };
   var ENV_PROFILE = "AWS_PROFILE";
   var DEFAULT_PROFILE = "default";
   var getProfileName = (init) => init.profile || process.env[ENV_PROFILE] || DEFAULT_PROFILE;
   var getSSOTokenFilepath = (id2) => {
-    const hasher = createHash17("sha1");
+    const hasher = createHash19("sha1");
     const cacheName = hasher.update(id2).digest("hex");
     return join4(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
   };
@@ -9311,11 +9311,11 @@ var require_config = __commonJS((exports) => {
   };
   function getSelectorName(functionString) {
     try {
-      const constants12 = new Set(Array.from(functionString.match(/([A-Z_]){3,}/g) ?? []));
-      constants12.delete("CONFIG");
-      constants12.delete("CONFIG_PREFIX_SEPARATOR");
-      constants12.delete("ENV");
-      return [...constants12].join(", ");
+      const constants13 = new Set(Array.from(functionString.match(/([A-Z_]){3,}/g) ?? []));
+      constants13.delete("CONFIG");
+      constants13.delete("CONFIG_PREFIX_SEPARATOR");
+      constants13.delete("ENV");
+      return [...constants13].join(", ");
     } catch (ignored) {
       return functionString;
     }
@@ -9477,7 +9477,7 @@ var require_config = __commonJS((exports) => {
   };
   var imdsRequest = async (options) => {
     const { request: request2 } = __require("http");
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       const req = request2({
         hostname: options.hostname,
         port: options.port,
@@ -9505,7 +9505,7 @@ var require_config = __commonJS((exports) => {
         const chunks = [];
         res.on("data", (chunk) => chunks.push(chunk));
         res.on("end", () => {
-          resolve17(Buffer.concat(chunks));
+          resolve18(Buffer.concat(chunks));
           req.destroy();
         });
       });
@@ -10511,10 +10511,10 @@ var require_endpoints = __commonJS((exports) => {
 
 // node_modules/@smithy/core/dist-cjs/submodules/serde/index.js
 var require_serde = __commonJS((exports) => {
-  var { createHmac: createHmac2, createHash: createHash17, getRandomValues } = __require("crypto");
+  var { createHmac: createHmac2, createHash: createHash19, getRandomValues } = __require("crypto");
   var { hasOwn: hasOwn2, HttpResponse } = require_transport();
   exports.hasOwn = hasOwn2;
-  var { ReadStream, lstatSync: lstatSync20, fstatSync: fstatSync4 } = __require("fs");
+  var { ReadStream, lstatSync: lstatSync22, fstatSync: fstatSync4 } = __require("fs");
   var { toEndpointV1 } = require_endpoints();
   var { Readable, Writable, PassThrough } = __require("stream");
   var isArrayBuffer = (arg) => typeof ArrayBuffer === "function" && arg instanceof ArrayBuffer || Object.prototype.toString.call(arg) === "[object ArrayBuffer]";
@@ -11280,7 +11280,7 @@ var require_serde = __commonJS((exports) => {
       return body.end + 1 - body.start;
     } else if (body instanceof ReadStream) {
       if (body.path != null) {
-        return lstatSync20(body.path).size;
+        return lstatSync22(body.path).size;
       } else if (typeof body.fd === "number") {
         return fstatSync4(body.fd).size;
       }
@@ -11416,7 +11416,7 @@ var require_serde = __commonJS((exports) => {
       return Promise.resolve(this.hash.digest());
     }
     reset() {
-      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash17(this.algorithmIdentifier);
+      this.hash = this.secret ? createHmac2(this.algorithmIdentifier, castSourceData(this.secret)) : createHash19(this.algorithmIdentifier);
     }
   }
   function castSourceData(toCast, encoding) {
@@ -11861,7 +11861,7 @@ ${value}\r
     if (isReadableStream(stream)) {
       return headStream$1(stream, bytes);
     }
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       const collector = new Collector$1;
       collector.limit = bytes;
       stream.pipe(collector);
@@ -11872,7 +11872,7 @@ ${value}\r
       collector.on("error", reject);
       collector.on("finish", function() {
         const bytes2 = concatBytes(this.buffers);
-        resolve17(bytes2);
+        resolve18(bytes2);
       });
     });
   };
@@ -11986,7 +11986,7 @@ ${value}\r
     if (isReadableStream(stream)) {
       return collectReadableStream(stream);
     }
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       const collector = new Collector;
       const nodeStream = stream;
       nodeStream.pipe(collector);
@@ -11997,7 +11997,7 @@ ${value}\r
       collector.on("error", reject);
       collector.on("finish", function() {
         const bytes = concatBytes(this.bufferedBytes);
-        resolve17(bytes);
+        resolve18(bytes);
       });
     });
   };
@@ -12155,7 +12155,7 @@ var require_checksum = __commonJS((exports) => {
   var { createReadStream } = __require("fs");
   var { Writable } = __require("stream");
   var { toUint8Array, concatBytes } = require_serde();
-  var { createHash: createHash17, createHmac: createHmac2 } = __require("crypto");
+  var { createHash: createHash19, createHmac: createHmac2 } = __require("crypto");
   var zlib = __require("zlib");
   async function blobReader(blob, onChunk, chunkSize = 1024 * 1024) {
     const size = blob.size;
@@ -12189,7 +12189,7 @@ var require_checksum = __commonJS((exports) => {
       callback();
     }
   }
-  var fileStreamHasher = (hashCtor, fileStream) => new Promise((resolve17, reject) => {
+  var fileStreamHasher = (hashCtor, fileStream) => new Promise((resolve18, reject) => {
     if (!isReadStream(fileStream)) {
       reject(new Error("Unable to calculate hash for non-file streams."));
       return;
@@ -12207,7 +12207,7 @@ var require_checksum = __commonJS((exports) => {
     });
     hashCalculator.on("error", reject);
     hashCalculator.on("finish", function() {
-      hash2.digest().then(resolve17).catch(reject);
+      hash2.digest().then(resolve18).catch(reject);
     });
   });
   var isReadStream = (stream) => typeof stream.path === "string";
@@ -12218,14 +12218,14 @@ var require_checksum = __commonJS((exports) => {
     const hash2 = new hashCtor;
     const hashCalculator = new HashCalculator(hash2);
     readableStream.pipe(hashCalculator);
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       readableStream.on("error", (err) => {
         hashCalculator.end();
         reject(err);
       });
       hashCalculator.on("error", reject);
       hashCalculator.on("finish", () => {
-        hash2.digest().then(resolve17).catch(reject);
+        hash2.digest().then(resolve18).catch(reject);
       });
     });
   };
@@ -12320,7 +12320,7 @@ var require_checksum = __commonJS((exports) => {
   }
   var hasNativeCrypto$1 = (() => {
     try {
-      createHash17("md5");
+      createHash19("md5");
       return true;
     } catch {
       return false;
@@ -12330,7 +12330,7 @@ var require_checksum = __commonJS((exports) => {
   function buildNativeClass$2() {
     return class Md5Node2 {
       digestLength = 16;
-      hash = createHash17("md5");
+      hash = createHash19("md5");
       update(data) {
         this.hash.update(toUint8Array(data));
       }
@@ -12339,7 +12339,7 @@ var require_checksum = __commonJS((exports) => {
         return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
       }
       reset() {
-        this.hash = createHash17("md5");
+        this.hash = createHash19("md5");
       }
     };
   }
@@ -12629,7 +12629,7 @@ var require_checksum = __commonJS((exports) => {
   ]);
   var hasNativeCrypto = (() => {
     try {
-      createHash17("sha256");
+      createHash19("sha256");
       return true;
     } catch {
       return false;
@@ -12669,7 +12669,7 @@ var require_checksum = __commonJS((exports) => {
         this.finished = false;
       }
       createHash() {
-        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash17("sha256");
+        return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash19("sha256");
       }
     };
   }
@@ -13334,7 +13334,7 @@ var require_event_streams = __commonJS((exports) => {
       streamEnded = true;
     });
     while (!generationEnded) {
-      const value = await new Promise((resolve17) => setTimeout(() => resolve17(records.shift()), 0));
+      const value = await new Promise((resolve18) => setTimeout(() => resolve18(records.shift()), 0));
       if (value) {
         yield value;
       }
@@ -14852,7 +14852,7 @@ var require_retry = __commonJS((exports) => {
       }
     };
   }
-  var cooldown = (ms) => new Promise((resolve17) => setTimeout(resolve17, ms));
+  var cooldown = (ms) => new Promise((resolve18) => setTimeout(resolve18, ms));
   var isRetryStrategyV2 = (retryStrategy) => typeof retryStrategy.acquireInitialRetryToken !== "undefined" && typeof retryStrategy.refreshRetryTokenForRetry !== "undefined" && typeof retryStrategy.recordSuccess !== "undefined";
   var getRetryErrorInfo = (error, logger) => {
     const errorInfo = {
@@ -14951,7 +14951,7 @@ var require_retry = __commonJS((exports) => {
       this.refillTokenBucket();
       while (amount > this.availableTokens) {
         const delay = (amount - this.availableTokens) / this.fillRate * 1000;
-        await new Promise((resolve17) => DefaultRateLimiter.setTimeoutFn(resolve17, delay));
+        await new Promise((resolve18) => DefaultRateLimiter.setTimeoutFn(resolve18, delay));
         this.refillTokenBucket();
       }
       this.availableTokens = this.availableTokens - amount;
@@ -15293,7 +15293,7 @@ var require_retry = __commonJS((exports) => {
             const delayFromResponse = getDelayFromRetryAfterHeader(err.$response);
             const delay = Math.max(delayFromResponse || 0, delayFromDecider);
             totalDelay += delay;
-            await new Promise((resolve17) => setTimeout(resolve17, delay));
+            await new Promise((resolve18) => setTimeout(resolve18, delay));
             continue;
           }
           if (!err.$metadata) {
@@ -24586,7 +24586,7 @@ var require_httpAuthSchemes = __commonJS((exports) => {
 });
 
 // node_modules/@aws-sdk/credential-provider-env/dist-es/fromEnv.js
-var import_client8, import_config8, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET = "AWS_SECRET_ACCESS_KEY", ENV_SESSION = "AWS_SESSION_TOKEN", ENV_EXPIRATION = "AWS_CREDENTIAL_EXPIRATION", ENV_CREDENTIAL_SCOPE = "AWS_CREDENTIAL_SCOPE", ENV_ACCOUNT_ID = "AWS_ACCOUNT_ID", fromEnv = (init) => async () => {
+var import_client8, import_config9, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET = "AWS_SECRET_ACCESS_KEY", ENV_SESSION = "AWS_SESSION_TOKEN", ENV_EXPIRATION = "AWS_CREDENTIAL_EXPIRATION", ENV_CREDENTIAL_SCOPE = "AWS_CREDENTIAL_SCOPE", ENV_ACCOUNT_ID = "AWS_ACCOUNT_ID", fromEnv = (init) => async () => {
   init?.logger?.debug("@aws-sdk/credential-provider-env - fromEnv");
   const accessKeyId = process.env[ENV_KEY];
   const secretAccessKey = process.env[ENV_SECRET];
@@ -24606,11 +24606,11 @@ var import_client8, import_config8, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET =
     import_client8.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS", "g");
     return credentials;
   }
-  throw new import_config8.CredentialsProviderError("Unable to find environment variable credentials.", { logger: init?.logger });
+  throw new import_config9.CredentialsProviderError("Unable to find environment variable credentials.", { logger: init?.logger });
 };
 var init_fromEnv = __esm(() => {
   import_client8 = __toESM(require_client2(), 1);
-  import_config8 = __toESM(require_config(), 1);
+  import_config9 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-env/dist-es/index.js
@@ -24646,24 +24646,24 @@ var init_node_http = () => {};
 
 // node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/httpRequest.js
 function httpRequest(options) {
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve18, reject) => {
     const req = node_http.request({
       method: "GET",
       ...options,
       hostname: options.hostname?.replace(/^\[(.+)\]$/, "$1")
     });
     req.on("error", (err) => {
-      reject(Object.assign(new import_config9.ProviderError("Unable to connect to instance metadata service"), err));
+      reject(Object.assign(new import_config10.ProviderError("Unable to connect to instance metadata service"), err));
       req.destroy();
     });
     req.on("timeout", () => {
-      reject(new import_config9.ProviderError("TimeoutError from instance metadata service"));
+      reject(new import_config10.ProviderError("TimeoutError from instance metadata service"));
       req.destroy();
     });
     req.on("response", (res) => {
       const { statusCode = 400 } = res;
       if (statusCode < 200 || 300 <= statusCode) {
-        reject(Object.assign(new import_config9.ProviderError("Error response received from instance metadata service"), { statusCode }));
+        reject(Object.assign(new import_config10.ProviderError("Error response received from instance metadata service"), { statusCode }));
         req.destroy();
       }
       const chunks = [];
@@ -24671,17 +24671,17 @@ function httpRequest(options) {
         chunks.push(chunk);
       });
       res.on("end", () => {
-        resolve17(Buffer.concat(chunks));
+        resolve18(Buffer.concat(chunks));
         req.destroy();
       });
     });
     req.end();
   });
 }
-var import_config9;
+var import_config10;
 var init_httpRequest = __esm(() => {
   init_node_http();
-  import_config9 = __toESM(require_config(), 1);
+  import_config10 = __toESM(require_config(), 1);
 });
 
 // node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/retry.js
@@ -24694,13 +24694,13 @@ var retry = (toRetry, maxRetries) => {
 };
 
 // node_modules/@smithy/credential-provider-imds/dist-es/fromContainerMetadata.js
-var import_config10, ENV_CMDS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", ENV_CMDS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", ENV_CMDS_AUTH_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromContainerMetadata = (init = {}) => {
+var import_config11, ENV_CMDS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", ENV_CMDS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", ENV_CMDS_AUTH_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromContainerMetadata = (init = {}) => {
   const { timeout, maxRetries } = providerConfigFromInit(init);
   return () => retry(async () => {
     const requestOptions = await getCmdsUri({ logger: init.logger });
     const credsResponse = JSON.parse(await requestFromEcsImds(timeout, requestOptions));
     if (!isImdsCredentials(credsResponse)) {
-      throw new import_config10.CredentialsProviderError("Invalid response received from instance metadata service.", {
+      throw new import_config11.CredentialsProviderError("Invalid response received from instance metadata service.", {
         logger: init.logger
       });
     }
@@ -24730,16 +24730,16 @@ var import_config10, ENV_CMDS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", E
     try {
       parsed = new URL(process.env[ENV_CMDS_FULL_URI]);
     } catch {
-      throw new import_config10.CredentialsProviderError(`${process.env[ENV_CMDS_FULL_URI]} is not a valid container metadata service URL`, { tryNextLink: false, logger });
+      throw new import_config11.CredentialsProviderError(`${process.env[ENV_CMDS_FULL_URI]} is not a valid container metadata service URL`, { tryNextLink: false, logger });
     }
     if (!parsed.hostname || !GREENGRASS_HOSTS.has(parsed.hostname)) {
-      throw new import_config10.CredentialsProviderError(`${parsed.hostname} is not a valid container metadata service hostname`, {
+      throw new import_config11.CredentialsProviderError(`${parsed.hostname} is not a valid container metadata service hostname`, {
         tryNextLink: false,
         logger
       });
     }
     if (!parsed.protocol || !GREENGRASS_PROTOCOLS.has(parsed.protocol)) {
-      throw new import_config10.CredentialsProviderError(`${parsed.protocol} is not a valid container metadata service protocol`, {
+      throw new import_config11.CredentialsProviderError(`${parsed.protocol} is not a valid container metadata service protocol`, {
         tryNextLink: false,
         logger
       });
@@ -24751,23 +24751,23 @@ var import_config10, ENV_CMDS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", E
       port: parsed.port ? parseInt(parsed.port, 10) : undefined
     };
   }
-  throw new import_config10.CredentialsProviderError("The container metadata credential provider cannot be used unless" + ` the ${ENV_CMDS_RELATIVE_URI} or ${ENV_CMDS_FULL_URI} environment` + " variable is set", {
+  throw new import_config11.CredentialsProviderError("The container metadata credential provider cannot be used unless" + ` the ${ENV_CMDS_RELATIVE_URI} or ${ENV_CMDS_FULL_URI} environment` + " variable is set", {
     tryNextLink: false,
     logger
   });
 };
 var init_fromContainerMetadata = __esm(() => {
   init_httpRequest();
-  import_config10 = __toESM(require_config(), 1);
+  import_config11 = __toESM(require_config(), 1);
   GREENGRASS_HOSTS = new Set(["localhost", "127.0.0.1"]);
   GREENGRASS_PROTOCOLS = new Set(["http:", "https:"]);
 });
 
 // node_modules/@smithy/credential-provider-imds/dist-es/error/InstanceMetadataV1FallbackError.js
-var import_config11, InstanceMetadataV1FallbackError;
+var import_config12, InstanceMetadataV1FallbackError;
 var init_InstanceMetadataV1FallbackError = __esm(() => {
-  import_config11 = __toESM(require_config(), 1);
-  InstanceMetadataV1FallbackError = class InstanceMetadataV1FallbackError extends import_config11.CredentialsProviderError {
+  import_config12 = __toESM(require_config(), 1);
+  InstanceMetadataV1FallbackError = class InstanceMetadataV1FallbackError extends import_config12.CredentialsProviderError {
     tryNextLink;
     name = "InstanceMetadataV1FallbackError";
     constructor(message, tryNextLink = true) {
@@ -24818,8 +24818,8 @@ var init_EndpointModeConfigOptions = __esm(() => {
 });
 
 // node_modules/@smithy/credential-provider-imds/dist-es/utils/getInstanceMetadataEndpoint.js
-var import_config12, import_protocols, getInstanceMetadataEndpoint = async () => import_protocols.parseUrl(await getFromEndpointConfig() || await getFromEndpointModeConfig()), getFromEndpointConfig = async () => import_config12.loadConfig(ENDPOINT_CONFIG_OPTIONS)(), getFromEndpointModeConfig = async () => {
-  const endpointMode = await import_config12.loadConfig(ENDPOINT_MODE_CONFIG_OPTIONS)();
+var import_config13, import_protocols, getInstanceMetadataEndpoint = async () => import_protocols.parseUrl(await getFromEndpointConfig() || await getFromEndpointModeConfig()), getFromEndpointConfig = async () => import_config13.loadConfig(ENDPOINT_CONFIG_OPTIONS)(), getFromEndpointModeConfig = async () => {
+  const endpointMode = await import_config13.loadConfig(ENDPOINT_MODE_CONFIG_OPTIONS)();
   switch (endpointMode) {
     case EndpointMode.IPv4:
       return Endpoint.IPv4;
@@ -24834,7 +24834,7 @@ var init_getInstanceMetadataEndpoint = __esm(() => {
   init_EndpointConfigOptions();
   init_EndpointMode();
   init_EndpointModeConfigOptions();
-  import_config12 = __toESM(require_config(), 1);
+  import_config13 = __toESM(require_config(), 1);
   import_protocols = __toESM(require_protocols(), 1);
 });
 
@@ -24884,7 +24884,7 @@ var init_staticStabilityProvider = __esm(() => {
 });
 
 // node_modules/@smithy/credential-provider-imds/dist-es/fromInstanceMetadata.js
-var import_config13, IMDS_PATH = "/latest/meta-data/iam/security-credentials/", IMDS_TOKEN_PATH = "/latest/api/token", AWS_EC2_METADATA_V1_DISABLED = "AWS_EC2_METADATA_V1_DISABLED", PROFILE_AWS_EC2_METADATA_V1_DISABLED = "ec2_metadata_v1_disabled", X_AWS_EC2_METADATA_TOKEN = "x-aws-ec2-metadata-token", fromInstanceMetadata = (init = {}) => staticStabilityProvider(getInstanceMetadataProvider(init), { logger: init.logger }), getInstanceMetadataProvider = (init = {}) => {
+var import_config14, IMDS_PATH = "/latest/meta-data/iam/security-credentials/", IMDS_TOKEN_PATH = "/latest/api/token", AWS_EC2_METADATA_V1_DISABLED = "AWS_EC2_METADATA_V1_DISABLED", PROFILE_AWS_EC2_METADATA_V1_DISABLED = "ec2_metadata_v1_disabled", X_AWS_EC2_METADATA_TOKEN = "x-aws-ec2-metadata-token", fromInstanceMetadata = (init = {}) => staticStabilityProvider(getInstanceMetadataProvider(init), { logger: init.logger }), getInstanceMetadataProvider = (init = {}) => {
   let disableFetchToken = false;
   const { logger, profile } = init;
   const { timeout, maxRetries } = providerConfigFromInit(init);
@@ -24893,12 +24893,12 @@ var import_config13, IMDS_PATH = "/latest/meta-data/iam/security-credentials/",
     if (isImdsV1Fallback) {
       let fallbackBlockedFromProfile = false;
       let fallbackBlockedFromProcessEnv = false;
-      const configValue = await import_config13.loadConfig({
+      const configValue = await import_config14.loadConfig({
         environmentVariableSelector: (env) => {
           const envValue = env[AWS_EC2_METADATA_V1_DISABLED];
           fallbackBlockedFromProcessEnv = !!envValue && envValue !== "false";
           if (envValue === undefined) {
-            throw new import_config13.CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`, { logger: init.logger });
+            throw new import_config14.CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`, { logger: init.logger });
           }
           return fallbackBlockedFromProcessEnv;
         },
@@ -24989,7 +24989,7 @@ var import_config13, IMDS_PATH = "/latest/meta-data/iam/security-credentials/",
     path: IMDS_PATH + profile
   })).toString());
   if (!isImdsCredentials(credentialsResponse)) {
-    throw new import_config13.CredentialsProviderError("Invalid response received from instance metadata service.", {
+    throw new import_config14.CredentialsProviderError("Invalid response received from instance metadata service.", {
       logger: init.logger
     });
   }
@@ -25000,7 +25000,7 @@ var init_fromInstanceMetadata = __esm(() => {
   init_httpRequest();
   init_getInstanceMetadataEndpoint();
   init_staticStabilityProvider();
-  import_config13 = __toESM(require_config(), 1);
+  import_config14 = __toESM(require_config(), 1);
 });
 
 // node_modules/@smithy/credential-provider-imds/dist-es/index.js
@@ -25168,21 +25168,21 @@ var require_dist_cjs6 = __commonJS((exports) => {
     let sendBody = true;
     if (!externalAgent && expect === "100-continue") {
       sendBody = await Promise.race([
-        new Promise((resolve17) => {
-          timeoutId = Number(timing.setTimeout(() => resolve17(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
+        new Promise((resolve18) => {
+          timeoutId = Number(timing.setTimeout(() => resolve18(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
         }),
-        new Promise((resolve17) => {
+        new Promise((resolve18) => {
           httpRequest2.on("continue", () => {
             timing.clearTimeout(timeoutId);
-            resolve17(true);
+            resolve18(true);
           });
           httpRequest2.on("response", () => {
             timing.clearTimeout(timeoutId);
-            resolve17(false);
+            resolve18(false);
           });
           httpRequest2.on("error", () => {
             timing.clearTimeout(timeoutId);
-            resolve17(false);
+            resolve18(false);
           });
         })
       ]);
@@ -25259,13 +25259,13 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return socketWarningTimestamp;
     }
     constructor(options) {
-      this.configProvider = new Promise((resolve17, reject) => {
+      this.configProvider = new Promise((resolve18, reject) => {
         if (typeof options === "function") {
           options().then((_options) => {
-            resolve17(this.resolveDefaultConfig(_options));
+            resolve18(this.resolveDefaultConfig(_options));
           }).catch(reject);
         } else {
-          resolve17(this.resolveDefaultConfig(options));
+          resolve18(this.resolveDefaultConfig(options));
         }
       });
     }
@@ -25297,7 +25297,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
           timing.clearTimeout(socketTimeoutId);
           timing.clearTimeout(keepAliveTimeoutId);
         };
-        const resolve17 = async (arg) => {
+        const resolve18 = async (arg) => {
           await writeRequestBodyPromise;
           clearTimeouts();
           _resolve(arg);
@@ -25361,7 +25361,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             headers: getTransformedHeaders(res.headers),
             body: res
           });
-          resolve17({ response: httpResponse });
+          resolve18({ response: httpResponse });
         });
         req.on("error", (err) => {
           if (NODEJS_TIMEOUT_ERROR_CODES.includes(err.code)) {
@@ -25679,7 +25679,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return this.connectOptions === undefined ? http2.connect(url) : http2.connect(url, this.connectOptions);
     }
   }
-  var { constants: constants12 } = http2;
+  var { constants: constants13 } = http2;
 
   class NodeHttp2Handler {
     config;
@@ -25693,13 +25693,13 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return new NodeHttp2Handler(instanceOrOptions);
     }
     constructor(options) {
-      this.configProvider = new Promise((resolve17, reject) => {
+      this.configProvider = new Promise((resolve18, reject) => {
         if (typeof options === "function") {
           options().then((opts) => {
-            resolve17(opts || {});
+            resolve18(opts || {});
           }).catch(reject);
         } else {
-          resolve17(options || {});
+          resolve18(options || {});
         }
       });
     }
@@ -25724,7 +25724,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return new Promise((_resolve, _reject) => {
         let fulfilled = false;
         let writeRequestBodyPromise = undefined;
-        const resolve17 = async (arg) => {
+        const resolve18 = async (arg) => {
           await writeRequestBodyPromise;
           _resolve(arg);
         };
@@ -25770,8 +25770,8 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
         }
         const clientHttp2Stream = session.request({
           ...request2.headers,
-          [constants12.HTTP2_HEADER_PATH]: path,
-          [constants12.HTTP2_HEADER_METHOD]: method
+          [constants13.HTTP2_HEADER_PATH]: path,
+          [constants13.HTTP2_HEADER_METHOD]: method
         });
         if (effectiveRequestTimeout) {
           clientHttp2Stream.setTimeout(effectiveRequestTimeout, () => {
@@ -25809,7 +25809,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             body: clientHttp2Stream
           });
           fulfilled = true;
-          resolve17({ response: httpResponse });
+          resolve18({ response: httpResponse });
           if (useIsolatedSession) {
             session.close();
             clientHttp2Stream.on("end", () => {
@@ -25853,7 +25853,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
 });
 
