@hasna/skills 0.9.11 → 0.9.13

package/dist/sdk/index.js

@@ -8209,7 +8209,7 @@ var require_client = __commonJS((exports) => {
     };
   };
   var sleep = (seconds) => {
-    return new Promise((resolve17) => setTimeout(resolve17, seconds * 1000));
+    return new Promise((resolve18) => setTimeout(resolve18, seconds * 1000));
   };
   var waiterServiceDefaults = {
     minDelay: 2,
@@ -8338,8 +8338,8 @@ var require_client = __commonJS((exports) => {
   };
   var abortTimeout = (abortSignal) => {
     let onAbort;
-    const promise = new Promise((resolve17) => {
-      onAbort = () => resolve17({ state: WaiterState.ABORTED });
+    const promise = new Promise((resolve18) => {
+      onAbort = () => resolve18({ state: WaiterState.ABORTED });
       if (typeof abortSignal.addEventListener === "function") {
         abortSignal.addEventListener("abort", onAbort);
       } else {
@@ -9002,8 +9002,8 @@ var require_client = __commonJS((exports) => {
 
 // node_modules/@smithy/core/dist-cjs/submodules/config/index.js
 var require_config = __commonJS((exports) => {
-  var { homedir: homedir6 } = __require("os");
-  var { sep: sep7, join: join4 } = __require("path");
+  var { homedir: homedir7 } = __require("os");
+  var { sep: sep8, join: join4 } = __require("path");
   var { createHash: createHash19 } = __require("crypto");
   var { readFile: readFile$1 } = __require("fs/promises");
   var { IniSectionType } = require_dist_cjs();
@@ -9143,7 +9143,7 @@ var require_config = __commonJS((exports) => {
     return "DEFAULT";
   };
   var getHomeDir = () => {
-    const { HOME, USERPROFILE, HOMEPATH, HOMEDRIVE = `C:${sep7}` } = process.env;
+    const { HOME, USERPROFILE, HOMEPATH, HOMEDRIVE = `C:${sep8}` } = process.env;
     if (HOME)
       return HOME;
     if (USERPROFILE)
@@ -9152,7 +9152,7 @@ var require_config = __commonJS((exports) => {
       return `${HOMEDRIVE}${HOMEPATH}`;
     const homeDirCacheKey = getHomeDirCacheKey();
     if (!homeDirCache[homeDirCacheKey])
-      homeDirCache[homeDirCacheKey] = homedir6();
+      homeDirCache[homeDirCacheKey] = homedir7();
     return homeDirCache[homeDirCacheKey];
   };
   var ENV_PROFILE = "AWS_PROFILE";
@@ -9477,7 +9477,7 @@ var require_config = __commonJS((exports) => {
   };
   var imdsRequest = async (options) => {
     const { request: request2 } = __require("http");
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       const req = request2({
         hostname: options.hostname,
         port: options.port,
@@ -9505,7 +9505,7 @@ var require_config = __commonJS((exports) => {
         const chunks = [];
         res.on("data", (chunk) => chunks.push(chunk));
         res.on("end", () => {
-          resolve17(Buffer.concat(chunks));
+          resolve18(Buffer.concat(chunks));
           req.destroy();
         });
       });
@@ -10514,7 +10514,7 @@ var require_serde = __commonJS((exports) => {
   var { createHmac: createHmac2, createHash: createHash19, getRandomValues } = __require("crypto");
   var { hasOwn: hasOwn2, HttpResponse } = require_transport();
   exports.hasOwn = hasOwn2;
-  var { ReadStream, lstatSync: lstatSync21, fstatSync: fstatSync4 } = __require("fs");
+  var { ReadStream, lstatSync: lstatSync22, fstatSync: fstatSync4 } = __require("fs");
   var { toEndpointV1 } = require_endpoints();
   var { Readable, Writable, PassThrough } = __require("stream");
   var isArrayBuffer = (arg) => typeof ArrayBuffer === "function" && arg instanceof ArrayBuffer || Object.prototype.toString.call(arg) === "[object ArrayBuffer]";
@@ -11280,7 +11280,7 @@ var require_serde = __commonJS((exports) => {
       return body.end + 1 - body.start;
     } else if (body instanceof ReadStream) {
       if (body.path != null) {
-        return lstatSync21(body.path).size;
+        return lstatSync22(body.path).size;
       } else if (typeof body.fd === "number") {
         return fstatSync4(body.fd).size;
       }
@@ -11861,7 +11861,7 @@ ${value}\r
     if (isReadableStream(stream)) {
       return headStream$1(stream, bytes);
     }
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       const collector = new Collector$1;
       collector.limit = bytes;
       stream.pipe(collector);
@@ -11872,7 +11872,7 @@ ${value}\r
       collector.on("error", reject);
       collector.on("finish", function() {
         const bytes2 = concatBytes(this.buffers);
-        resolve17(bytes2);
+        resolve18(bytes2);
       });
     });
   };
@@ -11986,7 +11986,7 @@ ${value}\r
     if (isReadableStream(stream)) {
       return collectReadableStream(stream);
     }
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       const collector = new Collector;
       const nodeStream = stream;
       nodeStream.pipe(collector);
@@ -11997,7 +11997,7 @@ ${value}\r
       collector.on("error", reject);
       collector.on("finish", function() {
         const bytes = concatBytes(this.bufferedBytes);
-        resolve17(bytes);
+        resolve18(bytes);
       });
     });
   };
@@ -12189,7 +12189,7 @@ var require_checksum = __commonJS((exports) => {
       callback();
     }
   }
-  var fileStreamHasher = (hashCtor, fileStream) => new Promise((resolve17, reject) => {
+  var fileStreamHasher = (hashCtor, fileStream) => new Promise((resolve18, reject) => {
     if (!isReadStream(fileStream)) {
       reject(new Error("Unable to calculate hash for non-file streams."));
       return;
@@ -12207,7 +12207,7 @@ var require_checksum = __commonJS((exports) => {
     });
     hashCalculator.on("error", reject);
     hashCalculator.on("finish", function() {
-      hash2.digest().then(resolve17).catch(reject);
+      hash2.digest().then(resolve18).catch(reject);
     });
   });
   var isReadStream = (stream) => typeof stream.path === "string";
@@ -12218,14 +12218,14 @@ var require_checksum = __commonJS((exports) => {
     const hash2 = new hashCtor;
     const hashCalculator = new HashCalculator(hash2);
     readableStream.pipe(hashCalculator);
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       readableStream.on("error", (err) => {
         hashCalculator.end();
         reject(err);
       });
       hashCalculator.on("error", reject);
       hashCalculator.on("finish", () => {
-        hash2.digest().then(resolve17).catch(reject);
+        hash2.digest().then(resolve18).catch(reject);
       });
     });
   };
@@ -13334,7 +13334,7 @@ var require_event_streams = __commonJS((exports) => {
       streamEnded = true;
     });
     while (!generationEnded) {
-      const value = await new Promise((resolve17) => setTimeout(() => resolve17(records.shift()), 0));
+      const value = await new Promise((resolve18) => setTimeout(() => resolve18(records.shift()), 0));
       if (value) {
         yield value;
       }
@@ -14852,7 +14852,7 @@ var require_retry = __commonJS((exports) => {
       }
     };
   }
-  var cooldown = (ms) => new Promise((resolve17) => setTimeout(resolve17, ms));
+  var cooldown = (ms) => new Promise((resolve18) => setTimeout(resolve18, ms));
   var isRetryStrategyV2 = (retryStrategy) => typeof retryStrategy.acquireInitialRetryToken !== "undefined" && typeof retryStrategy.refreshRetryTokenForRetry !== "undefined" && typeof retryStrategy.recordSuccess !== "undefined";
   var getRetryErrorInfo = (error, logger) => {
     const errorInfo = {
@@ -14951,7 +14951,7 @@ var require_retry = __commonJS((exports) => {
       this.refillTokenBucket();
       while (amount > this.availableTokens) {
         const delay = (amount - this.availableTokens) / this.fillRate * 1000;
-        await new Promise((resolve17) => DefaultRateLimiter.setTimeoutFn(resolve17, delay));
+        await new Promise((resolve18) => DefaultRateLimiter.setTimeoutFn(resolve18, delay));
         this.refillTokenBucket();
       }
       this.availableTokens = this.availableTokens - amount;
@@ -15293,7 +15293,7 @@ var require_retry = __commonJS((exports) => {
             const delayFromResponse = getDelayFromRetryAfterHeader(err.$response);
             const delay = Math.max(delayFromResponse || 0, delayFromDecider);
             totalDelay += delay;
-            await new Promise((resolve17) => setTimeout(resolve17, delay));
+            await new Promise((resolve18) => setTimeout(resolve18, delay));
             continue;
           }
           if (!err.$metadata) {
@@ -24586,7 +24586,7 @@ var require_httpAuthSchemes = __commonJS((exports) => {
 });
 
 // node_modules/@aws-sdk/credential-provider-env/dist-es/fromEnv.js
-var import_client8, import_config8, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET = "AWS_SECRET_ACCESS_KEY", ENV_SESSION = "AWS_SESSION_TOKEN", ENV_EXPIRATION = "AWS_CREDENTIAL_EXPIRATION", ENV_CREDENTIAL_SCOPE = "AWS_CREDENTIAL_SCOPE", ENV_ACCOUNT_ID = "AWS_ACCOUNT_ID", fromEnv = (init) => async () => {
+var import_client8, import_config9, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET = "AWS_SECRET_ACCESS_KEY", ENV_SESSION = "AWS_SESSION_TOKEN", ENV_EXPIRATION = "AWS_CREDENTIAL_EXPIRATION", ENV_CREDENTIAL_SCOPE = "AWS_CREDENTIAL_SCOPE", ENV_ACCOUNT_ID = "AWS_ACCOUNT_ID", fromEnv = (init) => async () => {
   init?.logger?.debug("@aws-sdk/credential-provider-env - fromEnv");
   const accessKeyId = process.env[ENV_KEY];
   const secretAccessKey = process.env[ENV_SECRET];
@@ -24606,11 +24606,11 @@ var import_client8, import_config8, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET =
     import_client8.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS", "g");
     return credentials;
   }
-  throw new import_config8.CredentialsProviderError("Unable to find environment variable credentials.", { logger: init?.logger });
+  throw new import_config9.CredentialsProviderError("Unable to find environment variable credentials.", { logger: init?.logger });
 };
 var init_fromEnv = __esm(() => {
   import_client8 = __toESM(require_client2(), 1);
-  import_config8 = __toESM(require_config(), 1);
+  import_config9 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-env/dist-es/index.js
@@ -24646,24 +24646,24 @@ var init_node_http = () => {};
 
 // node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/httpRequest.js
 function httpRequest(options) {
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve18, reject) => {
     const req = node_http.request({
       method: "GET",
       ...options,
       hostname: options.hostname?.replace(/^\[(.+)\]$/, "$1")
     });
     req.on("error", (err) => {
-      reject(Object.assign(new import_config9.ProviderError("Unable to connect to instance metadata service"), err));
+      reject(Object.assign(new import_config10.ProviderError("Unable to connect to instance metadata service"), err));
       req.destroy();
     });
     req.on("timeout", () => {
-      reject(new import_config9.ProviderError("TimeoutError from instance metadata service"));
+      reject(new import_config10.ProviderError("TimeoutError from instance metadata service"));
       req.destroy();
     });
     req.on("response", (res) => {
       const { statusCode = 400 } = res;
       if (statusCode < 200 || 300 <= statusCode) {
-        reject(Object.assign(new import_config9.ProviderError("Error response received from instance metadata service"), { statusCode }));
+        reject(Object.assign(new import_config10.ProviderError("Error response received from instance metadata service"), { statusCode }));
         req.destroy();
       }
       const chunks = [];
@@ -24671,17 +24671,17 @@ function httpRequest(options) {
         chunks.push(chunk);
       });
       res.on("end", () => {
-        resolve17(Buffer.concat(chunks));
+        resolve18(Buffer.concat(chunks));
         req.destroy();
       });
     });
     req.end();
   });
 }
-var import_config9;
+var import_config10;
 var init_httpRequest = __esm(() => {
   init_node_http();
-  import_config9 = __toESM(require_config(), 1);
+  import_config10 = __toESM(require_config(), 1);
 });
 
 // node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/retry.js
@@ -24694,13 +24694,13 @@ var retry = (toRetry, maxRetries) => {
 };
 
 // node_modules/@smithy/credential-provider-imds/dist-es/fromContainerMetadata.js
-var import_config10, ENV_CMDS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", ENV_CMDS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", ENV_CMDS_AUTH_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromContainerMetadata = (init = {}) => {
+var import_config11, ENV_CMDS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", ENV_CMDS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", ENV_CMDS_AUTH_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromContainerMetadata = (init = {}) => {
   const { timeout, maxRetries } = providerConfigFromInit(init);
   return () => retry(async () => {
     const requestOptions = await getCmdsUri({ logger: init.logger });
     const credsResponse = JSON.parse(await requestFromEcsImds(timeout, requestOptions));
     if (!isImdsCredentials(credsResponse)) {
-      throw new import_config10.CredentialsProviderError("Invalid response received from instance metadata service.", {
+      throw new import_config11.CredentialsProviderError("Invalid response received from instance metadata service.", {
         logger: init.logger
       });
     }
@@ -24730,16 +24730,16 @@ var import_config10, ENV_CMDS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", E
     try {
       parsed = new URL(process.env[ENV_CMDS_FULL_URI]);
     } catch {
-      throw new import_config10.CredentialsProviderError(`${process.env[ENV_CMDS_FULL_URI]} is not a valid container metadata service URL`, { tryNextLink: false, logger });
+      throw new import_config11.CredentialsProviderError(`${process.env[ENV_CMDS_FULL_URI]} is not a valid container metadata service URL`, { tryNextLink: false, logger });
     }
     if (!parsed.hostname || !GREENGRASS_HOSTS.has(parsed.hostname)) {
-      throw new import_config10.CredentialsProviderError(`${parsed.hostname} is not a valid container metadata service hostname`, {
+      throw new import_config11.CredentialsProviderError(`${parsed.hostname} is not a valid container metadata service hostname`, {
         tryNextLink: false,
         logger
       });
     }
     if (!parsed.protocol || !GREENGRASS_PROTOCOLS.has(parsed.protocol)) {
-      throw new import_config10.CredentialsProviderError(`${parsed.protocol} is not a valid container metadata service protocol`, {
+      throw new import_config11.CredentialsProviderError(`${parsed.protocol} is not a valid container metadata service protocol`, {
         tryNextLink: false,
         logger
       });
@@ -24751,23 +24751,23 @@ var import_config10, ENV_CMDS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", E
       port: parsed.port ? parseInt(parsed.port, 10) : undefined
     };
   }
-  throw new import_config10.CredentialsProviderError("The container metadata credential provider cannot be used unless" + ` the ${ENV_CMDS_RELATIVE_URI} or ${ENV_CMDS_FULL_URI} environment` + " variable is set", {
+  throw new import_config11.CredentialsProviderError("The container metadata credential provider cannot be used unless" + ` the ${ENV_CMDS_RELATIVE_URI} or ${ENV_CMDS_FULL_URI} environment` + " variable is set", {
     tryNextLink: false,
     logger
   });
 };
 var init_fromContainerMetadata = __esm(() => {
   init_httpRequest();
-  import_config10 = __toESM(require_config(), 1);
+  import_config11 = __toESM(require_config(), 1);
   GREENGRASS_HOSTS = new Set(["localhost", "127.0.0.1"]);
   GREENGRASS_PROTOCOLS = new Set(["http:", "https:"]);
 });
 
 // node_modules/@smithy/credential-provider-imds/dist-es/error/InstanceMetadataV1FallbackError.js
-var import_config11, InstanceMetadataV1FallbackError;
+var import_config12, InstanceMetadataV1FallbackError;
 var init_InstanceMetadataV1FallbackError = __esm(() => {
-  import_config11 = __toESM(require_config(), 1);
-  InstanceMetadataV1FallbackError = class InstanceMetadataV1FallbackError extends import_config11.CredentialsProviderError {
+  import_config12 = __toESM(require_config(), 1);
+  InstanceMetadataV1FallbackError = class InstanceMetadataV1FallbackError extends import_config12.CredentialsProviderError {
     tryNextLink;
     name = "InstanceMetadataV1FallbackError";
     constructor(message, tryNextLink = true) {
@@ -24818,8 +24818,8 @@ var init_EndpointModeConfigOptions = __esm(() => {
 });
 
 // node_modules/@smithy/credential-provider-imds/dist-es/utils/getInstanceMetadataEndpoint.js
-var import_config12, import_protocols, getInstanceMetadataEndpoint = async () => import_protocols.parseUrl(await getFromEndpointConfig() || await getFromEndpointModeConfig()), getFromEndpointConfig = async () => import_config12.loadConfig(ENDPOINT_CONFIG_OPTIONS)(), getFromEndpointModeConfig = async () => {
-  const endpointMode = await import_config12.loadConfig(ENDPOINT_MODE_CONFIG_OPTIONS)();
+var import_config13, import_protocols, getInstanceMetadataEndpoint = async () => import_protocols.parseUrl(await getFromEndpointConfig() || await getFromEndpointModeConfig()), getFromEndpointConfig = async () => import_config13.loadConfig(ENDPOINT_CONFIG_OPTIONS)(), getFromEndpointModeConfig = async () => {
+  const endpointMode = await import_config13.loadConfig(ENDPOINT_MODE_CONFIG_OPTIONS)();
   switch (endpointMode) {
     case EndpointMode.IPv4:
       return Endpoint.IPv4;
@@ -24834,7 +24834,7 @@ var init_getInstanceMetadataEndpoint = __esm(() => {
   init_EndpointConfigOptions();
   init_EndpointMode();
   init_EndpointModeConfigOptions();
-  import_config12 = __toESM(require_config(), 1);
+  import_config13 = __toESM(require_config(), 1);
   import_protocols = __toESM(require_protocols(), 1);
 });
 
@@ -24884,7 +24884,7 @@ var init_staticStabilityProvider = __esm(() => {
 });
 