 // node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/checkUrl.js
-var import_config14, ECS_CONTAINER_HOST = "169.254.170.2", EKS_CONTAINER_HOST_IPv4 = "169.254.170.23", EKS_CONTAINER_HOST_IPv6 = "[fd00:ec2::23]", checkUrl = (url, logger) => {
+var import_config15, ECS_CONTAINER_HOST = "169.254.170.2", EKS_CONTAINER_HOST_IPv4 = "169.254.170.23", EKS_CONTAINER_HOST_IPv6 = "[fd00:ec2::23]", checkUrl = (url, logger) => {
   if (url.protocol === "https:") {
     return;
   }
@@ -25877,13 +25877,13 @@ var import_config14, ECS_CONTAINER_HOST = "169.254.170.2", EKS_CONTAINER_HOST_IP
       return;
     }
   }
-  throw new import_config14.CredentialsProviderError(`URL not accepted. It must either be HTTPS or match one of the following:
+  throw new import_config15.CredentialsProviderError(`URL not accepted. It must either be HTTPS or match one of the following:
   - loopback CIDR 127.0.0.0/8 or [::1/128]
   - ECS container host 169.254.170.2
   - EKS container host 169.254.170.23 or [fd00:ec2::23]`, { logger });
 };
 var init_checkUrl = __esm(() => {
-  import_config14 = __toESM(require_config(), 1);
+  import_config15 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/requestHelpers.js
@@ -25906,7 +25906,7 @@ async function getCredentials(response, logger) {
   if (response.statusCode === 200) {
     const parsed = JSON.parse(str);
     if (typeof parsed.AccessKeyId !== "string" || typeof parsed.SecretAccessKey !== "string" || typeof parsed.Token !== "string" || typeof parsed.Expiration !== "string") {
-      throw new import_config15.CredentialsProviderError("HTTP credential provider response not of the required format, an object matching: " + "{ AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }", { logger });
+      throw new import_config16.CredentialsProviderError("HTTP credential provider response not of the required format, an object matching: " + "{ AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }", { logger });
     }
     return {
       accessKeyId: parsed.AccessKeyId,
@@ -25920,16 +25920,16 @@ async function getCredentials(response, logger) {
     try {
       parsedBody = JSON.parse(str);
     } catch (e3) {}
-    throw Object.assign(new import_config15.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger }), {
+    throw Object.assign(new import_config16.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger }), {
       Code: parsedBody.Code,
       Message: parsedBody.Message
     });
   }
-  throw new import_config15.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger });
+  throw new import_config16.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger });
 }
-var import_config15, import_protocols2, import_serde, import_serde2;
+var import_config16, import_protocols2, import_serde, import_serde2;
 var init_requestHelpers = __esm(() => {
-  import_config15 = __toESM(require_config(), 1);
+  import_config16 = __toESM(require_config(), 1);
   import_protocols2 = __toESM(require_protocols(), 1);
   import_serde = __toESM(require_serde(), 1);
   import_serde2 = __toESM(require_serde(), 1);
@@ -25942,7 +25942,7 @@ var retryWrapper = (toRetry, maxRetries, delayMs) => {
       try {
         return await toRetry();
       } catch (e3) {
-        await new Promise((resolve17) => setTimeout(resolve17, delayMs));
+        await new Promise((resolve18) => setTimeout(resolve18, delayMs));
       }
     }
     return await toRetry();
@@ -25951,7 +25951,7 @@ var retryWrapper = (toRetry, maxRetries, delayMs) => {
 
 // node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/fromHttp.js
 import fs from "fs/promises";
-var import_client9, import_config16, import_node_http_handler, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2", AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromHttp = (options = {}) => {
+var import_client9, import_config17, import_node_http_handler, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2", AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromHttp = (options = {}) => {
   options.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");
   let host;
   const relative6 = options.awsContainerCredentialsRelativeUri ?? process.env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI];
@@ -25972,7 +25972,7 @@ var import_client9, import_config16, import_node_http_handler, AWS_CONTAINER_CRE
   } else if (full) {
     host = full;
   } else {
-    throw new import_config16.CredentialsProviderError(`No HTTP credential provider host provided.
+    throw new import_config17.CredentialsProviderError(`No HTTP credential provider host provided.
 Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`, { logger: options.logger });
   }
   const url = new URL(host);
@@ -25990,7 +25990,7 @@ Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
       const result = await requestHandler.handle(request2, { requestTimeout });
       return getCredentials(result.response).then((creds) => import_client9.setCredentialFeature(creds, "CREDENTIALS_HTTP", "z"));
     } catch (e3) {
-      throw new import_config16.CredentialsProviderError(String(e3), { logger: options.logger });
+      throw new import_config17.CredentialsProviderError(String(e3), { logger: options.logger });
     }
   }, options.maxRetries ?? 3, options.timeout ?? 1000);
   return async () => {
@@ -26003,7 +26003,7 @@ Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
 }, validateToken = (token) => {
   if (token.includes(`\r
 `)) {
-    throw new import_config16.CredentialsProviderError("Authorization token contains invalid \\r\\n sequence.");
+    throw new import_config17.CredentialsProviderError("Authorization token contains invalid \\r\\n sequence.");
   }
   return token;
 };
@@ -26011,7 +26011,7 @@ var init_fromHttp = __esm(() => {
   init_checkUrl();
   init_requestHelpers();
   import_client9 = __toESM(require_client2(), 1);
-  import_config16 = __toESM(require_config(), 1);
+  import_config17 = __toESM(require_config(), 1);
   import_node_http_handler = __toESM(require_dist_cjs6(), 1);
 });
 
@@ -26814,70 +26814,70 @@ var getNewSsoOidcToken = async (ssoToken, ssoRegion, init = {}, callerClientConf
 var init_getNewSsoOidcToken = () => {};
 
 // node_modules/@aws-sdk/token-providers/dist-es/validateTokenExpiry.js
-var import_config18, validateTokenExpiry = (token) => {
+var import_config19, validateTokenExpiry = (token) => {
   if (token.expiration && token.expiration.getTime() < Date.now()) {
-    throw new import_config18.TokenProviderError(`Token is expired. ${REFRESH_MESSAGE}`, false);
+    throw new import_config19.TokenProviderError(`Token is expired. ${REFRESH_MESSAGE}`, false);
   }
 };
 var init_validateTokenExpiry = __esm(() => {
   init_constants();
-  import_config18 = __toESM(require_config(), 1);
+  import_config19 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/token-providers/dist-es/validateTokenKey.js
-var import_config19, validateTokenKey = (key, value, forRefresh = false) => {
+var import_config20, validateTokenKey = (key, value, forRefresh = false) => {
   if (typeof value === "undefined") {
-    throw new import_config19.TokenProviderError(`Value not present for '${key}' in SSO Token${forRefresh ? ". Cannot refresh" : ""}. ${REFRESH_MESSAGE}`, false);
+    throw new import_config20.TokenProviderError(`Value not present for '${key}' in SSO Token${forRefresh ? ". Cannot refresh" : ""}. ${REFRESH_MESSAGE}`, false);
   }
 };
 var init_validateTokenKey = __esm(() => {
   init_constants();
-  import_config19 = __toESM(require_config(), 1);
+  import_config20 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/token-providers/dist-es/writeSSOTokenToFile.js
 import { promises as fsPromises } from "fs";
-var import_config20, writeFile, writeSSOTokenToFile = (id2, ssoToken) => {
-  const tokenFilepath = import_config20.getSSOTokenFilepath(id2);
+var import_config21, writeFile, writeSSOTokenToFile = (id2, ssoToken) => {
+  const tokenFilepath = import_config21.getSSOTokenFilepath(id2);
   const tokenString = JSON.stringify(ssoToken, null, 2);
   return writeFile(tokenFilepath, tokenString);
 };
 var init_writeSSOTokenToFile = __esm(() => {
-  import_config20 = __toESM(require_config(), 1);
+  import_config21 = __toESM(require_config(), 1);
   ({ writeFile } = fsPromises);
 });
 
 // node_modules/@aws-sdk/token-providers/dist-es/fromSso.js
-var import_config21, lastRefreshAttemptTimes, fromSso = (init = {}) => async ({ callerClientConfig } = {}) => {
+var import_config22, lastRefreshAttemptTimes, fromSso = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/token-providers - fromSso");
-  const profiles = await import_config21.parseKnownFiles(init);
-  const profileName = import_config21.getProfileName({
+  const profiles = await import_config22.parseKnownFiles(init);
+  const profileName = import_config22.getProfileName({
     profile: init.profile ?? callerClientConfig?.profile
   });
   const profile = profiles[profileName];
   if (!profile) {
-    throw new import_config21.TokenProviderError(`Profile '${profileName}' could not be found in shared credentials file.`, false);
+    throw new import_config22.TokenProviderError(`Profile '${profileName}' could not be found in shared credentials file.`, false);
   } else if (!profile["sso_session"]) {
-    throw new import_config21.TokenProviderError(`Profile '${profileName}' is missing required property 'sso_session'.`);
+    throw new import_config22.TokenProviderError(`Profile '${profileName}' is missing required property 'sso_session'.`);
   }
   const ssoSessionName = profile["sso_session"];
-  const ssoSessions = await import_config21.loadSsoSessionData(init);
+  const ssoSessions = await import_config22.loadSsoSessionData(init);
   const ssoSession = ssoSessions[ssoSessionName];
   if (!ssoSession) {
-    throw new import_config21.TokenProviderError(`Sso session '${ssoSessionName}' could not be found in shared credentials file.`, false);
+    throw new import_config22.TokenProviderError(`Sso session '${ssoSessionName}' could not be found in shared credentials file.`, false);
   }
   for (const ssoSessionRequiredKey of ["sso_start_url", "sso_region"]) {
     if (!ssoSession[ssoSessionRequiredKey]) {
-      throw new import_config21.TokenProviderError(`Sso session '${ssoSessionName}' is missing required property '${ssoSessionRequiredKey}'.`, false);
+      throw new import_config22.TokenProviderError(`Sso session '${ssoSessionName}' is missing required property '${ssoSessionRequiredKey}'.`, false);
     }
   }
   const ssoStartUrl = ssoSession["sso_start_url"];
   const ssoRegion = ssoSession["sso_region"];
   let ssoToken;
   try {
-    ssoToken = await import_config21.getSSOTokenFromFile(ssoSessionName);
+    ssoToken = await import_config22.getSSOTokenFromFile(ssoSessionName);
   } catch (e3) {
-    throw new import_config21.TokenProviderError(`The SSO session token associated with profile=${profileName} was not found or is invalid. ${REFRESH_MESSAGE}`, false);
+    throw new import_config22.TokenProviderError(`The SSO session token associated with profile=${profileName} was not found or is invalid. ${REFRESH_MESSAGE}`, false);
   }
   validateTokenKey("accessToken", ssoToken.accessToken);
   validateTokenKey("expiresAt", ssoToken.expiresAt);
@@ -26926,7 +26926,7 @@ var init_fromSso = __esm(() => {
   init_validateTokenExpiry();
   init_validateTokenKey();
   init_writeSSOTokenToFile();
-  import_config21 = __toESM(require_config(), 1);
+  import_config22 = __toESM(require_config(), 1);
   lastRefreshAttemptTimes = new Map;
 });
 
@@ -27394,7 +27394,7 @@ var init_loadSso = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-sso/dist-es/resolveSSOCredentials.js
-var import_client10, import_config22, SHOULD_FAIL_CREDENTIAL_CHAIN = false, resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger }) => {
+var import_client10, import_config23, SHOULD_FAIL_CREDENTIAL_CHAIN = false, resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger }) => {
   let token;
   const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
   if (ssoSession) {
@@ -27413,23 +27413,23 @@ var import_client10, import_config22, SHOULD_FAIL_CREDENTIAL_CHAIN = false, reso
         expiresAt: new Date(_token.expiration).toISOString()
       };
     } catch (e4) {
-      throw new import_config22.CredentialsProviderError(e4.message, {
+      throw new import_config23.CredentialsProviderError(e4.message, {
         tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
         logger
       });
     }
   } else {
     try {
-      token = await import_config22.getSSOTokenFromFile(ssoStartUrl);
+      token = await import_config23.getSSOTokenFromFile(ssoStartUrl);
     } catch (e4) {
-      throw new import_config22.CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, {
+      throw new import_config23.CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, {
         tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
         logger
       });
     }
   }
   if (new Date(token.expiresAt).getTime() - Date.now() <= 0) {
-    throw new import_config22.CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, {
+    throw new import_config23.CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, {
       tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
       logger
     });
@@ -27449,14 +27449,14 @@ var import_client10, import_config22, SHOULD_FAIL_CREDENTIAL_CHAIN = false, reso
       accessToken
     }));
   } catch (e4) {
-    throw new import_config22.CredentialsProviderError(e4, {
+    throw new import_config23.CredentialsProviderError(e4, {
       tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
       logger
     });
   }
   const { roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration, credentialScope, accountId } = {} } = ssoResp;
   if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {
-    throw new import_config22.CredentialsProviderError("SSO returns an invalid temporary credential.", {
+    throw new import_config23.CredentialsProviderError("SSO returns an invalid temporary credential.", {
       tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
       logger
     });
@@ -27479,53 +27479,53 @@ var import_client10, import_config22, SHOULD_FAIL_CREDENTIAL_CHAIN = false, reso
 var init_resolveSSOCredentials = __esm(() => {
   init_dist_es4();
   import_client10 = __toESM(require_client2(), 1);
-  import_config22 = __toESM(require_config(), 1);
+  import_config23 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-sso/dist-es/validateSsoProfile.js
-var import_config23, validateSsoProfile = (profile, logger) => {
+var import_config24, validateSsoProfile = (profile, logger) => {
   const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;
   if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {
-    throw new import_config23.CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", ` + `"sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(profile).join(", ")}
+    throw new import_config24.CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", ` + `"sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(profile).join(", ")}
 Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`, { tryNextLink: false, logger });
   }
   return profile;
 };
 var init_validateSsoProfile = __esm(() => {
-  import_config23 = __toESM(require_config(), 1);
+  import_config24 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-sso/dist-es/fromSSO.js
-var import_config24, fromSSO = (init = {}) => async ({ callerClientConfig } = {}) => {
+var import_config25, fromSSO = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");
   const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
   const { ssoClient } = init;
-  const profileName = import_config24.getProfileName({
+  const profileName = import_config25.getProfileName({
     profile: init.profile ?? callerClientConfig?.profile
   });
   if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
-    const profiles = await import_config24.parseKnownFiles(init);
+    const profiles = await import_config25.parseKnownFiles(init);
     const profile = profiles[profileName];
     if (!profile) {
-      throw new import_config24.CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });
+      throw new import_config25.CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });
     }
     if (!isSsoProfile(profile)) {
-      throw new import_config24.CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {
+      throw new import_config25.CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {
         logger: init.logger
       });
     }
     if (profile?.sso_session) {
-      const ssoSessions = await import_config24.loadSsoSessionData(init);
+      const ssoSessions = await import_config25.loadSsoSessionData(init);
       const session = ssoSessions[profile.sso_session];
       const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;
       if (ssoRegion && ssoRegion !== session.sso_region) {
-        throw new import_config24.CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {
+        throw new import_config25.CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {
           tryNextLink: false,
           logger: init.logger
         });
       }
       if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {
-        throw new import_config24.CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {
+        throw new import_config25.CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {
           tryNextLink: false,
           logger: init.logger
         });
@@ -27551,7 +27551,7 @@ var import_config24, fromSSO = (init = {}) => async ({ callerClientConfig } = {}
       logger: init.logger
     });
   } else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {
-    throw new import_config24.CredentialsProviderError("Incomplete configuration. The fromSSO() argument hash must include " + '"ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"', { tryNextLink: false, logger: init.logger });
+    throw new import_config25.CredentialsProviderError("Incomplete configuration. The fromSSO() argument hash must include " + '"ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"', { tryNextLink: false, logger: init.logger });
   } else {
     return resolveSSOCredentials({
       ssoStartUrl,
@@ -27574,7 +27574,7 @@ var import_config24, fromSSO = (init = {}) => async ({ callerClientConfig } = {}
 var init_fromSSO = __esm(() => {
   init_resolveSSOCredentials();
   init_validateSsoProfile();
-  import_config24 = __toESM(require_config(), 1);
+  import_config25 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-sso/dist-es/index.js
@@ -27590,13 +27590,13 @@ var init_dist_es5 = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveCredentialSource.js
-var import_client11, import_config25, resolveCredentialSource = (credentialSource, profileName, logger) => {
+var import_client11, import_config26, resolveCredentialSource = (credentialSource, profileName, logger) => {
   const sourceProvidersMap = {
     EcsContainer: async (options) => {
       const { fromHttp: fromHttp2 } = await Promise.resolve().then(() => (init_dist_es3(), exports_dist_es3));
       const { fromContainerMetadata: fromContainerMetadata2 } = await Promise.resolve().then(() => (init_dist_es2(), exports_dist_es2));
       logger?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer");
-      return async () => import_config25.chain(fromHttp2(options ?? {}), fromContainerMetadata2(options))().then(setNamedProvider);
+      return async () => import_config26.chain(fromHttp2(options ?? {}), fromContainerMetadata2(options))().then(setNamedProvider);
     },
     Ec2InstanceMetadata: async (options) => {
       logger?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");
@@ -27612,12 +27612,12 @@ var import_client11, import_config25, resolveCredentialSource = (credentialSourc
   if (credentialSource in sourceProvidersMap) {
     return sourceProvidersMap[credentialSource];
   } else {
-    throw new import_config25.CredentialsProviderError(`Unsupported credential source in profile ${profileName}. Got ${credentialSource}, expected EcsContainer or Ec2InstanceMetadata or Environment.`, { logger });
+    throw new import_config26.CredentialsProviderError(`Unsupported credential source in profile ${profileName}. Got ${credentialSource}, expected EcsContainer or Ec2InstanceMetadata or Environment.`, { logger });
   }
 }, setNamedProvider = (creds) => import_client11.setCredentialFeature(creds, "CREDENTIALS_PROFILE_NAMED_PROVIDER", "p");
 var init_resolveCredentialSource = __esm(() => {
   import_client11 = __toESM(require_client2(), 1);
-  import_config25 = __toESM(require_config(), 1);
+  import_config26 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sts/index.js
@@ -28643,7 +28643,7 @@ var require_sts = __commonJS((exports) => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveAssumeRoleCredentials.js
-var import_client12, import_config26, isAssumeRoleProfile = (arg, { profile = "default", logger } = {}) => {
+var import_client12, import_config27, isAssumeRoleProfile = (arg, { profile = "default", logger } = {}) => {
   return Boolean(arg) && typeof arg === "object" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1 && ["undefined", "string"].indexOf(typeof arg.external_id) > -1 && ["undefined", "string"].indexOf(typeof arg.mfa_serial) > -1 && (isAssumeRoleWithSourceProfile(arg, { profile, logger }) || isCredentialSourceProfile(arg, { profile, logger }));
 }, isAssumeRoleWithSourceProfile = (arg, { profile, logger }) => {
   const withSourceProfile = typeof arg.source_profile === "string" && typeof arg.credential_source === "undefined";
@@ -28674,7 +28674,7 @@ var import_client12, import_config26, isAssumeRoleProfile = (arg, { profile = "d
     }, options.clientPlugins);
   }
   if (source_profile && source_profile in visitedProfiles) {
-    throw new import_config26.CredentialsProviderError(`Detected a cycle attempting to resolve credentials for profile ${import_config26.getProfileName(options)}. Profiles visited: ` + Object.keys(visitedProfiles).join(", "), { logger: options.logger });
+    throw new import_config27.CredentialsProviderError(`Detected a cycle attempting to resolve credentials for profile ${import_config27.getProfileName(options)}. Profiles visited: ` + Object.keys(visitedProfiles).join(", "), { logger: options.logger });
   }
   options.logger?.debug(`@aws-sdk/credential-provider-ini - finding credential resolver using ${source_profile ? `source_profile=[${source_profile}]` : `profile=[${profileName}]`}`);
   const sourceCredsProvider = source_profile ? resolveProfileData(source_profile, profiles, options, callerClientConfig, {
@@ -28693,7 +28693,7 @@ var import_client12, import_config26, isAssumeRoleProfile = (arg, { profile = "d
     const { mfa_serial } = profileData;
     if (mfa_serial) {
       if (!options.mfaCodeProvider) {
-        throw new import_config26.CredentialsProviderError(`Profile ${profileName} requires multi-factor authentication, but no MFA code callback was provided.`, { logger: options.logger, tryNextLink: false });
+        throw new import_config27.CredentialsProviderError(`Profile ${profileName} requires multi-factor authentication, but no MFA code callback was provided.`, { logger: options.logger, tryNextLink: false });
       }
       params.SerialNumber = mfa_serial;
       params.TokenCode = await options.mfaCodeProvider(mfa_serial);
@@ -28707,7 +28707,7 @@ var import_client12, import_config26, isAssumeRoleProfile = (arg, { profile = "d
 var init_resolveAssumeRoleCredentials = __esm(() => {
   init_resolveCredentialSource();
   import_client12 = __toESM(require_client2(), 1);
-  import_config26 = __toESM(require_config(), 1);
+  import_config27 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/signin/index.js
@@ -29443,13 +29443,13 @@ var require_signin = __commonJS((exports) => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.js
-import { createHash as createHash17, createPrivateKey, createPublicKey, sign } from "crypto";
+import { createHash as createHash19, createPrivateKey, createPublicKey, sign } from "crypto";
 import { promises as fs2 } from "fs";
-import { homedir as homedir6 } from "os";
-import { dirname as dirname18, join as join31 } from "path";
-var import_config27, import_protocols3, LoginCredentialsFetcher;
+import { homedir as homedir7 } from "os";
+import { dirname as dirname20, join as join32 } from "path";
+var import_config28, import_protocols3, LoginCredentialsFetcher;
 var init_LoginCredentialsFetcher = __esm(() => {
-  import_config27 = __toESM(require_config(), 1);
+  import_config28 = __toESM(require_config(), 1);
   import_protocols3 = __toESM(require_protocols(), 1);
   LoginCredentialsFetcher = class LoginCredentialsFetcher {
     profileData;
@@ -29464,7 +29464,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
     async loadCredentials() {
       const token = await this.loadToken();
       if (!token) {
-        throw new import_config27.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`, { tryNextLink: false, logger: this.logger });
+        throw new import_config28.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`, { tryNextLink: false, logger: this.logger });
       }
       const accessToken = token.accessToken;
       const now = Date.now();
@@ -29531,7 +29531,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
         const { accessKeyId, secretAccessKey, sessionToken } = response.tokenOutput?.accessToken ?? {};
         const { refreshToken, expiresIn } = response.tokenOutput ?? {};
         if (!accessKeyId || !secretAccessKey || !sessionToken || !refreshToken) {
-          throw new import_config27.CredentialsProviderError("Token refresh response missing required fields", {
+          throw new import_config28.CredentialsProviderError("Token refresh response missing required fields", {
             logger: this.logger,
             tryNextLink: false
           });
@@ -29568,7 +29568,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
             default:
               message = `Failed to refresh token: ${String(error)}. Please re-authenticate using \`aws login\``;
           }
-          throw new import_config27.CredentialsProviderError(message, {
+          throw new import_config28.CredentialsProviderError(message, {
             logger: this.logger,
             tryNextLink: false
           });
@@ -29578,7 +29578,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
           this.logger?.warn?.(`Failed to refresh token: ${String(error)}. Using existing token until expiry.`);
           return this.toCredentials(freshToken.accessToken);
         }
-        throw new import_config27.CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });
+        throw new import_config28.CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });
       }
     }
     async loadToken() {
@@ -29591,14 +29591,14 @@ var init_LoginCredentialsFetcher = __esm(() => {
           missingFields.push("accountId");
         }
         if (missingFields.length > 0) {
-          throw new import_config27.CredentialsProviderError(`Token validation failed, missing fields: ${missingFields.join(", ")}`, {
+          throw new import_config28.CredentialsProviderError(`Token validation failed, missing fields: ${missingFields.join(", ")}`, {
             logger: this.logger,
             tryNextLink: false
           });
         }
         return token;
       } catch (error) {
-        throw new import_config27.CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error)}`, {
+        throw new import_config28.CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error)}`, {
           logger: this.logger,
           tryNextLink: false
         });
@@ -29606,17 +29606,17 @@ var init_LoginCredentialsFetcher = __esm(() => {
     }
     async saveToken(token) {
       const tokenFilePath = this.getTokenFilePath();
-      const directory = dirname18(tokenFilePath);
+      const directory = dirname20(tokenFilePath);
       try {
         await fs2.mkdir(directory, { recursive: true });
       } catch (error) {}
       await fs2.writeFile(tokenFilePath, JSON.stringify(token, null, 2), "utf8");
     }
     getTokenFilePath() {
-      const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join31(homedir6(), ".aws", "login", "cache");
+      const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join32(homedir7(), ".aws", "login", "cache");
       const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
-      const loginSessionSha256 = createHash17("sha256").update(loginSessionBytes).digest("hex");
-      return join31(directory, `${loginSessionSha256}.json`);
+      const loginSessionSha256 = createHash19("sha256").update(loginSessionBytes).digest("hex");
+      return join32(directory, `${loginSessionSha256}.json`);
     }
     derToRawSignature(derSignature) {
       let offset = 2;
@@ -29700,22 +29700,22 @@ var init_LoginCredentialsFetcher = __esm(() => {
         const signatureB64 = rawSignature.toString("base64url");
         return `${message}.${signatureB64}`;
       } catch (error) {
-        throw new import_config27.CredentialsProviderError(`Failed to generate Dpop proof: ${error instanceof Error ? error.message : String(error)}`, { logger: this.logger, tryNextLink: false });
+        throw new import_config28.CredentialsProviderError(`Failed to generate Dpop proof: ${error instanceof Error ? error.message : String(error)}`, { logger: this.logger, tryNextLink: false });
       }
     }
   };
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/credential-provider-login/dist-es/fromLoginCredentials.js
-var import_client13, import_config28, fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
+var import_client13, import_config29, fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
   init?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");
-  const profiles = await import_config28.parseKnownFiles(init || {});
-  const profileName = import_config28.getProfileName({
+  const profiles = await import_config29.parseKnownFiles(init || {});
+  const profileName = import_config29.getProfileName({
     profile: init?.profile ?? callerClientConfig?.profile
   });
   const profile = profiles[profileName];
   if (!profile?.login_session) {
-    throw new import_config28.CredentialsProviderError(`Profile ${profileName} does not contain login_session.`, {
+    throw new import_config29.CredentialsProviderError(`Profile ${profileName} does not contain login_session.`, {
       tryNextLink: true,
       logger: init?.logger
     });
@@ -29727,7 +29727,7 @@ var import_client13, import_config28, fromLoginCredentials = (init) => async ({
 var init_fromLoginCredentials = __esm(() => {
   init_LoginCredentialsFetcher();
   import_client13 = __toESM(require_client2(), 1);
-  import_config28 = __toESM(require_config(), 1);
+  import_config29 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/credential-provider-login/dist-es/index.js
@@ -29791,12 +29791,12 @@ var init_getValidatedProcessCredentials = __esm(() => {
 // node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js
 import { exec } from "child_process";
 import { promisify } from "util";
-var import_config29, resolveProcessCredentials = async (profileName, profiles, logger) => {
+var import_config30, resolveProcessCredentials = async (profileName, profiles, logger) => {
   const profile = profiles[profileName];
   if (profiles[profileName]) {
     const credentialProcess = profile["credential_process"];
     if (credentialProcess !== undefined) {
-      const execPromise = promisify(import_config29.externalDataInterceptor?.getTokenRecord?.().exec ?? exec);
+      const execPromise = promisify(import_config30.externalDataInterceptor?.getTokenRecord?.().exec ?? exec);
       try {
         const { stdout } = await execPromise(credentialProcess);
         let data;
@@ -29807,33 +29807,33 @@ var import_config29, resolveProcessCredentials = async (profileName, profiles, l
         }
         return getValidatedProcessCredentials(profileName, data, profiles);
       } catch (error) {
-        throw new import_config29.CredentialsProviderError(error.message, { logger });
+        throw new import_config30.CredentialsProviderError(error.message, { logger });
       }
     } else {
-      throw new import_config29.CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`, { logger });
+      throw new import_config30.CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`, { logger });
     }
   } else {
-    throw new import_config29.CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`, {
+    throw new import_config30.CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`, {
       logger
     });
   }
 };
 var init_resolveProcessCredentials = __esm(() => {
   init_getValidatedProcessCredentials();
-  import_config29 = __toESM(require_config(), 1);
+  import_config30 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-process/dist-es/fromProcess.js
-var import_config30, fromProcess = (init = {}) => async ({ callerClientConfig } = {}) => {
+var import_config31, fromProcess = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");
-  const profiles = await import_config30.parseKnownFiles(init);
-  return resolveProcessCredentials(import_config30.getProfileName({
+  const profiles = await import_config31.parseKnownFiles(init);
+  return resolveProcessCredentials(import_config31.getProfileName({
     profile: init.profile ?? callerClientConfig?.profile
   }), profiles, init.logger);
 };
 var init_fromProcess = __esm(() => {
   init_resolveProcessCredentials();
-  import_config30 = __toESM(require_config(), 1);
+  import_config31 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-process/dist-es/index.js
@@ -30947,19 +30947,19 @@ var fromWebToken = (init) => async (awsIdentityProperties) => {
 