 // node_modules/@smithy/credential-provider-imds/dist-es/fromInstanceMetadata.js
-var import_config13, IMDS_PATH = "/latest/meta-data/iam/security-credentials/", IMDS_TOKEN_PATH = "/latest/api/token", AWS_EC2_METADATA_V1_DISABLED = "AWS_EC2_METADATA_V1_DISABLED", PROFILE_AWS_EC2_METADATA_V1_DISABLED = "ec2_metadata_v1_disabled", X_AWS_EC2_METADATA_TOKEN = "x-aws-ec2-metadata-token", fromInstanceMetadata = (init = {}) => staticStabilityProvider(getInstanceMetadataProvider(init), { logger: init.logger }), getInstanceMetadataProvider = (init = {}) => {
+var import_config14, IMDS_PATH = "/latest/meta-data/iam/security-credentials/", IMDS_TOKEN_PATH = "/latest/api/token", AWS_EC2_METADATA_V1_DISABLED = "AWS_EC2_METADATA_V1_DISABLED", PROFILE_AWS_EC2_METADATA_V1_DISABLED = "ec2_metadata_v1_disabled", X_AWS_EC2_METADATA_TOKEN = "x-aws-ec2-metadata-token", fromInstanceMetadata = (init = {}) => staticStabilityProvider(getInstanceMetadataProvider(init), { logger: init.logger }), getInstanceMetadataProvider = (init = {}) => {
   let disableFetchToken = false;
   const { logger, profile } = init;
   const { timeout, maxRetries } = providerConfigFromInit(init);
@@ -24893,12 +24893,12 @@ var import_config13, IMDS_PATH = "/latest/meta-data/iam/security-credentials/",
     if (isImdsV1Fallback) {
       let fallbackBlockedFromProfile = false;
       let fallbackBlockedFromProcessEnv = false;
-      const configValue = await import_config13.loadConfig({
+      const configValue = await import_config14.loadConfig({
         environmentVariableSelector: (env) => {
           const envValue = env[AWS_EC2_METADATA_V1_DISABLED];
           fallbackBlockedFromProcessEnv = !!envValue && envValue !== "false";
           if (envValue === undefined) {
-            throw new import_config13.CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`, { logger: init.logger });
+            throw new import_config14.CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`, { logger: init.logger });
           }
           return fallbackBlockedFromProcessEnv;
         },
@@ -24989,7 +24989,7 @@ var import_config13, IMDS_PATH = "/latest/meta-data/iam/security-credentials/",
     path: IMDS_PATH + profile
   })).toString());
   if (!isImdsCredentials(credentialsResponse)) {
-    throw new import_config13.CredentialsProviderError("Invalid response received from instance metadata service.", {
+    throw new import_config14.CredentialsProviderError("Invalid response received from instance metadata service.", {
       logger: init.logger
     });
   }
@@ -25000,7 +25000,7 @@ var init_fromInstanceMetadata = __esm(() => {
   init_httpRequest();
   init_getInstanceMetadataEndpoint();
   init_staticStabilityProvider();
-  import_config13 = __toESM(require_config(), 1);
+  import_config14 = __toESM(require_config(), 1);
 });
 
 // node_modules/@smithy/credential-provider-imds/dist-es/index.js
@@ -25168,21 +25168,21 @@ var require_dist_cjs6 = __commonJS((exports) => {
     let sendBody = true;
     if (!externalAgent && expect === "100-continue") {
       sendBody = await Promise.race([
-        new Promise((resolve17) => {
-          timeoutId = Number(timing.setTimeout(() => resolve17(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
+        new Promise((resolve18) => {
+          timeoutId = Number(timing.setTimeout(() => resolve18(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
         }),
-        new Promise((resolve17) => {
+        new Promise((resolve18) => {
           httpRequest2.on("continue", () => {
             timing.clearTimeout(timeoutId);
-            resolve17(true);
+            resolve18(true);
           });
           httpRequest2.on("response", () => {
             timing.clearTimeout(timeoutId);
-            resolve17(false);
+            resolve18(false);
           });
           httpRequest2.on("error", () => {
             timing.clearTimeout(timeoutId);
-            resolve17(false);
+            resolve18(false);
           });
         })
       ]);
@@ -25259,13 +25259,13 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return socketWarningTimestamp;
     }
     constructor(options) {
-      this.configProvider = new Promise((resolve17, reject) => {
+      this.configProvider = new Promise((resolve18, reject) => {
         if (typeof options === "function") {
           options().then((_options) => {
-            resolve17(this.resolveDefaultConfig(_options));
+            resolve18(this.resolveDefaultConfig(_options));
           }).catch(reject);
         } else {
-          resolve17(this.resolveDefaultConfig(options));
+          resolve18(this.resolveDefaultConfig(options));
         }
       });
     }
@@ -25297,7 +25297,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
           timing.clearTimeout(socketTimeoutId);
           timing.clearTimeout(keepAliveTimeoutId);
         };
-        const resolve17 = async (arg) => {
+        const resolve18 = async (arg) => {
           await writeRequestBodyPromise;
           clearTimeouts();
           _resolve(arg);
@@ -25361,7 +25361,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             headers: getTransformedHeaders(res.headers),
             body: res
           });
-          resolve17({ response: httpResponse });
+          resolve18({ response: httpResponse });
         });
         req.on("error", (err) => {
           if (NODEJS_TIMEOUT_ERROR_CODES.includes(err.code)) {
@@ -25693,13 +25693,13 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return new NodeHttp2Handler(instanceOrOptions);
     }
     constructor(options) {
-      this.configProvider = new Promise((resolve17, reject) => {
+      this.configProvider = new Promise((resolve18, reject) => {
         if (typeof options === "function") {
           options().then((opts) => {
-            resolve17(opts || {});
+            resolve18(opts || {});
           }).catch(reject);
         } else {
-          resolve17(options || {});
+          resolve18(options || {});
         }
       });
     }
@@ -25724,7 +25724,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return new Promise((_resolve, _reject) => {
         let fulfilled = false;
         let writeRequestBodyPromise = undefined;
-        const resolve17 = async (arg) => {
+        const resolve18 = async (arg) => {
           await writeRequestBodyPromise;
           _resolve(arg);
         };
@@ -25809,7 +25809,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             body: clientHttp2Stream
           });
           fulfilled = true;
-          resolve17({ response: httpResponse });
+          resolve18({ response: httpResponse });
           if (useIsolatedSession) {
             session.close();
             clientHttp2Stream.on("end", () => {
@@ -25853,7 +25853,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
 });
 
 // node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/checkUrl.js
-var import_config14, ECS_CONTAINER_HOST = "169.254.170.2", EKS_CONTAINER_HOST_IPv4 = "169.254.170.23", EKS_CONTAINER_HOST_IPv6 = "[fd00:ec2::23]", checkUrl = (url, logger) => {
+var import_config15, ECS_CONTAINER_HOST = "169.254.170.2", EKS_CONTAINER_HOST_IPv4 = "169.254.170.23", EKS_CONTAINER_HOST_IPv6 = "[fd00:ec2::23]", checkUrl = (url, logger) => {
   if (url.protocol === "https:") {
     return;
   }
@@ -25877,13 +25877,13 @@ var import_config14, ECS_CONTAINER_HOST = "169.254.170.2", EKS_CONTAINER_HOST_IP
       return;
     }
   }
-  throw new import_config14.CredentialsProviderError(`URL not accepted. It must either be HTTPS or match one of the following:
+  throw new import_config15.CredentialsProviderError(`URL not accepted. It must either be HTTPS or match one of the following:
   - loopback CIDR 127.0.0.0/8 or [::1/128]
   - ECS container host 169.254.170.2
   - EKS container host 169.254.170.23 or [fd00:ec2::23]`, { logger });
 };
 var init_checkUrl = __esm(() => {
-  import_config14 = __toESM(require_config(), 1);
+  import_config15 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/requestHelpers.js
@@ -25906,7 +25906,7 @@ async function getCredentials(response, logger) {
   if (response.statusCode === 200) {
     const parsed = JSON.parse(str);
     if (typeof parsed.AccessKeyId !== "string" || typeof parsed.SecretAccessKey !== "string" || typeof parsed.Token !== "string" || typeof parsed.Expiration !== "string") {
-      throw new import_config15.CredentialsProviderError("HTTP credential provider response not of the required format, an object matching: " + "{ AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }", { logger });
+      throw new import_config16.CredentialsProviderError("HTTP credential provider response not of the required format, an object matching: " + "{ AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }", { logger });
     }
     return {
       accessKeyId: parsed.AccessKeyId,
@@ -25920,16 +25920,16 @@ async function getCredentials(response, logger) {
     try {
       parsedBody = JSON.parse(str);
     } catch (e3) {}
-    throw Object.assign(new import_config15.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger }), {
+    throw Object.assign(new import_config16.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger }), {
       Code: parsedBody.Code,
       Message: parsedBody.Message
     });
   }
-  throw new import_config15.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger });
+  throw new import_config16.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger });
 }
-var import_config15, import_protocols2, import_serde, import_serde2;
+var import_config16, import_protocols2, import_serde, import_serde2;
 var init_requestHelpers = __esm(() => {
-  import_config15 = __toESM(require_config(), 1);
+  import_config16 = __toESM(require_config(), 1);
   import_protocols2 = __toESM(require_protocols(), 1);
   import_serde = __toESM(require_serde(), 1);
   import_serde2 = __toESM(require_serde(), 1);
@@ -25942,7 +25942,7 @@ var retryWrapper = (toRetry, maxRetries, delayMs) => {
       try {
         return await toRetry();
       } catch (e3) {
-        await new Promise((resolve17) => setTimeout(resolve17, delayMs));
+        await new Promise((resolve18) => setTimeout(resolve18, delayMs));
       }
     }
     return await toRetry();
@@ -25951,7 +25951,7 @@ var retryWrapper = (toRetry, maxRetries, delayMs) => {
 
 // node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/fromHttp.js
 import fs from "fs/promises";
-var import_client9, import_config16, import_node_http_handler, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2", AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromHttp = (options = {}) => {
+var import_client9, import_config17, import_node_http_handler, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2", AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromHttp = (options = {}) => {
   options.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");
   let host;
   const relative6 = options.awsContainerCredentialsRelativeUri ?? process.env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI];
@@ -25972,7 +25972,7 @@ var import_client9, import_config16, import_node_http_handler, AWS_CONTAINER_CRE
   } else if (full) {
     host = full;
   } else {
-    throw new import_config16.CredentialsProviderError(`No HTTP credential provider host provided.
+    throw new import_config17.CredentialsProviderError(`No HTTP credential provider host provided.
 Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`, { logger: options.logger });
   }
   const url = new URL(host);
@@ -25990,7 +25990,7 @@ Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
       const result = await requestHandler.handle(request2, { requestTimeout });
       return getCredentials(result.response).then((creds) => import_client9.setCredentialFeature(creds, "CREDENTIALS_HTTP", "z"));
     } catch (e3) {
-      throw new import_config16.CredentialsProviderError(String(e3), { logger: options.logger });
+      throw new import_config17.CredentialsProviderError(String(e3), { logger: options.logger });
     }
   }, options.maxRetries ?? 3, options.timeout ?? 1000);
   return async () => {
@@ -26003,7 +26003,7 @@ Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
 }, validateToken = (token) => {
   if (token.includes(`\r
 `)) {
-    throw new import_config16.CredentialsProviderError("Authorization token contains invalid \\r\\n sequence.");
+    throw new import_config17.CredentialsProviderError("Authorization token contains invalid \\r\\n sequence.");
   }
   return token;
 };
@@ -26011,7 +26011,7 @@ var init_fromHttp = __esm(() => {
   init_checkUrl();
   init_requestHelpers();
   import_client9 = __toESM(require_client2(), 1);
-  import_config16 = __toESM(require_config(), 1);
+  import_config17 = __toESM(require_config(), 1);
   import_node_http_handler = __toESM(require_dist_cjs6(), 1);
 });
 
@@ -26814,70 +26814,70 @@ var getNewSsoOidcToken = async (ssoToken, ssoRegion, init = {}, callerClientConf
 var init_getNewSsoOidcToken = () => {};
 
 // node_modules/@aws-sdk/token-providers/dist-es/validateTokenExpiry.js
-var import_config18, validateTokenExpiry = (token) => {
+var import_config19, validateTokenExpiry = (token) => {
   if (token.expiration && token.expiration.getTime() < Date.now()) {
-    throw new import_config18.TokenProviderError(`Token is expired. ${REFRESH_MESSAGE}`, false);
+    throw new import_config19.TokenProviderError(`Token is expired. ${REFRESH_MESSAGE}`, false);
   }
 };
 var init_validateTokenExpiry = __esm(() => {
   init_constants();
-  import_config18 = __toESM(require_config(), 1);
+  import_config19 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/token-providers/dist-es/validateTokenKey.js
-var import_config19, validateTokenKey = (key, value, forRefresh = false) => {
+var import_config20, validateTokenKey = (key, value, forRefresh = false) => {
   if (typeof value === "undefined") {
-    throw new import_config19.TokenProviderError(`Value not present for '${key}' in SSO Token${forRefresh ? ". Cannot refresh" : ""}. ${REFRESH_MESSAGE}`, false);
+    throw new import_config20.TokenProviderError(`Value not present for '${key}' in SSO Token${forRefresh ? ". Cannot refresh" : ""}. ${REFRESH_MESSAGE}`, false);
   }
 };
 var init_validateTokenKey = __esm(() => {
   init_constants();
-  import_config19 = __toESM(require_config(), 1);
+  import_config20 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/token-providers/dist-es/writeSSOTokenToFile.js
 import { promises as fsPromises } from "fs";
-var import_config20, writeFile, writeSSOTokenToFile = (id2, ssoToken) => {
-  const tokenFilepath = import_config20.getSSOTokenFilepath(id2);
+var import_config21, writeFile, writeSSOTokenToFile = (id2, ssoToken) => {
+  const tokenFilepath = import_config21.getSSOTokenFilepath(id2);
   const tokenString = JSON.stringify(ssoToken, null, 2);
   return writeFile(tokenFilepath, tokenString);
 };
 var init_writeSSOTokenToFile = __esm(() => {
-  import_config20 = __toESM(require_config(), 1);
+  import_config21 = __toESM(require_config(), 1);
   ({ writeFile } = fsPromises);
 });
 
 // node_modules/@aws-sdk/token-providers/dist-es/fromSso.js
-var import_config21, lastRefreshAttemptTimes, fromSso = (init = {}) => async ({ callerClientConfig } = {}) => {
+var import_config22, lastRefreshAttemptTimes, fromSso = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/token-providers - fromSso");
-  const profiles = await import_config21.parseKnownFiles(init);
-  const profileName = import_config21.getProfileName({
+  const profiles = await import_config22.parseKnownFiles(init);
+  const profileName = import_config22.getProfileName({
     profile: init.profile ?? callerClientConfig?.profile
   });
   const profile = profiles[profileName];
   if (!profile) {
-    throw new import_config21.TokenProviderError(`Profile '${profileName}' could not be found in shared credentials file.`, false);
+    throw new import_config22.TokenProviderError(`Profile '${profileName}' could not be found in shared credentials file.`, false);
   } else if (!profile["sso_session"]) {
-    throw new import_config21.TokenProviderError(`Profile '${profileName}' is missing required property 'sso_session'.`);
+    throw new import_config22.TokenProviderError(`Profile '${profileName}' is missing required property 'sso_session'.`);
   }
   const ssoSessionName = profile["sso_session"];
-  const ssoSessions = await import_config21.loadSsoSessionData(init);
+  const ssoSessions = await import_config22.loadSsoSessionData(init);
   const ssoSession = ssoSessions[ssoSessionName];
   if (!ssoSession) {
-    throw new import_config21.TokenProviderError(`Sso session '${ssoSessionName}' could not be found in shared credentials file.`, false);
+    throw new import_config22.TokenProviderError(`Sso session '${ssoSessionName}' could not be found in shared credentials file.`, false);
   }
   for (const ssoSessionRequiredKey of ["sso_start_url", "sso_region"]) {
     if (!ssoSession[ssoSessionRequiredKey]) {
-      throw new import_config21.TokenProviderError(`Sso session '${ssoSessionName}' is missing required property '${ssoSessionRequiredKey}'.`, false);
+      throw new import_config22.TokenProviderError(`Sso session '${ssoSessionName}' is missing required property '${ssoSessionRequiredKey}'.`, false);
     }
   }
   const ssoStartUrl = ssoSession["sso_start_url"];
   const ssoRegion = ssoSession["sso_region"];
   let ssoToken;
   try {
-    ssoToken = await import_config21.getSSOTokenFromFile(ssoSessionName);
+    ssoToken = await import_config22.getSSOTokenFromFile(ssoSessionName);
   } catch (e3) {
-    throw new import_config21.TokenProviderError(`The SSO session token associated with profile=${profileName} was not found or is invalid. ${REFRESH_MESSAGE}`, false);
+    throw new import_config22.TokenProviderError(`The SSO session token associated with profile=${profileName} was not found or is invalid. ${REFRESH_MESSAGE}`, false);
   }
   validateTokenKey("accessToken", ssoToken.accessToken);
   validateTokenKey("expiresAt", ssoToken.expiresAt);
@@ -26926,7 +26926,7 @@ var init_fromSso = __esm(() => {
   init_validateTokenExpiry();
   init_validateTokenKey();
   init_writeSSOTokenToFile();
-  import_config21 = __toESM(require_config(), 1);
+  import_config22 = __toESM(require_config(), 1);
   lastRefreshAttemptTimes = new Map;
 });
 