 // node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromTokenFile.js
 import { readFileSync as readFileSync21 } from "fs";
-var import_client19, import_config31, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE", ENV_ROLE_ARN = "AWS_ROLE_ARN", ENV_ROLE_SESSION_NAME = "AWS_ROLE_SESSION_NAME", fromTokenFile = (init = {}) => async (awsIdentityProperties) => {
+var import_client19, import_config32, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE", ENV_ROLE_ARN = "AWS_ROLE_ARN", ENV_ROLE_SESSION_NAME = "AWS_ROLE_SESSION_NAME", fromTokenFile = (init = {}) => async (awsIdentityProperties) => {
   init.logger?.debug("@aws-sdk/credential-provider-web-identity - fromTokenFile");
   const webIdentityTokenFile = init?.webIdentityTokenFile ?? process.env[ENV_TOKEN_FILE];
   const roleArn = init?.roleArn ?? process.env[ENV_ROLE_ARN];
   const roleSessionName = init?.roleSessionName ?? process.env[ENV_ROLE_SESSION_NAME];
   if (!webIdentityTokenFile || !roleArn) {
-    throw new import_config31.CredentialsProviderError("Web identity configuration not specified", {
+    throw new import_config32.CredentialsProviderError("Web identity configuration not specified", {
       logger: init.logger
     });
   }
   const credentials = await fromWebToken({
     ...init,
-    webIdentityToken: import_config31.externalDataInterceptor?.getTokenRecord?.()[webIdentityTokenFile] ?? readFileSync21(webIdentityTokenFile, { encoding: "ascii" }),
+    webIdentityToken: import_config32.externalDataInterceptor?.getTokenRecord?.()[webIdentityTokenFile] ?? readFileSync21(webIdentityTokenFile, { encoding: "ascii" }),
     roleArn,
     roleSessionName
   })(awsIdentityProperties);
@@ -30970,7 +30970,7 @@ var import_client19, import_config31, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_F
 };
 var init_fromTokenFile = __esm(() => {
   import_client19 = __toESM(require_client2(), 1);
-  import_config31 = __toESM(require_config(), 1);
+  import_config32 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-web-identity/dist-es/index.js
@@ -31003,7 +31003,7 @@ var init_resolveWebIdentityCredentials = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProfileData.js
-var import_config32, resolveProfileData = async (profileName, profiles, options, callerClientConfig, visitedProfiles = {}, isAssumeRoleRecursiveCall = false) => {
+var import_config33, resolveProfileData = async (profileName, profiles, options, callerClientConfig, visitedProfiles = {}, isAssumeRoleRecursiveCall = false) => {
   const data = profiles[profileName];
   if (Object.keys(visitedProfiles).length > 0 && isStaticCredsProfile(data)) {
     return resolveStaticCredentials(data, options);
@@ -31026,7 +31026,7 @@ var import_config32, resolveProfileData = async (profileName, profiles, options,
   if (isLoginProfile(data)) {
     return resolveLoginCredentials(profileName, options, callerClientConfig);
   }
-  throw new import_config32.CredentialsProviderError(`Could not resolve credentials using profile: [${profileName}] in configuration/credentials file(s).`, { logger: options.logger });
+  throw new import_config33.CredentialsProviderError(`Could not resolve credentials using profile: [${profileName}] in configuration/credentials file(s).`, { logger: options.logger });
 };
 var init_resolveProfileData = __esm(() => {
   init_resolveAssumeRoleCredentials();
@@ -31035,20 +31035,20 @@ var init_resolveProfileData = __esm(() => {
   init_resolveSsoCredentials();
   init_resolveStaticCredentials();
   init_resolveWebIdentityCredentials();
-  import_config32 = __toESM(require_config(), 1);
+  import_config33 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/fromIni.js
-var import_config33, fromIni = (init = {}) => async ({ callerClientConfig } = {}) => {
+var import_config34, fromIni = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/credential-provider-ini - fromIni");
-  const profiles = await import_config33.parseKnownFiles(init);
-  return resolveProfileData(import_config33.getProfileName({
+  const profiles = await import_config34.parseKnownFiles(init);
+  return resolveProfileData(import_config34.getProfileName({
     profile: init.profile ?? callerClientConfig?.profile
   }), profiles, init, callerClientConfig);
 };
 var init_fromIni = __esm(() => {
   init_resolveProfileData();
-  import_config33 = __toESM(require_config(), 1);
+  import_config34 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/index.js
@@ -31066,8 +31066,8 @@ import { Buffer as Buffer2 } from "buffer";
 import { existsSync as existsSync22 } from "fs";
 import { join as join210 } from "path";
 import { existsSync as existsSync16 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join35, resolve as resolve17 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join36, resolve as resolve18 } from "path";
 import { homedir as pathsResolverHomedir2 } from "os";
 import { join as pathsResolverJoin2 } from "path";
 import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual3 } from "crypto";
@@ -31225,10 +31225,10 @@ function dataDir2(options) {
   return pathsResolverResolve("data", options);
 }
 function effectiveHome2() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || homedir7();
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir8();
 }
 function legacyHomeDir() {
-  return join35(effectiveHome2(), ".hasna", "events");
+  return join36(effectiveHome2(), ".hasna", "events");
 }
 function resolverHome() {
   return dataDir2({ app: "events", home: effectiveHome2() || undefined });
@@ -31237,7 +31237,7 @@ function adoptResolverHome(resolved, env = process.env) {
   const dataOverride = env.HASNA_DATA_HOME;
   if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
     return true;
-  return existsSync16(join35(resolved, EVENTS_STORE_SENTINEL_FILE));
+  return existsSync16(join36(resolved, EVENTS_STORE_SENTINEL_FILE));
 }
 function exactEventsHome() {
   const dir = process.env[HASNA_EVENTS_DIR_ENV];
@@ -31251,9 +31251,9 @@ function exactEventsHome() {
 function getEventsHome() {
   const exact = exactEventsHome();
   if (exact)
-    return resolve17(exact);
+    return resolve18(exact);
   const resolved = resolverHome();
-  return adoptResolverHome(resolved) ? resolve17(resolved) : resolve17(legacyHomeDir());
+  return adoptResolverHome(resolved) ? resolve18(resolved) : resolve18(legacyHomeDir());
 }
 function getEventsDataDir(override) {
   return override || getEventsHome();
@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.10",
+  version: "0.9.12",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -37210,10 +37210,10 @@ async function reconcileSkillSession(input, options = {}) {
   return { applied: true, plan, planDigest, ...result };
 }
 // src/lib/selected-run.ts
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 import { spawn } from "child_process";
-import { mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync8, realpathSync as realpathSync7 } from "fs";
-import { dirname as dirname17, join as join30, resolve as resolve16 } from "path";
+import { mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync9, realpathSync as realpathSync8 } from "fs";
+import { dirname as dirname19, join as join31, resolve as resolve17 } from "path";
 import { tmpdir, hostname as stationHostname2 } from "os";
 
 // src/lib/dependency-preparation.ts
@@ -37425,18 +37425,18 @@ async function prepareSkillDependencies(skillPath, env, timeoutMs = DEFAULT_PREP
 
 // src/lib/skillinfo.ts
 import { existsSync as existsSync14, readFileSync as readFileSync20 } from "fs";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 
 // src/lib/installer.ts
 import { existsSync as existsSync13, readFileSync as readFileSync19, rmSync as rmSync4 } from "fs";
-import { join as join28 } from "path";
-import { homedir as homedir5 } from "os";
+import { join as join29 } from "path";
+import { homedir as homedir6 } from "os";
 
 // src/lib/agent-sync.ts
 import {
   cpSync as cpSync2,
   existsSync as existsSync10,
-  lstatSync as lstatSync19,
+  lstatSync as lstatSync21,
   mkdirSync as mkdirSync8,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync16,
@@ -37444,15 +37444,34 @@ import {
   renameSync as renameSync5,
   rmSync as rmSync3,
   statSync as statSync9,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "fs";
-import { homedir as homedir4 } from "os";
-import { basename as basename9, dirname as dirname16, join as join25 } from "path";
+import { homedir as homedir5 } from "os";
+import { basename as basename10, dirname as dirname18, join as join26 } from "path";
+
+// src/lib/native-discovery-roots.ts
+var NATIVE_SKILL_ROOTS = [
+  ["claude", ".claude/skills"],
+  ["codex", ".codex/skills"],
+  ["codex", ".agents/skills"],
+  ["gemini", ".gemini/skills"],
+  ["codewith", ".codewith/skills"],
+  ["opencode", ".config/opencode/skills"],
+  ["opencode", ".opencode/skills"],
+  ["cursor", ".cursor/skills"],
+  ["hermes", ".hermes/skills"],
+  ["windsurf", ".windsurf/skills"],
+  ["pi", ".pi/agent/skills"],
+  ["amp", ".amp/skills"],
+  ["cline", ".cline/skills"],
+  ["roo", ".roo/skills"],
+  ["copilot", ".github/skills"]
+];
 
 // src/lib/agent-integration.ts
-import { createHash as createHash14, randomUUID as randomUUID3 } from "crypto";
-import { existsSync as existsSync6, lstatSync as lstatSync17, statSync as statSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync13, readdirSync as readdirSync7, opendirSync as opendirSync5, readlinkSync as readlinkSync2, realpathSync as realpathSync4, renameSync as renameSync3, rmdirSync as rmdirSync3, writeFileSync as writeFileSync3, unlinkSync as unlinkSync4, chmodSync, openSync as openSync15, closeSync as closeSync15, fsyncSync as fsyncSync3, fstatSync as fstatSync15, readSync as readSync10, constants as constants11, linkSync as linkSync2 } from "fs";
-import { dirname as dirname13, join as join21, resolve as resolve14, relative as relative3, isAbsolute as isAbsolute15, sep as sep4 } from "path";
+import { createHash as createHash16, randomUUID as randomUUID3 } from "crypto";
+import { existsSync as existsSync6, lstatSync as lstatSync18, statSync as statSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync13, readdirSync as readdirSync7, opendirSync as opendirSync5, readlinkSync as readlinkSync2, realpathSync as realpathSync4, renameSync as renameSync3, rmdirSync as rmdirSync3, writeFileSync as writeFileSync4, unlinkSync as unlinkSync4, chmodSync, openSync as openSync16, closeSync as closeSync16, fsyncSync as fsyncSync4, fstatSync as fstatSync16, readSync as readSync11, constants as constants12, linkSync as linkSync2 } from "fs";
+import { dirname as dirname14, join as join21, resolve as resolve14, relative as relative3, isAbsolute as isAbsolute15, sep as sep4 } from "path";
 import { homedir as homedir3 } from "os";
 
 // src/lib/managed-policy.ts
@@ -37682,9 +37701,9 @@ function isOwnedCliBridge(path, expectedPaths) {
 }
 
 // src/lib/agent-discovery.ts
-import { createHash as createHash13 } from "crypto";
-import { lstatSync as lstatSync16, readFileSync as readFileSync12, readdirSync as readdirSync6, realpathSync as realpathSync3 } from "fs";
-import { basename as basename6, dirname as dirname12, isAbsolute as isAbsolute14, join as join20, resolve as resolve13, sep as sep3 } from "path";
+import { createHash as createHash15 } from "crypto";
+import { lstatSync as lstatSync17, readFileSync as readFileSync12, readdirSync as readdirSync6, realpathSync as realpathSync3 } from "fs";
+import { basename as basename6, dirname as dirname13, isAbsolute as isAbsolute14, join as join20, resolve as resolve13, sep as sep3 } from "path";
 
 // node_modules/yaml/dist/index.js
 var composer = require_composer();
@@ -37812,6 +37831,48 @@ function assertHermesEnvironment(home) {
   if (process.env.HERMES_ENABLE_PROJECT_PLUGINS?.trim() && !["0", "false", "no", "off"].includes(process.env.HERMES_ENABLE_PROJECT_PLUGINS.trim().toLowerCase()))
     throw new Error("NATIVE_SKILL_DRIFT: Hermes project plugins require a dedicated discovery review");
 }
+function read(path) {
+  for (let current = path;; current = dirname4(current)) {
+    if (lstatSync7(current, { throwIfNoEntry: false })?.isSymbolicLink())
+      throw new Error("NATIVE_SKILL_DRIFT: symlink Hermes protection input");
+    if (dirname4(current) === current)
+      break;
+  }
+  const stat = lstatSync7(path, { throwIfNoEntry: false });
+  if (!stat)
+    return null;
+  if (!stat.isFile() || stat.size > 1024 * 1024)
+    throw new Error("NATIVE_SKILL_DRIFT: invalid Hermes protection input");
+  return readFileSync9(path, "utf8");
+}
+function assertHermesProtection(home, config, command, profile, supervisor) {
+  assertHermesEnvironment(home);
+  if (read(join12(home, ".hermes", HERMES_OPT_OUT)) === null)
+    throw new Error("NATIVE_SKILL_DRIFT: Hermes bundled skill reseeding is not disabled; run skills hook install");
+  if (!supervisor || !isAbsolute4(supervisor.path) || supervisor.runtime !== process.execPath || read(supervisor.path) !== renderHermesSupervisor(command, profile))
+    throw new Error("NATIVE_SKILL_DRIFT: Hermes owned supervisor changed; run skills hook install");
+  const raw = read(join12(home, ".hermes/shell-hooks-allowlist.json"));
+  let trust;
+  try {
+    trust = raw === null ? undefined : JSON.parse(raw);
+  } catch {
+    throw new Error("NATIVE_SKILL_DRIFT: invalid Hermes native hook trust");
+  }
+  for (const [event, entry] of Object.entries(hermesHookDefinitions(supervisor))) {
+    if (!Array.isArray(config.hooks?.[event]) || config.hooks[event].filter((actual) => sameEntry(actual, entry)).length !== 1)
+      throw new Error("NATIVE_SKILL_DRIFT: Hermes required native hooks changed; run skills hook install");
+    if (!Array.isArray(trust?.approvals) || !trust.approvals.some((approval) => object3(approval) && approval.event === event && approval.command === entry.command))
+      throw new Error("NATIVE_SKILL_DRIFT: approve the exact managed commands through Hermes normal native hook trust before starting a session");
+  }
+  if (config.skills?.platform_disabled !== undefined && !object3(config.skills.platform_disabled))
+    throw new Error("NATIVE_SKILL_DRIFT: malformed Hermes platform skill settings");
+  const disabled = config.skills?.disabled;
+  if (disabled !== undefined && (!Array.isArray(disabled) || disabled.some((value) => typeof value !== "string") || disabled.includes("skills-cli")))
+    throw new Error("NATIVE_SKILL_DRIFT: Hermes Skills CLI bridge is disabled or its names are malformed");
+  for (const names of Object.values(config.skills?.platform_disabled ?? {}))
+    if (!Array.isArray(names) || names.some((value) => typeof value !== "string") || names.includes("skills-cli"))
+      throw new Error("NATIVE_SKILL_DRIFT: a Hermes platform disables the Skills CLI bridge");
+}
 function assertNoHermesLegacyShadow(root) {
   let entries = 0;
   for (let cursor = resolve4(root);; cursor = dirname4(cursor)) {
@@ -40054,6 +40115,27 @@ function canonical3(value) {
     return { kind: "array", items: value.items.map(canonical3) };
   return value;
 }
+function assertClaudeStopHookReplacement(before, replacement) {
+  function bounded(text2) {
+    need3(typeof text2 === "string" && Buffer.byteLength(text2) <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes, "Stop update exceeds its byte limit");
+    return parse6(text2);
+  }
+  const original = bounded(before ?? "{}"), next = bounded(replacement);
+  const hadHooks = original.entries.some(([key]) => key === "hooks");
+  function withoutStop(value) {
+    const hooks = value.entries.find(([key]) => key === "hooks")?.[1];
+    if (hooks !== undefined) {
+      need3(hooks.kind === "object", "Stop update requires an object of hooks");
+      const stop = hooks.entries.find(([key]) => key === "Stop")?.[1];
+      need3(stop === undefined || stop.kind === "array", "Stop update requires a Stop array");
+      hooks.entries = hooks.entries.filter(([key]) => key !== "Stop");
+      if (!hadHooks && hooks.entries.length === 0)
+        value.entries = value.entries.filter(([key]) => key !== "hooks");
+    }
+    return canonical3(value);
+  }
+  need3(JSON.stringify(withoutStop(original)) === JSON.stringify(withoutStop(next)), "Stop update changed settings outside hooks.Stop");
+}
 function settingsDigest(text2) {
   const value = parse6(text2);
   value.entries = value.entries.filter(([key, child]) => {
@@ -40084,8 +40166,76 @@ function captureClaudeSettings(path, budget = { remaining: 256 * 1024 * 1024 })
   return { path, hashMode: "claude-settings-v1", sha256: settingsDigest(readSettings(path, budget)) };
 }
 
+// src/lib/codex-hook-discovery-recovery.ts
+import { createHash as createHash14 } from "crypto";
+
+// src/lib/codex-hook-trust-files.ts
+import { closeSync as closeSync15, constants as constants11, fstatSync as fstatSync15, fsyncSync as fsyncSync3, lstatSync as lstatSync16, openSync as openSync15, readSync as readSync10, writeFileSync as writeFileSync3 } from "fs";
+import { createHash as createHash13 } from "crypto";
+import { dirname as dirname12 } from "path";
+function need4(value, code) {
+  if (!value)
+    throw new Error(`CODEX_HOOK_TRUST_${code}`);
+}
+var sameStat = (a, b) => ["dev", "ino", "uid", "nlink", "mode", "size", "mtimeNs", "ctimeNs"].every((key) => a[key] === b[key]);
+function safeParents(file) {
+  for (let p = dirname12(file);; p = dirname12(p)) {
+    const s = lstatSync16(p);
+    need4(s.isDirectory() && !s.isSymbolicLink(), "UNSAFE_PARENT");
+    need4((s.mode & 18) === 0 || s.uid === 0 && (s.mode & 512) !== 0, "UNSAFE_PARENT");
+    if (dirname12(p) === p)
+      break;
+  }
+}
+function snapshot(file, privateFile = false, options = {}) {
+  const readOnlyPackage = options.readOnlyPackage === true && !privateFile;
+  safeParents(file);
+  const initial = lstatSync16(file, { bigint: true });
+  need4(initial.isFile() && initial.uid === BigInt(process.getuid()) && (initial.nlink === 1n || readOnlyPackage && initial.nlink > 1n) && (initial.mode & 0o022n) === 0n && (!privateFile || (initial.mode & 0o777n) === 0o600n), "UNSAFE_FILE");
+  need4(initial.size <= 8n * 1024n * 1024n, "FILE_BOUND");
+  const fd = openSync15(file, constants11.O_RDONLY | constants11.O_NOFOLLOW | constants11.O_NONBLOCK);
+  try {
+    const before = fstatSync15(fd, { bigint: true });
+    need4(sameStat(initial, before), "INPUT_CHANGED");
+    const bytes = Buffer.alloc(Number(before.size) + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const n2 = readSync10(fd, bytes, length, bytes.length - length, null);
+      if (!n2)
+        break;
+      length += n2;
+    }
+    need4(length === Number(before.size) && sameStat(before, fstatSync15(fd, { bigint: true })) && sameStat(before, lstatSync16(file, { bigint: true })), "INPUT_CHANGED");
+    const content = bytes.subarray(0, length), text2 = new TextDecoder("utf-8", { fatal: true }).decode(content);
+    return { file, privateFile, readOnlyPackage, text: text2, bytes: content, stat: before, sha256: createHash13("sha256").update(content).digest("hex") };
+  } finally {
+    closeSync15(fd);
+  }
+}
+function unchanged2(before) {
+  const after = snapshot(before.file, before.privateFile, before.readOnlyPackage ? { readOnlyPackage: true } : {});
+  need4(sameStat(before.stat, after.stat) && after.sha256 === before.sha256, "INPUT_CHANGED");
+}
+
+// src/lib/codex-hook-discovery-recovery.ts
+var sha = (text2) => createHash14("sha256").update(text2).digest("hex");
+var proofs = new WeakMap;
+function assertCodexHookDiscoveryRecovery(binding, witness) {
+  const proof = proofs.get(witness);
+  need4(!!proof && binding.agent === "codex" && witness.discoverySha256 === sha(JSON.stringify(binding)), "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
+  unchanged2(proof.before);
+  unchanged2(proof.current);
+}
+function verifiesCodexHookDiscoverySource(binding, source, currentDigest, witness) {
+  if (!witness || source.path !== witness.configPath || source.hashMode !== "bytes")
+    return false;
+  assertCodexHookDiscoveryRecovery(binding, witness);
+  need4(source.sha256 === witness.beforeSha256 && currentDigest === witness.currentSha256, "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
+  return true;
+}
+
 // src/lib/agent-discovery.ts
-var digest2 = (text2) => createHash13("sha256").update(text2).digest("hex");
+var digest2 = (text2) => createHash15("sha256").update(text2).digest("hex");
 function parseConfig(text2, path, toml = false) {
   try {
     const value = toml ? Bun.TOML.parse(text2) : JSON.parse(text2);
@@ -40099,18 +40249,18 @@ function parseConfig(text2, path, toml = false) {
 function safe4(path) {
   if (!isAbsolute14(path) || path.includes("\x00"))
     throw new Error("Expected an absolute native discovery path");
-  for (let cursor = path;; cursor = dirname12(cursor)) {
-    if (lstatSync16(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+  for (let cursor = path;; cursor = dirname13(cursor)) {
+    if (lstatSync17(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink native discovery input: ${cursor}`);
-    if (dirname12(cursor) === cursor)
+    if (dirname13(cursor) === cursor)
       break;
   }
 }
-function read(path, changes) {
+function read2(path, changes) {
   safe4(path);
   if (changes?.has(path))
     return changes.get(path);
-  const stat2 = lstatSync16(path, { throwIfNoEntry: false });
+  const stat2 = lstatSync17(path, { throwIfNoEntry: false });
   if (!stat2)
     return null;
   if (!stat2.isFile() || stat2.size > 16 * 1024 * 1024)
@@ -40150,7 +40300,7 @@ function projected(source, changes, budget = discoveryByteBudget()) {
       return hashDiscoveryPathFile(source.path, budget, changes);
     return hashRawDiscoveryFile(source.path, budget, changes);
   }
-  const text2 = read(source.path, changes);
+  const text2 = read2(source.path, changes);
   if (text2 === null)
     return null;
   if (!source.format)
@@ -40160,7 +40310,9 @@ function projected(source, changes, budget = discoveryByteBudget()) {
     throw new Error("Expected native discovery configuration object");
   return digest2(JSON.stringify(Object.fromEntries((source.fields ?? []).map((field2) => [field2, object4[field2] ?? null]))));
 }
-function verifyAgentDiscovery(binding) {
+function verifyAgentDiscovery(binding, codexRecovery) {
+  if (codexRecovery)
+    assertCodexHookDiscoveryRecovery(binding, codexRecovery);
   if (!binding || !Array.isArray(binding.sources) || !Array.isArray(binding.roots) || binding.sources.length > AGENT_POLICY_LIMITS.discoverySources || binding.roots.length > AGENT_POLICY_LIMITS.discoveryRoots)
     throw new Error("Invalid native discovery binding");
   if (binding.agent === "hermes" && !binding.directories?.length)
@@ -40176,7 +40328,8 @@ function verifyAgentDiscovery(binding) {
       throw new Error("Invalid native discovery projection");
     if (source.sha256 !== null && !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Invalid native discovery digest");
-    if (projected(source, undefined, budget) !== source.sha256)
+    const current = projected(source, undefined, budget);
+    if (current !== source.sha256 && !verifiesCodexHookDiscoverySource(binding, source, current, codexRecovery))
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
   }
   for (const root2 of binding.roots)
@@ -40207,6 +40360,49 @@ function captureDiscoveryPathSources(paths) {
   const budget = discoveryByteBudget();
   return paths.map((path) => ({ path, hashMode: "path-bytes", sha256: hashDiscoveryPathFile(path, budget) }));
 }
+function assertProjectDiscovery(agent, directories, home, canonical4 = resolve13, reviewed) {
+  for (const directory of directories) {
+    const isHome = resolve13(directory) === resolve13(home);
+    if (agent === "hermes") {
+      assertHermesEnvironment(home);
+      continue;
+    }
+    if (isHome && agent !== "claude")
+      continue;
+    const paths = agent === "claude" ? [...isHome ? [] : [".claude/settings.json"], ".claude/settings.local.json"] : agent === "codex" ? [".codex/config.toml"] : agent === "gemini" ? [".gemini/settings.json"] : agent === "opencode" ? ["opencode.json", "opencode.jsonc", ".opencode/opencode.json", ".opencode/opencode.jsonc"] : [".cursor/hooks.json"];
+    for (const suffix of paths) {
+      const path = canonical4(join20(directory, suffix)), raw = read2(path);
+      if (raw === null)
+        continue;
+      if (agent === "claude" && suffix === ".claude/settings.json" && path === canonical4(join20(home, suffix)))
+        continue;
+      if (suffix.endsWith(".jsonc"))
+        throw new Error(`NATIVE_SKILL_DRIFT: project JSONC discovery configuration requires review: ${path}`);
+      const config = parseConfig(raw, path, suffix.endsWith(".toml"));
+      const keys2 = agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces", "skillOverrides"] : agent === "codex" ? ["plugins", "marketplaces", "skills"] : agent === "gemini" ? ["skills", "extensions"] : agent === "opencode" ? ["plugin", "skills"] : ["hooks"];
+      let admittedPlugins = false;
+      if (agent === "claude" && reviewed?.agent === agent && reviewed.method === "reviewed" && config.enabledPlugins && typeof config.enabledPlugins === "object" && !Array.isArray(config.enabledPlugins)) {
+        const exact = reviewed.sources.find((source) => source.path === path && source.format === undefined && source.fields === undefined && (source.hashMode === undefined || source.hashMode === "bytes"));
+        const managed = reviewed.sources.flatMap((source) => source.hashMode === "claude-plugin-registry" ? source.managedPlugins ?? [] : []);
+        if (exact && projected(exact) === exact.sha256 && managed.length) {
+          const bindings = managed.map((item) => readPluginBinding(item.storeRoot, item.bindingId));
+          admittedPlugins = Object.entries(config.enabledPlugins).every(([id2, enabled]) => typeof enabled === "boolean" && bindings.some((binding) => binding.target.pluginId === id2 && binding.target.registrations.some((scope) => scope.scope === "project" && scope.projectPath === canonical4(directory))));
+        }
+      }
+      if (keys2.some((key) => config[key] !== undefined && !(key === "enabledPlugins" && admittedPlugins)) || config.disableAllHooks === true || config.disableBundledSkills === false || config.hooksConfig?.enabled === false || config.permission?.skill !== undefined || config.permissions?.deny?.some((rule) => typeof rule === "string" && /^Skill(?:\(|$)/.test(rule)))
+        throw new Error(`NATIVE_SKILL_DRIFT: higher-precedence project skill or hook configuration requires review: ${path}`);
+    }
+    if (agent === "claude") {
+      const commands = canonical4(join20(directory, ".claude/commands"));
+      safe4(commands);
+      if (lstatSync17(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync6(commands).length)
+        throw new Error("NATIVE_SKILL_DRIFT: legacy project command discovery requires a dedicated format adapter");
+    }
+  }
+}
+function agentDiscoveryConfigPath(home, agent) {
+  return join20(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
+}
 function resolveAgentDiscovery(options) {
   const canonical4 = options.canonical ?? resolve13, home = resolve13(options.home), agent = options.agent;
   const sources = [], roots = new Set, builtinNames = [];
@@ -40214,11 +40410,11 @@ function resolveAgentDiscovery(options) {
     const source = { path: canonical4(path), sha256: null, ...format ? { format, fields } : {} };
     source.sha256 = projected(source);
     sources.push(source);
-    return read(source.path);
+    return read2(source.path);
   };
   if (agent === "hermes")
     assertHermesEnvironment(home);
-  const configPath = join20(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
+  const configPath = agentDiscoveryConfigPath(home, agent);
   const configText = witness(configPath, agent === "hermes" ? "yaml" : agent === "codex" ? "toml" : "json", agent === "hermes" ? ["skills", "plugins", "hooks"] : agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces"] : agent === "codex" ? ["plugins", "marketplaces", "skills"] : agent === "gemini" ? ["skills", "extensions", "security"] : agent === "opencode" ? ["plugin", "skills"] : ["version"]);
   const config = configText === null ? {} : agent === "hermes" ? parseHermesConfig(configText) : parseConfig(configText, configPath, agent === "codex");
   const unresolved = (detail) => {
@@ -40248,21 +40444,21 @@ function resolveAgentDiscovery(options) {
     const executable = Bun.which("gemini");
     if (executable) {
       let packageRoot;
-      for (let directory = dirname12(realpathSync3(executable)), depth = 0;depth < 8; directory = dirname12(directory), depth++) {
-        const path = join20(directory, "package.json"), raw = read(path);
+      for (let directory = dirname13(realpathSync3(executable)), depth = 0;depth < 8; directory = dirname13(directory), depth++) {
+        const path = join20(directory, "package.json"), raw = read2(path);
         if (raw !== null && parseConfig(raw, path).name === "@google/gemini-cli") {
           packageRoot = directory;
           witness(path);
           break;
         }
-        if (dirname12(directory) === directory)
+        if (dirname13(directory) === directory)
           break;
       }
       if (!packageRoot)
         unresolved("installed Gemini package layout is not recognized");
       const builtinRoot = join20(packageRoot, "bundle/builtin");
       safe4(builtinRoot);
-      if (!lstatSync16(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
+      if (!lstatSync17(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
         unresolved("installed Gemini builtin root is missing");
       for (const name of readdirSync6(builtinRoot).sort()) {
         const text2 = witness(join20(builtinRoot, name, "SKILL.md"));
@@ -40302,7 +40498,7 @@ function resolveAgentDiscovery(options) {
       unresolved("plugin hooks require a separate no-skill-injection review");
     const commands = join20(root2, "commands");
     safe4(commands);
-    if (agent === "claude" && (manifest.commands !== undefined || lstatSync16(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync6(commands).length))
+    if (agent === "claude" && (manifest.commands !== undefined || lstatSync17(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync6(commands).length))
       unresolved("legacy command discovery requires retirement or a dedicated format adapter");
     const rootSkill = witness(join20(root2, "SKILL.md"));
     if (rootSkill !== null)
@@ -40316,7 +40512,7 @@ function resolveAgentDiscovery(options) {
       const path = resolve13(root2, value);
       if (path !== root2 && !path.startsWith(root2 + sep3))
         unresolved("plugin skill path escapes its root");
-      roots.add(path.endsWith(`${sep3}SKILL.md`) ? dirname12(path) : path);
+      roots.add(path.endsWith(`${sep3}SKILL.md`) ? dirname13(path) : path);
     }
   }
   if (agent === "claude") {
@@ -40324,7 +40520,7 @@ function resolveAgentDiscovery(options) {
     const installed = registrations === null ? {} : parseConfig(registrations, join20(home, ".claude/plugins/installed_plugins.json")).plugins;
     const commands = canonical4(join20(home, ".claude/commands"));
     safe4(commands);
-    if (lstatSync16(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync6(commands).length)
+    if (lstatSync17(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync6(commands).length)
       unresolved("legacy home command discovery requires a dedicated format adapter");
     for (const [id2, enabled] of Object.entries(config.enabledPlugins ?? {})) {
       if (enabled === false)
@@ -40366,12 +40562,12 @@ function resolveAgentDiscovery(options) {
     }
     const localPlugins = join20(home, ".config/opencode/plugins");
     safe4(localPlugins);
-    if (lstatSync16(localPlugins, { throwIfNoEntry: false }) && readdirSync6(localPlugins).some((name) => name !== "skills-cli.js"))
+    if (lstatSync17(localPlugins, { throwIfNoEntry: false }) && readdirSync6(localPlugins).some((name) => name !== "skills-cli.js"))
       unresolved("additional local plugin hooks require review");
   } else if (agent === "hermes") {
     for (const directory of [join20(home, ".hermes/plugins"), join20(home, ".hermes/hermes-agent")]) {
       safe4(directory);
-      if (lstatSync16(directory, { throwIfNoEntry: false }))
+      if (lstatSync17(directory, { throwIfNoEntry: false }))
         unresolved("installed runtime/plugin discovery requires reviewed source bindings");
     }
     if (Bun.which("hermes") || Object.keys(config.plugins ?? {}).length)
@@ -40381,11 +40577,11 @@ function resolveAgentDiscovery(options) {
       unresolved("custom extension or skill paths");
     const directory = join20(home, ".gemini/extensions");
     safe4(directory);
-    if (lstatSync16(directory, { throwIfNoEntry: false }))
+    if (lstatSync17(directory, { throwIfNoEntry: false }))
       for (const name of readdirSync6(directory)) {
         const root2 = join20(directory, name);
         safe4(root2);
-        if (!lstatSync16(root2)?.isDirectory())
+        if (!lstatSync17(root2)?.isDirectory())
           continue;
         const raw = witness(join20(root2, "gemini-extension.json"));
         if (raw === null)
@@ -40540,30 +40736,14 @@ function disableCodexBundledSkills(text2) {
 }
 
 // src/lib/agent-integration.ts
-var sha = (data) => createHash14("sha256").update(data).digest("hex");
-var ROOTS = [
-  ["claude", ".claude/skills"],
-  ["codex", ".codex/skills"],
-  ["codex", ".agents/skills"],
-  ["gemini", ".gemini/skills"],
-  ["codewith", ".codewith/skills"],
-  ["opencode", ".config/opencode/skills"],
-  ["opencode", ".opencode/skills"],
-  ["cursor", ".cursor/skills"],
-  ["hermes", ".hermes/skills"],
-  ["windsurf", ".windsurf/skills"],
-  ["pi", ".pi/agent/skills"],
-  ["amp", ".amp/skills"],
-  ["cline", ".cline/skills"],
-  ["roo", ".roo/skills"],
-  ["copilot", ".github/skills"]
-];
+var sha2 = (data) => createHash16("sha256").update(data).digest("hex");
+var ROOTS = NATIVE_SKILL_ROOTS;
 function assertSafePath(path) {
   let cursor = resolve14(path);
   while (true) {
-    if (lstatSync17(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync18(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink path: ${cursor}`);
-    const parent = dirname13(cursor);
+    const parent = dirname14(cursor);
     if (parent === cursor)
       return;
     cursor = parent;
@@ -40572,12 +40752,12 @@ function assertSafePath(path) {
 function readRootAlias(home, agent) {
   assertSafePath(home);
   const realHome = realpathSync4(home), alias = join21(realHome, `.${agent}`);
-  const stat2 = lstatSync17(alias, { throwIfNoEntry: false, bigint: true });
+  const stat2 = lstatSync18(alias, { throwIfNoEntry: false, bigint: true });
   if (!stat2?.isSymbolicLink())
     throw new Error(`Agent root alias changed after planning: ${alias}`);
-  const link = readlinkSync2(alias), targetPath = resolve14(dirname13(alias), link);
+  const link = readlinkSync2(alias), targetPath = resolve14(dirname14(alias), link);
   assertSafePath(targetPath);
-  const targetStat = lstatSync17(targetPath, { throwIfNoEntry: false });
+  const targetStat = lstatSync18(targetPath, { throwIfNoEntry: false });
   if (!targetStat?.isDirectory())
     throw new Error(`Agent root alias must target an existing directory: ${alias}`);
   const target = realpathSync4(targetPath), inside = relative3(realHome, target);
@@ -40590,7 +40770,7 @@ function rootAliases(home, allowed = false) {
     return [];
   const result = [];
   for (const agent of ["claude", "codex"])
-    if (lstatSync17(join21(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync18(join21(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
       result.push(readRootAlias(home, agent));
   if (result.some((item, index) => result.slice(index + 1).some((other) => item.target === other.target || item.target.startsWith(other.target + sep4) || other.target.startsWith(item.target + sep4))))
     throw new Error("Agent root alias targets must not overlap");
@@ -40611,35 +40791,35 @@ function recheckRootAliases(aliases) {
 }
 function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
   assertSafePath(path);
-  const before = lstatSync17(path);
+  const before = lstatSync18(path);
   if (!before.isFile() || before.size > maximum)
     throw new Error("Unsupported or oversized native skill file");
-  const descriptor = openSync15(path, constants11.O_RDONLY | constants11.O_NOFOLLOW | constants11.O_NONBLOCK);
+  const descriptor = openSync16(path, constants12.O_RDONLY | constants12.O_NOFOLLOW | constants12.O_NONBLOCK);
   try {
-    const opened = fstatSync15(descriptor);
+    const opened = fstatSync16(descriptor);
     if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size)
       throw new Error("Native skill file changed while reading");
     const bytes = Buffer.allocUnsafe(before.size + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync10(descriptor, bytes, length, bytes.length - length, null);
+      const count = readSync11(descriptor, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    const after = fstatSync15(descriptor);
+    const after = fstatSync16(descriptor);
     if (length !== before.size || after.size !== before.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs)
       throw new Error("Native skill file changed while reading");
     return bytes.subarray(0, length);
   } finally {
-    closeSync15(descriptor);
+    closeSync16(descriptor);
   }
 }
 function treeHash(root2) {
-  const hash2 = createHash14("sha256");
+  const hash2 = createHash16("sha256");
   let bytes = 0, files = 0;
   function visit2(path) {
-    const stat2 = lstatSync17(path);
+    const stat2 = lstatSync18(path);
     if (stat2.isSymbolicLink())
       throw new Error(`Refusing symlink in skill: ${path}`);
     const rel = relative3(root2, path);
@@ -40669,7 +40849,7 @@ function selectNativeMigrationTargets(inventory, manifest) {
   const selected = [];
   for (const target of manifest.targets) {
     const projectRoot = resolve14(target.projectRoot), normalized = relative3(projectRoot, resolve14(projectRoot, target.path));
-    if (!isAbsolute15(target.projectRoot) || projectRoot !== target.projectRoot || !existsSync6(projectRoot) || !lstatSync17(projectRoot).isDirectory())
+    if (!isAbsolute15(target.projectRoot) || projectRoot !== target.projectRoot || !existsSync6(projectRoot) || !lstatSync18(projectRoot).isDirectory())
       throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
     assertSafePath(projectRoot);
     if (isAbsolute15(target.path) || target.path.includes("\\") || target.path.includes("\x00") || !normalized || normalized === ".." || normalized.startsWith(`..${sep4}`) || normalized !== target.path || !/^[0-9a-f]{64}$/.test(target.treeSha256))
@@ -40698,7 +40878,7 @@ function projectAncestorDirectories(projects) {
       if (depth >= 100)
         throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
       directories.add(path);
-      const parent = dirname13(path);
+      const parent = dirname14(path);
       if (parent === path)
         break;
       path = parent;
@@ -40729,9 +40909,9 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
   }
   function emptySiblingCacheAlias(path, parent) {
     const link = readlinkSync2(path), target = resolve14(parent, link);
-    if (dirname13(target) !== parent || (isAbsolute15(link) ? link !== target : dirname13(link) !== "."))
+    if (dirname14(target) !== parent || (isAbsolute15(link) ? link !== target : dirname14(link) !== "."))
       return false;
-    if (!lstatSync17(target, { throwIfNoEntry: false })?.isDirectory())
+    if (!lstatSync18(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
     const scan = cacheScans.get(target);
     return Boolean(scan?.complete && !scan.hasSkills && scan.entries <= maxAliasProofEntries);
@@ -40743,7 +40923,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     assertSafePath(path);
     if (!existsSync6(path))
       return scan;
-    const stat2 = lstatSync17(path);
+    const stat2 = lstatSync18(path);
     if (stat2.isFile())
       return scan;
     if (!stat2.isDirectory())
@@ -40789,7 +40969,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       if (isVendor && !options.includeVendor)
         continue;
       const child = join21(path, name);
-      if (isVendor && lstatSync17(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      if (isVendor && lstatSync18(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
         const target = statSync5(child, { throwIfNoEntry: false });
         if (target?.isFile() || pluginCache && target?.isDirectory() && emptySiblingCacheAlias(child, path)) {
           scan.entries++;
@@ -40854,6 +41034,22 @@ function configureHooks(config, agent, command, profileId, nativeReady) {
     if (!Array.isArray(existing))
       throw new Error(`Expected ${event} hooks array`);
     const hookCommand = renderAgentHookCommand(command, agent, profileId, event);
+    if (agent === "codex") {
+      let ownedIndex = -1;
+      for (const [index, entry] of existing.entries()) {
+        if (!entry || !Array.isArray(entry.hooks))
+          throw new Error(`Malformed ${event} hook entry`);
+        const owned = entry.hooks.filter((hook) => hook?.type === "command" && typeof hook.command === "string" && /(?:^|\s)hook user-prompt --agent codex(?: --selection-profile [A-Za-z0-9._-]+)?(?: --event [A-Za-z]+)?$/.test(hook.command));
+        if (!owned.length)
+          continue;
+        if (ownedIndex !== -1 || entry.hooks.length !== 1 || Object.keys(entry).length !== 1)
+          throw new Error(`Review ambiguous ${event} Codex Skills hook groups before installation; unrelated native hook positions must be preserved`);
+        ownedIndex = index;
+      }
+      const replacement = { hooks: [{ type: "command", command: hookCommand, timeout: 15 }] };
+      config.hooks[event] = ownedIndex === -1 ? [...existing, replacement] : existing.map((entry, index) => index === ownedIndex ? replacement : entry);
+      continue;
+    }
     const retained = existing.flatMap((entry) => {
       if (agent === "cursor") {
         if (!entry || typeof entry.command !== "string")
@@ -40999,7 +41195,7 @@ function planAgentIntegration(options) {
         throw new Error("Refusing to overwrite an unrecognized Hermes supervisor");
       if (supervisorBefore !== supervisorAfter)
         changes.push({ path: supervisorPath, before: supervisorBefore, after: supervisorAfter });
-      const supervisor = { path: supervisorPath, runtime: process.execPath, sha256: sha(supervisorAfter) };
+      const supervisor = { path: supervisorPath, runtime: process.execPath, sha256: sha2(supervisorAfter) };
       const after2 = configureHermesHooks(before, supervisor, previous);
       if (before !== after2)
         changes.push({ path, before, after: after2 });
@@ -41046,7 +41242,7 @@ function planAgentIntegration(options) {
     agents: [...new Set([...priorAgents, ...options.agents])].sort(),
     home: resolve14(home),
     includeVendor: true,
-    ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join21(dataDir2, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha(renderHermesSupervisor(bindings.get("hermes").command, bindings.get("hermes").profileId)) } } } : {},
+    ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join21(dataDir2, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha2(renderHermesSupervisor(bindings.get("hermes").command, bindings.get("hermes").profileId)) } } } : {},
     commands: { ...policy.bridge?.commands, ...Object.fromEntries([...bindings].map(([agent, binding]) => [agent, binding.command])) },
     profiles: Object.fromEntries([...new Set([...priorAgents, ...options.agents])].sort().map((agent) => [agent, bindings.get(agent)?.profileId ?? policy.bridge?.profiles?.[agent] ?? policy.profileId])),
     disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join21(home, ".codex", "skills", ".system"), aliases) + sep4)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
@@ -41059,12 +41255,68 @@ function planAgentIntegration(options) {
   recheckRootAliases(aliases);
   return { dataDir: dataDir2, profileId, changes, nativeSkills, observedPolicy: { path: policyPath, before: previousPolicy }, discoveryBefore: discoveries, discoveryAfter, ...aliases.length ? { rootAliases: aliases } : {} };
 }
+function planClaudeStopHookUpdate(options) {
+  const home = resolve14(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
+  const policyPath = join21(dataDir2, "agent-policy.json");
+  assertSafePath(policyPath);
+  const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
+  if (!snapshot2)
+    return null;
+  const policy = snapshot2.value, bridge = policy.bridge;
+  if (!bridge || bridge.home !== home || bridge.version !== CLI_BRIDGE_VERSION || bridge.digest !== CLI_BRIDGE_DIGEST || !Array.isArray(bridge.agents) || !bridge.agents.length || bridge.agents.some((agent) => !INTEGRATION_AGENTS.includes(agent)) || new Set(bridge.agents).size !== bridge.agents.length || !bridge.discovery || typeof bridge.discovery !== "object" || Array.isArray(bridge.discovery)) {
+    throw new Error("Invalid managed bridge for Claude settings update");
+  }
+  const aliases = bridge.rootAliases ?? [];
+  recheckRootAliases(aliases);
+  const path = canonicalAgentPath(join21(home, ".claude", "settings.json"), aliases);
+  assertSafePath(path);
+  const before = lstatSync18(path, { throwIfNoEntry: false }) ? new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(readNativeBytes(path, 1024 * 1024)) : null;
+  if ((before === null ? "absent" : sha2(before)) !== options.expectedSettingsSha256)
+    throw new Error("Claude settings preimage changed");
+  assertClaudeStopHookReplacement(before, options.replacement);
+  const agents = bridge.agents;
+  const discoveries = Object.entries(bridge.discovery).map(([agent, binding]) => {
+    if (!agents.includes(agent) || binding?.agent !== agent)
+      throw new Error("Invalid managed discovery owner");
+    return binding;
+  });
+  if (discoveries.length !== agents.length)
+    throw new Error("Missing managed discovery coverage");
+  for (const agent of agents)
+    assertManagedAgentBridge(agent, { home, dataDir: dataDir2, projectDir: home });
+  const replacements = new Map(before === options.replacement ? [] : [[path, options.replacement]]);
+  const discoveryAfter = discoveries.map((binding) => rebindAgentDiscovery(binding, replacements));
+  const nextPolicy = { ...policy, bridge: { ...bridge, discovery: Object.fromEntries(discoveryAfter.map((binding) => [binding.agent, binding])) } };
+  const changes = before === options.replacement ? [] : [{ path, before, after: options.replacement }];
+  if (JSON.stringify(nextPolicy) !== JSON.stringify(policy))
+    changes.push({ path: policyPath, before: snapshot2.text, after: serializeManagedSkillPolicy(nextPolicy) });
+  recheckRootAliases(aliases);
+  const nativeSkills = inventoryNativeSkills(home, {
+    agents,
+    projectDir: home,
+    includeVendor: true,
+    guardHermes: agents.includes("hermes"),
+    allowRootAliases: aliases.length > 0,
+    agentRoots: discoveries.flatMap((binding) => binding.roots.map((path2) => ({ agent: binding.agent, path: path2 })))
+  });
+  return {
+    dataDir: dataDir2,
+    profileId: policy.profileId ?? "default",
+    changes,
+    nativeSkills,
+    observedPolicy: { path: policyPath, before: snapshot2.text },
+    discoveryBefore: discoveries,
+    discoveryAfter,
+    rootAliases: aliases,
+    managedAgentChecks: { home, agents: [...agents] }
+  };
+}
 function atomicWrite2(path, content) {
   assertSafePath(path);
-  mkdirSync5(dirname13(path), { recursive: true, mode: 448 });
+  mkdirSync5(dirname14(path), { recursive: true, mode: 448 });
   const temporary = `${path}.skills-${randomUUID3()}`;
   try {
-    writeFileSync3(temporary, content, { mode: 384, flag: "wx" });
+    writeFileSync4(temporary, content, { mode: 384, flag: "wx" });
     renameSync3(temporary, path);
   } finally {
     if (existsSync6(temporary))
@@ -41081,6 +41333,8 @@ function applyAgentIntegration(plan) {
       parseManagedSkillPolicy(change.after);
   const aliases = plan.rootAliases ?? [];
   recheckRootAliases(aliases);
+  for (const agent of plan.managedAgentChecks?.agents ?? [])
+    assertManagedAgentBridge(agent, { home: plan.managedAgentChecks.home, dataDir: plan.dataDir, projectDir: plan.managedAgentChecks.home });
   for (const binding of plan.discoveryBefore ?? [])
     verifyAgentDiscovery(binding);
   if (plan.observedPolicy && currentText(plan.observedPolicy.path) !== plan.observedPolicy.before)
@@ -41098,8 +41352,8 @@ function applyAgentIntegration(plan) {
   chmodSync(backupRoot, 448);
   for (const [index, change] of plan.changes.entries())
     if (change.before !== null) {
-      const backup = join21(backupRoot, `${index}-${sha(change.path).slice(0, 12)}.backup`);
-      writeFileSync3(backup, change.before, { mode: 384, flag: "wx" });
+      const backup = join21(backupRoot, `${index}-${sha2(change.path).slice(0, 12)}.backup`);
+      writeFileSync4(backup, change.before, { mode: 384, flag: "wx" });
       backups.push(backup);
     }
   try {
@@ -41107,7 +41361,7 @@ function applyAgentIntegration(plan) {
       recheckRootAliases(aliases);
       if (currentText(change.path) !== change.before)
         throw new Error(`Configuration changed after planning: ${change.path}`);
-      for (let directory = dirname13(change.path);!existsSync6(directory); directory = dirname13(directory))
+      for (let directory = dirname14(change.path);!existsSync6(directory); directory = dirname14(directory))
         createdDirectories.add(directory);
       const after = change.after;
       atomicWrite2(change.path, after);
@@ -41116,7 +41370,9 @@ function applyAgentIntegration(plan) {
     recheckRootAliases(aliases);
     for (const binding of plan.discoveryAfter ?? [])
       verifyAgentDiscovery(binding);
-    atomicWrite2(join21(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha(change.before), afterHash: sha(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
+    for (const agent of plan.managedAgentChecks?.agents ?? [])
+      assertManagedAgentBridge(agent, { home: plan.managedAgentChecks.home, dataDir: plan.dataDir, projectDir: plan.managedAgentChecks.home });
+    atomicWrite2(join21(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha2(change.before), afterHash: sha2(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
 `);
   } catch (error) {
     for (const change of written.reverse()) {
@@ -41147,11 +41403,11 @@ function applyAgentIntegration(plan) {
 }
 function syncArchiveDirectory(path) {
   assertSafePath(path);
-  const descriptor = openSync15(path, constants11.O_RDONLY | constants11.O_DIRECTORY | constants11.O_NOFOLLOW | constants11.O_NONBLOCK);
+  const descriptor = openSync16(path, constants12.O_RDONLY | constants12.O_DIRECTORY | constants12.O_NOFOLLOW | constants12.O_NONBLOCK);
   try {
-    fsyncSync3(descriptor);
+    fsyncSync4(descriptor);
   } finally {
-    closeSync15(descriptor);
+    closeSync16(descriptor);
   }
 }
 function writeArchiveJournal(path, value) {
@@ -41159,18 +41415,18 @@ function writeArchiveJournal(path, value) {
   const temporary = `${path}.skills-${randomUUID3()}`;
   let descriptor;
   try {
-    descriptor = openSync15(temporary, constants11.O_WRONLY | constants11.O_CREAT | constants11.O_EXCL | constants11.O_NOFOLLOW, 384);
-    writeFileSync3(descriptor, `${JSON.stringify(value)}
+    descriptor = openSync16(temporary, constants12.O_WRONLY | constants12.O_CREAT | constants12.O_EXCL | constants12.O_NOFOLLOW, 384);
+    writeFileSync4(descriptor, `${JSON.stringify(value)}
 `);
-    fsyncSync3(descriptor);
-    closeSync15(descriptor);
+    fsyncSync4(descriptor);
+    closeSync16(descriptor);
     descriptor = undefined;
     renameSync3(temporary, path);
-    syncArchiveDirectory(dirname13(path));
+    syncArchiveDirectory(dirname14(path));
   } finally {
     if (descriptor !== undefined)
-      closeSync15(descriptor);
-    if (lstatSync17(temporary, { throwIfNoEntry: false }))
+      closeSync16(descriptor);
+    if (lstatSync18(temporary, { throwIfNoEntry: false }))
       unlinkSync4(temporary);
   }
 }
@@ -41195,8 +41451,8 @@ function archiveNativeSkills(inventory, options) {
   const operationId = randomUUID3(), archiveRoot = join21(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join21(archiveRoot, "receipt.json");
   const entries = selected.map((entry, index) => ({
     source: entry.vendor ? join21(entry.path, "SKILL.md") : entry.path,
-    archive: join21(archiveRoot, `${index}-${sha(entry.path).slice(0, 12)}`),
-    hash: entry.vendor ? sha(readNativeBytes(join21(entry.path, "SKILL.md"))) : entry.hash,
+    archive: join21(archiveRoot, `${index}-${sha2(entry.path).slice(0, 12)}`),
+    hash: entry.vendor ? sha2(readNativeBytes(join21(entry.path, "SKILL.md"))) : entry.hash,
     ...entry.vendor ? { discoveryOnly: true } : {},
     status: "planned"
   }));
@@ -41204,22 +41460,22 @@ function archiveNativeSkills(inventory, options) {
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
-    const stat2 = lstatSync17(entry.archive);
+    const stat2 = lstatSync18(entry.archive);
     if (entry.discoveryOnly ? !stat2.isFile() : !stat2.isDirectory())
       throw new Error("Archive type changed");
-    if ((entry.discoveryOnly ? sha(readNativeBytes(entry.archive)) : treeHash(entry.archive)) !== entry.hash)
+    if ((entry.discoveryOnly ? sha2(readNativeBytes(entry.archive)) : treeHash(entry.archive)) !== entry.hash)
       throw new Error("Archive bytes changed");
   };
   assertSafePath(archiveRoot);
   const created = [];
-  for (let path = archiveRoot;!existsSync6(path); path = dirname13(path))
+  for (let path = archiveRoot;!existsSync6(path); path = dirname14(path))
     created.push(path);
   mkdirSync5(archiveRoot, { recursive: true, mode: 448 });
   try {
     for (const directory of created)
       syncArchiveDirectory(directory);
     if (created.length)
-      syncArchiveDirectory(dirname13(created.at(-1)));
+      syncArchiveDirectory(dirname14(created.at(-1)));
     writeArchiveJournal(receiptPath, journal);
     for (const [index, entry] of selected.entries()) {
       recheckRootAliases(aliases);
@@ -41231,7 +41487,7 @@ function archiveNativeSkills(inventory, options) {
       writeArchiveJournal(receiptPath, journal);
       renameSync3(move.source, move.archive);
       moved.push(move);
-      syncArchiveDirectory(dirname13(move.source));
+      syncArchiveDirectory(dirname14(move.source));
       syncArchiveDirectory(archiveRoot);
       verifyArchive(move);
       move.status = "archived";
@@ -41252,7 +41508,7 @@ function archiveNativeSkills(inventory, options) {
         recheckRootAliases(aliases);
         assertSafePath(entry.source);
         assertSafePath(entry.archive);
-        if (lstatSync17(entry.source, { throwIfNoEntry: false })) {
+        if (lstatSync18(entry.source, { throwIfNoEntry: false })) {
           entry.status = "recovery-required";
           entry.conflict = "source-occupied";
           continue;
@@ -41266,10 +41522,10 @@ function archiveNativeSkills(inventory, options) {
         }
         if (entry.discoveryOnly) {
           linkSync2(entry.archive, entry.source);
-          syncArchiveDirectory(dirname13(entry.source));
+          syncArchiveDirectory(dirname14(entry.source));
           unlinkSync4(entry.archive);
         } else {
-          if (lstatSync17(entry.source, { throwIfNoEntry: false })) {
+          if (lstatSync18(entry.source, { throwIfNoEntry: false })) {
             entry.status = "recovery-required";
             entry.conflict = "source-occupied";
             continue;
@@ -41277,7 +41533,7 @@ function archiveNativeSkills(inventory, options) {
           renameSync3(entry.archive, entry.source);
         }
         entry.status = "restored";
-        syncArchiveDirectory(dirname13(entry.source));
+        syncArchiveDirectory(dirname14(entry.source));
         syncArchiveDirectory(archiveRoot);
       } catch {
         entry.status = "recovery-required";
@@ -41296,6 +41552,97 @@ function archiveNativeSkills(inventory, options) {
   }
   return { entries: entries.map(({ status, conflict, ...entry }) => entry), receiptPath, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
 }
+function assertManagedAgentBridge(agent, options = {}) {
+  const home = resolve14(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
+  assertSafePath(join21(dataDir2, "agent-policy.json"));
+  const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
+  if (!snapshot2)
+    throw new Error("NATIVE_SKILL_DRIFT: install the Skills bridge with skills hook install");
+  const binding = snapshot2.value.bridge;
+  if (!binding || binding.version !== CLI_BRIDGE_VERSION || binding.digest !== CLI_BRIDGE_DIGEST || binding.home !== home || !Array.isArray(binding.agents) || !binding.agents.includes(agent))
+    throw new Error("NATIVE_SKILL_DRIFT: the managed Skills bridge binding is missing or incompatible; run skills hook install");
+  const aliases = binding.rootAliases ?? [];
+  if (!Array.isArray(aliases))
+    throw new Error("NATIVE_SKILL_DRIFT: invalid root alias binding");
+  recheckRootAliases(aliases);
+  const expected = canonicalAgentPath(join21(home, AGENT_ADAPTERS[agent].root, CLI_BRIDGE_NAME), aliases);
+  if (!isOwnedCliBridge(expected, [expected]))
+    throw new Error("NATIVE_SKILL_DRIFT: the native Skills bridge is missing or modified; repair it before continuing");
+  const roots = projectAncestorDirectories([options.projectDir ?? process.cwd(), ...options.projectDirs ?? [], ...agent === "hermes" && process.env.TERMINAL_CWD ? [process.cwd()] : []]);
+  const visible = (entry) => entry.agent === agent || ["codex", "gemini", "opencode", "hermes"].includes(agent) && entry.path.includes(`${sep4}.agents${sep4}skills${sep4}`) || agent === "opencode" && entry.agent === "claude";
+  const discovery = binding.discovery?.[agent];
+  assertProjectDiscovery(agent, [...roots], home, (path) => canonicalAgentPath(path, aliases), discovery);
+  const configPath = canonicalAgentPath(join21(home, AGENT_ADAPTERS[agent].config), aliases), config = agent === "hermes" ? parseHermesConfig(readOptional(configPath)) : jsonObject(readOptional(configPath), configPath);
+  const command = binding.commands?.[agent], profile = binding.profiles?.[agent];
+  if (typeof command !== "string" || typeof profile !== "string")
+    throw new Error("NATIVE_SKILL_DRIFT: the native hook command/profile binding is missing");
+  if (options.profileId !== undefined && options.profileId !== profile)
+    throw new Error("NATIVE_SKILL_DRIFT: the hook selection profile differs from its managed binding; restart the native client after reviewing skills hook install");
+  if (agent === "hermes") {
+    const supervisor = binding.supervisors?.hermes;
+    if (supervisor?.path !== join21(dataDir2, "agent-hooks", "hermes.js") || supervisor?.sha256 !== sha2(renderHermesSupervisor(command, profile)))
+      throw new Error("NATIVE_SKILL_DRIFT: Hermes supervisor binding changed; run skills hook install");
+    assertHermesProtection(home, config, command, profile, supervisor);
+  } else if (agent === "opencode") {
+    if (JSON.stringify(config.permission?.skill) !== JSON.stringify({ "*": "deny", [CLI_BRIDGE_NAME]: "allow" }) || readOptional(join21(home, ".config", "opencode", "plugins", "skills-cli.js")) !== renderOpenCodePlugin(command, profile))
+      throw new Error("NATIVE_SKILL_DRIFT: OpenCode bridge protection changed; run skills hook install");
+  } else {
+    const required = {};
+    configureHooks(required, agent, command, profile, true);
+    for (const [event, entries] of Object.entries(required.hooks))
+      for (const entry of entries) {
+        if (!Array.isArray(config.hooks?.[event]) || config.hooks[event].filter((actual) => JSON.stringify(actual) === JSON.stringify(entry)).length !== 1)
+          throw new Error("NATIVE_SKILL_DRIFT: required native prompt/skill hooks changed; run skills hook install");
+      }
+    if (agent === "claude" && (config.disableBundledSkills !== true || config.disableAllHooks === true || !config.permissions?.allow?.includes(`Skill(${CLI_BRIDGE_NAME})`) || config.permissions?.deny?.includes("Skill")))
+      throw new Error("NATIVE_SKILL_DRIFT: Claude bridge or bundled-skill protection changed; retire copies and run skills hook install");
+    if (agent === "claude" && config.syncClaudeAiSkills !== false)
+      throw new Error("NATIVE_SKILL_DRIFT: Claude account skill synchronization is not disabled (syncClaudeAiSkills); run skills hook install to prevent native copies from returning");
+    if (agent === "gemini" && (config.hooksConfig?.enabled === false || config.skills?.enabled !== true || !["antigravity-support", "skill-creator"].every((name) => config.skills?.disabled?.includes(name)) || config.skills?.disabled?.includes(CLI_BRIDGE_NAME)))
+      throw new Error("NATIVE_SKILL_DRIFT: Gemini bridge or bundled-skill protection changed; run skills hook install");
+  }
+  const codexPath = canonicalAgentPath(join21(home, ".codex", "config.toml"), aliases);
+  if (options.codexDiscoveryRecovery && (agent !== "codex" || options.codexDiscoveryRecovery.configPath !== codexPath))
+    throw new Error("NATIVE_SKILL_DRIFT: Codex trust recovery names a different configuration root");
+  const codexConfig = agent === "codex" ? Bun.TOML.parse(readOptional(codexPath) ?? "") : {};
+  if (agent === "codex" && codexConfig.skills?.bundled?.enabled !== false)
+    throw new Error("NATIVE_SKILL_DRIFT: Codex bundled skill reseeding is not disabled (skills.bundled.enabled); run skills hook install");
+  const setting = (path) => (codexConfig.skills?.config ?? []).filter((entry) => typeof entry.path === "string" && [path, join21(path, "SKILL.md")].includes(canonicalAgentPath(entry.path, aliases)));
+  if (agent === "codex" && [...setting(expected), ...(codexConfig.skills?.config ?? []).filter((entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME)].some((entry) => entry.enabled === false))
+    throw new Error("NATIVE_SKILL_DRIFT: the Codex CLI bridge is disabled; run skills hook install");
+  const disabledBuiltin = (entry) => {
+    if (agent !== "codex" || !entry.vendor || !entry.path.startsWith(canonicalAgentPath(join21(home, ".codex", "skills", ".system"), aliases) + sep4))
+      return false;
+    const matched = Array.isArray(binding.disabledBuiltins) && binding.disabledBuiltins.some((item) => item.path === entry.path && item.hash === entry.hash);
+    const settings = setting(entry.path);
+    return matched && settings.length === 1 && settings[0]?.enabled === false;
+  };
+  if (!discovery || discovery.agent !== agent)
+    throw new Error("NATIVE_SKILL_DRIFT: native discovery coverage is missing; run skills hook install");
+  if (agent === "gemini" && !discovery.builtinNames?.every((name) => config.skills.disabled.includes(name)))
+    throw new Error("NATIVE_SKILL_DRIFT: an installed Gemini builtin is not disabled");
+  try {
+    verifyAgentDiscovery(discovery, options.codexDiscoveryRecovery);
+    if (discovery.method === "automatic") {
+      const current = resolveAgentDiscovery({ home, agent, canonical: (path) => canonicalAgentPath(path, aliases) });
+      if (JSON.stringify(current) !== JSON.stringify(discovery))
+        throw new Error("Configured native discovery roots changed");
+    }
+  } catch (error) {
+    throw new Error(`NATIVE_SKILL_DRIFT: ${error.message}`);
+  }
+  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0 });
+  const unexpected = inventory.filter((entry) => visible(entry) && !entry.bridge && !disabledBuiltin(entry));
+  if (unexpected.length) {
+    const paths = unexpected.slice(0, 3).map((entry) => {
+      const escaped = JSON.stringify(entry.path).replace(/[\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/g, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
+      return escaped.length > 768 ? `${escaped.slice(0, 384)}...${escaped.slice(-381)}` : escaped;
+    });
+    const remaining = unexpected.length - paths.length;
+    throw new Error(`NATIVE_SKILL_DRIFT: ${unexpected.length} unexpected native skill copies were found: ${paths.join(", ")}${remaining ? `; ${remaining} more` : ""}. Review skills migrate native --project <working-directory> --include-unmanaged --include-vendor --json before continuing; it inventories that directory and its ancestors. Use --apply after reviewing the archive plan.`);
+  }
+  recheckRootAliases(aliases);
+}
 function assertNativeExportAllowed(dataDir2 = getDataDirReadOnly()) {
   if (requiresCliSkillLoading(dataDir2))
     throw new Error("NATIVE_SKILL_EXPORT_DISABLED: this station loads skills through the Skills CLI; use skills sync --selection-profile <id>");
@@ -41307,19 +41654,19 @@ import {
   mkdirSync as mkdirSync7,
   mkdtempSync,
   readdirSync as readdirSync9,
-  realpathSync as realpathSync6,
+  realpathSync as realpathSync7,
   renameSync as renameSync4,
   rmSync as rmSync2,
   statSync as statSync8,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "fs";
-import { basename as basename8, dirname as dirname15, isAbsolute as isAbsolute16, join as join24, normalize as normalize2, relative as relative5, resolve as resolve15, sep as sep6 } from "path";
+import { basename as basename9, dirname as dirname17, isAbsolute as isAbsolute16, join as join25, normalize as normalize2, relative as relative5, resolve as resolve16, sep as sep7 } from "path";
 