@@ -27394,7 +27394,7 @@ var init_loadSso = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-sso/dist-es/resolveSSOCredentials.js
-var import_client10, import_config22, SHOULD_FAIL_CREDENTIAL_CHAIN = false, resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger }) => {
+var import_client10, import_config23, SHOULD_FAIL_CREDENTIAL_CHAIN = false, resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger }) => {
   let token;
   const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
   if (ssoSession) {
@@ -27413,23 +27413,23 @@ var import_client10, import_config22, SHOULD_FAIL_CREDENTIAL_CHAIN = false, reso
         expiresAt: new Date(_token.expiration).toISOString()
       };
     } catch (e4) {
-      throw new import_config22.CredentialsProviderError(e4.message, {
+      throw new import_config23.CredentialsProviderError(e4.message, {
         tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
         logger
       });
     }
   } else {
     try {
-      token = await import_config22.getSSOTokenFromFile(ssoStartUrl);
+      token = await import_config23.getSSOTokenFromFile(ssoStartUrl);
     } catch (e4) {
-      throw new import_config22.CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, {
+      throw new import_config23.CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, {
         tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
         logger
       });
     }
   }
   if (new Date(token.expiresAt).getTime() - Date.now() <= 0) {
-    throw new import_config22.CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, {
+    throw new import_config23.CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, {
       tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
       logger
     });
@@ -27449,14 +27449,14 @@ var import_client10, import_config22, SHOULD_FAIL_CREDENTIAL_CHAIN = false, reso
       accessToken
     }));
   } catch (e4) {
-    throw new import_config22.CredentialsProviderError(e4, {
+    throw new import_config23.CredentialsProviderError(e4, {
       tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
       logger
     });
   }
   const { roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration, credentialScope, accountId } = {} } = ssoResp;
   if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {
-    throw new import_config22.CredentialsProviderError("SSO returns an invalid temporary credential.", {
+    throw new import_config23.CredentialsProviderError("SSO returns an invalid temporary credential.", {
       tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
       logger
     });
@@ -27479,53 +27479,53 @@ var import_client10, import_config22, SHOULD_FAIL_CREDENTIAL_CHAIN = false, reso
 var init_resolveSSOCredentials = __esm(() => {
   init_dist_es4();
   import_client10 = __toESM(require_client2(), 1);
-  import_config22 = __toESM(require_config(), 1);
+  import_config23 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-sso/dist-es/validateSsoProfile.js
-var import_config23, validateSsoProfile = (profile, logger) => {
+var import_config24, validateSsoProfile = (profile, logger) => {
   const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;
   if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {
-    throw new import_config23.CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", ` + `"sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(profile).join(", ")}
+    throw new import_config24.CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", ` + `"sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(profile).join(", ")}
 Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`, { tryNextLink: false, logger });
   }
   return profile;
 };
 var init_validateSsoProfile = __esm(() => {
-  import_config23 = __toESM(require_config(), 1);
+  import_config24 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-sso/dist-es/fromSSO.js
-var import_config24, fromSSO = (init = {}) => async ({ callerClientConfig } = {}) => {
+var import_config25, fromSSO = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");
   const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
   const { ssoClient } = init;
-  const profileName = import_config24.getProfileName({
+  const profileName = import_config25.getProfileName({
     profile: init.profile ?? callerClientConfig?.profile
   });
   if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
-    const profiles = await import_config24.parseKnownFiles(init);
+    const profiles = await import_config25.parseKnownFiles(init);
     const profile = profiles[profileName];
     if (!profile) {
-      throw new import_config24.CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });
+      throw new import_config25.CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });
     }
     if (!isSsoProfile(profile)) {
-      throw new import_config24.CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {
+      throw new import_config25.CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {
         logger: init.logger
       });
     }
     if (profile?.sso_session) {
-      const ssoSessions = await import_config24.loadSsoSessionData(init);
+      const ssoSessions = await import_config25.loadSsoSessionData(init);
       const session = ssoSessions[profile.sso_session];
       const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;
       if (ssoRegion && ssoRegion !== session.sso_region) {
-        throw new import_config24.CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {
+        throw new import_config25.CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {
           tryNextLink: false,
           logger: init.logger
         });
       }
       if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {
-        throw new import_config24.CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {
+        throw new import_config25.CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {
           tryNextLink: false,
           logger: init.logger
         });
@@ -27551,7 +27551,7 @@ var import_config24, fromSSO = (init = {}) => async ({ callerClientConfig } = {}
       logger: init.logger
     });
   } else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {
-    throw new import_config24.CredentialsProviderError("Incomplete configuration. The fromSSO() argument hash must include " + '"ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"', { tryNextLink: false, logger: init.logger });
+    throw new import_config25.CredentialsProviderError("Incomplete configuration. The fromSSO() argument hash must include " + '"ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"', { tryNextLink: false, logger: init.logger });
   } else {
     return resolveSSOCredentials({
       ssoStartUrl,
@@ -27574,7 +27574,7 @@ var import_config24, fromSSO = (init = {}) => async ({ callerClientConfig } = {}
 var init_fromSSO = __esm(() => {
   init_resolveSSOCredentials();
   init_validateSsoProfile();
-  import_config24 = __toESM(require_config(), 1);
+  import_config25 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-sso/dist-es/index.js
@@ -27590,13 +27590,13 @@ var init_dist_es5 = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveCredentialSource.js
-var import_client11, import_config25, resolveCredentialSource = (credentialSource, profileName, logger) => {
+var import_client11, import_config26, resolveCredentialSource = (credentialSource, profileName, logger) => {
   const sourceProvidersMap = {
     EcsContainer: async (options) => {
       const { fromHttp: fromHttp2 } = await Promise.resolve().then(() => (init_dist_es3(), exports_dist_es3));
       const { fromContainerMetadata: fromContainerMetadata2 } = await Promise.resolve().then(() => (init_dist_es2(), exports_dist_es2));
       logger?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer");
-      return async () => import_config25.chain(fromHttp2(options ?? {}), fromContainerMetadata2(options))().then(setNamedProvider);
+      return async () => import_config26.chain(fromHttp2(options ?? {}), fromContainerMetadata2(options))().then(setNamedProvider);
     },
     Ec2InstanceMetadata: async (options) => {
       logger?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");
@@ -27612,12 +27612,12 @@ var import_client11, import_config25, resolveCredentialSource = (credentialSourc
   if (credentialSource in sourceProvidersMap) {
     return sourceProvidersMap[credentialSource];
   } else {
-    throw new import_config25.CredentialsProviderError(`Unsupported credential source in profile ${profileName}. Got ${credentialSource}, expected EcsContainer or Ec2InstanceMetadata or Environment.`, { logger });
+    throw new import_config26.CredentialsProviderError(`Unsupported credential source in profile ${profileName}. Got ${credentialSource}, expected EcsContainer or Ec2InstanceMetadata or Environment.`, { logger });
   }
 }, setNamedProvider = (creds) => import_client11.setCredentialFeature(creds, "CREDENTIALS_PROFILE_NAMED_PROVIDER", "p");
 var init_resolveCredentialSource = __esm(() => {
   import_client11 = __toESM(require_client2(), 1);
-  import_config25 = __toESM(require_config(), 1);
+  import_config26 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sts/index.js
@@ -28643,7 +28643,7 @@ var require_sts = __commonJS((exports) => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveAssumeRoleCredentials.js
-var import_client12, import_config26, isAssumeRoleProfile = (arg, { profile = "default", logger } = {}) => {
+var import_client12, import_config27, isAssumeRoleProfile = (arg, { profile = "default", logger } = {}) => {
   return Boolean(arg) && typeof arg === "object" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1 && ["undefined", "string"].indexOf(typeof arg.external_id) > -1 && ["undefined", "string"].indexOf(typeof arg.mfa_serial) > -1 && (isAssumeRoleWithSourceProfile(arg, { profile, logger }) || isCredentialSourceProfile(arg, { profile, logger }));
 }, isAssumeRoleWithSourceProfile = (arg, { profile, logger }) => {
   const withSourceProfile = typeof arg.source_profile === "string" && typeof arg.credential_source === "undefined";
@@ -28674,7 +28674,7 @@ var import_client12, import_config26, isAssumeRoleProfile = (arg, { profile = "d
     }, options.clientPlugins);
   }
   if (source_profile && source_profile in visitedProfiles) {
-    throw new import_config26.CredentialsProviderError(`Detected a cycle attempting to resolve credentials for profile ${import_config26.getProfileName(options)}. Profiles visited: ` + Object.keys(visitedProfiles).join(", "), { logger: options.logger });
+    throw new import_config27.CredentialsProviderError(`Detected a cycle attempting to resolve credentials for profile ${import_config27.getProfileName(options)}. Profiles visited: ` + Object.keys(visitedProfiles).join(", "), { logger: options.logger });
   }
   options.logger?.debug(`@aws-sdk/credential-provider-ini - finding credential resolver using ${source_profile ? `source_profile=[${source_profile}]` : `profile=[${profileName}]`}`);
   const sourceCredsProvider = source_profile ? resolveProfileData(source_profile, profiles, options, callerClientConfig, {
@@ -28693,7 +28693,7 @@ var import_client12, import_config26, isAssumeRoleProfile = (arg, { profile = "d
     const { mfa_serial } = profileData;
     if (mfa_serial) {
       if (!options.mfaCodeProvider) {
-        throw new import_config26.CredentialsProviderError(`Profile ${profileName} requires multi-factor authentication, but no MFA code callback was provided.`, { logger: options.logger, tryNextLink: false });
+        throw new import_config27.CredentialsProviderError(`Profile ${profileName} requires multi-factor authentication, but no MFA code callback was provided.`, { logger: options.logger, tryNextLink: false });
       }
       params.SerialNumber = mfa_serial;
       params.TokenCode = await options.mfaCodeProvider(mfa_serial);
@@ -28707,7 +28707,7 @@ var import_client12, import_config26, isAssumeRoleProfile = (arg, { profile = "d
 var init_resolveAssumeRoleCredentials = __esm(() => {
   init_resolveCredentialSource();
   import_client12 = __toESM(require_client2(), 1);
-  import_config26 = __toESM(require_config(), 1);
+  import_config27 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/signin/index.js
@@ -29445,11 +29445,11 @@ var require_signin = __commonJS((exports) => {
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.js
 import { createHash as createHash19, createPrivateKey, createPublicKey, sign } from "crypto";
 import { promises as fs2 } from "fs";
-import { homedir as homedir6 } from "os";
-import { dirname as dirname19, join as join31 } from "path";
-var import_config27, import_protocols3, LoginCredentialsFetcher;
+import { homedir as homedir7 } from "os";
+import { dirname as dirname20, join as join32 } from "path";
+var import_config28, import_protocols3, LoginCredentialsFetcher;
 var init_LoginCredentialsFetcher = __esm(() => {
-  import_config27 = __toESM(require_config(), 1);
+  import_config28 = __toESM(require_config(), 1);
   import_protocols3 = __toESM(require_protocols(), 1);
   LoginCredentialsFetcher = class LoginCredentialsFetcher {
     profileData;
@@ -29464,7 +29464,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
     async loadCredentials() {
       const token = await this.loadToken();
       if (!token) {
-        throw new import_config27.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`, { tryNextLink: false, logger: this.logger });
+        throw new import_config28.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`, { tryNextLink: false, logger: this.logger });
       }
       const accessToken = token.accessToken;
       const now = Date.now();
@@ -29531,7 +29531,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
         const { accessKeyId, secretAccessKey, sessionToken } = response.tokenOutput?.accessToken ?? {};
         const { refreshToken, expiresIn } = response.tokenOutput ?? {};
         if (!accessKeyId || !secretAccessKey || !sessionToken || !refreshToken) {
-          throw new import_config27.CredentialsProviderError("Token refresh response missing required fields", {
+          throw new import_config28.CredentialsProviderError("Token refresh response missing required fields", {
             logger: this.logger,
             tryNextLink: false
           });
@@ -29568,7 +29568,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
             default:
               message = `Failed to refresh token: ${String(error)}. Please re-authenticate using \`aws login\``;
           }
-          throw new import_config27.CredentialsProviderError(message, {
+          throw new import_config28.CredentialsProviderError(message, {
             logger: this.logger,
             tryNextLink: false
           });
@@ -29578,7 +29578,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
           this.logger?.warn?.(`Failed to refresh token: ${String(error)}. Using existing token until expiry.`);
           return this.toCredentials(freshToken.accessToken);
         }
-        throw new import_config27.CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });
+        throw new import_config28.CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });
       }
     }
     async loadToken() {
@@ -29591,14 +29591,14 @@ var init_LoginCredentialsFetcher = __esm(() => {
           missingFields.push("accountId");
         }
         if (missingFields.length > 0) {
-          throw new import_config27.CredentialsProviderError(`Token validation failed, missing fields: ${missingFields.join(", ")}`, {
+          throw new import_config28.CredentialsProviderError(`Token validation failed, missing fields: ${missingFields.join(", ")}`, {
             logger: this.logger,
             tryNextLink: false
           });
         }
         return token;
       } catch (error) {
-        throw new import_config27.CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error)}`, {
+        throw new import_config28.CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error)}`, {
           logger: this.logger,
           tryNextLink: false
         });
@@ -29606,17 +29606,17 @@ var init_LoginCredentialsFetcher = __esm(() => {
     }
     async saveToken(token) {
       const tokenFilePath = this.getTokenFilePath();
-      const directory = dirname19(tokenFilePath);
+      const directory = dirname20(tokenFilePath);
       try {
         await fs2.mkdir(directory, { recursive: true });
       } catch (error) {}
       await fs2.writeFile(tokenFilePath, JSON.stringify(token, null, 2), "utf8");
     }
     getTokenFilePath() {
-      const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join31(homedir6(), ".aws", "login", "cache");
+      const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join32(homedir7(), ".aws", "login", "cache");
       const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
       const loginSessionSha256 = createHash19("sha256").update(loginSessionBytes).digest("hex");
-      return join31(directory, `${loginSessionSha256}.json`);
+      return join32(directory, `${loginSessionSha256}.json`);
     }
     derToRawSignature(derSignature) {
       let offset = 2;
@@ -29700,22 +29700,22 @@ var init_LoginCredentialsFetcher = __esm(() => {
         const signatureB64 = rawSignature.toString("base64url");
         return `${message}.${signatureB64}`;
       } catch (error) {
-        throw new import_config27.CredentialsProviderError(`Failed to generate Dpop proof: ${error instanceof Error ? error.message : String(error)}`, { logger: this.logger, tryNextLink: false });
+        throw new import_config28.CredentialsProviderError(`Failed to generate Dpop proof: ${error instanceof Error ? error.message : String(error)}`, { logger: this.logger, tryNextLink: false });
       }
     }
   };
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/credential-provider-login/dist-es/fromLoginCredentials.js
-var import_client13, import_config28, fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
+var import_client13, import_config29, fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
   init?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");
-  const profiles = await import_config28.parseKnownFiles(init || {});
-  const profileName = import_config28.getProfileName({
+  const profiles = await import_config29.parseKnownFiles(init || {});
+  const profileName = import_config29.getProfileName({
     profile: init?.profile ?? callerClientConfig?.profile
   });
   const profile = profiles[profileName];
   if (!profile?.login_session) {
-    throw new import_config28.CredentialsProviderError(`Profile ${profileName} does not contain login_session.`, {
+    throw new import_config29.CredentialsProviderError(`Profile ${profileName} does not contain login_session.`, {
       tryNextLink: true,
       logger: init?.logger
     });
@@ -29727,7 +29727,7 @@ var import_client13, import_config28, fromLoginCredentials = (init) => async ({
 var init_fromLoginCredentials = __esm(() => {
   init_LoginCredentialsFetcher();
   import_client13 = __toESM(require_client2(), 1);
-  import_config28 = __toESM(require_config(), 1);
+  import_config29 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/node_modules/@aws-sdk/credential-provider-login/dist-es/index.js
@@ -29791,12 +29791,12 @@ var init_getValidatedProcessCredentials = __esm(() => {
 // node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js
 import { exec } from "child_process";
 import { promisify } from "util";
-var import_config29, resolveProcessCredentials = async (profileName, profiles, logger) => {
+var import_config30, resolveProcessCredentials = async (profileName, profiles, logger) => {
   const profile = profiles[profileName];
   if (profiles[profileName]) {
     const credentialProcess = profile["credential_process"];
     if (credentialProcess !== undefined) {
-      const execPromise = promisify(import_config29.externalDataInterceptor?.getTokenRecord?.().exec ?? exec);
+      const execPromise = promisify(import_config30.externalDataInterceptor?.getTokenRecord?.().exec ?? exec);
       try {
         const { stdout } = await execPromise(credentialProcess);
         let data;
@@ -29807,33 +29807,33 @@ var import_config29, resolveProcessCredentials = async (profileName, profiles, l
         }
         return getValidatedProcessCredentials(profileName, data, profiles);
       } catch (error) {
-        throw new import_config29.CredentialsProviderError(error.message, { logger });
+        throw new import_config30.CredentialsProviderError(error.message, { logger });
       }
     } else {
-      throw new import_config29.CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`, { logger });
+      throw new import_config30.CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`, { logger });
     }
   } else {
-    throw new import_config29.CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`, {
+    throw new import_config30.CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`, {
       logger
     });
   }
 };
 var init_resolveProcessCredentials = __esm(() => {
   init_getValidatedProcessCredentials();
-  import_config29 = __toESM(require_config(), 1);
+  import_config30 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-process/dist-es/fromProcess.js
-var import_config30, fromProcess = (init = {}) => async ({ callerClientConfig } = {}) => {
+var import_config31, fromProcess = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");
-  const profiles = await import_config30.parseKnownFiles(init);
-  return resolveProcessCredentials(import_config30.getProfileName({
+  const profiles = await import_config31.parseKnownFiles(init);
+  return resolveProcessCredentials(import_config31.getProfileName({
     profile: init.profile ?? callerClientConfig?.profile
   }), profiles, init.logger);
 };
 var init_fromProcess = __esm(() => {
   init_resolveProcessCredentials();
-  import_config30 = __toESM(require_config(), 1);
+  import_config31 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-process/dist-es/index.js
@@ -30947,19 +30947,19 @@ var fromWebToken = (init) => async (awsIdentityProperties) => {
 
 // node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromTokenFile.js
 import { readFileSync as readFileSync21 } from "fs";
-var import_client19, import_config31, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE", ENV_ROLE_ARN = "AWS_ROLE_ARN", ENV_ROLE_SESSION_NAME = "AWS_ROLE_SESSION_NAME", fromTokenFile = (init = {}) => async (awsIdentityProperties) => {
+var import_client19, import_config32, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE", ENV_ROLE_ARN = "AWS_ROLE_ARN", ENV_ROLE_SESSION_NAME = "AWS_ROLE_SESSION_NAME", fromTokenFile = (init = {}) => async (awsIdentityProperties) => {
   init.logger?.debug("@aws-sdk/credential-provider-web-identity - fromTokenFile");
   const webIdentityTokenFile = init?.webIdentityTokenFile ?? process.env[ENV_TOKEN_FILE];
   const roleArn = init?.roleArn ?? process.env[ENV_ROLE_ARN];
   const roleSessionName = init?.roleSessionName ?? process.env[ENV_ROLE_SESSION_NAME];
   if (!webIdentityTokenFile || !roleArn) {
-    throw new import_config31.CredentialsProviderError("Web identity configuration not specified", {
+    throw new import_config32.CredentialsProviderError("Web identity configuration not specified", {
       logger: init.logger
     });
   }
   const credentials = await fromWebToken({
     ...init,
-    webIdentityToken: import_config31.externalDataInterceptor?.getTokenRecord?.()[webIdentityTokenFile] ?? readFileSync21(webIdentityTokenFile, { encoding: "ascii" }),
+    webIdentityToken: import_config32.externalDataInterceptor?.getTokenRecord?.()[webIdentityTokenFile] ?? readFileSync21(webIdentityTokenFile, { encoding: "ascii" }),
     roleArn,
     roleSessionName
   })(awsIdentityProperties);
@@ -30970,7 +30970,7 @@ var import_client19, import_config31, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_F
 };
 var init_fromTokenFile = __esm(() => {
   import_client19 = __toESM(require_client2(), 1);
-  import_config31 = __toESM(require_config(), 1);
+  import_config32 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-web-identity/dist-es/index.js
@@ -31003,7 +31003,7 @@ var init_resolveWebIdentityCredentials = __esm(() => {
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProfileData.js
-var import_config32, resolveProfileData = async (profileName, profiles, options, callerClientConfig, visitedProfiles = {}, isAssumeRoleRecursiveCall = false) => {
+var import_config33, resolveProfileData = async (profileName, profiles, options, callerClientConfig, visitedProfiles = {}, isAssumeRoleRecursiveCall = false) => {
   const data = profiles[profileName];
   if (Object.keys(visitedProfiles).length > 0 && isStaticCredsProfile(data)) {
     return resolveStaticCredentials(data, options);
@@ -31026,7 +31026,7 @@ var import_config32, resolveProfileData = async (profileName, profiles, options,
   if (isLoginProfile(data)) {
     return resolveLoginCredentials(profileName, options, callerClientConfig);
   }
-  throw new import_config32.CredentialsProviderError(`Could not resolve credentials using profile: [${profileName}] in configuration/credentials file(s).`, { logger: options.logger });
+  throw new import_config33.CredentialsProviderError(`Could not resolve credentials using profile: [${profileName}] in configuration/credentials file(s).`, { logger: options.logger });
 };
 var init_resolveProfileData = __esm(() => {
   init_resolveAssumeRoleCredentials();
@@ -31035,20 +31035,20 @@ var init_resolveProfileData = __esm(() => {
   init_resolveSsoCredentials();
   init_resolveStaticCredentials();
   init_resolveWebIdentityCredentials();
-  import_config32 = __toESM(require_config(), 1);
+  import_config33 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/fromIni.js
-var import_config33, fromIni = (init = {}) => async ({ callerClientConfig } = {}) => {
+var import_config34, fromIni = (init = {}) => async ({ callerClientConfig } = {}) => {
   init.logger?.debug("@aws-sdk/credential-provider-ini - fromIni");
-  const profiles = await import_config33.parseKnownFiles(init);
-  return resolveProfileData(import_config33.getProfileName({
+  const profiles = await import_config34.parseKnownFiles(init);
+  return resolveProfileData(import_config34.getProfileName({
     profile: init.profile ?? callerClientConfig?.profile
   }), profiles, init, callerClientConfig);
 };
 var init_fromIni = __esm(() => {
   init_resolveProfileData();
-  import_config33 = __toESM(require_config(), 1);
+  import_config34 = __toESM(require_config(), 1);
 });
 