 // src/lib/registry-data/index.ts
 var SKILLS = [];
 
 // src/lib/skill-hash.ts
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 import { existsSync as existsSync7, readdirSync as readdirSync8, readFileSync as readFileSync14, statSync as statSync6 } from "fs";
 import { join as join22, sep as sep5 } from "path";
 var CONTENT_HASH_ALGORITHM = "sha256";
@@ -41443,13 +41790,13 @@ function* bundleHashParts(files) {
   yield new TextEncoder().encode("\x00");
 }
 function hashBundleFiles(files) {
-  const hash2 = createHash15(CONTENT_HASH_ALGORITHM);
+  const hash2 = createHash17(CONTENT_HASH_ALGORITHM);
   for (const part of bundleHashParts(files))
     hash2.update(part);
   return hash2.digest("hex");
 }
 async function hashBundleFilesCooperatively(files, check) {
-  const hash2 = createHash15(CONTENT_HASH_ALGORITHM);
+  const hash2 = createHash17(CONTENT_HASH_ALGORITHM);
   let bytesSinceYield = 0;
   for (const part of bundleHashParts(files)) {
     for (let offset = 0;offset < part.byteLength; offset += 64 * 1024) {
@@ -41532,7 +41879,7 @@ function snapshotContentEntries(entries, limits, check) {
     contentLimit("Content hash entry limit exceeded");
   if (Reflect.ownKeys(entries).length !== entries.length + 1)
     invalidContent("Invalid content hash entry array");
-  const snapshot = [];
+  const snapshot2 = [];
   const paths = new SkillEntryPaths;
   let rawBytes = 0;
   for (let index = 0;index < entries.length; index++) {
@@ -41556,10 +41903,10 @@ function snapshotContentEntries(entries, limits, check) {
     rawBytes += size;
     const bytes = new Uint8Array(new ArrayBuffer(size));
     bytes.set(entry.bytes);
-    snapshot.push({ path: entry.path, bytes, mode: entry.mode });
+    snapshot2.push({ path: entry.path, bytes, mode: entry.mode });
   }
   check();
-  return snapshot;
+  return snapshot2;
 }
 function coveredContentPath(path) {
   const segments = path.split("/");
@@ -41607,12 +41954,12 @@ async function hashContentEntries(entries, options) {
   try {
     signal?.addEventListener("abort", abort, { once: true });
     check();
-    const snapshot = snapshotContentEntries(entries, limits, check);
+    const snapshot2 = snapshotContentEntries(entries, limits, check);
     const normalized = [];
     let normalizedBytes = 0;
     let manifest;
     await new Promise((resolve15) => setImmediate(resolve15));
-    for (const entry of snapshot) {
+    for (const entry of snapshot2) {
       check();
       if (!coveredContentPath(entry.path))
         continue;
@@ -41763,7 +42110,7 @@ function validatePortableManifestContract(manifest, options = {}) {
 function validateRuntimeContract(manifest, issues, strict) {
   const runtime = manifest.runtime;
   if (runtime === undefined) {
-    if (strict) {
+    if (strict && manifest.kind !== "instruction") {
       add2(issues, "contract.runtime_missing", "runtime contract is required: { runtime, entrypoint?, timeout?, needs_network?, env?, sandbox?, system_deps?, artifacts? }");
     }
     return;
@@ -41832,13 +42179,13 @@ function validateRuntimeContract(manifest, issues, strict) {
 import {
   cpSync,
   existsSync as existsSync8,
-  lstatSync as lstatSync18,
+  lstatSync as lstatSync19,
   mkdirSync as mkdirSync6,
   readFileSync as readFileSync15,
   realpathSync as realpathSync5,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync5
 } from "fs";
-import { basename as basename7, dirname as dirname14, join as join23, relative as relative4 } from "path";
+import { basename as basename7, dirname as dirname15, join as join23, relative as relative4 } from "path";
 var ANY_SEGMENT_COPY_EXCLUDES = new Set([
   ".git",
   ".DS_Store",
@@ -41950,13 +42297,12 @@ function createInstructionManifest(name, options) {
     kind: "instruction",
     inputs: [],
     commands: [],
-    runtime: defaultRuntimeContract(),
     provenance: defaultProvenance()
   };
 }
 function writeInstructionSkillTemplate(skillPath, manifest) {
   mkdirSync6(skillPath, { recursive: true });
-  writeFileSync4(join23(skillPath, "SKILL.md"), renderInstructionSkillMd(manifest));
+  writeFileSync5(join23(skillPath, "SKILL.md"), renderInstructionSkillMd(manifest));
   writeSkillJsonWithHash(skillPath, manifest);
 }
 function renderInstructionSkillMd(manifest) {
@@ -42007,11 +42353,11 @@ function createPortableManifest(name, options) {
 }
 function writePortableSkillTemplate(skillPath, manifest) {
   mkdirSync6(join23(skillPath, "src"), { recursive: true });
-  writeFileSync4(join23(skillPath, "SKILL.md"), renderSkillMd(manifest));
-  writeFileSync4(join23(skillPath, "AGENTS.md"), renderAgentsMd(manifest));
-  writeFileSync4(join23(skillPath, "package.json"), renderPackageJson(manifest));
-  writeFileSync4(join23(skillPath, "tsconfig.json"), renderTsconfig());
-  writeFileSync4(join23(skillPath, "src", "index.ts"), renderEntrypoint(manifest));
+  writeFileSync5(join23(skillPath, "SKILL.md"), renderSkillMd(manifest));
+  writeFileSync5(join23(skillPath, "AGENTS.md"), renderAgentsMd(manifest));
+  writeFileSync5(join23(skillPath, "package.json"), renderPackageJson(manifest));
+  writeFileSync5(join23(skillPath, "tsconfig.json"), renderTsconfig());
+  writeFileSync5(join23(skillPath, "src", "index.ts"), renderEntrypoint(manifest));
   writeSkillJsonWithHash(skillPath, manifest);
 }
 function fillContractDefaults(manifest, entrypoint) {
@@ -42019,7 +42365,7 @@ function fillContractDefaults(manifest, entrypoint) {
   return {
     ...manifest,
     standard: PORTABLE_SKILL_STANDARD,
-    runtime: manifest.runtime ?? defaultRuntimeContract(resolvedEntrypoint),
+    ...manifest.kind === "instruction" ? {} : { runtime: manifest.runtime ?? defaultRuntimeContract(resolvedEntrypoint) },
     provenance: {
       ...defaultProvenance(),
       ...manifest.provenance ?? {}
@@ -42036,7 +42382,7 @@ function writeSkillJsonWithHash(skillPath, manifest) {
       content_hash: undefined
     }
   };
-  writeFileSync4(join23(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withoutHash) }, null, 2)}
+  writeFileSync5(join23(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withoutHash) }, null, 2)}
 `);
   const hash2 = computeContentHash(skillPath);
   const withHash = {
@@ -42046,7 +42392,7 @@ function writeSkillJsonWithHash(skillPath, manifest) {
       content_hash: hash2
     }
   };
-  writeFileSync4(join23(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withHash) }, null, 2)}
+  writeFileSync5(join23(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withHash) }, null, 2)}
 `);
   return withHash;
 }
@@ -42086,18 +42432,18 @@ function ensurePortableSkillFiles(skillPath, manifest) {
   };
   const entry = next.commands[0]?.entry ?? "src/index.ts";
   if (entry && !existsSync8(join23(skillPath, entry))) {
-    mkdirSync6(dirname14(join23(skillPath, entry)), { recursive: true });
-    writeFileSync4(join23(skillPath, entry), renderEntrypoint(next));
+    mkdirSync6(dirname15(join23(skillPath, entry)), { recursive: true });
+    writeFileSync5(join23(skillPath, entry), renderEntrypoint(next));
   }
   if (!existsSync8(join23(skillPath, "SKILL.md")))
-    writeFileSync4(join23(skillPath, "SKILL.md"), renderSkillMd(next));
+    writeFileSync5(join23(skillPath, "SKILL.md"), renderSkillMd(next));
   else
-    writeFileSync4(join23(skillPath, "SKILL.md"), ensureSkillMdFrontmatter(readFileSync15(join23(skillPath, "SKILL.md"), "utf-8"), next));
+    writeFileSync5(join23(skillPath, "SKILL.md"), ensureSkillMdFrontmatter(readFileSync15(join23(skillPath, "SKILL.md"), "utf-8"), next));
   if (!existsSync8(join23(skillPath, "AGENTS.md")))
-    writeFileSync4(join23(skillPath, "AGENTS.md"), renderAgentsMd(next));
+    writeFileSync5(join23(skillPath, "AGENTS.md"), renderAgentsMd(next));
   ensurePackageJson(skillPath, next);
   if (!existsSync8(join23(skillPath, "tsconfig.json")))
-    writeFileSync4(join23(skillPath, "tsconfig.json"), renderTsconfig());
+    writeFileSync5(join23(skillPath, "tsconfig.json"), renderTsconfig());
   writeSkillJsonWithHash(skillPath, next);
   return readPortableSkillManifest(skillPath, next.name);
 }
@@ -42107,7 +42453,7 @@ function ensurePackageJson(skillPath, manifest) {
   const commandName = normalizePortableSkillName(first.name || manifest.name);
   const entry = (first.entry ?? "src/index.ts").replace(/^\.\//, "");
   if (!existsSync8(pkgPath)) {
-    writeFileSync4(pkgPath, renderPackageJson(manifest));
+    writeFileSync5(pkgPath, renderPackageJson(manifest));
     return;
   }
   const existing = readJsonObject(pkgPath);
@@ -42126,7 +42472,7 @@ function ensurePackageJson(skillPath, manifest) {
   const scripts = isRecord2(existing.scripts) ? { ...existing.scripts } : {};
   if (!stringValue(scripts.dev))
     scripts.dev = `bun run ${entry}`;
-  writeFileSync4(pkgPath, `${JSON.stringify({
+  writeFileSync5(pkgPath, `${JSON.stringify({
     ...existing,
     name: manifest.name,
     version: manifest.version,
@@ -42150,20 +42496,20 @@ function ensureInstructionSkillFiles(skillPath, manifest) {
     commands: []
   };
   if (!existsSync8(join23(skillPath, "SKILL.md"))) {
-    writeFileSync4(join23(skillPath, "SKILL.md"), renderSkillMd(next));
+    writeFileSync5(join23(skillPath, "SKILL.md"), renderSkillMd(next));
   } else {
     const path = join23(skillPath, "SKILL.md");
     const content = readFileSync15(path, "utf8");
     const declaredName = parseSkillFrontmatter(content)?.name;
     if (declaredName && declaredName !== next.name) {
-      writeFileSync4(path, renameInstructionFrontmatter(content, next.name));
+      writeFileSync5(path, renameInstructionFrontmatter(content, next.name));
     }
   }
   const packagePath = join23(skillPath, "package.json");
   if (existsSync8(packagePath)) {
     const pkg = readJsonObject(packagePath);
     if (typeof pkg.name === "string" && pkg.name !== next.name) {
-      writeFileSync4(packagePath, `${JSON.stringify({ ...pkg, name: next.name }, null, 2)}
+      writeFileSync5(packagePath, `${JSON.stringify({ ...pkg, name: next.name }, null, 2)}
 `);
     }
   }
@@ -42191,7 +42537,7 @@ function renameInstructionFrontmatter(content, name) {
   return renamed + content.slice(frontmatter[0].length);
 }
 function copySkillDirectory(source, destination) {
-  const resolvedSource = lstatSync18(source).isSymbolicLink() ? realpathSync5(source) : source;
+  const resolvedSource = lstatSync19(source).isSymbolicLink() ? realpathSync5(source) : source;
   mkdirSync6(destination, { recursive: true });
   cpSync(resolvedSource, destination, {
     recursive: true,
@@ -42204,7 +42550,7 @@ function copySkillDirectory(source, destination) {
         if (isExcludedCopyEntry(segments[i], i === 0))
           return false;
       }
-      if (lstatSync18(src).isSymbolicLink())
+      if (lstatSync19(src).isSymbolicLink())
         return false;
       return true;
     }
@@ -42481,6 +42827,103 @@ function displayName(name) {
 function escapeJsString(value) {
   return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\r?\n/g, " ");
 }
+
+// src/lib/authoring-path.ts
+import { lstatSync as lstatSync20, realpathSync as realpathSync6 } from "fs";
+import { homedir as homedir4 } from "os";
+import { basename as basename8, dirname as dirname16, join as join24, resolve as resolve15, sep as sep6 } from "path";
+var NATIVE_DISCOVERY_ROOTS = NATIVE_SKILL_ROOTS.map(([, path]) => path.split("/"));
+function pathParts(path) {
+  return resolve15(path).split(sep6).filter(Boolean);
+}
+function nativeRootMatch(path) {
+  const parts = pathParts(path);
+  for (let start = 0;start < parts.length; start += 1) {
+    for (const root2 of NATIVE_DISCOVERY_ROOTS) {
+      if (root2.every((part, offset) => parts[start + offset] === part)) {
+        return root2.join("/");
+      }
+    }
+  }
+  return;
+}
+function physicalPath(path) {
+  let cursor = resolve15(path);
+  const suffix = [];
+  while (!lstatSync20(cursor, { throwIfNoEntry: false })) {
+    suffix.unshift(basename8(cursor));
+    const parent = dirname16(cursor);
+    if (parent === cursor)
+      return resolve15(path);
+    cursor = parent;
+  }
+  return resolve15(realpathSync6(cursor), ...suffix);
+}
+function contains(root2, path) {
+  return path === root2 || path.startsWith(root2 + sep6);
+}
+function configuredRoots(home, explicitHome) {
+  const homeData = join24(home, ".hasna", "skills");
+  const homePolicy = readManagedSkillPolicySnapshot(homeData);
+  const configuredPolicy = !explicitHome && resolve15(getDataDirReadOnly()) !== resolve15(homeData) ? readManagedSkillPolicySnapshot(getDataDirReadOnly()) : null;
+  const policy = homePolicy ?? configuredPolicy;
+  const bridge = policy?.value.bridge;
+  if (bridge && (typeof bridge.home !== "string" || physicalPath(bridge.home) !== physicalPath(home))) {
+    throw new Error("Native discovery policy belongs to a different home; refusing portable authoring");
+  }
+  const roots = [];
+  const admitBinding = (binding) => {
+    if (!INTEGRATION_AGENTS.includes(binding.agent) || !binding.sources.some((source) => source.path === physicalPath(agentDiscoveryConfigPath(home, binding.agent)))) {
+      throw new Error("Native discovery policy does not bind the current account configuration");
+    }
+    verifyAgentDiscovery(binding);
+    roots.push(...binding.roots);
+  };
+  if (homePolicy && configuredPolicy?.value.bridge) {
+    if (physicalPath(configuredPolicy.value.bridge.home) !== physicalPath(home))
+      throw new Error("Native discovery policy belongs to a different home; refusing portable authoring");
+    for (const binding of Object.values(configuredPolicy.value.bridge.discovery ?? {})) {
+      admitBinding(binding);
+    }
+  }
+  for (const agent of INTEGRATION_AGENTS) {
+    const binding = bridge?.discovery?.[agent];
+    if (binding !== undefined) {
+      if (binding.agent !== agent)
+        throw new Error("Invalid native discovery policy binding");
+      admitBinding(binding);
+      continue;
+    }
+    const nativeHome = join24(home, agent === "opencode" ? ".config/opencode" : `.${agent}`);
+    if (!lstatSync20(nativeHome, { throwIfNoEntry: false }))
+      continue;
+    roots.push(...resolveAgentDiscovery({ home, agent, canonical: physicalPath }).roots);
+  }
+  return roots;
+}
+function assertPortableAuthoringPath(path, options = {}) {
+  if (typeof path !== "string" || !path || path.includes("\x00"))
+    throw new Error("Invalid portable authoring path");
+  const lexical = resolve15(path);
+  const physical = physicalPath(lexical);
+  const candidates = [lexical, physical];
+  let native = candidates.map(nativeRootMatch).find(Boolean);
+  const home = resolve15(options.homeDir ?? homedir4());
+  const defaults = NATIVE_DISCOVERY_ROOTS.map((parts) => join24(home, ...parts));
+  defaults.push(join24(home, ".codex/plugins/cache"), join24(home, ".claude/plugins/cache"), join24(home, ".claude/plugins/synced"), join24(home, ".gemini/extensions"));
+  for (const root2 of defaults) {
+    if (candidates.some((candidate2) => contains(resolve15(root2), candidate2) || contains(physicalPath(root2), candidate2)))
+      native ??= root2;
+  }
+  if (native) {
+    throw new Error(`Refusing portable Skills authoring below native discovery root '${native}': ${lexical}. Set HASNA_SKILLS_DIR to a private authoring corpus outside native roots.`);
+  }
+  for (const root2 of configuredRoots(home, options.homeDir !== undefined)) {
+    if (candidates.some((candidate2) => contains(resolve15(root2), candidate2) || contains(physicalPath(root2), candidate2))) {
+      throw new Error(`Refusing portable Skills authoring below configured native discovery root: ${lexical}`);
+    }
+  }
+}
 // src/lib/portable-skills.ts
 function getPortableSkillsRoot(options = {}) {
   return resolvePortableSkillsRoot(options, true);
@@ -42488,15 +42931,15 @@ function getPortableSkillsRoot(options = {}) {
 function resolvePortableSkillsRoot(options, migrate) {
   if (options.rootDir)
     return options.rootDir;
-  const appDir = options.homeDir ? join24(options.homeDir, ".hasna", "skills") : migrate ? getDataDir() : getDataDirReadOnly();
-  const cache = join24(appDir, SKILLS_CACHE_DIRNAME);
+  const appDir = options.homeDir ? join25(options.homeDir, ".hasna", "skills") : migrate ? getDataDir() : getDataDirReadOnly();
+  const cache = join25(appDir, SKILLS_CACHE_DIRNAME);
   if (isOwnerLayoutMigrated(appDir) && safeIsDirectory(cache))
     return cache;
-  const installed = join24(appDir, INSTALLED_SKILLS_DIRNAME);
+  const installed = join25(appDir, INSTALLED_SKILLS_DIRNAME);
   return installed;
 }
 function getPortableSkillPath(name, options = {}) {
-  return join24(getPortableSkillsRoot(options), normalizePortableSkillName(name));
+  return join25(getPortableSkillsRoot(options), normalizePortableSkillName(name));
 }
 function findPortableSkill(name, options = {}) {
   let normalized;
@@ -42522,7 +42965,7 @@ function listPortableSkills(options = {}) {
   for (const entry of readdirSync9(root2).sort()) {
     if (entry.startsWith("."))
       continue;
-    const path = join24(root2, entry);
+    const path = join25(root2, entry);
     if (!safeIsDirectory(path))
       continue;
     try {
@@ -42555,8 +42998,11 @@ function isOfficialSkillName(name) {
 }
 function scaffoldPortableSkill(name, options = {}) {
   const skillName = normalizeNewPortableSkillName(name);
+  const readOnlyRoot = resolvePortableSkillsRoot(options, false);
+  assertPortableAuthoringPath(join25(readOnlyRoot, skillName), options);
   const root2 = getPortableSkillsRoot(options);
-  const skillPath = join24(root2, skillName);
+  const skillPath = join25(root2, skillName);
+  assertPortableAuthoringPath(skillPath, options);
   if (existsSync9(skillPath)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${skillPath}`);
@@ -42589,7 +43035,7 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   const skipped = [];
   const entries = readdirSync9(absoluteSource, { withFileTypes: true }).map((entry) => entry.name).filter((entryName) => !entryName.startsWith(".")).sort();
   for (const entryName of entries) {
-    const childPath = join24(absoluteSource, entryName);
+    const childPath = join25(absoluteSource, entryName);
     if (!safeIsDirectory(childPath))
       continue;
     if (!isSkillCandidate(childPath)) {
@@ -42618,25 +43064,25 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   };
 }
 function isSkillCandidate(dir) {
-  return existsSync9(join24(dir, "SKILL.md")) || existsSync9(join24(dir, "skill.json")) || existsSync9(join24(dir, "package.json"));
+  return existsSync9(join25(dir, "SKILL.md")) || existsSync9(join25(dir, "skill.json")) || existsSync9(join25(dir, "package.json"));
 }
 function physicalImportPath(path) {
-  let ancestor = resolve15(path);
+  let ancestor = resolve16(path);
   const suffix = [];
   while (!existsSync9(ancestor)) {
-    suffix.unshift(basename8(ancestor));
-    ancestor = dirname15(ancestor);
+    suffix.unshift(basename9(ancestor));
+    ancestor = dirname17(ancestor);
   }
-  return join24(realpathSync6(ancestor), ...suffix);
+  return join25(realpathSync7(ancestor), ...suffix);
 }
 function assertDisjointImportPaths(source, destination) {
-  const sourcePath = realpathSync6(source);
+  const sourcePath = realpathSync7(source);
   const destinationPath = physicalImportPath(destination);
-  const contains = (parent, child) => {
+  const contains2 = (parent, child) => {
     const path = relative5(parent, child);
-    return path === "" || !isAbsolute16(path) && path !== ".." && !path.startsWith(`..${sep6}`);
+    return path === "" || !isAbsolute16(path) && path !== ".." && !path.startsWith(`..${sep7}`);
   };
-  if (contains(sourcePath, destinationPath) || contains(destinationPath, sourcePath)) {
+  if (contains2(sourcePath, destinationPath) || contains2(destinationPath, sourcePath)) {
     throw new Error("Source and destination skill directories must not overlap");
   }
 }
@@ -42649,20 +43095,23 @@ function portPortableSkill(sourcePath, options = {}) {
   const explicitName = options.name != null;
   const skillName = normalizeNewPortableSkillName(options.name ?? inferred.name);
   if (isOfficialSkillName(skillName) && !options.allowShadow) {
-    const sourceSlug = safeNormalizeName(basename8(absoluteSource));
-    const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename8(absoluteSource)}')` : ""} matches a bundled official skill.`;
+    const sourceSlug = safeNormalizeName(basename9(absoluteSource));
+    const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename9(absoluteSource)}')` : ""} matches a bundled official skill.`;
     throw new Error(`${via} Importing it would shadow the official '${skillName}'. ` + `Pass --name to choose a different name, or --allow-shadow to override deliberately.`);
   }
-  assertDisjointImportPaths(absoluteSource, join24(resolvePortableSkillsRoot(options, false), skillName));
+  const readOnlyDestination = join25(resolvePortableSkillsRoot(options, false), skillName);
+  assertPortableAuthoringPath(readOnlyDestination, options);
+  assertDisjointImportPaths(absoluteSource, readOnlyDestination);
   const root2 = getPortableSkillsRoot(options);
-  const destination = join24(root2, skillName);
+  const destination = join25(root2, skillName);
+  assertPortableAuthoringPath(destination, options);
   assertDisjointImportPaths(absoluteSource, destination);
   if (existsSync9(destination)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${destination}`);
     rmSync2(destination, { recursive: true, force: true });
   }
-  mkdirSync7(dirname15(destination), { recursive: true });
+  mkdirSync7(dirname17(destination), { recursive: true });
   copySkillDirectory(absoluteSource, destination);
   const base = {
     ...inferred,
@@ -42698,31 +43147,37 @@ function buildCorpusManifest(input, name) {
 }
 function writeCorpusSkill(input, options = {}) {
   const name = normalizePortableSkillName(input.name);
+  const readOnlyRoot = resolvePortableSkillsRoot(options, false);
+  assertPortableAuthoringPath(join25(readOnlyRoot, name), options);
   const root2 = getPortableSkillsRoot(options);
-  const skillPath = join24(root2, name);
+  const skillPath = join25(root2, name);
+  assertPortableAuthoringPath(skillPath, options);
   const created = !existsSync9(skillPath);
   mkdirSync7(skillPath, { recursive: true });
-  writeFileSync5(join24(skillPath, "SKILL.md"), input.skillMd);
+  writeFileSync6(join25(skillPath, "SKILL.md"), input.skillMd);
   const manifest = buildCorpusManifest(input, name);
   writeSkillJsonWithHash(skillPath, manifest);
   return { name, path: skillPath, manifest, created };
 }
 function installCorpusSkillAtomically(input, options = {}) {
   const name = normalizePortableSkillName(input.name);
+  const readOnlyRoot = resolvePortableSkillsRoot(options, false);
+  assertPortableAuthoringPath(join25(readOnlyRoot, name), options);
   const root2 = getPortableSkillsRoot(options);
-  const target = join24(root2, name);
+  const target = join25(root2, name);
+  assertPortableAuthoringPath(target, options);
   const created = !existsSync9(target);
   mkdirSync7(root2, { recursive: true });
-  const staging = mkdtempSync(join24(root2, `.pull-${name}-`));
+  const staging = mkdtempSync(join25(root2, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
-    writeFileSync5(join24(staging, "SKILL.md"), input.skillMd);
+    writeFileSync6(join25(staging, "SKILL.md"), input.skillMd);
     const manifest = buildCorpusManifest(input, name);
     writeSkillJsonWithHash(staging, manifest);
     if (existsSync9(target)) {
-      backup = mkdtempSync(join24(root2, `.pull-backup-${name}-`));
-      renameSync4(target, join24(backup, name));
+      backup = mkdtempSync(join25(root2, `.pull-backup-${name}-`));
+      renameSync4(target, join25(backup, name));
       moved = true;
     }
     renameSync4(staging, target);
@@ -42731,9 +43186,9 @@ function installCorpusSkillAtomically(input, options = {}) {
     return { name, path: target, manifest, created };
   } catch (error) {
     rmSync2(staging, { recursive: true, force: true });
-    if (moved && backup && existsSync9(join24(backup, name))) {
+    if (moved && backup && existsSync9(join25(backup, name))) {