 // node_modules/@aws-sdk/credential-provider-ini/dist-es/index.js
@@ -31066,8 +31066,8 @@ import { Buffer as Buffer2 } from "buffer";
 import { existsSync as existsSync22 } from "fs";
 import { join as join210 } from "path";
 import { existsSync as existsSync16 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join35, resolve as resolve17 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join36, resolve as resolve18 } from "path";
 import { homedir as pathsResolverHomedir2 } from "os";
 import { join as pathsResolverJoin2 } from "path";
 import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual3 } from "crypto";
@@ -31225,10 +31225,10 @@ function dataDir2(options) {
   return pathsResolverResolve("data", options);
 }
 function effectiveHome2() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || homedir7();
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir8();
 }
 function legacyHomeDir() {
-  return join35(effectiveHome2(), ".hasna", "events");
+  return join36(effectiveHome2(), ".hasna", "events");
 }
 function resolverHome() {
   return dataDir2({ app: "events", home: effectiveHome2() || undefined });
@@ -31237,7 +31237,7 @@ function adoptResolverHome(resolved, env = process.env) {
   const dataOverride = env.HASNA_DATA_HOME;
   if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
     return true;
-  return existsSync16(join35(resolved, EVENTS_STORE_SENTINEL_FILE));
+  return existsSync16(join36(resolved, EVENTS_STORE_SENTINEL_FILE));
 }
 function exactEventsHome() {
   const dir = process.env[HASNA_EVENTS_DIR_ENV];
@@ -31251,9 +31251,9 @@ function exactEventsHome() {
 function getEventsHome() {
   const exact = exactEventsHome();
   if (exact)
-    return resolve17(exact);
+    return resolve18(exact);
   const resolved = resolverHome();
-  return adoptResolverHome(resolved) ? resolve17(resolved) : resolve17(legacyHomeDir());
+  return adoptResolverHome(resolved) ? resolve18(resolved) : resolve18(legacyHomeDir());
 }
 function getEventsDataDir(override) {
   return override || getEventsHome();
@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.11",
+  version: "0.9.13",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -37212,8 +37212,8 @@ async function reconcileSkillSession(input, options = {}) {
 // src/lib/selected-run.ts
 import { createHash as createHash18 } from "crypto";
 import { spawn } from "child_process";
-import { mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync9, realpathSync as realpathSync7 } from "fs";
-import { dirname as dirname18, join as join30, resolve as resolve16 } from "path";
+import { mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync9, realpathSync as realpathSync8 } from "fs";
+import { dirname as dirname19, join as join31, resolve as resolve17 } from "path";
 import { tmpdir, hostname as stationHostname2 } from "os";
 
 // src/lib/dependency-preparation.ts
@@ -37425,18 +37425,18 @@ async function prepareSkillDependencies(skillPath, env, timeoutMs = DEFAULT_PREP
 
 // src/lib/skillinfo.ts
 import { existsSync as existsSync14, readFileSync as readFileSync20 } from "fs";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 
 // src/lib/installer.ts
 import { existsSync as existsSync13, readFileSync as readFileSync19, rmSync as rmSync4 } from "fs";
-import { join as join28 } from "path";
-import { homedir as homedir5 } from "os";
+import { join as join29 } from "path";
+import { homedir as homedir6 } from "os";
 
 // src/lib/agent-sync.ts
 import {
   cpSync as cpSync2,
   existsSync as existsSync10,
-  lstatSync as lstatSync20,
+  lstatSync as lstatSync21,
   mkdirSync as mkdirSync8,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync16,
@@ -37446,8 +37446,27 @@ import {
   statSync as statSync9,
   writeFileSync as writeFileSync7
 } from "fs";
-import { homedir as homedir4 } from "os";
-import { basename as basename9, dirname as dirname17, join as join25 } from "path";
+import { homedir as homedir5 } from "os";
+import { basename as basename10, dirname as dirname18, join as join26 } from "path";
+
+// src/lib/native-discovery-roots.ts
+var NATIVE_SKILL_ROOTS = [
+  ["claude", ".claude/skills"],
+  ["codex", ".codex/skills"],
+  ["codex", ".agents/skills"],
+  ["gemini", ".gemini/skills"],
+  ["codewith", ".codewith/skills"],
+  ["opencode", ".config/opencode/skills"],
+  ["opencode", ".opencode/skills"],
+  ["cursor", ".cursor/skills"],
+  ["hermes", ".hermes/skills"],
+  ["windsurf", ".windsurf/skills"],
+  ["pi", ".pi/agent/skills"],
+  ["amp", ".amp/skills"],
+  ["cline", ".cline/skills"],
+  ["roo", ".roo/skills"],
+  ["copilot", ".github/skills"]
+];
 
 // src/lib/agent-integration.ts
 import { createHash as createHash16, randomUUID as randomUUID3 } from "crypto";
@@ -37526,10 +37545,10 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
-      if (source.hashMode === "claude-settings-v1")
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-marketplace-registry-v2"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve3(source.path) === source.path && basename2(source.path) === "settings.json");
-      if (source.hashMode === "claude-marketplace-registry")
+      if (source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve3(source.path) === source.path && basename2(source.path) === "known_marketplaces.json");
       if (source.hashMode === "claude-plugin-registry") {
         requireBound(agent === "claude");
@@ -37812,6 +37831,48 @@ function assertHermesEnvironment(home) {
   if (process.env.HERMES_ENABLE_PROJECT_PLUGINS?.trim() && !["0", "false", "no", "off"].includes(process.env.HERMES_ENABLE_PROJECT_PLUGINS.trim().toLowerCase()))
     throw new Error("NATIVE_SKILL_DRIFT: Hermes project plugins require a dedicated discovery review");
 }
+function read(path) {
+  for (let current = path;; current = dirname4(current)) {
+    if (lstatSync7(current, { throwIfNoEntry: false })?.isSymbolicLink())
+      throw new Error("NATIVE_SKILL_DRIFT: symlink Hermes protection input");
+    if (dirname4(current) === current)
+      break;
+  }
+  const stat = lstatSync7(path, { throwIfNoEntry: false });
+  if (!stat)
+    return null;
+  if (!stat.isFile() || stat.size > 1024 * 1024)
+    throw new Error("NATIVE_SKILL_DRIFT: invalid Hermes protection input");
+  return readFileSync9(path, "utf8");
+}
+function assertHermesProtection(home, config, command, profile, supervisor) {
+  assertHermesEnvironment(home);
+  if (read(join12(home, ".hermes", HERMES_OPT_OUT)) === null)
+    throw new Error("NATIVE_SKILL_DRIFT: Hermes bundled skill reseeding is not disabled; run skills hook install");
+  if (!supervisor || !isAbsolute4(supervisor.path) || supervisor.runtime !== process.execPath || read(supervisor.path) !== renderHermesSupervisor(command, profile))
+    throw new Error("NATIVE_SKILL_DRIFT: Hermes owned supervisor changed; run skills hook install");
+  const raw = read(join12(home, ".hermes/shell-hooks-allowlist.json"));
+  let trust;
+  try {
+    trust = raw === null ? undefined : JSON.parse(raw);
+  } catch {
+    throw new Error("NATIVE_SKILL_DRIFT: invalid Hermes native hook trust");
+  }
+  for (const [event, entry] of Object.entries(hermesHookDefinitions(supervisor))) {
+    if (!Array.isArray(config.hooks?.[event]) || config.hooks[event].filter((actual) => sameEntry(actual, entry)).length !== 1)
+      throw new Error("NATIVE_SKILL_DRIFT: Hermes required native hooks changed; run skills hook install");
+    if (!Array.isArray(trust?.approvals) || !trust.approvals.some((approval) => object3(approval) && approval.event === event && approval.command === entry.command))
+      throw new Error("NATIVE_SKILL_DRIFT: approve the exact managed commands through Hermes normal native hook trust before starting a session");
+  }
+  if (config.skills?.platform_disabled !== undefined && !object3(config.skills.platform_disabled))
+    throw new Error("NATIVE_SKILL_DRIFT: malformed Hermes platform skill settings");
+  const disabled = config.skills?.disabled;
+  if (disabled !== undefined && (!Array.isArray(disabled) || disabled.some((value) => typeof value !== "string") || disabled.includes("skills-cli")))
+    throw new Error("NATIVE_SKILL_DRIFT: Hermes Skills CLI bridge is disabled or its names are malformed");
+  for (const names of Object.values(config.skills?.platform_disabled ?? {}))
+    if (!Array.isArray(names) || names.some((value) => typeof value !== "string") || names.includes("skills-cli"))
+      throw new Error("NATIVE_SKILL_DRIFT: a Hermes platform disables the Skills CLI bridge");
+}
 function assertNoHermesLegacyShadow(root) {
   let entries = 0;
   for (let cursor = resolve4(root);; cursor = dirname4(cursor)) {
@@ -39834,9 +39895,13 @@ function textField(value) {
   need2(value?.kind === "string" && value.value.length > 0 && !/[\x00-\x1f\x7f]/.test(value.value), "contains an invalid recognized field");
   return value.value;
 }
-function normalizeRow(row) {
-  if (!exactKeys2(row, ["source", "installLocation", "lastUpdated"]))
-    return;
+function normalizeRow(row, version = 1) {
+  if (!exactKeys2(row, ["source", "installLocation", "lastUpdated"])) {
+    if (version !== 2 || !exactKeys2(row, ["source", "installLocation", "lastUpdated", "autoUpdate"]))
+      return;
+    const autoUpdate = field(row, "autoUpdate");
+    need2(autoUpdate?.kind === "literal" && (autoUpdate.value === "true" || autoUpdate.value === "false"), "contains an invalid automatic-update preference");
+  }
   const source = field(row, "source");
   if (source?.kind !== "object")
     return;
@@ -39863,6 +39928,13 @@ function captureClaudeMarketplaceRegistry(path, budget = { remaining: 256 * 1024
   const sha2562 = createHash11("sha256").update("hasna.skills.claude-marketplace-registry.v1\x00").update(JSON.stringify(value)).digest("hex");
   return { path, hashMode: "claude-marketplace-registry", sha256: sha2562 };
 }
+function captureClaudeMarketplaceRegistryV2(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  const value = parse5(readRegistry2(path, budget));
+  for (const [, row] of value.entries)
+    normalizeRow(row, 2);
+  const sha2562 = createHash11("sha256").update("hasna.skills.claude-marketplace-registry.v2\x00").update(JSON.stringify(value)).digest("hex");
+  return { path, hashMode: "claude-marketplace-registry-v2", sha256: sha2562 };
+}
 
 // src/lib/claude-settings-witness.ts
 import { createHash as createHash12 } from "crypto";
@@ -40054,9 +40126,54 @@ function canonical3(value) {
     return { kind: "array", items: value.items.map(canonical3) };
   return value;
 }
-function settingsDigest(text2) {
+function assertClaudeStopHookReplacement(before, replacement) {
+  function bounded(text2) {
+    need3(typeof text2 === "string" && Buffer.byteLength(text2) <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes, "Stop update exceeds its byte limit");
+    return parse6(text2);
+  }
+  const original = bounded(before ?? "{}"), next = bounded(replacement);
+  const hadHooks = original.entries.some(([key]) => key === "hooks");
+  function withoutStop(value) {
+    const hooks = value.entries.find(([key]) => key === "hooks")?.[1];
+    if (hooks !== undefined) {
+      need3(hooks.kind === "object", "Stop update requires an object of hooks");
+      const stop = hooks.entries.find(([key]) => key === "Stop")?.[1];
+      need3(stop === undefined || stop.kind === "array", "Stop update requires a Stop array");
+      hooks.entries = hooks.entries.filter(([key]) => key !== "Stop");
+      if (!hadHooks && hooks.entries.length === 0)
+        value.entries = value.entries.filter(([key]) => key !== "hooks");
+    }
+    return canonical3(value);
+  }
+  need3(JSON.stringify(withoutStop(original)) === JSON.stringify(withoutStop(next)), "Stop update changed settings outside hooks.Stop");
+}
+var PERSISTED_EFFORT_LEVELS = new Set(["low", "medium", "high", "xhigh"]);
+function inferencePreference(key, child) {
+  if (key === "skipDangerousModePermissionPrompt") {
+    need3(child.kind === "literal" && (child.value === "true" || child.value === "false"), "contains an invalid dialog acknowledgment");
+    return true;
+  }
+  if (key === "effortLevel") {
+    need3(child.kind === "string" && PERSISTED_EFFORT_LEVELS.has(child.value), "contains an invalid persisted effort level");
+    return true;
+  }
+  if (key !== "modelSettings")
+    return false;
+  need3(child.kind === "object", "requires an object of model preferences");
+  child.entries = child.entries.filter(([model, preferences]) => {
+    if (!BUILTIN_MODEL_SELECTIONS.has(model) || preferences.kind !== "object" || preferences.entries.length !== 1 || preferences.entries[0][0] !== "effortLevel")
+      return true;
+    const effort = preferences.entries[0][1];
+    need3(effort.kind === "string" && PERSISTED_EFFORT_LEVELS.has(effort.value), "contains an invalid persisted model effort level");
+    return false;
+  });
+  return child.entries.length === 0;
+}
+function settingsDigest(text2, version = 1) {
   const value = parse6(text2);
   value.entries = value.entries.filter(([key, child]) => {
+    if (version === 2 && inferencePreference(key, child))
+      return false;
     if (key === "model") {
       need3(child.kind === "string", "contains an invalid model selection");
       return !BUILTIN_MODEL_SELECTIONS.has(child.value);
@@ -40071,7 +40188,7 @@ function settingsDigest(text2) {
     }
     return true;
   });
-  return createHash12("sha256").update("hasna.skills.claude-settings.v1\x00").update(JSON.stringify(canonical3(value))).digest("hex");
+  return createHash12("sha256").update(`hasna.skills.claude-settings.v${version}\x00`).update(JSON.stringify(canonical3(value))).digest("hex");
 }
 function hashClaudeSettingsReplacement(text2, budget) {
   need3(typeof text2 === "string", "requires settings text");
@@ -40083,6 +40200,16 @@ function hashClaudeSettingsReplacement(text2, budget) {
 function captureClaudeSettings(path, budget = { remaining: 256 * 1024 * 1024 }) {
   return { path, hashMode: "claude-settings-v1", sha256: settingsDigest(readSettings(path, budget)) };
 }
+function captureClaudeSettingsV2(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "claude-settings-v2", sha256: settingsDigest(readSettings(path, budget), 2) };
+}
+function hashClaudeSettingsReplacementV2(text2, budget) {
+  need3(typeof text2 === "string", "requires settings text");
+  const bytes = Buffer.byteLength(text2);
+  need3(bytes <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes && Number.isSafeInteger(budget.remaining) && budget.remaining >= bytes, "exceeds its byte limit");
+  budget.remaining -= bytes;
+  return settingsDigest(text2, 2);
+}
 
 // src/lib/codex-hook-discovery-recovery.ts
 import { createHash as createHash14 } from "crypto";
@@ -40174,7 +40301,7 @@ function safe4(path) {
       break;
   }
 }
-function read(path, changes) {
+function read2(path, changes) {
   safe4(path);
   if (changes?.has(path))
     return changes.get(path);
@@ -40186,18 +40313,18 @@ function read(path, changes) {
   return readFileSync12(path, "utf8");
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
-  if (source.hashMode === "claude-settings-v1") {
+  if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Claude settings witnesses require exact typed metadata");
-    const current = captureClaudeSettings(source.path, budget).sha256;
+    const current = (source.hashMode === "claude-settings-v2" ? captureClaudeSettingsV2 : captureClaudeSettings)(source.path, budget).sha256;
     if (current !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
-    return changes?.has(source.path) ? hashClaudeSettingsReplacement(changes.get(source.path), budget) : current;
+    return changes?.has(source.path) ? (source.hashMode === "claude-settings-v2" ? hashClaudeSettingsReplacementV2 : hashClaudeSettingsReplacement)(changes.get(source.path), budget) : current;
   }
-  if (source.hashMode === "claude-marketplace-registry") {
+  if (source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256) || changes?.has(source.path))
       throw new Error("Claude marketplace witnesses require an exact reviewed registry without synthetic changes");
-    const sha2562 = captureClaudeMarketplaceRegistry(source.path, budget).sha256;
+    const sha2562 = (source.hashMode === "claude-marketplace-registry-v2" ? captureClaudeMarketplaceRegistryV2 : captureClaudeMarketplaceRegistry)(source.path, budget).sha256;
     if (sha2562 !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
     return sha2562;
@@ -40218,7 +40345,7 @@ function projected(source, changes, budget = discoveryByteBudget()) {
       return hashDiscoveryPathFile(source.path, budget, changes);
     return hashRawDiscoveryFile(source.path, budget, changes);
   }
-  const text2 = read(source.path, changes);
+  const text2 = read2(source.path, changes);
   if (text2 === null)
     return null;
   if (!source.format)
@@ -40254,9 +40381,9 @@ function verifyAgentDiscovery(binding, codexRecovery) {
     safe4(root2);
 }
 function assertMarketplaceBinding(binding, source) {
-  if (source.hashMode === "claude-settings-v1" && (binding.agent !== "claude" || binding.method !== "reviewed" || basename6(source.path) !== "settings.json"))
+  if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename6(source.path) !== "settings.json"))
     throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
-  if (source.hashMode === "claude-marketplace-registry" && (binding.agent !== "claude" || binding.method !== "reviewed"))
+  if ((source.hashMode === "claude-marketplace-registry" || source.hashMode === "claude-marketplace-registry-v2") && (binding.agent !== "claude" || binding.method !== "reviewed"))
     throw new Error("Claude marketplace witnesses require explicit reviewed Claude discovery");
 }
 function rebindAgentDiscovery(binding, changes) {
@@ -40278,6 +40405,49 @@ function captureDiscoveryPathSources(paths) {
   const budget = discoveryByteBudget();
   return paths.map((path) => ({ path, hashMode: "path-bytes", sha256: hashDiscoveryPathFile(path, budget) }));
 }
+function assertProjectDiscovery(agent, directories, home, canonical4 = resolve13, reviewed) {
+  for (const directory of directories) {
+    const isHome = resolve13(directory) === resolve13(home);
+    if (agent === "hermes") {
+      assertHermesEnvironment(home);
+      continue;
+    }
+    if (isHome && agent !== "claude")
+      continue;
+    const paths = agent === "claude" ? [...isHome ? [] : [".claude/settings.json"], ".claude/settings.local.json"] : agent === "codex" ? [".codex/config.toml"] : agent === "gemini" ? [".gemini/settings.json"] : agent === "opencode" ? ["opencode.json", "opencode.jsonc", ".opencode/opencode.json", ".opencode/opencode.jsonc"] : [".cursor/hooks.json"];
+    for (const suffix of paths) {
+      const path = canonical4(join20(directory, suffix)), raw = read2(path);
+      if (raw === null)
+        continue;
+      if (agent === "claude" && suffix === ".claude/settings.json" && path === canonical4(join20(home, suffix)))
+        continue;
+      if (suffix.endsWith(".jsonc"))
+        throw new Error(`NATIVE_SKILL_DRIFT: project JSONC discovery configuration requires review: ${path}`);
+      const config = parseConfig(raw, path, suffix.endsWith(".toml"));
+      const keys2 = agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces", "skillOverrides"] : agent === "codex" ? ["plugins", "marketplaces", "skills"] : agent === "gemini" ? ["skills", "extensions"] : agent === "opencode" ? ["plugin", "skills"] : ["hooks"];
+      let admittedPlugins = false;
+      if (agent === "claude" && reviewed?.agent === agent && reviewed.method === "reviewed" && config.enabledPlugins && typeof config.enabledPlugins === "object" && !Array.isArray(config.enabledPlugins)) {
+        const exact = reviewed.sources.find((source) => source.path === path && source.format === undefined && source.fields === undefined && (source.hashMode === undefined || source.hashMode === "bytes"));
+        const managed = reviewed.sources.flatMap((source) => source.hashMode === "claude-plugin-registry" ? source.managedPlugins ?? [] : []);
+        if (exact && projected(exact) === exact.sha256 && managed.length) {
+          const bindings = managed.map((item) => readPluginBinding(item.storeRoot, item.bindingId));
+          admittedPlugins = Object.entries(config.enabledPlugins).every(([id2, enabled]) => typeof enabled === "boolean" && bindings.some((binding) => binding.target.pluginId === id2 && binding.target.registrations.some((scope) => scope.scope === "project" && scope.projectPath === canonical4(directory))));
+        }
+      }
+      if (keys2.some((key) => config[key] !== undefined && !(key === "enabledPlugins" && admittedPlugins)) || config.disableAllHooks === true || config.disableBundledSkills === false || config.hooksConfig?.enabled === false || config.permission?.skill !== undefined || config.permissions?.deny?.some((rule) => typeof rule === "string" && /^Skill(?:\(|$)/.test(rule)))
+        throw new Error(`NATIVE_SKILL_DRIFT: higher-precedence project skill or hook configuration requires review: ${path}`);
+    }
+    if (agent === "claude") {
+      const commands = canonical4(join20(directory, ".claude/commands"));
+      safe4(commands);
+      if (lstatSync17(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync6(commands).length)
+        throw new Error("NATIVE_SKILL_DRIFT: legacy project command discovery requires a dedicated format adapter");
+    }
+  }
+}
+function agentDiscoveryConfigPath(home, agent) {
+  return join20(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
+}
 function resolveAgentDiscovery(options) {
   const canonical4 = options.canonical ?? resolve13, home = resolve13(options.home), agent = options.agent;
   const sources = [], roots = new Set, builtinNames = [];
@@ -40285,11 +40455,11 @@ function resolveAgentDiscovery(options) {
     const source = { path: canonical4(path), sha256: null, ...format ? { format, fields } : {} };
     source.sha256 = projected(source);
     sources.push(source);
-    return read(source.path);
+    return read2(source.path);
   };
   if (agent === "hermes")
     assertHermesEnvironment(home);
-  const configPath = join20(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
+  const configPath = agentDiscoveryConfigPath(home, agent);
   const configText = witness(configPath, agent === "hermes" ? "yaml" : agent === "codex" ? "toml" : "json", agent === "hermes" ? ["skills", "plugins", "hooks"] : agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces"] : agent === "codex" ? ["plugins", "marketplaces", "skills"] : agent === "gemini" ? ["skills", "extensions", "security"] : agent === "opencode" ? ["plugin", "skills"] : ["version"]);
   const config = configText === null ? {} : agent === "hermes" ? parseHermesConfig(configText) : parseConfig(configText, configPath, agent === "codex");
   const unresolved = (detail) => {
@@ -40320,7 +40490,7 @@ function resolveAgentDiscovery(options) {
     if (executable) {
       let packageRoot;
       for (let directory = dirname13(realpathSync3(executable)), depth = 0;depth < 8; directory = dirname13(directory), depth++) {
-        const path = join20(directory, "package.json"), raw = read(path);
+        const path = join20(directory, "package.json"), raw = read2(path);
         if (raw !== null && parseConfig(raw, path).name === "@google/gemini-cli") {
           packageRoot = directory;
           witness(path);
@@ -40354,7 +40524,7 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (review.sources.some((source) => source.hashMode === "claude-settings-v1" && source.path !== canonical4(configPath)))
+    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2") && source.path !== canonical4(configPath)))
       throw new Error("Semantic settings witnesses must name the configured Claude configuration source");
     if (!review.sources.some((source) => source.path === canonical4(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
@@ -40612,23 +40782,7 @@ function disableCodexBundledSkills(text2) {
 
 // src/lib/agent-integration.ts
 var sha2 = (data) => createHash16("sha256").update(data).digest("hex");
-var ROOTS = [
-  ["claude", ".claude/skills"],
-  ["codex", ".codex/skills"],
-  ["codex", ".agents/skills"],
-  ["gemini", ".gemini/skills"],
-  ["codewith", ".codewith/skills"],
-  ["opencode", ".config/opencode/skills"],
-  ["opencode", ".opencode/skills"],
-  ["cursor", ".cursor/skills"],
-  ["hermes", ".hermes/skills"],
-  ["windsurf", ".windsurf/skills"],
-  ["pi", ".pi/agent/skills"],
-  ["amp", ".amp/skills"],
-  ["cline", ".cline/skills"],
-  ["roo", ".roo/skills"],
-  ["copilot", ".github/skills"]
-];
+var ROOTS = NATIVE_SKILL_ROOTS;
 function assertSafePath(path) {
   let cursor = resolve14(path);
   while (true) {
@@ -40925,6 +41079,22 @@ function configureHooks(config, agent, command, profileId, nativeReady) {
     if (!Array.isArray(existing))
       throw new Error(`Expected ${event} hooks array`);
     const hookCommand = renderAgentHookCommand(command, agent, profileId, event);
+    if (agent === "codex") {
+      let ownedIndex = -1;
+      for (const [index, entry] of existing.entries()) {
+        if (!entry || !Array.isArray(entry.hooks))
+          throw new Error(`Malformed ${event} hook entry`);
+        const owned = entry.hooks.filter((hook) => hook?.type === "command" && typeof hook.command === "string" && /(?:^|\s)hook user-prompt --agent codex(?: --selection-profile [A-Za-z0-9._-]+)?(?: --event [A-Za-z]+)?$/.test(hook.command));
+        if (!owned.length)
+          continue;
+        if (ownedIndex !== -1 || entry.hooks.length !== 1 || Object.keys(entry).length !== 1)
+          throw new Error(`Review ambiguous ${event} Codex Skills hook groups before installation; unrelated native hook positions must be preserved`);
+        ownedIndex = index;
+      }
+      const replacement = { hooks: [{ type: "command", command: hookCommand, timeout: 15 }] };
+      config.hooks[event] = ownedIndex === -1 ? [...existing, replacement] : existing.map((entry, index) => index === ownedIndex ? replacement : entry);
+      continue;
+    }
     const retained = existing.flatMap((entry) => {
       if (agent === "cursor") {
         if (!entry || typeof entry.command !== "string")
@@ -41130,6 +41300,62 @@ function planAgentIntegration(options) {
   recheckRootAliases(aliases);
   return { dataDir: dataDir2, profileId, changes, nativeSkills, observedPolicy: { path: policyPath, before: previousPolicy }, discoveryBefore: discoveries, discoveryAfter, ...aliases.length ? { rootAliases: aliases } : {} };
 }
+function planClaudeStopHookUpdate(options) {
+  const home = resolve14(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
+  const policyPath = join21(dataDir2, "agent-policy.json");
+  assertSafePath(policyPath);
+  const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
+  if (!snapshot2)
+    return null;
+  const policy = snapshot2.value, bridge = policy.bridge;
+  if (!bridge || bridge.home !== home || bridge.version !== CLI_BRIDGE_VERSION || bridge.digest !== CLI_BRIDGE_DIGEST || !Array.isArray(bridge.agents) || !bridge.agents.length || bridge.agents.some((agent) => !INTEGRATION_AGENTS.includes(agent)) || new Set(bridge.agents).size !== bridge.agents.length || !bridge.discovery || typeof bridge.discovery !== "object" || Array.isArray(bridge.discovery)) {
+    throw new Error("Invalid managed bridge for Claude settings update");
+  }
+  const aliases = bridge.rootAliases ?? [];
+  recheckRootAliases(aliases);
+  const path = canonicalAgentPath(join21(home, ".claude", "settings.json"), aliases);
+  assertSafePath(path);
+  const before = lstatSync18(path, { throwIfNoEntry: false }) ? new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(readNativeBytes(path, 1024 * 1024)) : null;
+  if ((before === null ? "absent" : sha2(before)) !== options.expectedSettingsSha256)
+    throw new Error("Claude settings preimage changed");
+  assertClaudeStopHookReplacement(before, options.replacement);
+  const agents = bridge.agents;
+  const discoveries = Object.entries(bridge.discovery).map(([agent, binding]) => {
+    if (!agents.includes(agent) || binding?.agent !== agent)
+      throw new Error("Invalid managed discovery owner");
+    return binding;
+  });
+  if (discoveries.length !== agents.length)
+    throw new Error("Missing managed discovery coverage");
+  for (const agent of agents)
+    assertManagedAgentBridge(agent, { home, dataDir: dataDir2, projectDir: home });
+  const replacements = new Map(before === options.replacement ? [] : [[path, options.replacement]]);
+  const discoveryAfter = discoveries.map((binding) => rebindAgentDiscovery(binding, replacements));
+  const nextPolicy = { ...policy, bridge: { ...bridge, discovery: Object.fromEntries(discoveryAfter.map((binding) => [binding.agent, binding])) } };
+  const changes = before === options.replacement ? [] : [{ path, before, after: options.replacement }];
+  if (JSON.stringify(nextPolicy) !== JSON.stringify(policy))
+    changes.push({ path: policyPath, before: snapshot2.text, after: serializeManagedSkillPolicy(nextPolicy) });
+  recheckRootAliases(aliases);
+  const nativeSkills = inventoryNativeSkills(home, {
+    agents,
+    projectDir: home,
+    includeVendor: true,
+    guardHermes: agents.includes("hermes"),
+    allowRootAliases: aliases.length > 0,
+    agentRoots: discoveries.flatMap((binding) => binding.roots.map((path2) => ({ agent: binding.agent, path: path2 })))
+  });
+  return {
+    dataDir: dataDir2,
+    profileId: policy.profileId ?? "default",
+    changes,
+    nativeSkills,
+    observedPolicy: { path: policyPath, before: snapshot2.text },
+    discoveryBefore: discoveries,
+    discoveryAfter,
+    rootAliases: aliases,
+    managedAgentChecks: { home, agents: [...agents] }
+  };
+}
 function atomicWrite2(path, content) {
   assertSafePath(path);
   mkdirSync5(dirname14(path), { recursive: true, mode: 448 });
@@ -41152,6 +41378,8 @@ function applyAgentIntegration(plan) {
       parseManagedSkillPolicy(change.after);
   const aliases = plan.rootAliases ?? [];
   recheckRootAliases(aliases);
+  for (const agent of plan.managedAgentChecks?.agents ?? [])
+    assertManagedAgentBridge(agent, { home: plan.managedAgentChecks.home, dataDir: plan.dataDir, projectDir: plan.managedAgentChecks.home });
   for (const binding of plan.discoveryBefore ?? [])
     verifyAgentDiscovery(binding);
   if (plan.observedPolicy && currentText(plan.observedPolicy.path) !== plan.observedPolicy.before)
@@ -41187,6 +41415,8 @@ function applyAgentIntegration(plan) {
     recheckRootAliases(aliases);
     for (const binding of plan.discoveryAfter ?? [])
       verifyAgentDiscovery(binding);
+    for (const agent of plan.managedAgentChecks?.agents ?? [])
+      assertManagedAgentBridge(agent, { home: plan.managedAgentChecks.home, dataDir: plan.dataDir, projectDir: plan.managedAgentChecks.home });
     atomicWrite2(join21(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha2(change.before), afterHash: sha2(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
 `);
   } catch (error) {
@@ -41367,6 +41597,97 @@ function archiveNativeSkills(inventory, options) {
   }
   return { entries: entries.map(({ status, conflict, ...entry }) => entry), receiptPath, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
 }
+function assertManagedAgentBridge(agent, options = {}) {
+  const home = resolve14(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
+  assertSafePath(join21(dataDir2, "agent-policy.json"));
+  const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
+  if (!snapshot2)
+    throw new Error("NATIVE_SKILL_DRIFT: install the Skills bridge with skills hook install");
+  const binding = snapshot2.value.bridge;
+  if (!binding || binding.version !== CLI_BRIDGE_VERSION || binding.digest !== CLI_BRIDGE_DIGEST || binding.home !== home || !Array.isArray(binding.agents) || !binding.agents.includes(agent))
+    throw new Error("NATIVE_SKILL_DRIFT: the managed Skills bridge binding is missing or incompatible; run skills hook install");
+  const aliases = binding.rootAliases ?? [];
+  if (!Array.isArray(aliases))
+    throw new Error("NATIVE_SKILL_DRIFT: invalid root alias binding");
+  recheckRootAliases(aliases);
+  const expected = canonicalAgentPath(join21(home, AGENT_ADAPTERS[agent].root, CLI_BRIDGE_NAME), aliases);
+  if (!isOwnedCliBridge(expected, [expected]))
+    throw new Error("NATIVE_SKILL_DRIFT: the native Skills bridge is missing or modified; repair it before continuing");
+  const roots = projectAncestorDirectories([options.projectDir ?? process.cwd(), ...options.projectDirs ?? [], ...agent === "hermes" && process.env.TERMINAL_CWD ? [process.cwd()] : []]);
+  const visible = (entry) => entry.agent === agent || ["codex", "gemini", "opencode", "hermes"].includes(agent) && entry.path.includes(`${sep4}.agents${sep4}skills${sep4}`) || agent === "opencode" && entry.agent === "claude";
+  const discovery = binding.discovery?.[agent];
+  assertProjectDiscovery(agent, [...roots], home, (path) => canonicalAgentPath(path, aliases), discovery);
+  const configPath = canonicalAgentPath(join21(home, AGENT_ADAPTERS[agent].config), aliases), config = agent === "hermes" ? parseHermesConfig(readOptional(configPath)) : jsonObject(readOptional(configPath), configPath);
+  const command = binding.commands?.[agent], profile = binding.profiles?.[agent];
+  if (typeof command !== "string" || typeof profile !== "string")
+    throw new Error("NATIVE_SKILL_DRIFT: the native hook command/profile binding is missing");
+  if (options.profileId !== undefined && options.profileId !== profile)
+    throw new Error("NATIVE_SKILL_DRIFT: the hook selection profile differs from its managed binding; restart the native client after reviewing skills hook install");
+  if (agent === "hermes") {
+    const supervisor = binding.supervisors?.hermes;
+    if (supervisor?.path !== join21(dataDir2, "agent-hooks", "hermes.js") || supervisor?.sha256 !== sha2(renderHermesSupervisor(command, profile)))
+      throw new Error("NATIVE_SKILL_DRIFT: Hermes supervisor binding changed; run skills hook install");
+    assertHermesProtection(home, config, command, profile, supervisor);
+  } else if (agent === "opencode") {
+    if (JSON.stringify(config.permission?.skill) !== JSON.stringify({ "*": "deny", [CLI_BRIDGE_NAME]: "allow" }) || readOptional(join21(home, ".config", "opencode", "plugins", "skills-cli.js")) !== renderOpenCodePlugin(command, profile))
+      throw new Error("NATIVE_SKILL_DRIFT: OpenCode bridge protection changed; run skills hook install");
+  } else {
+    const required = {};
+    configureHooks(required, agent, command, profile, true);
+    for (const [event, entries] of Object.entries(required.hooks))
+      for (const entry of entries) {
+        if (!Array.isArray(config.hooks?.[event]) || config.hooks[event].filter((actual) => JSON.stringify(actual) === JSON.stringify(entry)).length !== 1)
+          throw new Error("NATIVE_SKILL_DRIFT: required native prompt/skill hooks changed; run skills hook install");
+      }
+    if (agent === "claude" && (config.disableBundledSkills !== true || config.disableAllHooks === true || !config.permissions?.allow?.includes(`Skill(${CLI_BRIDGE_NAME})`) || config.permissions?.deny?.includes("Skill")))
+      throw new Error("NATIVE_SKILL_DRIFT: Claude bridge or bundled-skill protection changed; retire copies and run skills hook install");
+    if (agent === "claude" && config.syncClaudeAiSkills !== false)
+      throw new Error("NATIVE_SKILL_DRIFT: Claude account skill synchronization is not disabled (syncClaudeAiSkills); run skills hook install to prevent native copies from returning");
+    if (agent === "gemini" && (config.hooksConfig?.enabled === false || config.skills?.enabled !== true || !["antigravity-support", "skill-creator"].every((name) => config.skills?.disabled?.includes(name)) || config.skills?.disabled?.includes(CLI_BRIDGE_NAME)))
+      throw new Error("NATIVE_SKILL_DRIFT: Gemini bridge or bundled-skill protection changed; run skills hook install");
+  }
+  const codexPath = canonicalAgentPath(join21(home, ".codex", "config.toml"), aliases);
+  if (options.codexDiscoveryRecovery && (agent !== "codex" || options.codexDiscoveryRecovery.configPath !== codexPath))
+    throw new Error("NATIVE_SKILL_DRIFT: Codex trust recovery names a different configuration root");
+  const codexConfig = agent === "codex" ? Bun.TOML.parse(readOptional(codexPath) ?? "") : {};
+  if (agent === "codex" && codexConfig.skills?.bundled?.enabled !== false)
+    throw new Error("NATIVE_SKILL_DRIFT: Codex bundled skill reseeding is not disabled (skills.bundled.enabled); run skills hook install");
+  const setting = (path) => (codexConfig.skills?.config ?? []).filter((entry) => typeof entry.path === "string" && [path, join21(path, "SKILL.md")].includes(canonicalAgentPath(entry.path, aliases)));
+  if (agent === "codex" && [...setting(expected), ...(codexConfig.skills?.config ?? []).filter((entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME)].some((entry) => entry.enabled === false))
+    throw new Error("NATIVE_SKILL_DRIFT: the Codex CLI bridge is disabled; run skills hook install");
+  const disabledBuiltin = (entry) => {
+    if (agent !== "codex" || !entry.vendor || !entry.path.startsWith(canonicalAgentPath(join21(home, ".codex", "skills", ".system"), aliases) + sep4))
+      return false;
+    const matched = Array.isArray(binding.disabledBuiltins) && binding.disabledBuiltins.some((item) => item.path === entry.path && item.hash === entry.hash);
+    const settings = setting(entry.path);
+    return matched && settings.length === 1 && settings[0]?.enabled === false;
+  };
+  if (!discovery || discovery.agent !== agent)
+    throw new Error("NATIVE_SKILL_DRIFT: native discovery coverage is missing; run skills hook install");
+  if (agent === "gemini" && !discovery.builtinNames?.every((name) => config.skills.disabled.includes(name)))
+    throw new Error("NATIVE_SKILL_DRIFT: an installed Gemini builtin is not disabled");
+  try {
+    verifyAgentDiscovery(discovery, options.codexDiscoveryRecovery);
+    if (discovery.method === "automatic") {
+      const current = resolveAgentDiscovery({ home, agent, canonical: (path) => canonicalAgentPath(path, aliases) });
+      if (JSON.stringify(current) !== JSON.stringify(discovery))
+        throw new Error("Configured native discovery roots changed");
+    }
+  } catch (error) {
+    throw new Error(`NATIVE_SKILL_DRIFT: ${error.message}`);
+  }
+  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0 });
+  const unexpected = inventory.filter((entry) => visible(entry) && !entry.bridge && !disabledBuiltin(entry));
+  if (unexpected.length) {
+    const paths = unexpected.slice(0, 3).map((entry) => {
+      const escaped = JSON.stringify(entry.path).replace(/[\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/g, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
+      return escaped.length > 768 ? `${escaped.slice(0, 384)}...${escaped.slice(-381)}` : escaped;
+    });
+    const remaining = unexpected.length - paths.length;
+    throw new Error(`NATIVE_SKILL_DRIFT: ${unexpected.length} unexpected native skill copies were found: ${paths.join(", ")}${remaining ? `; ${remaining} more` : ""}. Review skills migrate native --project <working-directory> --include-unmanaged --include-vendor --json before continuing; it inventories that directory and its ancestors. Use --apply after reviewing the archive plan.`);
+  }
+  recheckRootAliases(aliases);
+}
 function assertNativeExportAllowed(dataDir2 = getDataDirReadOnly()) {
   if (requiresCliSkillLoading(dataDir2))
     throw new Error("NATIVE_SKILL_EXPORT_DISABLED: this station loads skills through the Skills CLI; use skills sync --selection-profile <id>");
@@ -41378,13 +41699,13 @@ import {
   mkdirSync as mkdirSync7,
   mkdtempSync,
   readdirSync as readdirSync9,
-  realpathSync as realpathSync6,
+  realpathSync as realpathSync7,
   renameSync as renameSync4,
   rmSync as rmSync2,
   statSync as statSync8,
   writeFileSync as writeFileSync6
 } from "fs";
-import { basename as basename8, dirname as dirname16, isAbsolute as isAbsolute16, join as join24, normalize as normalize2, relative as relative5, resolve as resolve15, sep as sep6 } from "path";
+import { basename as basename9, dirname as dirname17, isAbsolute as isAbsolute16, join as join25, normalize as normalize2, relative as relative5, resolve as resolve16, sep as sep7 } from "path";
 