       try {
-        renameSync4(join24(backup, name), target);
+        renameSync4(join25(backup, name), target);
       } catch {}
     }
     throw error;
@@ -42746,8 +43201,8 @@ function validatePortableSkillDirectory(name, skillPath) {
   const warnings = [...base.warnings];
   let manifest;
   if (existsSync9(skillPath)) {
-    const skillJsonPath = join24(skillPath, "skill.json");
-    const skillMdPath = join24(skillPath, "SKILL.md");
+    const skillJsonPath = join25(skillPath, "skill.json");
+    const skillMdPath = join25(skillPath, "SKILL.md");
     if (!existsSync9(skillJsonPath) && !existsSync9(skillMdPath)) {
       add3(issues, "portable.manifest_missing", "Missing portable manifest: expected SKILL.md frontmatter and/or skill.json");
     }
@@ -42767,7 +43222,7 @@ function validatePortableSkillDirectory(name, skillPath) {
         add3(issues, "portable.version_missing", "Portable manifest missing version");
       }
       const contractIssues = validatePortableManifestContract(manifest, {
-        strict: existsSync9(join24(skillPath, "skill.json")),
+        strict: existsSync9(join25(skillPath, "skill.json")),
         skillPath
       });
       for (const issue of contractIssues)
@@ -42807,7 +43262,7 @@ function validatePortableSkillDirectory(name, skillPath) {
               add3(issues, "portable.command_entry_unsafe", `Command '${command.name}' entry '${command.entry}' must stay inside the skill directory`);
               continue;
             }
-            const entryPath = join24(skillPath, command.entry);
+            const entryPath = join25(skillPath, command.entry);
             if (!existsSync9(entryPath))
               add3(issues, "portable.command_entry_missing", `Command '${command.name}' entry '${command.entry}' is missing`);
             else if (statSync8(entryPath).isDirectory())
@@ -42818,7 +43273,7 @@ function validatePortableSkillDirectory(name, skillPath) {
     } catch (error) {
       add3(issues, "portable.manifest_invalid", error.message);
     }
-    if (manifest?.kind !== "instruction" && !existsSync9(join24(skillPath, "AGENTS.md"))) {
+    if (manifest?.kind !== "instruction" && !existsSync9(join25(skillPath, "AGENTS.md"))) {
       add3(issues, "portable.agents_missing", "Missing AGENTS.md with build-out instructions for coding agents");
     }
   }
@@ -42854,12 +43309,12 @@ async function runPortableSkill(name, args, options = {}) {
   if (!isSafeRelativePath2(command.entry)) {
     return { exitCode: 1, error: `Portable skill '${name}' command entry is unsafe` };
   }
-  const entryPath = join24(skill.path, command.entry);
+  const entryPath = join25(skill.path, command.entry);
   if (!existsSync9(entryPath)) {
     return { exitCode: 1, error: `Entry point '${command.entry}' not found in portable skill '${name}'` };
   }
-  const pkgPath = join24(skill.path, "package.json");
-  const nodeModules = join24(skill.path, "node_modules");
+  const pkgPath = join25(skill.path, "package.json");
+  const nodeModules = join25(skill.path, "node_modules");
   if (existsSync9(pkgPath) && !existsSync9(nodeModules) && hasPackageDependencies(pkgPath)) {
     const install = Bun.spawn(["bun", "install", "--no-save"], {
       cwd: skill.path,
@@ -42931,9 +43386,9 @@ function isSkillsOwnershipMarker(marker) {
   return typeof marker === "object" && marker !== null && Object.hasOwn(marker, "managedBy") && marker.managedBy === SYNC_MARKER_MANAGED_BY;
 }
 function hasSkillsOwnershipMarker(dir) {
-  const path = join25(dir, SYNC_MARKER_FILE);
+  const path = join26(dir, SYNC_MARKER_FILE);
   try {
-    if (!lstatSync19(path).isFile())
+    if (!lstatSync21(path).isFile())
       return false;
     const marker = JSON.parse(readFileSync16(path, "utf8"));
     return isSkillsOwnershipMarker(marker);
@@ -42952,12 +43407,12 @@ function resolveSyncAgents(arg) {
   }
   return [arg];
 }
-function agentGlobalSkillsDir(agent, homeDir3 = homedir4()) {
+function agentGlobalSkillsDir(agent, homeDir3 = homedir5()) {
   switch (agent) {
     case "opencode":
-      return join25(homeDir3, ".config", "opencode", "skills");
+      return join26(homeDir3, ".config", "opencode", "skills");
     default:
-      return join25(homeDir3, `.${agent}`, "skills");
+      return join26(homeDir3, `.${agent}`, "skills");
   }
 }
 function adaptSkillMdForAgent(skillMd, agent) {
@@ -43016,7 +43471,7 @@ function resolveSyncCorpus(options = {}) {
 function packageSourceRoots(source) {
   const roots = [];
   for (const sub of ["skills"]) {
-    const candidate2 = join25(source, sub);
+    const candidate2 = join26(source, sub);
     if (existsSync10(candidate2) && isDirectory(candidate2))
       roots.push(candidate2);
   }
@@ -43032,10 +43487,10 @@ function containsSkillDirectories(path) {
     return false;
   }
   return entries.some((entry) => {
-    const candidate2 = join25(path, entry);
+    const candidate2 = join26(path, entry);
     if (!isDirectory(candidate2))
       return false;
-    return existsSync10(join25(candidate2, "SKILL.md")) || existsSync10(join25(candidate2, "skill.json")) || existsSync10(join25(candidate2, "package.json"));
+    return existsSync10(join26(candidate2, "SKILL.md")) || existsSync10(join26(candidate2, "skill.json")) || existsSync10(join26(candidate2, "package.json"));
   });
 }
 function isDirectory(path) {
@@ -43049,7 +43504,7 @@ function syncSkillsToAgents(options = {}) {
   assertNativeExportAllowed();
   const requested = normalizeRequested(options.names);
   const agents = options.agents?.length ? options.agents : [...SYNC_AGENTS];
-  const homeDir3 = options.homeDir ?? homedir4();
+  const homeDir3 = options.homeDir ?? homedir5();
   const { roots, source } = resolveSyncCorpus(options);
   const corpus = listPortableSkillsAcrossRoots(roots);
   const byName = new Map(corpus.map((skill) => [skill.name, skill]));
@@ -43075,7 +43530,7 @@ function syncSkillsToAgents(options = {}) {
         actions.push({
           skill: name,
           agent,
-          path: join25(agentGlobalSkillsDir(agent, homeDir3), name, "SKILL.md"),
+          path: join26(agentGlobalSkillsDir(agent, homeDir3), name, "SKILL.md"),
           action: "skip",
           reason: "not found in this machine's corpus"
         });
@@ -43104,8 +43559,8 @@ function syncSkillsToAgents(options = {}) {
   return { actions };
 }
 function writeManagedAgentSkill(params) {
-  const homeDir3 = params.homeDir ?? homedir4();
-  const dir = join25(agentGlobalSkillsDir(params.agent, homeDir3), params.skill);
+  const homeDir3 = params.homeDir ?? homedir5();
+  const dir = join26(agentGlobalSkillsDir(params.agent, homeDir3), params.skill);
   const result = writeManagedSkillDir(dir, params.skillMd, {
     skill: params.skill,
     source: params.source,
@@ -43122,8 +43577,8 @@ function writeManagedAgentSkill(params) {
   };
 }
 function writeManagedSkillDir(dir, skillMd, options) {
-  const skillMdPath = join25(dir, "SKILL.md");
-  const markerPath = join25(dir, SYNC_MARKER_FILE);
+  const skillMdPath = join26(dir, "SKILL.md");
+  const markerPath = join26(dir, SYNC_MARKER_FILE);
   const dirExists = existsSync10(dir);
   const managed = hasSkillsOwnershipMarker(dir);
   const hasSkillMd = existsSync10(skillMdPath);
@@ -43159,13 +43614,13 @@ function writeManagedSkillDir(dir, skillMd, options) {
   const action = dirExists ? "update" : "create";
   if (options.dryRun)
     return { action, path: skillMdPath };
-  const parentDir = dirname16(dir);
+  const parentDir = dirname18(dir);
   mkdirSync8(parentDir, { recursive: true });
-  const transactionDir = mkdtempSync2(join25(parentDir, `.hasna-skills-write-${basename9(dir)}-`));
-  const candidateDir = join25(transactionDir, "candidate");
-  const backupDir = join25(transactionDir, "backup");
-  const candidateSkillMdPath = join25(candidateDir, "SKILL.md");
-  const candidateMarkerPath = join25(candidateDir, SYNC_MARKER_FILE);
+  const transactionDir = mkdtempSync2(join26(parentDir, `.hasna-skills-write-${basename10(dir)}-`));
+  const candidateDir = join26(transactionDir, "candidate");
+  const backupDir = join26(transactionDir, "backup");
+  const candidateSkillMdPath = join26(candidateDir, "SKILL.md");
+  const candidateMarkerPath = join26(candidateDir, SYNC_MARKER_FILE);
   const marker = {
     managedBy: SYNC_MARKER_MANAGED_BY,
     skill: options.skill,
@@ -43181,10 +43636,10 @@ function writeManagedSkillDir(dir, skillMd, options) {
     } else {
       mkdirSync8(candidateDir, { recursive: true });
     }
-    writeFileSync6(candidateSkillMdPath, skillMd.endsWith(`
+    writeFileSync7(candidateSkillMdPath, skillMd.endsWith(`
 `) ? skillMd : `${skillMd}
 `);
-    writeFileSync6(candidateMarkerPath, `${JSON.stringify(marker, null, 2)}
+    writeFileSync7(candidateMarkerPath, `${JSON.stringify(marker, null, 2)}
 `);
     if (dirExists) {
       originalMoved = true;
@@ -43213,8 +43668,8 @@ function writeManagedSkillDir(dir, skillMd, options) {
   }
   return { action, path: skillMdPath };
 }
-function removeManagedAgentSkill(skill, agent, homeDir3 = homedir4()) {
-  const dir = join25(agentGlobalSkillsDir(agent, homeDir3), skill);
+function removeManagedAgentSkill(skill, agent, homeDir3 = homedir5()) {
+  const dir = join26(agentGlobalSkillsDir(agent, homeDir3), skill);
   if (!hasSkillsOwnershipMarker(dir))
     return false;
   rmSync3(dir, { recursive: true, force: true });
@@ -43222,7 +43677,7 @@ function removeManagedAgentSkill(skill, agent, homeDir3 = homedir4()) {
 }
 function sourceSkillMd(skillPath, name, description, kind, preferBundledDocs = false) {
   if (kind === undefined || kind === "instruction" || preferBundledDocs) {
-    const skillMdPath = join25(skillPath, "SKILL.md");
+    const skillMdPath = join26(skillPath, "SKILL.md");
     if (existsSync10(skillMdPath))
       return readFileSync16(skillMdPath, "utf-8");
   }
@@ -43255,7 +43710,7 @@ function normalizeSkillName(name) {
 
 // src/lib/registry.ts
 import { existsSync as existsSync11, readFileSync as readFileSync17, readdirSync as readdirSync11 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 
 // src/lib/registry-merge.ts
 var SKILL_SOURCE_PRECEDENCE = {
@@ -43465,7 +43920,7 @@ function discoverSkillsInDir(dir, source = "custom") {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillMdPath = join26(dir, entry.name, "SKILL.md");
+      const skillMdPath = join27(dir, entry.name, "SKILL.md");
       if (!existsSync11(skillMdPath))
         continue;
       let content;
@@ -43485,7 +43940,7 @@ function discoverSkillsInDir(dir, source = "custom") {
         category: fm.category || "Development Tools",
         tags: fm.tags || [],
         ...fm.kind ? { kind: fm.kind } : {},
-        ...isHostedMetadataSkillDir(join26(dir, entry.name)) ? { serverOwned: true } : {},
+        ...isHostedMetadataSkillDir(join27(dir, entry.name)) ? { serverOwned: true } : {},
         source
       });
     }
@@ -43501,8 +43956,8 @@ function findExtensionSkillPath(name) {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillDir = join26(config.extensionsDir, entry.name);
-      const skillMdPath = join26(skillDir, "SKILL.md");
+      const skillDir = join27(config.extensionsDir, entry.name);
+      const skillMdPath = join27(skillDir, "SKILL.md");
       if (!existsSync11(skillMdPath))
         continue;
       let content;
@@ -43572,8 +44027,8 @@ function getAllTags() {
 }
 
 // src/lib/project-state.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync18, writeFileSync as writeFileSync7 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync18, writeFileSync as writeFileSync8 } from "fs";
+import { join as join28 } from "path";
 var VALID_PIN_SOURCES = [
   "official",
   "custom",
@@ -43588,10 +44043,10 @@ var SKILLS_PROJECT_DIR = ".skills";
 var PROJECT_CONFIG_FILE = "project.json";
 var DEFAULT_EXPORT_DIR = ".skills/exports";
 function getProjectStateDir(targetDir = process.cwd()) {
-  return join27(targetDir, SKILLS_PROJECT_DIR);
+  return join28(targetDir, SKILLS_PROJECT_DIR);
 }
 function getProjectConfigPath(targetDir = process.cwd()) {
-  return join27(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
+  return join28(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
 }
 function loadProjectConfig(targetDir = process.cwd()) {
   const path = getProjectConfigPath(targetDir);
@@ -43621,7 +44076,7 @@ function saveProjectConfig(config, targetDir = process.cwd()) {
   const dir = getProjectStateDir(targetDir);
   mkdirSync9(dir, { recursive: true });
   const normalized = normalizeProjectConfig({ ...config, updatedAt: new Date().toISOString() });
-  writeFileSync7(getProjectConfigPath(targetDir), JSON.stringify(normalized, null, 2) + `
+  writeFileSync8(getProjectConfigPath(targetDir), JSON.stringify(normalized, null, 2) + `
 `);
 }
 function pinProjectSkill(name, details = {}, targetDir = process.cwd()) {
@@ -43720,7 +44175,7 @@ function getSkillPath(name) {
   const extensionPath = findExtensionSkillPath(skillName);
   if (extensionPath)
     return extensionPath;
-  return join28(getPortableSkillsRoot(), skillName);
+  return join29(getPortableSkillsRoot(), skillName);
 }
 function getCanonicalSkillName(name) {
   return getSkill(name)?.name ?? resolveSkillAlias(normalizeSkillSlug(name));
@@ -43783,7 +44238,7 @@ function createLocalSkillManifest(name, generateSkillMd) {
   if (!existsSync13(sourcePath))
     return null;
   let skillMd = "";
-  const skillMdPath = join28(sourcePath, "SKILL.md");
+  const skillMdPath = join29(sourcePath, "SKILL.md");
   if (existsSync13(skillMdPath)) {
     skillMd = readFileSync19(skillMdPath, "utf-8");
   } else if (generateSkillMd) {
@@ -43857,16 +44312,16 @@ function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const base = projectDir || process.cwd();
   switch (agent) {
     case "pi":
-      return scope === "project" ? join28(base, ".pi", "skills") : join28(homedir5(), ".pi", "agent", "skills");
+      return scope === "project" ? join29(base, ".pi", "skills") : join29(homedir6(), ".pi", "agent", "skills");
     case "opencode":
-      return scope === "project" ? join28(base, ".opencode", "skills") : join28(homedir5(), ".config", "opencode", "skills");
+      return scope === "project" ? join29(base, ".opencode", "skills") : join29(homedir6(), ".config", "opencode", "skills");
     default:
-      return scope === "project" ? join28(base, `.${agent}`, "skills") : join28(homedir5(), `.${agent}`, "skills");
+      return scope === "project" ? join29(base, `.${agent}`, "skills") : join29(homedir6(), `.${agent}`, "skills");
   }
 }
 function getAgentSkillPath(name, agent, scope = "global", projectDir) {
   const skillName = normalizeSkillName(getCanonicalSkillName(name));
-  return join28(getAgentSkillsDir(agent, scope, projectDir), skillName);
+  return join29(getAgentSkillsDir(agent, scope, projectDir), skillName);
 }
 function installSkillForAgent(name, options, generateSkillMd) {
   assertNativeExportAllowed();
@@ -43902,7 +44357,7 @@ function removeSkillForAgent(name, options) {
 }
 function resolveAgentSkillMd(name, generateSkillMd) {
   const sourcePath = getSkillPath(name);
-  const skillMdPath = join28(sourcePath, "SKILL.md");
+  const skillMdPath = join29(sourcePath, "SKILL.md");
   if (existsSync13(skillMdPath))
     return readFileSync19(skillMdPath, "utf-8");
   if (generateSkillMd)
@@ -43937,7 +44392,7 @@ function generateMinimalSkillMd(name) {
     "---",
     ""
   ].filter(Boolean);
-  const fallbackDoc = readFileIfExists(join28(sourcePath, "README.md")) || readFileIfExists(join28(sourcePath, "CLAUDE.md"));
+  const fallbackDoc = readFileIfExists(join29(sourcePath, "README.md")) || readFileIfExists(join29(sourcePath, "CLAUDE.md"));
   if (fallbackDoc)
     return `${frontmatter.join(`
 `)}${fallbackDoc.trim()}
@@ -43956,7 +44411,7 @@ skills run ${canonicalName}
 `;
 }
 function readBundledSkillVersion(name) {
-  const pkgPath = join28(getSkillPath(name), "package.json");
+  const pkgPath = join29(getSkillPath(name), "package.json");
   if (!existsSync13(pkgPath))
     return "unknown";
   try {
@@ -44011,7 +44466,7 @@ function selectSkillDoc(docs, file) {
 function isInstructionSkillDir(skillPath, meta) {
   if (meta?.kind === "instruction")
     return true;
-  const skillMdPath = join29(skillPath, "SKILL.md");
+  const skillMdPath = join30(skillPath, "SKILL.md");
   if (!existsSync14(skillMdPath))
     return false;
   try {
@@ -44041,9 +44496,9 @@ function getSkillDocs(name) {
   if (!existsSync14(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join29(skillPath, "SKILL.md")),
-    readme: readIfExists(join29(skillPath, "README.md")),
-    claudeMd: readIfExists(join29(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join30(skillPath, "SKILL.md")),
+    readme: readIfExists(join30(skillPath, "README.md")),
+    claudeMd: readIfExists(join30(skillPath, "CLAUDE.md"))
   };
 }
 function getSkillBestDoc(name, file) {
@@ -44059,14 +44514,14 @@ function getSkillRequirements(name) {
     return null;
   const texts = [];
   for (const file of ["SKILL.md", "README.md", "CLAUDE.md", ".env.example", ".env.local.example"]) {
-    const content = readIfExists(join29(skillPath, file));
+    const content = readIfExists(join30(skillPath, file));
     if (content)
       texts.push(content);
   }
   const meta = getSkill(name);
   let dependencies = {};
   try {
-    dependencies = JSON.parse(readFileSync20(join29(skillPath, "package.json"), "utf8")).dependencies || {};
+    dependencies = JSON.parse(readFileSync20(join30(skillPath, "package.json"), "utf8")).dependencies || {};
   } catch {}
   return getSkillRequirementsFromContent(name, texts, dependencies, meta);
 }
@@ -44128,7 +44583,7 @@ async function runSkill(name, args, options = {}) {
       error: `Skill '${name}' is an instruction skill (kind: instruction) and is not runnable. Instruction skills are consumed by coding agents via SKILL.md, not executed with 'skills run'.`
     };
   }
-  const pkgPath = join29(skillPath, "package.json");
+  const pkgPath = join30(skillPath, "package.json");
   if (!existsSync14(pkgPath)) {
     return { exitCode: 1, error: `No package.json in skill '${name}'` };
   }
@@ -44148,12 +44603,12 @@ async function runSkill(name, args, options = {}) {
   } catch {
     return { exitCode: 1, error: `Failed to parse package.json for skill '${name}'` };
   }
-  const entryPath = join29(skillPath, entryPoint2);
+  const entryPath = join30(skillPath, entryPoint2);
   if (!existsSync14(entryPath)) {
     return { exitCode: 1, error: `Entry point '${entryPoint2}' not found in skill '${name}'` };
   }
   const env = { ...process.env, ...options.env };
-  if (!existsSync14(join29(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
+  if (!existsSync14(join30(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
     const failure = await prepareSkillDependencies(skillPath, env, options.preparationTimeoutMs);
     if (failure)
       return failure;
@@ -44231,10 +44686,10 @@ function generateSkillMd(name) {
     "---"
   ].join(`
 `);
-  const readme = readIfExists(join29(skillPath, "README.md"));
-  const claudeMd = readIfExists(join29(skillPath, "CLAUDE.md"));
+  const readme = readIfExists(join30(skillPath, "README.md"));
+  const claudeMd = readIfExists(join30(skillPath, "CLAUDE.md"));
   let cliCommand = null;
-  const pkgPath = join29(skillPath, "package.json");
+  const pkgPath = join30(skillPath, "package.json");
   if (existsSync14(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync20(pkgPath, "utf-8"));
@@ -44516,7 +44971,7 @@ async function executeSelectedLocal(selected, options = {}) {
         throw new SkillSelectionError("INVALID_SECRET_BINDINGS", "Explicit environment values must be bounded strings without NUL bytes.");
       secretEnv[name] = value;
     }
-  const runDirectory = mkdtempSync3(join30(tmpdir(), "skills-execution-"));
+  const runDirectory = mkdtempSync3(join31(tmpdir(), "skills-execution-"));
   const paths = new SkillEntryPaths;
   for (const entry of entries) {
     paths.add(entry.path, 100, () => {
@@ -44524,12 +44979,12 @@ async function executeSelectedLocal(selected, options = {}) {
     }, () => {
       throw new SkillSelectionError("INVALID_BUNDLE_PATH", "The execution bundle path exceeds its limit.");
     });
-    const destination = join30(runDirectory, entry.path);
-    mkdirSync10(dirname17(destination), { recursive: true, mode: 448 });
-    writeFileSync8(destination, entry.bytes, { flag: "wx", mode: entry.mode & 511 });
+    const destination = join31(runDirectory, entry.path);
+    mkdirSync10(dirname19(destination), { recursive: true, mode: 448 });
+    writeFileSync9(destination, entry.bytes, { flag: "wx", mode: entry.mode & 511 });
   }
   env.SKILLS_INPUT_JSON = input;
-  env.SKILLS_WORKSPACE_DIR = resolve16(options.cwd ?? process.cwd());
+  env.SKILLS_WORKSPACE_DIR = resolve17(options.cwd ?? process.cwd());
   env.SKILLS_RUN_DIR = runDirectory;
   if (runtime.version) {
     const version = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], "--version"], runDirectory, env, "", Math.min(timeoutMs, 5000));
@@ -44542,7 +44997,7 @@ async function executeSelectedLocal(selected, options = {}) {
     const { authority: authority2, workspaceId, profileRevision, slug, version, bundleDigest } = selection2;
     const request2 = {
       selection: { authority: authority2, workspaceId, profileId, profileRevision, slug, version, bundleDigest },
-      consumer: { stationId: process.env.HASNA_STATION || stationHostname2(), workspaceDirectory: realpathSync7(options.cwd ?? process.cwd()) }
+      consumer: { stationId: process.env.HASNA_STATION || stationHostname2(), workspaceDirectory: realpathSync8(options.cwd ?? process.cwd()) }
     };
     const grant = await (options.resolveExecutionGrant ?? resolveExecutionGrant)(request2);
     if (!grant || !grantIdentifier(grant.policyRevision) || !grantIdentifier(grant.grantId))
@@ -44552,20 +45007,20 @@ async function executeSelectedLocal(selected, options = {}) {
   }
   if (bindings)
     secretEnv = await resolveSelectedSecrets(bindings, options.createSecretsClient);
-  const result = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], join30(runDirectory, declaredEntry), ...args], runDirectory, { ...env, ...secretEnv }, input, timeoutMs);
+  const result = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], join31(runDirectory, declaredEntry), ...args], runDirectory, { ...env, ...secretEnv }, input, timeoutMs);
   result.stdout = redactExecutionSecrets(result.stdout, secretEnv);
   result.stderr = redactExecutionSecrets(result.stderr, secretEnv);
   const receipt = {
     selection: selection2,
     target: "local",
     runtime: runtimeName,
-    inputDigest: `sha256:${createHash16("sha256").update(input).digest("hex")}`,
+    inputDigest: `sha256:${createHash18("sha256").update(input).digest("hex")}`,
     runDirectory,
     ...executionGrant ? { executionGrant } : {},
     ...bindings ? { secretBinding: { schema: bindings.schema, selection: bindings.selection, consumer: bindings.consumer, secretsAuthority: bindings.secretsAuthority, bindings: bindings.bindings } } : {},
     ...result
   };
-  writeFileSync8(join30(runDirectory, ".execution-receipt.json"), JSON.stringify({ ...receipt, stdout: undefined, stderr: undefined }), { mode: 384 });
+  writeFileSync9(join31(runDirectory, ".execution-receipt.json"), JSON.stringify({ ...receipt, stdout: undefined, stderr: undefined }), { mode: 384 });
   return receipt;
 }
 async function subprocess(command, cwd, env, input, timeoutMs) {
@@ -45684,7 +46139,7 @@ var $resolveS3Config = resolveS3Config;
 // node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
 var import_core = __toESM(require_dist_cjs2(), 1);
 var import_client27 = __toESM(require_client(), 1);
-var import_config36 = __toESM(require_config(), 1);
+var import_config37 = __toESM(require_config(), 1);
 var import_endpoints5 = __toESM(require_endpoints(), 1);
 var import_event_streams2 = __toESM(require_event_streams(), 1);
 var import_protocols6 = __toESM(require_protocols(), 1);
@@ -53687,21 +54142,21 @@ var import_httpAuthSchemes3 = __toESM(require_httpAuthSchemes(), 1);
 