 // src/lib/registry-data/index.ts
 var SKILLS = [];
@@ -41834,7 +42155,7 @@ function validatePortableManifestContract(manifest, options = {}) {
 function validateRuntimeContract(manifest, issues, strict) {
   const runtime = manifest.runtime;
   if (runtime === undefined) {
-    if (strict) {
+    if (strict && manifest.kind !== "instruction") {
       add2(issues, "contract.runtime_missing", "runtime contract is required: { runtime, entrypoint?, timeout?, needs_network?, env?, sandbox?, system_deps?, artifacts? }");
     }
     return;
@@ -42021,7 +42342,6 @@ function createInstructionManifest(name, options) {
     kind: "instruction",
     inputs: [],
     commands: [],
-    runtime: defaultRuntimeContract(),
     provenance: defaultProvenance()
   };
 }
@@ -42090,7 +42410,7 @@ function fillContractDefaults(manifest, entrypoint) {
   return {
     ...manifest,
     standard: PORTABLE_SKILL_STANDARD,
-    runtime: manifest.runtime ?? defaultRuntimeContract(resolvedEntrypoint),
+    ...manifest.kind === "instruction" ? {} : { runtime: manifest.runtime ?? defaultRuntimeContract(resolvedEntrypoint) },
     provenance: {
       ...defaultProvenance(),
       ...manifest.provenance ?? {}
@@ -42552,6 +42872,103 @@ function displayName(name) {
 function escapeJsString(value) {
   return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\r?\n/g, " ");
 }
+
+// src/lib/authoring-path.ts
+import { lstatSync as lstatSync20, realpathSync as realpathSync6 } from "fs";
+import { homedir as homedir4 } from "os";
+import { basename as basename8, dirname as dirname16, join as join24, resolve as resolve15, sep as sep6 } from "path";
+var NATIVE_DISCOVERY_ROOTS = NATIVE_SKILL_ROOTS.map(([, path]) => path.split("/"));
+function pathParts(path) {
+  return resolve15(path).split(sep6).filter(Boolean);
+}
+function nativeRootMatch(path) {
+  const parts = pathParts(path);
+  for (let start = 0;start < parts.length; start += 1) {
+    for (const root2 of NATIVE_DISCOVERY_ROOTS) {
+      if (root2.every((part, offset) => parts[start + offset] === part)) {
+        return root2.join("/");
+      }
+    }
+  }
+  return;
+}
+function physicalPath(path) {
+  let cursor = resolve15(path);
+  const suffix = [];
+  while (!lstatSync20(cursor, { throwIfNoEntry: false })) {
+    suffix.unshift(basename8(cursor));
+    const parent = dirname16(cursor);
+    if (parent === cursor)
+      return resolve15(path);
+    cursor = parent;
+  }
+  return resolve15(realpathSync6(cursor), ...suffix);
+}
+function contains(root2, path) {
+  return path === root2 || path.startsWith(root2 + sep6);
+}
+function configuredRoots(home, explicitHome) {
+  const homeData = join24(home, ".hasna", "skills");
+  const homePolicy = readManagedSkillPolicySnapshot(homeData);
+  const configuredPolicy = !explicitHome && resolve15(getDataDirReadOnly()) !== resolve15(homeData) ? readManagedSkillPolicySnapshot(getDataDirReadOnly()) : null;
+  const policy = homePolicy ?? configuredPolicy;
+  const bridge = policy?.value.bridge;
+  if (bridge && (typeof bridge.home !== "string" || physicalPath(bridge.home) !== physicalPath(home))) {
+    throw new Error("Native discovery policy belongs to a different home; refusing portable authoring");
+  }
+  const roots = [];
+  const admitBinding = (binding) => {
+    if (!INTEGRATION_AGENTS.includes(binding.agent) || !binding.sources.some((source) => source.path === physicalPath(agentDiscoveryConfigPath(home, binding.agent)))) {
+      throw new Error("Native discovery policy does not bind the current account configuration");
+    }
+    verifyAgentDiscovery(binding);
+    roots.push(...binding.roots);
+  };
+  if (homePolicy && configuredPolicy?.value.bridge) {
+    if (physicalPath(configuredPolicy.value.bridge.home) !== physicalPath(home))
+      throw new Error("Native discovery policy belongs to a different home; refusing portable authoring");
+    for (const binding of Object.values(configuredPolicy.value.bridge.discovery ?? {})) {
+      admitBinding(binding);
+    }
+  }
+  for (const agent of INTEGRATION_AGENTS) {
+    const binding = bridge?.discovery?.[agent];
+    if (binding !== undefined) {
+      if (binding.agent !== agent)
+        throw new Error("Invalid native discovery policy binding");
+      admitBinding(binding);
+      continue;
+    }
+    const nativeHome = join24(home, agent === "opencode" ? ".config/opencode" : `.${agent}`);
+    if (!lstatSync20(nativeHome, { throwIfNoEntry: false }))
+      continue;
+    roots.push(...resolveAgentDiscovery({ home, agent, canonical: physicalPath }).roots);
+  }
+  return roots;
+}
+function assertPortableAuthoringPath(path, options = {}) {
+  if (typeof path !== "string" || !path || path.includes("\x00"))
+    throw new Error("Invalid portable authoring path");
+  const lexical = resolve15(path);
+  const physical = physicalPath(lexical);
+  const candidates = [lexical, physical];
+  let native = candidates.map(nativeRootMatch).find(Boolean);
+  const home = resolve15(options.homeDir ?? homedir4());
+  const defaults = NATIVE_DISCOVERY_ROOTS.map((parts) => join24(home, ...parts));
+  defaults.push(join24(home, ".codex/plugins/cache"), join24(home, ".claude/plugins/cache"), join24(home, ".claude/plugins/synced"), join24(home, ".gemini/extensions"));
+  for (const root2 of defaults) {
+    if (candidates.some((candidate2) => contains(resolve15(root2), candidate2) || contains(physicalPath(root2), candidate2)))
+      native ??= root2;
+  }
+  if (native) {
+    throw new Error(`Refusing portable Skills authoring below native discovery root '${native}': ${lexical}. Set HASNA_SKILLS_DIR to a private authoring corpus outside native roots.`);
+  }
+  for (const root2 of configuredRoots(home, options.homeDir !== undefined)) {
+    if (candidates.some((candidate2) => contains(resolve15(root2), candidate2) || contains(physicalPath(root2), candidate2))) {
+      throw new Error(`Refusing portable Skills authoring below configured native discovery root: ${lexical}`);
+    }
+  }
+}
 // src/lib/portable-skills.ts
 function getPortableSkillsRoot(options = {}) {
   return resolvePortableSkillsRoot(options, true);
@@ -42559,15 +42976,15 @@ function getPortableSkillsRoot(options = {}) {
 function resolvePortableSkillsRoot(options, migrate) {
   if (options.rootDir)
     return options.rootDir;
-  const appDir = options.homeDir ? join24(options.homeDir, ".hasna", "skills") : migrate ? getDataDir() : getDataDirReadOnly();
-  const cache = join24(appDir, SKILLS_CACHE_DIRNAME);
+  const appDir = options.homeDir ? join25(options.homeDir, ".hasna", "skills") : migrate ? getDataDir() : getDataDirReadOnly();
+  const cache = join25(appDir, SKILLS_CACHE_DIRNAME);
   if (isOwnerLayoutMigrated(appDir) && safeIsDirectory(cache))
     return cache;
-  const installed = join24(appDir, INSTALLED_SKILLS_DIRNAME);
+  const installed = join25(appDir, INSTALLED_SKILLS_DIRNAME);
   return installed;
 }
 function getPortableSkillPath(name, options = {}) {
-  return join24(getPortableSkillsRoot(options), normalizePortableSkillName(name));
+  return join25(getPortableSkillsRoot(options), normalizePortableSkillName(name));
 }
 function findPortableSkill(name, options = {}) {
   let normalized;
@@ -42593,7 +43010,7 @@ function listPortableSkills(options = {}) {
   for (const entry of readdirSync9(root2).sort()) {
     if (entry.startsWith("."))
       continue;
-    const path = join24(root2, entry);
+    const path = join25(root2, entry);
     if (!safeIsDirectory(path))
       continue;
     try {
@@ -42626,8 +43043,11 @@ function isOfficialSkillName(name) {
 }
 function scaffoldPortableSkill(name, options = {}) {
   const skillName = normalizeNewPortableSkillName(name);
+  const readOnlyRoot = resolvePortableSkillsRoot(options, false);
+  assertPortableAuthoringPath(join25(readOnlyRoot, skillName), options);
   const root2 = getPortableSkillsRoot(options);
-  const skillPath = join24(root2, skillName);
+  const skillPath = join25(root2, skillName);
+  assertPortableAuthoringPath(skillPath, options);
   if (existsSync9(skillPath)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${skillPath}`);
@@ -42660,7 +43080,7 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   const skipped = [];
   const entries = readdirSync9(absoluteSource, { withFileTypes: true }).map((entry) => entry.name).filter((entryName) => !entryName.startsWith(".")).sort();
   for (const entryName of entries) {
-    const childPath = join24(absoluteSource, entryName);
+    const childPath = join25(absoluteSource, entryName);
     if (!safeIsDirectory(childPath))
       continue;
     if (!isSkillCandidate(childPath)) {
@@ -42689,25 +43109,25 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   };
 }
 function isSkillCandidate(dir) {
-  return existsSync9(join24(dir, "SKILL.md")) || existsSync9(join24(dir, "skill.json")) || existsSync9(join24(dir, "package.json"));
+  return existsSync9(join25(dir, "SKILL.md")) || existsSync9(join25(dir, "skill.json")) || existsSync9(join25(dir, "package.json"));
 }
 function physicalImportPath(path) {
-  let ancestor = resolve15(path);
+  let ancestor = resolve16(path);
   const suffix = [];
   while (!existsSync9(ancestor)) {
-    suffix.unshift(basename8(ancestor));
-    ancestor = dirname16(ancestor);
+    suffix.unshift(basename9(ancestor));
+    ancestor = dirname17(ancestor);
   }
-  return join24(realpathSync6(ancestor), ...suffix);
+  return join25(realpathSync7(ancestor), ...suffix);
 }
 function assertDisjointImportPaths(source, destination) {
-  const sourcePath = realpathSync6(source);
+  const sourcePath = realpathSync7(source);
   const destinationPath = physicalImportPath(destination);
-  const contains = (parent, child) => {
+  const contains2 = (parent, child) => {
     const path = relative5(parent, child);
-    return path === "" || !isAbsolute16(path) && path !== ".." && !path.startsWith(`..${sep6}`);
+    return path === "" || !isAbsolute16(path) && path !== ".." && !path.startsWith(`..${sep7}`);
   };
-  if (contains(sourcePath, destinationPath) || contains(destinationPath, sourcePath)) {
+  if (contains2(sourcePath, destinationPath) || contains2(destinationPath, sourcePath)) {
     throw new Error("Source and destination skill directories must not overlap");
   }
 }
@@ -42720,20 +43140,23 @@ function portPortableSkill(sourcePath, options = {}) {
   const explicitName = options.name != null;
   const skillName = normalizeNewPortableSkillName(options.name ?? inferred.name);
   if (isOfficialSkillName(skillName) && !options.allowShadow) {
-    const sourceSlug = safeNormalizeName(basename8(absoluteSource));
-    const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename8(absoluteSource)}')` : ""} matches a bundled official skill.`;
+    const sourceSlug = safeNormalizeName(basename9(absoluteSource));
+    const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename9(absoluteSource)}')` : ""} matches a bundled official skill.`;
     throw new Error(`${via} Importing it would shadow the official '${skillName}'. ` + `Pass --name to choose a different name, or --allow-shadow to override deliberately.`);
   }
-  assertDisjointImportPaths(absoluteSource, join24(resolvePortableSkillsRoot(options, false), skillName));
+  const readOnlyDestination = join25(resolvePortableSkillsRoot(options, false), skillName);
+  assertPortableAuthoringPath(readOnlyDestination, options);
+  assertDisjointImportPaths(absoluteSource, readOnlyDestination);
   const root2 = getPortableSkillsRoot(options);
-  const destination = join24(root2, skillName);
+  const destination = join25(root2, skillName);
+  assertPortableAuthoringPath(destination, options);
   assertDisjointImportPaths(absoluteSource, destination);
   if (existsSync9(destination)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${destination}`);
     rmSync2(destination, { recursive: true, force: true });
   }
-  mkdirSync7(dirname16(destination), { recursive: true });
+  mkdirSync7(dirname17(destination), { recursive: true });
   copySkillDirectory(absoluteSource, destination);
   const base = {
     ...inferred,
@@ -42769,31 +43192,37 @@ function buildCorpusManifest(input, name) {
 }
 function writeCorpusSkill(input, options = {}) {
   const name = normalizePortableSkillName(input.name);
+  const readOnlyRoot = resolvePortableSkillsRoot(options, false);
+  assertPortableAuthoringPath(join25(readOnlyRoot, name), options);
   const root2 = getPortableSkillsRoot(options);
-  const skillPath = join24(root2, name);
+  const skillPath = join25(root2, name);
+  assertPortableAuthoringPath(skillPath, options);
   const created = !existsSync9(skillPath);
   mkdirSync7(skillPath, { recursive: true });
-  writeFileSync6(join24(skillPath, "SKILL.md"), input.skillMd);
+  writeFileSync6(join25(skillPath, "SKILL.md"), input.skillMd);
   const manifest = buildCorpusManifest(input, name);
   writeSkillJsonWithHash(skillPath, manifest);
   return { name, path: skillPath, manifest, created };
 }
 function installCorpusSkillAtomically(input, options = {}) {
   const name = normalizePortableSkillName(input.name);
+  const readOnlyRoot = resolvePortableSkillsRoot(options, false);
+  assertPortableAuthoringPath(join25(readOnlyRoot, name), options);
   const root2 = getPortableSkillsRoot(options);
-  const target = join24(root2, name);
+  const target = join25(root2, name);
+  assertPortableAuthoringPath(target, options);
   const created = !existsSync9(target);
   mkdirSync7(root2, { recursive: true });
-  const staging = mkdtempSync(join24(root2, `.pull-${name}-`));
+  const staging = mkdtempSync(join25(root2, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
-    writeFileSync6(join24(staging, "SKILL.md"), input.skillMd);
+    writeFileSync6(join25(staging, "SKILL.md"), input.skillMd);
     const manifest = buildCorpusManifest(input, name);
     writeSkillJsonWithHash(staging, manifest);
     if (existsSync9(target)) {
-      backup = mkdtempSync(join24(root2, `.pull-backup-${name}-`));
-      renameSync4(target, join24(backup, name));
+      backup = mkdtempSync(join25(root2, `.pull-backup-${name}-`));
+      renameSync4(target, join25(backup, name));
       moved = true;
     }
     renameSync4(staging, target);
@@ -42802,9 +43231,9 @@ function installCorpusSkillAtomically(input, options = {}) {
     return { name, path: target, manifest, created };
   } catch (error) {
     rmSync2(staging, { recursive: true, force: true });
-    if (moved && backup && existsSync9(join24(backup, name))) {
+    if (moved && backup && existsSync9(join25(backup, name))) {
       try {
-        renameSync4(join24(backup, name), target);
+        renameSync4(join25(backup, name), target);
       } catch {}
     }
     throw error;
@@ -42817,8 +43246,8 @@ function validatePortableSkillDirectory(name, skillPath) {
   const warnings = [...base.warnings];
   let manifest;
   if (existsSync9(skillPath)) {
-    const skillJsonPath = join24(skillPath, "skill.json");
-    const skillMdPath = join24(skillPath, "SKILL.md");
+    const skillJsonPath = join25(skillPath, "skill.json");
+    const skillMdPath = join25(skillPath, "SKILL.md");
     if (!existsSync9(skillJsonPath) && !existsSync9(skillMdPath)) {
       add3(issues, "portable.manifest_missing", "Missing portable manifest: expected SKILL.md frontmatter and/or skill.json");
     }
@@ -42838,7 +43267,7 @@ function validatePortableSkillDirectory(name, skillPath) {
         add3(issues, "portable.version_missing", "Portable manifest missing version");
       }
       const contractIssues = validatePortableManifestContract(manifest, {
-        strict: existsSync9(join24(skillPath, "skill.json")),
+        strict: existsSync9(join25(skillPath, "skill.json")),
         skillPath
       });
       for (const issue of contractIssues)
@@ -42878,7 +43307,7 @@ function validatePortableSkillDirectory(name, skillPath) {
               add3(issues, "portable.command_entry_unsafe", `Command '${command.name}' entry '${command.entry}' must stay inside the skill directory`);
               continue;
             }
-            const entryPath = join24(skillPath, command.entry);
+            const entryPath = join25(skillPath, command.entry);
             if (!existsSync9(entryPath))
               add3(issues, "portable.command_entry_missing", `Command '${command.name}' entry '${command.entry}' is missing`);
             else if (statSync8(entryPath).isDirectory())
@@ -42889,7 +43318,7 @@ function validatePortableSkillDirectory(name, skillPath) {
     } catch (error) {
       add3(issues, "portable.manifest_invalid", error.message);
     }
-    if (manifest?.kind !== "instruction" && !existsSync9(join24(skillPath, "AGENTS.md"))) {
+    if (manifest?.kind !== "instruction" && !existsSync9(join25(skillPath, "AGENTS.md"))) {
       add3(issues, "portable.agents_missing", "Missing AGENTS.md with build-out instructions for coding agents");
     }
   }
@@ -42925,12 +43354,12 @@ async function runPortableSkill(name, args, options = {}) {
   if (!isSafeRelativePath2(command.entry)) {
     return { exitCode: 1, error: `Portable skill '${name}' command entry is unsafe` };
   }
-  const entryPath = join24(skill.path, command.entry);
+  const entryPath = join25(skill.path, command.entry);
   if (!existsSync9(entryPath)) {
     return { exitCode: 1, error: `Entry point '${command.entry}' not found in portable skill '${name}'` };
   }
-  const pkgPath = join24(skill.path, "package.json");
-  const nodeModules = join24(skill.path, "node_modules");
+  const pkgPath = join25(skill.path, "package.json");
+  const nodeModules = join25(skill.path, "node_modules");
   if (existsSync9(pkgPath) && !existsSync9(nodeModules) && hasPackageDependencies(pkgPath)) {
     const install = Bun.spawn(["bun", "install", "--no-save"], {
       cwd: skill.path,
@@ -43002,9 +43431,9 @@ function isSkillsOwnershipMarker(marker) {
   return typeof marker === "object" && marker !== null && Object.hasOwn(marker, "managedBy") && marker.managedBy === SYNC_MARKER_MANAGED_BY;
 }
 function hasSkillsOwnershipMarker(dir) {
-  const path = join25(dir, SYNC_MARKER_FILE);
+  const path = join26(dir, SYNC_MARKER_FILE);
   try {
-    if (!lstatSync20(path).isFile())
+    if (!lstatSync21(path).isFile())
       return false;
     const marker = JSON.parse(readFileSync16(path, "utf8"));
     return isSkillsOwnershipMarker(marker);
@@ -43023,12 +43452,12 @@ function resolveSyncAgents(arg) {
   }
   return [arg];
 }
-function agentGlobalSkillsDir(agent, homeDir3 = homedir4()) {
+function agentGlobalSkillsDir(agent, homeDir3 = homedir5()) {
   switch (agent) {
     case "opencode":
-      return join25(homeDir3, ".config", "opencode", "skills");
+      return join26(homeDir3, ".config", "opencode", "skills");
     default:
-      return join25(homeDir3, `.${agent}`, "skills");
+      return join26(homeDir3, `.${agent}`, "skills");
   }
 }
 function adaptSkillMdForAgent(skillMd, agent) {
@@ -43087,7 +43516,7 @@ function resolveSyncCorpus(options = {}) {
 function packageSourceRoots(source) {
   const roots = [];
   for (const sub of ["skills"]) {
-    const candidate2 = join25(source, sub);
+    const candidate2 = join26(source, sub);
     if (existsSync10(candidate2) && isDirectory(candidate2))
       roots.push(candidate2);
   }
@@ -43103,10 +43532,10 @@ function containsSkillDirectories(path) {
     return false;
   }
   return entries.some((entry) => {
-    const candidate2 = join25(path, entry);
+    const candidate2 = join26(path, entry);
     if (!isDirectory(candidate2))
       return false;
-    return existsSync10(join25(candidate2, "SKILL.md")) || existsSync10(join25(candidate2, "skill.json")) || existsSync10(join25(candidate2, "package.json"));
+    return existsSync10(join26(candidate2, "SKILL.md")) || existsSync10(join26(candidate2, "skill.json")) || existsSync10(join26(candidate2, "package.json"));
   });
 }
 function isDirectory(path) {
@@ -43120,7 +43549,7 @@ function syncSkillsToAgents(options = {}) {
   assertNativeExportAllowed();
   const requested = normalizeRequested(options.names);
   const agents = options.agents?.length ? options.agents : [...SYNC_AGENTS];
-  const homeDir3 = options.homeDir ?? homedir4();
+  const homeDir3 = options.homeDir ?? homedir5();
   const { roots, source } = resolveSyncCorpus(options);
   const corpus = listPortableSkillsAcrossRoots(roots);
   const byName = new Map(corpus.map((skill) => [skill.name, skill]));
@@ -43146,7 +43575,7 @@ function syncSkillsToAgents(options = {}) {
         actions.push({
           skill: name,
           agent,
-          path: join25(agentGlobalSkillsDir(agent, homeDir3), name, "SKILL.md"),
+          path: join26(agentGlobalSkillsDir(agent, homeDir3), name, "SKILL.md"),
           action: "skip",
           reason: "not found in this machine's corpus"
         });
@@ -43175,8 +43604,8 @@ function syncSkillsToAgents(options = {}) {
   return { actions };
 }
 function writeManagedAgentSkill(params) {
-  const homeDir3 = params.homeDir ?? homedir4();
-  const dir = join25(agentGlobalSkillsDir(params.agent, homeDir3), params.skill);
+  const homeDir3 = params.homeDir ?? homedir5();
+  const dir = join26(agentGlobalSkillsDir(params.agent, homeDir3), params.skill);
   const result = writeManagedSkillDir(dir, params.skillMd, {
     skill: params.skill,
     source: params.source,
@@ -43193,8 +43622,8 @@ function writeManagedAgentSkill(params) {
   };
 }
 function writeManagedSkillDir(dir, skillMd, options) {
-  const skillMdPath = join25(dir, "SKILL.md");
-  const markerPath = join25(dir, SYNC_MARKER_FILE);
+  const skillMdPath = join26(dir, "SKILL.md");
+  const markerPath = join26(dir, SYNC_MARKER_FILE);
   const dirExists = existsSync10(dir);
   const managed = hasSkillsOwnershipMarker(dir);
   const hasSkillMd = existsSync10(skillMdPath);
@@ -43230,13 +43659,13 @@ function writeManagedSkillDir(dir, skillMd, options) {
   const action = dirExists ? "update" : "create";
   if (options.dryRun)
     return { action, path: skillMdPath };
-  const parentDir = dirname17(dir);
+  const parentDir = dirname18(dir);
   mkdirSync8(parentDir, { recursive: true });
-  const transactionDir = mkdtempSync2(join25(parentDir, `.hasna-skills-write-${basename9(dir)}-`));
-  const candidateDir = join25(transactionDir, "candidate");
-  const backupDir = join25(transactionDir, "backup");
-  const candidateSkillMdPath = join25(candidateDir, "SKILL.md");
-  const candidateMarkerPath = join25(candidateDir, SYNC_MARKER_FILE);
+  const transactionDir = mkdtempSync2(join26(parentDir, `.hasna-skills-write-${basename10(dir)}-`));
+  const candidateDir = join26(transactionDir, "candidate");
+  const backupDir = join26(transactionDir, "backup");
+  const candidateSkillMdPath = join26(candidateDir, "SKILL.md");
+  const candidateMarkerPath = join26(candidateDir, SYNC_MARKER_FILE);
   const marker = {
     managedBy: SYNC_MARKER_MANAGED_BY,
     skill: options.skill,
@@ -43284,8 +43713,8 @@ function writeManagedSkillDir(dir, skillMd, options) {
   }
   return { action, path: skillMdPath };
 }
-function removeManagedAgentSkill(skill, agent, homeDir3 = homedir4()) {
-  const dir = join25(agentGlobalSkillsDir(agent, homeDir3), skill);
+function removeManagedAgentSkill(skill, agent, homeDir3 = homedir5()) {
+  const dir = join26(agentGlobalSkillsDir(agent, homeDir3), skill);
   if (!hasSkillsOwnershipMarker(dir))
     return false;
   rmSync3(dir, { recursive: true, force: true });
@@ -43293,7 +43722,7 @@ function removeManagedAgentSkill(skill, agent, homeDir3 = homedir4()) {
 }
 function sourceSkillMd(skillPath, name, description, kind, preferBundledDocs = false) {
   if (kind === undefined || kind === "instruction" || preferBundledDocs) {
-    const skillMdPath = join25(skillPath, "SKILL.md");
+    const skillMdPath = join26(skillPath, "SKILL.md");
     if (existsSync10(skillMdPath))
       return readFileSync16(skillMdPath, "utf-8");
   }
@@ -43326,7 +43755,7 @@ function normalizeSkillName(name) {
 
 // src/lib/registry.ts
 import { existsSync as existsSync11, readFileSync as readFileSync17, readdirSync as readdirSync11 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 
 // src/lib/registry-merge.ts
 var SKILL_SOURCE_PRECEDENCE = {
@@ -43536,7 +43965,7 @@ function discoverSkillsInDir(dir, source = "custom") {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillMdPath = join26(dir, entry.name, "SKILL.md");
+      const skillMdPath = join27(dir, entry.name, "SKILL.md");
       if (!existsSync11(skillMdPath))
         continue;
       let content;
@@ -43556,7 +43985,7 @@ function discoverSkillsInDir(dir, source = "custom") {
         category: fm.category || "Development Tools",
         tags: fm.tags || [],
         ...fm.kind ? { kind: fm.kind } : {},
-        ...isHostedMetadataSkillDir(join26(dir, entry.name)) ? { serverOwned: true } : {},
+        ...isHostedMetadataSkillDir(join27(dir, entry.name)) ? { serverOwned: true } : {},
         source
       });
     }
@@ -43572,8 +44001,8 @@ function findExtensionSkillPath(name) {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillDir = join26(config.extensionsDir, entry.name);
-      const skillMdPath = join26(skillDir, "SKILL.md");
+      const skillDir = join27(config.extensionsDir, entry.name);
+      const skillMdPath = join27(skillDir, "SKILL.md");
       if (!existsSync11(skillMdPath))
         continue;
       let content;
@@ -43644,7 +44073,7 @@ function getAllTags() {
 
 // src/lib/project-state.ts
 import { existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync18, writeFileSync as writeFileSync8 } from "fs";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 var VALID_PIN_SOURCES = [
   "official",
   "custom",
@@ -43659,10 +44088,10 @@ var SKILLS_PROJECT_DIR = ".skills";
 var PROJECT_CONFIG_FILE = "project.json";
 var DEFAULT_EXPORT_DIR = ".skills/exports";
 function getProjectStateDir(targetDir = process.cwd()) {
-  return join27(targetDir, SKILLS_PROJECT_DIR);
+  return join28(targetDir, SKILLS_PROJECT_DIR);
 }
 function getProjectConfigPath(targetDir = process.cwd()) {
-  return join27(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
+  return join28(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
 }
 function loadProjectConfig(targetDir = process.cwd()) {
   const path = getProjectConfigPath(targetDir);
@@ -43791,7 +44220,7 @@ function getSkillPath(name) {
   const extensionPath = findExtensionSkillPath(skillName);
   if (extensionPath)
     return extensionPath;
-  return join28(getPortableSkillsRoot(), skillName);
+  return join29(getPortableSkillsRoot(), skillName);
 }
 function getCanonicalSkillName(name) {
   return getSkill(name)?.name ?? resolveSkillAlias(normalizeSkillSlug(name));
@@ -43854,7 +44283,7 @@ function createLocalSkillManifest(name, generateSkillMd) {
   if (!existsSync13(sourcePath))
     return null;
   let skillMd = "";
-  const skillMdPath = join28(sourcePath, "SKILL.md");
+  const skillMdPath = join29(sourcePath, "SKILL.md");
   if (existsSync13(skillMdPath)) {
     skillMd = readFileSync19(skillMdPath, "utf-8");
   } else if (generateSkillMd) {
@@ -43928,16 +44357,16 @@ function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const base = projectDir || process.cwd();
   switch (agent) {
     case "pi":
-      return scope === "project" ? join28(base, ".pi", "skills") : join28(homedir5(), ".pi", "agent", "skills");
+      return scope === "project" ? join29(base, ".pi", "skills") : join29(homedir6(), ".pi", "agent", "skills");
     case "opencode":
-      return scope === "project" ? join28(base, ".opencode", "skills") : join28(homedir5(), ".config", "opencode", "skills");
+      return scope === "project" ? join29(base, ".opencode", "skills") : join29(homedir6(), ".config", "opencode", "skills");
     default:
-      return scope === "project" ? join28(base, `.${agent}`, "skills") : join28(homedir5(), `.${agent}`, "skills");
+      return scope === "project" ? join29(base, `.${agent}`, "skills") : join29(homedir6(), `.${agent}`, "skills");
   }
 }
 function getAgentSkillPath(name, agent, scope = "global", projectDir) {
   const skillName = normalizeSkillName(getCanonicalSkillName(name));
-  return join28(getAgentSkillsDir(agent, scope, projectDir), skillName);
+  return join29(getAgentSkillsDir(agent, scope, projectDir), skillName);
 }
 function installSkillForAgent(name, options, generateSkillMd) {
   assertNativeExportAllowed();
@@ -43973,7 +44402,7 @@ function removeSkillForAgent(name, options) {
 }
 function resolveAgentSkillMd(name, generateSkillMd) {
   const sourcePath = getSkillPath(name);
-  const skillMdPath = join28(sourcePath, "SKILL.md");
+  const skillMdPath = join29(sourcePath, "SKILL.md");
   if (existsSync13(skillMdPath))
     return readFileSync19(skillMdPath, "utf-8");
   if (generateSkillMd)
@@ -44008,7 +44437,7 @@ function generateMinimalSkillMd(name) {
     "---",
     ""
   ].filter(Boolean);
-  const fallbackDoc = readFileIfExists(join28(sourcePath, "README.md")) || readFileIfExists(join28(sourcePath, "CLAUDE.md"));
+  const fallbackDoc = readFileIfExists(join29(sourcePath, "README.md")) || readFileIfExists(join29(sourcePath, "CLAUDE.md"));
   if (fallbackDoc)
     return `${frontmatter.join(`
 `)}${fallbackDoc.trim()}
@@ -44027,7 +44456,7 @@ skills run ${canonicalName}
 `;
 }
 function readBundledSkillVersion(name) {
-  const pkgPath = join28(getSkillPath(name), "package.json");
+  const pkgPath = join29(getSkillPath(name), "package.json");
   if (!existsSync13(pkgPath))
     return "unknown";
   try {
@@ -44082,7 +44511,7 @@ function selectSkillDoc(docs, file) {
 function isInstructionSkillDir(skillPath, meta) {
   if (meta?.kind === "instruction")
     return true;
-  const skillMdPath = join29(skillPath, "SKILL.md");
+  const skillMdPath = join30(skillPath, "SKILL.md");
   if (!existsSync14(skillMdPath))
     return false;
   try {
@@ -44112,9 +44541,9 @@ function getSkillDocs(name) {
   if (!existsSync14(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join29(skillPath, "SKILL.md")),
-    readme: readIfExists(join29(skillPath, "README.md")),
-    claudeMd: readIfExists(join29(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join30(skillPath, "SKILL.md")),
+    readme: readIfExists(join30(skillPath, "README.md")),
+    claudeMd: readIfExists(join30(skillPath, "CLAUDE.md"))
   };
 }
 function getSkillBestDoc(name, file) {
@@ -44130,14 +44559,14 @@ function getSkillRequirements(name) {
     return null;
   const texts = [];
   for (const file of ["SKILL.md", "README.md", "CLAUDE.md", ".env.example", ".env.local.example"]) {
-    const content = readIfExists(join29(skillPath, file));
+    const content = readIfExists(join30(skillPath, file));
     if (content)
       texts.push(content);
   }
   const meta = getSkill(name);
   let dependencies = {};
   try {
-    dependencies = JSON.parse(readFileSync20(join29(skillPath, "package.json"), "utf8")).dependencies || {};
+    dependencies = JSON.parse(readFileSync20(join30(skillPath, "package.json"), "utf8")).dependencies || {};
   } catch {}
   return getSkillRequirementsFromContent(name, texts, dependencies, meta);
 }
@@ -44199,7 +44628,7 @@ async function runSkill(name, args, options = {}) {
       error: `Skill '${name}' is an instruction skill (kind: instruction) and is not runnable. Instruction skills are consumed by coding agents via SKILL.md, not executed with 'skills run'.`
     };
   }
-  const pkgPath = join29(skillPath, "package.json");
+  const pkgPath = join30(skillPath, "package.json");
   if (!existsSync14(pkgPath)) {
     return { exitCode: 1, error: `No package.json in skill '${name}'` };
   }
@@ -44219,12 +44648,12 @@ async function runSkill(name, args, options = {}) {
   } catch {
     return { exitCode: 1, error: `Failed to parse package.json for skill '${name}'` };
   }
-  const entryPath = join29(skillPath, entryPoint2);
+  const entryPath = join30(skillPath, entryPoint2);
   if (!existsSync14(entryPath)) {
     return { exitCode: 1, error: `Entry point '${entryPoint2}' not found in skill '${name}'` };
   }
   const env = { ...process.env, ...options.env };
-  if (!existsSync14(join29(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
+  if (!existsSync14(join30(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
     const failure = await prepareSkillDependencies(skillPath, env, options.preparationTimeoutMs);
     if (failure)
       return failure;
@@ -44302,10 +44731,10 @@ function generateSkillMd(name) {
     "---"
   ].join(`
 `);
-  const readme = readIfExists(join29(skillPath, "README.md"));
-  const claudeMd = readIfExists(join29(skillPath, "CLAUDE.md"));
+  const readme = readIfExists(join30(skillPath, "README.md"));
+  const claudeMd = readIfExists(join30(skillPath, "CLAUDE.md"));
   let cliCommand = null;
-  const pkgPath = join29(skillPath, "package.json");
+  const pkgPath = join30(skillPath, "package.json");
   if (existsSync14(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync20(pkgPath, "utf-8"));
@@ -44587,7 +45016,7 @@ async function executeSelectedLocal(selected, options = {}) {
         throw new SkillSelectionError("INVALID_SECRET_BINDINGS", "Explicit environment values must be bounded strings without NUL bytes.");
       secretEnv[name] = value;
     }
-  const runDirectory = mkdtempSync3(join30(tmpdir(), "skills-execution-"));
+  const runDirectory = mkdtempSync3(join31(tmpdir(), "skills-execution-"));
   const paths = new SkillEntryPaths;
   for (const entry of entries) {
     paths.add(entry.path, 100, () => {
@@ -44595,12 +45024,12 @@ async function executeSelectedLocal(selected, options = {}) {
     }, () => {
       throw new SkillSelectionError("INVALID_BUNDLE_PATH", "The execution bundle path exceeds its limit.");
     });
-    const destination = join30(runDirectory, entry.path);
-    mkdirSync10(dirname18(destination), { recursive: true, mode: 448 });
+    const destination = join31(runDirectory, entry.path);
+    mkdirSync10(dirname19(destination), { recursive: true, mode: 448 });
     writeFileSync9(destination, entry.bytes, { flag: "wx", mode: entry.mode & 511 });
   }
   env.SKILLS_INPUT_JSON = input;
-  env.SKILLS_WORKSPACE_DIR = resolve16(options.cwd ?? process.cwd());
+  env.SKILLS_WORKSPACE_DIR = resolve17(options.cwd ?? process.cwd());
   env.SKILLS_RUN_DIR = runDirectory;
   if (runtime.version) {
     const version = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], "--version"], runDirectory, env, "", Math.min(timeoutMs, 5000));
@@ -44613,7 +45042,7 @@ async function executeSelectedLocal(selected, options = {}) {
     const { authority: authority2, workspaceId, profileRevision, slug, version, bundleDigest } = selection2;
     const request2 = {
       selection: { authority: authority2, workspaceId, profileId, profileRevision, slug, version, bundleDigest },
-      consumer: { stationId: process.env.HASNA_STATION || stationHostname2(), workspaceDirectory: realpathSync7(options.cwd ?? process.cwd()) }
+      consumer: { stationId: process.env.HASNA_STATION || stationHostname2(), workspaceDirectory: realpathSync8(options.cwd ?? process.cwd()) }
     };
     const grant = await (options.resolveExecutionGrant ?? resolveExecutionGrant)(request2);
     if (!grant || !grantIdentifier(grant.policyRevision) || !grantIdentifier(grant.grantId))
@@ -44623,7 +45052,7 @@ async function executeSelectedLocal(selected, options = {}) {
   }
   if (bindings)
     secretEnv = await resolveSelectedSecrets(bindings, options.createSecretsClient);
-  const result = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], join30(runDirectory, declaredEntry), ...args], runDirectory, { ...env, ...secretEnv }, input, timeoutMs);
+  const result = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], join31(runDirectory, declaredEntry), ...args], runDirectory, { ...env, ...secretEnv }, input, timeoutMs);
   result.stdout = redactExecutionSecrets(result.stdout, secretEnv);
   result.stderr = redactExecutionSecrets(result.stderr, secretEnv);
   const receipt = {
@@ -44636,7 +45065,7 @@ async function executeSelectedLocal(selected, options = {}) {
     ...bindings ? { secretBinding: { schema: bindings.schema, selection: bindings.selection, consumer: bindings.consumer, secretsAuthority: bindings.secretsAuthority, bindings: bindings.bindings } } : {},
     ...result
   };
-  writeFileSync9(join30(runDirectory, ".execution-receipt.json"), JSON.stringify({ ...receipt, stdout: undefined, stderr: undefined }), { mode: 384 });
+  writeFileSync9(join31(runDirectory, ".execution-receipt.json"), JSON.stringify({ ...receipt, stdout: undefined, stderr: undefined }), { mode: 384 });
   return receipt;
 }
 async function subprocess(command, cwd, env, input, timeoutMs) {
@@ -45755,7 +46184,7 @@ var $resolveS3Config = resolveS3Config;
 // node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
 var import_core = __toESM(require_dist_cjs2(), 1);
 var import_client27 = __toESM(require_client(), 1);
-var import_config36 = __toESM(require_config(), 1);
+var import_config37 = __toESM(require_config(), 1);
 var import_endpoints5 = __toESM(require_endpoints(), 1);
 var import_event_streams2 = __toESM(require_event_streams(), 1);
 var import_protocols6 = __toESM(require_protocols(), 1);
@@ -53758,21 +54187,21 @@ var import_httpAuthSchemes3 = __toESM(require_httpAuthSchemes(), 1);
 