 // node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.js
 init_dist_es();
-var import_config34 = __toESM(require_config(), 1);
+var import_config35 = __toESM(require_config(), 1);
 
 // node_modules/@aws-sdk/credential-provider-node/dist-es/remoteProvider.js
-var import_config17 = __toESM(require_config(), 1);
+var import_config18 = __toESM(require_config(), 1);
 var ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
 var remoteProvider = async (init) => {
   const { ENV_CMDS_FULL_URI: ENV_CMDS_FULL_URI2, ENV_CMDS_RELATIVE_URI: ENV_CMDS_RELATIVE_URI2, fromContainerMetadata: fromContainerMetadata2, fromInstanceMetadata: fromInstanceMetadata2 } = await Promise.resolve().then(() => (init_dist_es2(), exports_dist_es2));
   if (process.env[ENV_CMDS_RELATIVE_URI2] || process.env[ENV_CMDS_FULL_URI2]) {
     init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromHttp/fromContainerMetadata");
     const { fromHttp: fromHttp2 } = await Promise.resolve().then(() => (init_dist_es3(), exports_dist_es3));
-    return import_config17.chain(fromHttp2(init), fromContainerMetadata2(init));
+    return import_config18.chain(fromHttp2(init), fromContainerMetadata2(init));
   }
   if (process.env[ENV_IMDS_DISABLED] && process.env[ENV_IMDS_DISABLED] !== "false") {
     return async () => {
-      throw new import_config17.CredentialsProviderError("EC2 Instance Metadata Service access disabled", { logger: init.logger });
+      throw new import_config18.CredentialsProviderError("EC2 Instance Metadata Service access disabled", { logger: init.logger });
     };
   }
   init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromInstanceMetadata");
@@ -53776,7 +54231,7 @@ var internalCreateChain = (providers) => async (awsIdentityProperties) => {
 var multipleCredentialSourceWarningEmitted = false;
 var defaultProvider = (init = {}) => memoizeChain([
   async () => {
-    const profile = init.profile ?? process.env[import_config34.ENV_PROFILE];
+    const profile = init.profile ?? process.env[import_config35.ENV_PROFILE];
     if (profile) {
       const envStaticCredentialsAreSet = process.env[ENV_KEY] && process.env[ENV_SECRET];
       if (envStaticCredentialsAreSet) {
@@ -53794,7 +54249,7 @@ var defaultProvider = (init = {}) => memoizeChain([
           multipleCredentialSourceWarningEmitted = true;
         }
       }
-      throw new import_config34.CredentialsProviderError("AWS_PROFILE is set, skipping fromEnv provider.", {
+      throw new import_config35.CredentialsProviderError("AWS_PROFILE is set, skipping fromEnv provider.", {
         logger: init.logger,
         tryNextLink: true
       });
@@ -53806,7 +54261,7 @@ var defaultProvider = (init = {}) => memoizeChain([
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromSSO");
     const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
     if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
-      throw new import_config34.CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).", { logger: init.logger });
+      throw new import_config35.CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).", { logger: init.logger });
     }
     const { fromSSO: fromSSO2 } = await Promise.resolve().then(() => (init_dist_es5(), exports_dist_es4));
     return fromSSO2(init)(awsIdentityProperties);
@@ -53831,7 +54286,7 @@ var defaultProvider = (init = {}) => memoizeChain([
     return (await remoteProvider(init))();
   },
   async () => {
-    throw new import_config34.CredentialsProviderError("Could not load credentials from any providers", {
+    throw new import_config35.CredentialsProviderError("Could not load credentials from any providers", {
       tryNextLink: false,
       logger: init.logger
     });
@@ -53841,7 +54296,7 @@ var credentialsTreatedAsExpired = (credentials) => credentials?.expiration !== u
 // node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var import_checksum2 = __toESM(require_checksum(), 1);
 var import_client23 = __toESM(require_client(), 1);
-var import_config35 = __toESM(require_config(), 1);
+var import_config36 = __toESM(require_config(), 1);
 var import_event_streams = __toESM(require_event_streams(), 1);
 var import_retry3 = __toESM(require_retry(), 1);
 var import_serde4 = __toESM(require_serde(), 1);
@@ -53849,7 +54304,7 @@ var import_node_http_handler2 = __toESM(require_dist_cjs6(), 1);
 
 // node_modules/@aws-sdk/checksums/dist-cjs/submodules/sha/index.js
 var { toUint8Array: toUint8Array2, concatBytes } = require_serde();
-var { createHmac: createHmac2, createHash: createHash18 } = __require("crypto");
+var { createHmac: createHmac2, createHash: createHash20 } = __require("crypto");
 var { Sha256: Sha2562, Sha256Js, Sha256Node } = require_checksum();
 var BLOCK2 = 64;
 var DIGEST_LENGTH = 20;
@@ -54018,7 +54473,7 @@ class Sha1Js {
 }
 var hasNativeCrypto = (() => {
   try {
-    createHash18("sha1");
+    createHash20("sha1");
     return true;
   } catch {
     return false;
@@ -54058,7 +54513,7 @@ function buildNativeClass() {
       this.finished = false;
     }
     createHash() {
-      return this.secret ? createHmac2("sha1", toBuffer(this.secret)) : createHash18("sha1");
+      return this.secret ? createHmac2("sha1", toBuffer(this.secret)) : createHash20("sha1");
     }
   };
 }
@@ -54131,7 +54586,7 @@ var getRuntimeConfig2 = (config) => {
 // node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var getRuntimeConfig3 = (config) => {
   import_client23.emitWarningIfUnsupportedVersion(process.version);
-  const defaultsMode = import_config35.resolveDefaultsModeConfig(config);
+  const defaultsMode = import_config36.resolveDefaultsModeConfig(config);
   const defaultConfigProvider = () => defaultsMode().then(import_client23.loadConfigsForDefaultMode);
   const clientSharedValues = getRuntimeConfig2(config);
   import_client22.emitWarningIfUnsupportedVersion(process.version);
@@ -54144,28 +54599,28 @@ var getRuntimeConfig3 = (config) => {
     ...config,
     runtime: "node",
     defaultsMode,
-    authSchemePreference: config?.authSchemePreference ?? import_config35.loadConfig(import_httpAuthSchemes3.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
+    authSchemePreference: config?.authSchemePreference ?? import_config36.loadConfig(import_httpAuthSchemes3.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde4.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
     defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client22.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default2.version }),
-    disableS3ExpressSessionAuth: config?.disableS3ExpressSessionAuth ?? import_config35.loadConfig($NODE_DISABLE_S3_EXPRESS_SESSION_AUTH_OPTIONS, loaderConfig),
+    disableS3ExpressSessionAuth: config?.disableS3ExpressSessionAuth ?? import_config36.loadConfig($NODE_DISABLE_S3_EXPRESS_SESSION_AUTH_OPTIONS, loaderConfig),
     eventStreamSerdeProvider: config?.eventStreamSerdeProvider ?? import_event_streams.eventStreamSerdeProvider,
-    maxAttempts: config?.maxAttempts ?? import_config35.loadConfig(import_retry3.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
-    region: config?.region ?? import_config35.loadConfig(import_config35.NODE_REGION_CONFIG_OPTIONS, { ...import_config35.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
-    requestChecksumCalculation: config?.requestChecksumCalculation ?? import_config35.loadConfig($NODE_REQUEST_CHECKSUM_CALCULATION_CONFIG_OPTIONS, loaderConfig),
+    maxAttempts: config?.maxAttempts ?? import_config36.loadConfig(import_retry3.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
+    region: config?.region ?? import_config36.loadConfig(import_config36.NODE_REGION_CONFIG_OPTIONS, { ...import_config36.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
+    requestChecksumCalculation: config?.requestChecksumCalculation ?? import_config36.loadConfig($NODE_REQUEST_CHECKSUM_CALCULATION_CONFIG_OPTIONS, loaderConfig),
     requestHandler: import_node_http_handler2.NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
-    responseChecksumValidation: config?.responseChecksumValidation ?? import_config35.loadConfig($NODE_RESPONSE_CHECKSUM_VALIDATION_CONFIG_OPTIONS, loaderConfig),
-    retryMode: config?.retryMode ?? import_config35.loadConfig({
+    responseChecksumValidation: config?.responseChecksumValidation ?? import_config36.loadConfig($NODE_RESPONSE_CHECKSUM_VALIDATION_CONFIG_OPTIONS, loaderConfig),
+    retryMode: config?.retryMode ?? import_config36.loadConfig({
       ...import_retry3.NODE_RETRY_MODE_CONFIG_OPTIONS,
       default: async () => (await defaultConfigProvider()).retryMode || import_retry3.DEFAULT_RETRY_MODE
     }, config),
-    sigv4aSigningRegionSet: config?.sigv4aSigningRegionSet ?? import_config35.loadConfig(import_httpAuthSchemes3.NODE_SIGV4A_CONFIG_OPTIONS, loaderConfig),
+    sigv4aSigningRegionSet: config?.sigv4aSigningRegionSet ?? import_config36.loadConfig(import_httpAuthSchemes3.NODE_SIGV4A_CONFIG_OPTIONS, loaderConfig),
     streamCollector: config?.streamCollector ?? import_node_http_handler2.streamCollector,
     streamHasher: config?.streamHasher ?? import_checksum2.readableStreamHasher,
-    useArnRegion: config?.useArnRegion ?? import_config35.loadConfig($NODE_USE_ARN_REGION_CONFIG_OPTIONS, loaderConfig),
-    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config35.loadConfig(import_config35.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    useFipsEndpoint: config?.useFipsEndpoint ?? import_config35.loadConfig(import_config35.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    userAgentAppId: config?.userAgentAppId ?? import_config35.loadConfig(import_client22.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    useArnRegion: config?.useArnRegion ?? import_config36.loadConfig($NODE_USE_ARN_REGION_CONFIG_OPTIONS, loaderConfig),
+    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config36.loadConfig(import_config36.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    useFipsEndpoint: config?.useFipsEndpoint ?? import_config36.loadConfig(import_config36.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    userAgentAppId: config?.userAgentAppId ?? import_config36.loadConfig(import_client22.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
   };
 };
 
@@ -54231,7 +54686,7 @@ class S3Client extends import_client27.Client {
     const _config_2 = import_client26.resolveUserAgentConfig(_config_1);
     const _config_3 = $resolveFlexibleChecksumsConfig(_config_2);
     const _config_4 = import_retry4.resolveRetryConfig(_config_3);
-    const _config_5 = import_config36.resolveRegionConfig(_config_4);
+    const _config_5 = import_config37.resolveRegionConfig(_config_4);
     const _config_6 = import_client26.resolveHostHeaderConfig(_config_5);
     const _config_7 = import_endpoints5.resolveEndpointConfig(_config_6);
     const _config_8 = import_event_streams2.resolveEventStreamSerdeConfig(_config_7);
@@ -54627,10 +55082,10 @@ function assertReservationCents(value, field2) {
 import { Database as Database2 } from "bun:sqlite";
 import { randomUUID as randomUUID8 } from "crypto";
 import { mkdirSync as mkdirSync12 } from "fs";
-import { dirname as dirname21 } from "path";
+import { dirname as dirname23 } from "path";
 
 // src/server/database-url.ts
-import { isAbsolute as isAbsolute17, join as join32 } from "path";
+import { isAbsolute as isAbsolute17, join as join33 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var DEFAULT_SQLITE_FILENAME2 = "server.db";
 var SQLITE_MEMORY_PATH = ":memory:";
@@ -54639,7 +55094,7 @@ var SQLITE_SCHEMES = new Set(["sqlite", "sqlite3", "file"]);
 var MEMORY_SCHEMES = new Set(["memory"]);
 var SQLITE_EXTENSIONS = [".db", ".sqlite", ".sqlite3", ".db3"];
 function defaultSqlitePath() {
-  return join32(getDataDir(), DEFAULT_SQLITE_FILENAME2);
+  return join33(getDataDir(), DEFAULT_SQLITE_FILENAME2);
 }
 function resolveDatabaseTarget(raw) {
   const value = raw?.trim();
@@ -54666,7 +55121,7 @@ function resolveDatabaseTarget(raw) {
     throw new Error(`unsupported database scheme "${scheme}:". Supported: postgres://, postgresql://, sqlite:, file:, ` + `an absolute or relative path to a .db/.sqlite file, ":memory:", or "memory:" (non-durable, tests only). ` + `Leave the setting empty to use the default SQLite database at ${defaultSqlitePath()}.`);
   }
   if (looksLikeSqlitePath(value)) {
-    const path = isAbsolute17(value) ? value : join32(process.cwd(), value);
+    const path = isAbsolute17(value) ? value : join33(process.cwd(), value);
     return { kind: "sqlite", path, durable: true, label: `sqlite (${path})` };
   }
   throw new Error(`could not resolve a database backend from "${value}". Use postgres://\u2026, sqlite:\u2026, an absolute or ` + `relative path ending in ${SQLITE_EXTENSIONS.join("/")}, ":memory:", or leave it empty for the ` + `default SQLite database at ${defaultSqlitePath()}.`);
@@ -54690,7 +55145,7 @@ function sqlitePathFromUrl(value, scheme) {
     }
     return rest.slice(2).replace(/^\/\/+/, "/");
   }
-  return isAbsolute17(rest) ? rest : join32(process.cwd(), rest);
+  return isAbsolute17(rest) ? rest : join33(process.cwd(), rest);
 }
 function looksLikeSqlitePath(value) {
   if (value.includes("/"))
@@ -54923,12 +55378,12 @@ class PostgresSkillSelectionStore {
 // src/server/sqlite-store.ts
 import { randomUUID as randomUUID7 } from "crypto";
 import { mkdirSync as mkdirSync11, readFileSync as readFileSync22, readdirSync as readdirSync12 } from "fs";
-import { dirname as dirname20, join as join34 } from "path";
+import { dirname as dirname22, join as join35 } from "path";
 
 // src/server/auth.ts
-import { createHash as createHash19 } from "crypto";
+import { createHash as createHash21 } from "crypto";
 function hashApiKey(token) {
-  return createHash19("sha256").update(token).digest("hex");
+  return createHash21("sha256").update(token).digest("hex");
 }
 function bearerToken(request2) {
   const header = request2.headers.get("authorization") || "";
@@ -54957,24 +55412,24 @@ function publicPrincipal(partial = {}) {
 function permitsSkillsRoute(principal, method, resource) {
   const scopes = new Set(principal.scopes);
   if (resource === "execution-grants") {
-    const read3 = method === "GET" || method === "HEAD";
-    if (!read3 && method !== "POST" && !["owner", "admin"].includes(principal.role))
+    const read4 = method === "GET" || method === "HEAD";
+    if (!read4 && method !== "POST" && !["owner", "admin"].includes(principal.role))
       return false;
-    const allowed2 = read3 ? ["*", "execution-grants:*", "execution-grants:read"] : method === "POST" ? ["*", "execution-grants:*", "execution-grants:resolve", "skills:read", "skills:*"] : ["*", "execution-grants:*", "execution-grants:write"];
+    const allowed2 = read4 ? ["*", "execution-grants:*", "execution-grants:read"] : method === "POST" ? ["*", "execution-grants:*", "execution-grants:resolve", "skills:read", "skills:*"] : ["*", "execution-grants:*", "execution-grants:write"];
     return allowed2.some((scope) => scopes.has(scope));
   }
   if (scopes.has("*"))
     return true;
-  const read2 = method === "GET" || method === "HEAD";
-  if (resource === "capabilities" && read2)
+  const read3 = method === "GET" || method === "HEAD";
+  if (resource === "capabilities" && read3)
     return true;
   let allowed;
   if (resource === "runs" || resource === "executions") {
-    allowed = read2 ? ["runs:read", "runs:*", "skills:read", "skills:*"] : ["runs:write", "runs:*"];
+    allowed = read3 ? ["runs:read", "runs:*", "skills:read", "skills:*"] : ["runs:write", "runs:*"];
   } else if (resource === "stations") {
-    allowed = read2 ? ["stations:read", "stations:*", "skills:read", "skills:*"] : ["stations:write", "stations:*", "skills:*"];
+    allowed = read3 ? ["stations:read", "stations:*", "skills:read", "skills:*"] : ["stations:write", "stations:*", "skills:*"];
   } else if (["skills", "pins", "tags", "profiles", "capabilities"].includes(resource)) {
-    allowed = read2 ? ["skills:read", "skills:*"] : ["skills:write", "skills:publish", "skills:*"];
+    allowed = read3 ? ["skills:read", "skills:*"] : ["skills:write", "skills:publish", "skills:*"];
   } else
     return true;
   return allowed.some((scope) => scopes.has(scope));
@@ -54982,17 +55437,17 @@ function permitsSkillsRoute(principal, method, resource) {
 
 // src/server/migrations-dir.ts
 import { existsSync as existsSync15 } from "fs";
-import { dirname as dirname19, join as join33 } from "path";
+import { dirname as dirname21, join as join34 } from "path";
 var MIGRATION_DIALECTS = ["postgres", "sqlite"];
 var MAX_WALK_UP = 6;
 function findMigrationsRoot(startDirs = defaultStartDirs()) {
   for (const start of startDirs) {
     let dir = start;
     for (let level = 0;level < MAX_WALK_UP; level += 1) {
-      const candidate2 = join33(dir, "migrations");
-      if (MIGRATION_DIALECTS.some((dialect) => existsSync15(join33(candidate2, dialect))))
+      const candidate2 = join34(dir, "migrations");
+      if (MIGRATION_DIALECTS.some((dialect) => existsSync15(join34(candidate2, dialect))))
         return candidate2;
-      const parent = dirname19(dir);
+      const parent = dirname21(dir);
       if (parent === dir)
         break;
       dir = parent;
@@ -55004,7 +55459,7 @@ function resolveMigrationsDir(dialect, root4 = findMigrationsRoot()) {
   if (!root4) {
     throw new Error(`could not locate the migrations directory for dialect "${dialect}". ` + `Expected a migrations/${dialect}/ folder alongside the package root.`);
   }
-  const dir = join33(root4, dialect);
+  const dir = join34(root4, dialect);
   if (!existsSync15(dir)) {
     throw new Error(`migrations directory not found: ${dir}`);
   }
@@ -55238,7 +55693,7 @@ function validOperatorScopeEnrollmentInput(input) {
 }
 
 // src/lib/revision.ts
-import { createHash as createHash20 } from "crypto";
+import { createHash as createHash22 } from "crypto";
 var REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
 function revisionIdOf(content) {
   const canonicalContent = {
@@ -55260,7 +55715,7 @@ function revisionIdOf(content) {
     canonicalContent.replacementSlug = content.replacementSlug ?? null;
   }
   const canonical4 = JSON.stringify(canonicalContent);
-  return createHash20("sha256").update(canonical4).digest("hex");
+  return createHash22("sha256").update(canonical4).digest("hex");
 }
 function revisionIdOfRecord(record3) {
   return revisionIdOf(record3);
@@ -55285,7 +55740,7 @@ class SqliteSkillsStore {
   constructor(path = SQLITE_MEMORY_PATH, options = {}) {
     const inMemory = path === SQLITE_MEMORY_PATH;
     if (!inMemory)
-      mkdirSync11(dirname20(path), { recursive: true });
+      mkdirSync11(dirname22(path), { recursive: true });
     this.db = openDatabase(path);
     this.db.exec(`PRAGMA busy_timeout = ${Math.max(0, options.busyTimeoutMs ?? 5000)}`);
     if (!inMemory)
@@ -55948,7 +56403,7 @@ function applySqliteMigrations(db, migrationsDir = resolveMigrationsDir("sqlite"
   const appliedNow = [];
   for (const file of files) {
     const version2 = file.replace(/\.sql$/, "");
-    const text2 = readFileSync22(join34(migrationsDir, file), "utf8");
+    const text2 = readFileSync22(join35(migrationsDir, file), "utf8");
     const apply = db.transaction(() => {
       const already = db.query("SELECT 1 AS present FROM schema_migrations WHERE version = ? LIMIT 1").get(version2);
       if (already)
@@ -56095,7 +56550,7 @@ class SqliteGovernanceStore {
   closed = false;
   constructor(path = SQLITE_MEMORY_PATH, options = {}) {
     if (path !== SQLITE_MEMORY_PATH)
-      mkdirSync12(dirname21(path), { recursive: true });
+      mkdirSync12(dirname23(path), { recursive: true });
     this.db = new Database2(path, { create: true, readwrite: true });
     this.db.exec("PRAGMA busy_timeout = 5000");
     this.db.exec("PRAGMA foreign_keys = ON");
@@ -56328,7 +56783,7 @@ function nextMonthPrefix(monthPrefix) {
 }
 
 // src/server/skills-api.ts
-import { createHash as createHash21 } from "crypto";
+import { createHash as createHash23 } from "crypto";
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
 var SHA256_HEX2 = /^[0-9a-f]{64}$/;
 var MAX_SLUG_LENGTH = 128;
@@ -56518,7 +56973,7 @@ async function parsePublishRequest(request2, config) {
     if (bundleBytes.byteLength === 0) {
       throw new SkillRequestError(400, "BUNDLE_EMPTY", "the uploaded bundle is empty");
     }
-    const sha2562 = createHash21("sha256").update(bundleBytes).digest("hex");
+    const sha2562 = createHash23("sha256").update(bundleBytes).digest("hex");
     const claimed = optionalString(manifest.bundleSha256);
     if (claimed)
       assertSha2562(claimed);
@@ -56633,7 +57088,7 @@ async function readPublishedBundle(store, artifactStorage, principal, slug) {
   if (!bytes) {
     throw new SkillRequestError(503, "BUNDLE_BACKEND_UNAVAILABLE", "bundle storage backend unavailable");
   }
-  const actual = createHash21("sha256").update(bytes).digest("hex");
+  const actual = createHash23("sha256").update(bytes).digest("hex");
   if (actual !== record3.bundleSha256) {
     throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}' hashes to ${actual} but was published as ${record3.bundleSha256}`);
   }
@@ -56781,7 +57236,7 @@ async function readSkillVersionBundle(store, artifactStorage, principal, slug, v
   const bytes = await artifactStorage.readBundle(bundle2);
   if (!bytes)
     throw new SkillRequestError(503, "BUNDLE_BACKEND_UNAVAILABLE", "bundle storage backend unavailable");
-  const actual = createHash21("sha256").update(bytes).digest("hex");
+  const actual = createHash23("sha256").update(bytes).digest("hex");
   if (actual !== found.bundleSha256) {
     throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}@${version2}' hashes to ${actual} but was published as ${found.bundleSha256}`);
   }
@@ -57183,7 +57638,7 @@ async function handleProfileApi(store, principal, request2, parts, config) {
 // src/server/runtime-store.ts
 import { Database as Database3 } from "bun:sqlite";
 import { mkdirSync as mkdirSync13 } from "fs";
-import { dirname as dirname22 } from "path";
+import { dirname as dirname24 } from "path";
 
 // src/sdk/execution/types.ts
 var EXECUTION_PROTOCOL_VERSION = REMOTE_SKILL_RUN_CONTRACT_VERSION;
@@ -57239,7 +57694,7 @@ class RuntimeExecutionStore {
     }
     const path = target.kind === "sqlite" ? target.path : ":memory:";
     if (path !== ":memory:")
-      mkdirSync13(dirname22(path), { recursive: true });
+      mkdirSync13(dirname24(path), { recursive: true });
     const db = new Database3(path);
     db.run("PRAGMA busy_timeout=5000");
     db.run("PRAGMA journal_mode=WAL");
@@ -57479,7 +57934,7 @@ class RuntimeExecutionStore {
 }
 
 // src/sdk/execution/admission.ts
-import { createHash as createHash23 } from "crypto";
+import { createHash as createHash25 } from "crypto";
 
 // src/sdk/execution/image-profile.ts
 class ImageProfileResolutionError extends Error {
@@ -58091,11 +58546,11 @@ function ownedAdmission(admission) {
   };
 }
 function digestInput(input) {
-  return createHash23("sha256").update(canonicalJson2(input)).digest("hex");
+  return createHash25("sha256").update(canonicalJson2(input)).digest("hex");
 }
 
 // src/sdk/execution/dispatchers/ecs.ts
-import { createHash as createHash24 } from "crypto";
+import { createHash as createHash26 } from "crypto";
 
 // src/sdk/execution/state-machine.ts
 var LEGAL_TRANSITIONS = {
@@ -58263,7 +58718,7 @@ function createReceiptService(store) {
 var import_client36 = __toESM(require_client2(), 1);
 var import_core2 = __toESM(require_dist_cjs2(), 1);
 var import_client37 = __toESM(require_client(), 1);
-var import_config39 = __toESM(require_config(), 1);
+var import_config40 = __toESM(require_config(), 1);
 var import_endpoints8 = __toESM(require_endpoints(), 1);
 var import_protocols10 = __toESM(require_protocols(), 1);
 var import_retry6 = __toESM(require_retry(), 1);
@@ -58402,7 +58857,7 @@ var package_default3 = {
 var import_client32 = __toESM(require_client2(), 1);
 var import_httpAuthSchemes6 = __toESM(require_httpAuthSchemes(), 1);
 var import_client33 = __toESM(require_client(), 1);
-var import_config38 = __toESM(require_config(), 1);
+var import_config39 = __toESM(require_config(), 1);
 var import_retry5 = __toESM(require_retry(), 1);
 var import_serde6 = __toESM(require_serde(), 1);
 var import_node_http_handler3 = __toESM(require_dist_cjs6(), 1);
@@ -61344,7 +61799,7 @@ var getRuntimeConfig4 = (config) => {
 // node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
 var getRuntimeConfig5 = (config) => {
   import_client33.emitWarningIfUnsupportedVersion(process.version);
-  const defaultsMode = import_config38.resolveDefaultsModeConfig(config);
+  const defaultsMode = import_config39.resolveDefaultsModeConfig(config);
   const defaultConfigProvider = () => defaultsMode().then(import_client33.loadConfigsForDefaultMode);
   const clientSharedValues = getRuntimeConfig4(config);
   import_client32.emitWarningIfUnsupportedVersion(process.version);
@@ -61357,21 +61812,21 @@ var getRuntimeConfig5 = (config) => {
     ...config,
     runtime: "node",
     defaultsMode,
-    authSchemePreference: config?.authSchemePreference ?? import_config38.loadConfig(import_httpAuthSchemes6.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
+    authSchemePreference: config?.authSchemePreference ?? import_config39.loadConfig(import_httpAuthSchemes6.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde6.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
     defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client32.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default3.version }),
-    maxAttempts: config?.maxAttempts ?? import_config38.loadConfig(import_retry5.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
-    region: config?.region ?? import_config38.loadConfig(import_config38.NODE_REGION_CONFIG_OPTIONS, { ...import_config38.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
+    maxAttempts: config?.maxAttempts ?? import_config39.loadConfig(import_retry5.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
+    region: config?.region ?? import_config39.loadConfig(import_config39.NODE_REGION_CONFIG_OPTIONS, { ...import_config39.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
     requestHandler: import_node_http_handler3.NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
-    retryMode: config?.retryMode ?? import_config38.loadConfig({
+    retryMode: config?.retryMode ?? import_config39.loadConfig({
       ...import_retry5.NODE_RETRY_MODE_CONFIG_OPTIONS,
       default: async () => (await defaultConfigProvider()).retryMode || import_retry5.DEFAULT_RETRY_MODE
     }, config),
     streamCollector: config?.streamCollector ?? import_node_http_handler3.streamCollector,
-    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config38.loadConfig(import_config38.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    useFipsEndpoint: config?.useFipsEndpoint ?? import_config38.loadConfig(import_config38.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    userAgentAppId: config?.userAgentAppId ?? import_config38.loadConfig(import_client32.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config39.loadConfig(import_config39.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    useFipsEndpoint: config?.useFipsEndpoint ?? import_config39.loadConfig(import_config39.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    userAgentAppId: config?.userAgentAppId ?? import_config39.loadConfig(import_client32.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
   };
 };
 
@@ -61436,7 +61891,7 @@ class ECSClient extends import_client37.Client {
     const _config_1 = resolveClientEndpointParameters3(_config_0);
     const _config_2 = import_client36.resolveUserAgentConfig(_config_1);
     const _config_3 = import_retry6.resolveRetryConfig(_config_2);
-    const _config_4 = import_config39.resolveRegionConfig(_config_3);
+    const _config_4 = import_config40.resolveRegionConfig(_config_3);
     const _config_5 = import_client36.resolveHostHeaderConfig(_config_4);
     const _config_6 = import_endpoints8.resolveEndpointConfig(_config_5);
     const _config_7 = resolveHttpAuthSchemeConfig3(_config_6);
@@ -61495,13 +61950,13 @@ function observedTask(states, taskArn) {
   return state2.lastStatus === "STOPPED" || LIVE_TASK_STATUSES.has(state2.lastStatus) ? state2 : undefined;
 }
 function clientTokenFor(runId3, attemptId) {
-  return createHash24("sha256").update(`${runId3}\x00${attemptId}`).digest("hex").slice(0, CLIENT_TOKEN_BYTES * 2);
+  return createHash26("sha256").update(`${runId3}\x00${attemptId}`).digest("hex").slice(0, CLIENT_TOKEN_BYTES * 2);
 }
 function startedByFor(runId3, attemptNumber) {
   return `skills-exec/${runId3}/a${attemptNumber}`;
 }
 function requestDigestFor(admission, attemptId) {
-  return createHash24("sha256").update(canonicalJson2({ admission, attemptId })).digest("hex");
+  return createHash26("sha256").update(canonicalJson2({ admission, attemptId })).digest("hex");
 }
 
 class EcsDispatcher {
@@ -61797,10 +62252,10 @@ function validText(value) {
 }
 
 // src/server/runtime-policy.ts
-import { createHash as createHash26, createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash28, createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
 
 // src/server/runtime-pure-contract.ts
-import { createHash as createHash25 } from "crypto";
+import { createHash as createHash27 } from "crypto";
 var PURE_DESCRIPTOR = Object.freeze({
   id: "regex-test.v1",
   runtime: "bun",
@@ -61824,7 +62279,7 @@ var PURE_LIMITS = Object.freeze({
   maxArtifactsBytes: 0,
   maxConcurrency: 1
 });
-var hash2 = (bytes) => createHash25("sha256").update(bytes).digest("hex");
+var hash2 = (bytes) => createHash27("sha256").update(bytes).digest("hex");
 var object5 = (v2) => {
   if (!v2 || typeof v2 !== "object" || Array.isArray(v2))
     throw Error("Pure contract requires an object");
@@ -61935,13 +62390,13 @@ async function inspectPureBundle(bytes, contract) {
     throw Error("Pure entrypoint integrity failed");
   if (entries.some((e5) => e5.path.split("/").includes("node_modules")))
     throw Error("Pure bundle cannot supply dependencies");
-  const read2 = (name) => {
+  const read3 = (name) => {
     const entry2 = entries.find((e5) => e5.path === name);
     if (!entry2)
       throw Error("Pure bundle manifest missing");
     return object5(uniqueJson(Buffer.from(entry2.bytes).toString("utf8")));
   };
-  const manifest = read2("skill.json"), runtime = object5(manifest.runtime), pkg = read2("package.json");
+  const manifest = read3("skill.json"), runtime = object5(manifest.runtime), pkg = read3("package.json");
   if (manifest.kind !== "executable" || runtime.runtime !== "bun" || runtime.entrypoint !== contract.entrypoint || !Array.isArray(runtime.env) || runtime.env.length !== 0 || runtime.system_deps !== undefined && (!Array.isArray(runtime.system_deps) || runtime.system_deps.length !== 0) || runtime.needs_network === true || manifest.needs_network === true)
     throw Error("Pure bundle requires a credential-free self-contained Bun entrypoint");
   for (const key of ["dependencies", "optionalDependencies", "peerDependencies", "devDependencies", "scripts"])
@@ -62053,7 +62508,7 @@ function verifyRuntimeToken(token, key, admission, attempt, now = Date.now()) {
   const actual = Buffer.from(token);
   return actual.length === expected.length && timingSafeEqual2(actual, expected);
 }
-var hashBytes = (bytes) => createHash26("sha256").update(bytes).digest("hex");
+var hashBytes = (bytes) => createHash28("sha256").update(bytes).digest("hex");
 
 // src/server/runtime-api.ts
 async function createRuntimeService(options) {
@@ -68386,7 +68841,7 @@ var localRunExecutor = {
 // src/sdk/storage.ts
 var artifactStorageSeam = ArtifactStorage;
 // src/sdk/outputs.ts
-import { createHash as createHash27 } from "crypto";
+import { createHash as createHash29 } from "crypto";
 class DatabaseOnlyObjectStore {
   usesS3 = false;
   async materialize(run, artifact, body4) {
@@ -68433,7 +68888,7 @@ function createGovernedArtifactWriter(options) {
       const stamped = {
         ...meta,
         byteSize: outputBytes,
-        sha256: createHash27("sha256").update(persistedBytes).digest("hex"),
+        sha256: createHash29("sha256").update(persistedBytes).digest("hex"),
         visibility: options.visibility ?? config.defaultVisibility,
         ...config.artifactTtlSeconds !== undefined ? { expiresAt: expiresAtFor(createdAt, config.artifactTtlSeconds) } : {}
       };
@@ -87200,7 +87655,7 @@ function date4(params) {
   return _coercedDate(ZodDate2, params);
 }
 // src/lib/canonical-json.ts
-import { createHash as createHash28 } from "crypto";
+import { createHash as createHash30 } from "crypto";
 function canonicalJson3(value, maximumBytes = 2 * 1024 * 1024) {
   return canonicalJsonAtDepth(value, maximumBytes, 64);
 }
@@ -87244,7 +87699,7 @@ function canonicalJsonAtDepth(value, maximumBytes, maximumDepth) {
   return visit3(value, 0);
 }
 function canonicalJsonSha256(value, maximumBytes) {
-  return createHash28("sha256").update(canonicalJson3(value, maximumBytes)).digest("hex");
+  return createHash30("sha256").update(canonicalJson3(value, maximumBytes)).digest("hex");
 }
 
 // src/lib/remote-recurring-contract.ts
@@ -87387,8 +87842,8 @@ var inputs = {
 };
 function recurringInput(action, raw) {
   try {
-    const snapshot = JSON.parse(canonicalJson3(raw, action === "preview" ? 1048576 : 4096));
-    return inputs[action].parse(snapshot);
+    const snapshot2 = JSON.parse(canonicalJson3(raw, action === "preview" ? 1048576 : 4096));
+    return inputs[action].parse(snapshot2);
   } catch {
     throw new RecurringInputError;
   }
@@ -87418,7 +87873,7 @@ function assertRecurringCapability(value, action) {
 }
 function recurringRequest(action, input2) {
   const row = input2, base = "/api/v1/recurring-consents";
-  const read2 = ["draft", "list", "get", "occurrences"].includes(action);
+  const read3 = ["draft", "list", "get", "occurrences"].includes(action);
   let path2 = action === "preview" ? `${base}/preview` : action === "draft" ? `/api/v1/recurring-consent-drafts/${row.draftId}` : action === "activate" ? `${base}/${row.draftId}/activate` : action === "list" ? base : `${base}/${row.consentId}${action === "get" ? "" : `/${action}`}`;
   if (action === "list" || action === "occurrences") {
     const query = new URLSearchParams;
@@ -87429,7 +87884,7 @@ function recurringRequest(action, input2) {
     if (query.size)
       path2 += `?${query}`;
   }
-  return { path: path2, read: read2, method: read2 ? "GET" : "POST", body: read2 ? undefined : JSON.stringify(action === "preview" ? input2 : action === "activate" ? row.approval : { contractVersion: 1 }) };
+  return { path: path2, read: read3, method: read3 ? "GET" : "POST", body: read3 ? undefined : JSON.stringify(action === "preview" ? input2 : action === "activate" ? row.approval : { contractVersion: 1 }) };
 }
 var budget = exports_external2.object({ reservedCredits: integer2, settledCredits: integer2, admittedOccurrences: integer2 });
 var period = exports_external2.object({ startsAt: instant2, endsAt: instant2 });
@@ -88161,10 +88616,10 @@ async function readQuoteUnavailableCode(response) {
   let timer;
   let deadlineExceeded = false;
   const expired = Symbol("quote body deadline");
-  const deadline = new Promise((resolve18) => {
+  const deadline = new Promise((resolve19) => {
     timer = setTimeout(() => {
       deadlineExceeded = true;
-      resolve18(expired);
+      resolve19(expired);
       reader.cancel().catch(() => {});
     }, 1500);
   });
@@ -88690,24 +89145,24 @@ class RemoteSkillsClient {
     const identity3 = parseWorkspaceIdentity(identityValue, target.userId);
     if (identity3.user.membershipId !== target.membershipId)
       throw new WorkspaceIdentityMismatchError;
-    const request2 = invitationRequest(action, captured), read2 = action === "list" || action === "get";
+    const request2 = invitationRequest(action, captured), read3 = action === "list" || action === "get";
     let response, value;
     try {
       response = await connection.request(request2.path, { method: request2.method, ...request2.body ? { body: request2.body } : {}, credentials: "omit" });
       value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 64 * 1024 : 4096)));
     } catch {
-      throw read2 ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+      throw read3 ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
     }
     if (!response.ok) {
       const code = invitationFailure(value, response.status);
       if (code)
         throw new RemoteWorkspaceInvitationError(code);
-      throw read2 ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+      throw read3 ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
     }
     try {
       return parseInvitationResult(action, value, captured, identity3.organization.id);
     } catch {
-      throw read2 ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+      throw read3 ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
     }
   }
   previewRecurringConsent(request2, context) {
@@ -89345,7 +89800,7 @@ async function requestInvitationEmail(origin, action, input2) {
 }
 
 // src/lib/remote-private-publications.ts
-import { createHash as createHash29 } from "crypto";
+import { createHash as createHash31 } from "crypto";
 var PRIVATE_PUBLICATION_MAX_BYTES = 16 * 1024 * 1024;
 var failures2 = {
   INVALID_REQUEST: [400, "The publication request is invalid."],
@@ -89392,7 +89847,7 @@ var hash4 = (v2) => typeof v2 === "string" && /^[a-f0-9]{64}$/.test(v2);
 var record9 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
 var exact = (v2, keys3) => record9(v2) && Object.keys(v2).sort().join(",") === keys3.sort().join(",");
 var date5 = (v2) => typeof v2 === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v2) && Number.isFinite(Date.parse(v2));
-var publicationSha256 = (bytes) => createHash29("sha256").update(bytes).digest("hex");
+var publicationSha256 = (bytes) => createHash31("sha256").update(bytes).digest("hex");
 function checkedPublicationDeclaration(value) {
   if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash4(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
     return bad();
@@ -89637,12 +90092,12 @@ class RemotePrivatePublicationsClient {
       previous = view;
       if (!["queued", "verifying"].includes(view.state) || Date.now() >= until)
         return view;
-      await new Promise((resolve18) => {
+      await new Promise((resolve19) => {
         const timer = setTimeout(done, Math.min(1000, until - Date.now()));
         function done() {
           clearTimeout(timer);
           options.signal?.removeEventListener("abort", done);
-          resolve18();
+          resolve19();
         }
         options.signal?.addEventListener("abort", done, { once: true });
       });
@@ -89874,23 +90329,23 @@ class RemoteSkillsAuthClient {
   }
 }
 // src/lib/private-publication-recovery.ts
-import { constants as constants12, closeSync as closeSync16, fsyncSync as fsyncSync4, fstatSync as fstatSync16, lstatSync as lstatSync20, mkdirSync as mkdirSync14, openSync as openSync16, readSync as readSync11, realpathSync as realpathSync8, renameSync as renameSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname23, isAbsolute as isAbsolute18, join as join36, resolve as resolve18 } from "path";
+import { constants as constants13, closeSync as closeSync17, fsyncSync as fsyncSync5, fstatSync as fstatSync17, lstatSync as lstatSync22, mkdirSync as mkdirSync14, openSync as openSync17, readSync as readSync12, realpathSync as realpathSync9, renameSync as renameSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname25, isAbsolute as isAbsolute18, join as join37, resolve as resolve19 } from "path";
 import { randomUUID as randomUUID11 } from "crypto";
 var fail = () => {
   throw new PrivatePublicationError("PUBLICATION_RECOVERY_INVALID", "The recovery directory is invalid or changed. Preserve it and inspect the existing intent; do not start a replacement automatically.");
 };
 function safeDirectory(directory) {
-  if (!isAbsolute18(directory) || directory !== resolve18(directory) || realpathSync8(directory) !== directory)
+  if (!isAbsolute18(directory) || directory !== resolve19(directory) || realpathSync9(directory) !== directory)
     return fail();
-  for (let path2 = directory;; path2 = dirname23(path2)) {
-    const stat2 = lstatSync20(path2);
+  for (let path2 = directory;; path2 = dirname25(path2)) {
+    const stat2 = lstatSync22(path2);
     if (!stat2.isDirectory() || stat2.isSymbolicLink())
       return fail();
-    if (path2 === dirname23(path2))
+    if (path2 === dirname25(path2))
       break;
   }
-  const own2 = lstatSync20(directory);
+  const own2 = lstatSync22(directory);
   if ((own2.mode & 63) !== 0 || process.getuid && own2.uid !== process.getuid())
     return fail();
   return { dev: own2.dev, ino: own2.ino };
@@ -89901,36 +90356,36 @@ function unchangedDirectory(directory, identity3) {
     return fail();
 }
 function readOwned(directory, name, max) {
-  const identity3 = safeDirectory(directory), file2 = join36(directory, name);
-  const fd = openSync16(file2, constants12.O_RDONLY | constants12.O_NOFOLLOW);
+  const identity3 = safeDirectory(directory), file2 = join37(directory, name);
+  const fd = openSync17(file2, constants13.O_RDONLY | constants13.O_NOFOLLOW);
   try {
-    const stat2 = fstatSync16(fd);
+    const stat2 = fstatSync17(fd);
     if (!stat2.isFile() || stat2.nlink !== 1 || stat2.size > max || stat2.size < 1 || (stat2.mode & 63) !== 0 || process.getuid && stat2.uid !== process.getuid())
       return fail();
     const buffer = Buffer.alloc(Math.min(max, stat2.size) + 1);
     let length = 0;
     while (length < buffer.length) {
-      const count = readSync11(fd, buffer, length, buffer.length - length, length);
+      const count = readSync12(fd, buffer, length, buffer.length - length, length);
       if (count === 0)
         break;
       length += count;
     }
-    const bytes = buffer.subarray(0, length), after = fstatSync16(fd);
+    const bytes = buffer.subarray(0, length), after = fstatSync17(fd);
     unchangedDirectory(directory, identity3);
     if (bytes.length !== stat2.size || stat2.size !== after.size || stat2.mtimeMs !== after.mtimeMs || stat2.ctimeMs !== after.ctimeMs)
       return fail();
     return bytes;
   } finally {
-    closeSync16(fd);
+    closeSync17(fd);
   }
 }
 function writeOwned(directory, name, bytes) {
-  const fd = openSync16(join36(directory, name), constants12.O_WRONLY | constants12.O_CREAT | constants12.O_EXCL | constants12.O_NOFOLLOW, 384);
+  const fd = openSync17(join37(directory, name), constants13.O_WRONLY | constants13.O_CREAT | constants13.O_EXCL | constants13.O_NOFOLLOW, 384);
   try {
-    writeFileSync9(fd, bytes);
-    fsyncSync4(fd);
+    writeFileSync10(fd, bytes);
+    fsyncSync5(fd);
   } finally {
-    closeSync16(fd);
+    closeSync17(fd);
   }
 }
 function save(directory, value) {
@@ -89938,12 +90393,12 @@ function save(directory, value) {
   writeOwned(directory, temporary, JSON.stringify(value) + `
 `);
   unchangedDirectory(directory, identity3);
-  renameSync6(join36(directory, temporary), join36(directory, "receipt.json"));
-  const fd = openSync16(directory, constants12.O_RDONLY | constants12.O_NOFOLLOW);
+  renameSync6(join37(directory, temporary), join37(directory, "receipt.json"));
+  const fd = openSync17(directory, constants13.O_RDONLY | constants13.O_NOFOLLOW);
   try {
-    fsyncSync4(fd);
+    fsyncSync5(fd);
   } finally {
-    closeSync16(fd);
+    closeSync17(fd);
   }
 }
 function bind(client2, receipt) {
@@ -89951,23 +90406,23 @@ function bind(client2, receipt) {
     throw new PrivatePublicationError("PUBLICATION_IDENTITY_CHANGED", "The fresh session does not match the recovery directory's server, account and membership.");
 }
 async function locked(directory, action) {
-  const identity3 = safeDirectory(directory), file2 = join36(directory, "operation.lock");
+  const identity3 = safeDirectory(directory), file2 = join37(directory, "operation.lock");
   let fd;
   try {
-    fd = openSync16(file2, constants12.O_WRONLY | constants12.O_CREAT | constants12.O_EXCL | constants12.O_NOFOLLOW, 384);
+    fd = openSync17(file2, constants13.O_WRONLY | constants13.O_CREAT | constants13.O_EXCL | constants13.O_NOFOLLOW, 384);
   } catch {
     throw new PrivatePublicationError("PUBLICATION_RECOVERY_BUSY", "Another operation holds this recovery directory. If it crashed, confirm that process has stopped before explicitly removing operation.lock and resuming.");
   }
-  const lock = fstatSync16(fd);
+  const lock = fstatSync17(fd);
   try {
-    writeFileSync9(fd, JSON.stringify({ pid: process.pid }) + `
+    writeFileSync10(fd, JSON.stringify({ pid: process.pid }) + `
 `);
-    fsyncSync4(fd);
+    fsyncSync5(fd);
     return await action();
   } finally {
-    closeSync16(fd);
+    closeSync17(fd);
     unchangedDirectory(directory, identity3);
-    const now2 = lstatSync20(file2);
+    const now2 = lstatSync22(file2);
     if (now2.dev !== lock.dev || now2.ino !== lock.ino || !now2.isFile() || now2.isSymbolicLink())
       fail();
     unlinkSync5(file2);
@@ -90019,15 +90474,15 @@ async function preparePrivatePublication(client2, sourceDirectory, recoveryDirec
     phase: "prepared",
     intent: null
   };
-  if (!isAbsolute18(recoveryDirectory) || resolve18(recoveryDirectory) !== recoveryDirectory || realpathSync8(dirname23(recoveryDirectory)) !== dirname23(recoveryDirectory))
+  if (!isAbsolute18(recoveryDirectory) || resolve19(recoveryDirectory) !== recoveryDirectory || realpathSync9(dirname25(recoveryDirectory)) !== dirname25(recoveryDirectory))
     return fail();
   mkdirSync14(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
-  const parent = openSync16(dirname23(recoveryDirectory), constants12.O_RDONLY | constants12.O_NOFOLLOW);
+  const parent = openSync17(dirname25(recoveryDirectory), constants13.O_RDONLY | constants13.O_NOFOLLOW);
   try {
-    fsyncSync4(parent);
+    fsyncSync5(parent);
   } finally {
-    closeSync16(parent);
+    closeSync17(parent);
   }
   writeOwned(recoveryDirectory, "bundle.tgz", packed.bytes);
   save(recoveryDirectory, receipt);
@@ -90135,7 +90590,7 @@ function exact2(value, names) {
   const keys3 = Object.keys(value).sort(), expected = [...names].sort();
   return keys3.length === expected.length && keys3.every((key, index) => key === expected[index]);
 }
-function snapshot(value, maximum) {
+function snapshot2(value, maximum) {
   let nodes4 = 0, bytes = 0;
   const parts = [], ancestors2 = new Set;
   const append = (part) => {
@@ -90214,7 +90669,7 @@ function snapshot(value, maximum) {
 }
 function requestSnapshot(input2) {
   try {
-    const owned = snapshot(input2, SKILL_OPERATION_LIMITS.requestBytes), value = owned.value;
+    const owned = snapshot2(input2, SKILL_OPERATION_LIMITS.requestBytes), value = owned.value;
     if (!record10(value) || !exact2(value, ["contractVersion", "requestId", "operation", "input"]) || value.contractVersion !== 1 || !validId(value.requestId) || typeof value.operation !== "string" || value.operation.length > 128 || !/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/.test(value.operation) || !record10(value.input))
       throw Error();
     return { ...owned, value };
@@ -90224,7 +90679,7 @@ function requestSnapshot(input2) {
 }
 function resultSnapshot(input2, requestId) {
   try {
-    const value = snapshot(input2, SKILL_OPERATION_LIMITS.resultBytes).value;
+    const value = snapshot2(input2, SKILL_OPERATION_LIMITS.resultBytes).value;
     if (!record10(value) || value.contractVersion !== 1 || value.requestId !== requestId)
       throw Error();
     const fields = ["contractVersion", "requestId", "status"];