 // node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.js
 init_dist_es();
-var import_config34 = __toESM(require_config(), 1);
+var import_config35 = __toESM(require_config(), 1);
 
 // node_modules/@aws-sdk/credential-provider-node/dist-es/remoteProvider.js
-var import_config17 = __toESM(require_config(), 1);
+var import_config18 = __toESM(require_config(), 1);
 var ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
 var remoteProvider = async (init) => {
   const { ENV_CMDS_FULL_URI: ENV_CMDS_FULL_URI2, ENV_CMDS_RELATIVE_URI: ENV_CMDS_RELATIVE_URI2, fromContainerMetadata: fromContainerMetadata2, fromInstanceMetadata: fromInstanceMetadata2 } = await Promise.resolve().then(() => (init_dist_es2(), exports_dist_es2));
   if (process.env[ENV_CMDS_RELATIVE_URI2] || process.env[ENV_CMDS_FULL_URI2]) {
     init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromHttp/fromContainerMetadata");
     const { fromHttp: fromHttp2 } = await Promise.resolve().then(() => (init_dist_es3(), exports_dist_es3));
-    return import_config17.chain(fromHttp2(init), fromContainerMetadata2(init));
+    return import_config18.chain(fromHttp2(init), fromContainerMetadata2(init));
   }
   if (process.env[ENV_IMDS_DISABLED] && process.env[ENV_IMDS_DISABLED] !== "false") {
     return async () => {
-      throw new import_config17.CredentialsProviderError("EC2 Instance Metadata Service access disabled", { logger: init.logger });
+      throw new import_config18.CredentialsProviderError("EC2 Instance Metadata Service access disabled", { logger: init.logger });
     };
   }
   init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromInstanceMetadata");
@@ -53847,7 +54276,7 @@ var internalCreateChain = (providers) => async (awsIdentityProperties) => {
 var multipleCredentialSourceWarningEmitted = false;
 var defaultProvider = (init = {}) => memoizeChain([
   async () => {
-    const profile = init.profile ?? process.env[import_config34.ENV_PROFILE];
+    const profile = init.profile ?? process.env[import_config35.ENV_PROFILE];
     if (profile) {
       const envStaticCredentialsAreSet = process.env[ENV_KEY] && process.env[ENV_SECRET];
       if (envStaticCredentialsAreSet) {
@@ -53865,7 +54294,7 @@ var defaultProvider = (init = {}) => memoizeChain([
           multipleCredentialSourceWarningEmitted = true;
         }
       }
-      throw new import_config34.CredentialsProviderError("AWS_PROFILE is set, skipping fromEnv provider.", {
+      throw new import_config35.CredentialsProviderError("AWS_PROFILE is set, skipping fromEnv provider.", {
         logger: init.logger,
         tryNextLink: true
       });
@@ -53877,7 +54306,7 @@ var defaultProvider = (init = {}) => memoizeChain([
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromSSO");
     const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
     if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
-      throw new import_config34.CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).", { logger: init.logger });
+      throw new import_config35.CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).", { logger: init.logger });
     }
     const { fromSSO: fromSSO2 } = await Promise.resolve().then(() => (init_dist_es5(), exports_dist_es4));
     return fromSSO2(init)(awsIdentityProperties);
@@ -53902,7 +54331,7 @@ var defaultProvider = (init = {}) => memoizeChain([
     return (await remoteProvider(init))();
   },
   async () => {
-    throw new import_config34.CredentialsProviderError("Could not load credentials from any providers", {
+    throw new import_config35.CredentialsProviderError("Could not load credentials from any providers", {
       tryNextLink: false,
       logger: init.logger
     });
@@ -53912,7 +54341,7 @@ var credentialsTreatedAsExpired = (credentials) => credentials?.expiration !== u
 // node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var import_checksum2 = __toESM(require_checksum(), 1);
 var import_client23 = __toESM(require_client(), 1);
-var import_config35 = __toESM(require_config(), 1);
+var import_config36 = __toESM(require_config(), 1);
 var import_event_streams = __toESM(require_event_streams(), 1);
 var import_retry3 = __toESM(require_retry(), 1);
 var import_serde4 = __toESM(require_serde(), 1);
@@ -54202,7 +54631,7 @@ var getRuntimeConfig2 = (config) => {
 // node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var getRuntimeConfig3 = (config) => {
   import_client23.emitWarningIfUnsupportedVersion(process.version);
-  const defaultsMode = import_config35.resolveDefaultsModeConfig(config);
+  const defaultsMode = import_config36.resolveDefaultsModeConfig(config);
   const defaultConfigProvider = () => defaultsMode().then(import_client23.loadConfigsForDefaultMode);
   const clientSharedValues = getRuntimeConfig2(config);
   import_client22.emitWarningIfUnsupportedVersion(process.version);
@@ -54215,28 +54644,28 @@ var getRuntimeConfig3 = (config) => {
     ...config,
     runtime: "node",
     defaultsMode,
-    authSchemePreference: config?.authSchemePreference ?? import_config35.loadConfig(import_httpAuthSchemes3.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
+    authSchemePreference: config?.authSchemePreference ?? import_config36.loadConfig(import_httpAuthSchemes3.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde4.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
     defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client22.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default2.version }),
-    disableS3ExpressSessionAuth: config?.disableS3ExpressSessionAuth ?? import_config35.loadConfig($NODE_DISABLE_S3_EXPRESS_SESSION_AUTH_OPTIONS, loaderConfig),
+    disableS3ExpressSessionAuth: config?.disableS3ExpressSessionAuth ?? import_config36.loadConfig($NODE_DISABLE_S3_EXPRESS_SESSION_AUTH_OPTIONS, loaderConfig),
     eventStreamSerdeProvider: config?.eventStreamSerdeProvider ?? import_event_streams.eventStreamSerdeProvider,
-    maxAttempts: config?.maxAttempts ?? import_config35.loadConfig(import_retry3.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
-    region: config?.region ?? import_config35.loadConfig(import_config35.NODE_REGION_CONFIG_OPTIONS, { ...import_config35.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
-    requestChecksumCalculation: config?.requestChecksumCalculation ?? import_config35.loadConfig($NODE_REQUEST_CHECKSUM_CALCULATION_CONFIG_OPTIONS, loaderConfig),
+    maxAttempts: config?.maxAttempts ?? import_config36.loadConfig(import_retry3.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
+    region: config?.region ?? import_config36.loadConfig(import_config36.NODE_REGION_CONFIG_OPTIONS, { ...import_config36.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
+    requestChecksumCalculation: config?.requestChecksumCalculation ?? import_config36.loadConfig($NODE_REQUEST_CHECKSUM_CALCULATION_CONFIG_OPTIONS, loaderConfig),
     requestHandler: import_node_http_handler2.NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
-    responseChecksumValidation: config?.responseChecksumValidation ?? import_config35.loadConfig($NODE_RESPONSE_CHECKSUM_VALIDATION_CONFIG_OPTIONS, loaderConfig),
-    retryMode: config?.retryMode ?? import_config35.loadConfig({
+    responseChecksumValidation: config?.responseChecksumValidation ?? import_config36.loadConfig($NODE_RESPONSE_CHECKSUM_VALIDATION_CONFIG_OPTIONS, loaderConfig),
+    retryMode: config?.retryMode ?? import_config36.loadConfig({
       ...import_retry3.NODE_RETRY_MODE_CONFIG_OPTIONS,
       default: async () => (await defaultConfigProvider()).retryMode || import_retry3.DEFAULT_RETRY_MODE
     }, config),
-    sigv4aSigningRegionSet: config?.sigv4aSigningRegionSet ?? import_config35.loadConfig(import_httpAuthSchemes3.NODE_SIGV4A_CONFIG_OPTIONS, loaderConfig),
+    sigv4aSigningRegionSet: config?.sigv4aSigningRegionSet ?? import_config36.loadConfig(import_httpAuthSchemes3.NODE_SIGV4A_CONFIG_OPTIONS, loaderConfig),
     streamCollector: config?.streamCollector ?? import_node_http_handler2.streamCollector,
     streamHasher: config?.streamHasher ?? import_checksum2.readableStreamHasher,
-    useArnRegion: config?.useArnRegion ?? import_config35.loadConfig($NODE_USE_ARN_REGION_CONFIG_OPTIONS, loaderConfig),
-    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config35.loadConfig(import_config35.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    useFipsEndpoint: config?.useFipsEndpoint ?? import_config35.loadConfig(import_config35.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    userAgentAppId: config?.userAgentAppId ?? import_config35.loadConfig(import_client22.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    useArnRegion: config?.useArnRegion ?? import_config36.loadConfig($NODE_USE_ARN_REGION_CONFIG_OPTIONS, loaderConfig),
+    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config36.loadConfig(import_config36.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    useFipsEndpoint: config?.useFipsEndpoint ?? import_config36.loadConfig(import_config36.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    userAgentAppId: config?.userAgentAppId ?? import_config36.loadConfig(import_client22.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
   };
 };
 
@@ -54302,7 +54731,7 @@ class S3Client extends import_client27.Client {
     const _config_2 = import_client26.resolveUserAgentConfig(_config_1);
     const _config_3 = $resolveFlexibleChecksumsConfig(_config_2);
     const _config_4 = import_retry4.resolveRetryConfig(_config_3);
-    const _config_5 = import_config36.resolveRegionConfig(_config_4);
+    const _config_5 = import_config37.resolveRegionConfig(_config_4);
     const _config_6 = import_client26.resolveHostHeaderConfig(_config_5);
     const _config_7 = import_endpoints5.resolveEndpointConfig(_config_6);
     const _config_8 = import_event_streams2.resolveEventStreamSerdeConfig(_config_7);
@@ -54698,10 +55127,10 @@ function assertReservationCents(value, field2) {
 import { Database as Database2 } from "bun:sqlite";
 import { randomUUID as randomUUID8 } from "crypto";
 import { mkdirSync as mkdirSync12 } from "fs";
-import { dirname as dirname22 } from "path";
+import { dirname as dirname23 } from "path";
 
 // src/server/database-url.ts
-import { isAbsolute as isAbsolute17, join as join32 } from "path";
+import { isAbsolute as isAbsolute17, join as join33 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var DEFAULT_SQLITE_FILENAME2 = "server.db";
 var SQLITE_MEMORY_PATH = ":memory:";
@@ -54710,7 +55139,7 @@ var SQLITE_SCHEMES = new Set(["sqlite", "sqlite3", "file"]);
 var MEMORY_SCHEMES = new Set(["memory"]);
 var SQLITE_EXTENSIONS = [".db", ".sqlite", ".sqlite3", ".db3"];
 function defaultSqlitePath() {
-  return join32(getDataDir(), DEFAULT_SQLITE_FILENAME2);
+  return join33(getDataDir(), DEFAULT_SQLITE_FILENAME2);
 }
 function resolveDatabaseTarget(raw) {
   const value = raw?.trim();
@@ -54737,7 +55166,7 @@ function resolveDatabaseTarget(raw) {
     throw new Error(`unsupported database scheme "${scheme}:". Supported: postgres://, postgresql://, sqlite:, file:, ` + `an absolute or relative path to a .db/.sqlite file, ":memory:", or "memory:" (non-durable, tests only). ` + `Leave the setting empty to use the default SQLite database at ${defaultSqlitePath()}.`);
   }
   if (looksLikeSqlitePath(value)) {
-    const path = isAbsolute17(value) ? value : join32(process.cwd(), value);
+    const path = isAbsolute17(value) ? value : join33(process.cwd(), value);
     return { kind: "sqlite", path, durable: true, label: `sqlite (${path})` };
   }
   throw new Error(`could not resolve a database backend from "${value}". Use postgres://\u2026, sqlite:\u2026, an absolute or ` + `relative path ending in ${SQLITE_EXTENSIONS.join("/")}, ":memory:", or leave it empty for the ` + `default SQLite database at ${defaultSqlitePath()}.`);
@@ -54761,7 +55190,7 @@ function sqlitePathFromUrl(value, scheme) {
     }
     return rest.slice(2).replace(/^\/\/+/, "/");
   }
-  return isAbsolute17(rest) ? rest : join32(process.cwd(), rest);
+  return isAbsolute17(rest) ? rest : join33(process.cwd(), rest);
 }
 function looksLikeSqlitePath(value) {
   if (value.includes("/"))
@@ -54994,7 +55423,7 @@ class PostgresSkillSelectionStore {
 // src/server/sqlite-store.ts
 import { randomUUID as randomUUID7 } from "crypto";
 import { mkdirSync as mkdirSync11, readFileSync as readFileSync22, readdirSync as readdirSync12 } from "fs";
-import { dirname as dirname21, join as join34 } from "path";
+import { dirname as dirname22, join as join35 } from "path";
 
 // src/server/auth.ts
 import { createHash as createHash21 } from "crypto";
@@ -55028,24 +55457,24 @@ function publicPrincipal(partial = {}) {
 function permitsSkillsRoute(principal, method, resource) {
   const scopes = new Set(principal.scopes);
   if (resource === "execution-grants") {
-    const read3 = method === "GET" || method === "HEAD";
-    if (!read3 && method !== "POST" && !["owner", "admin"].includes(principal.role))
+    const read4 = method === "GET" || method === "HEAD";
+    if (!read4 && method !== "POST" && !["owner", "admin"].includes(principal.role))
       return false;
-    const allowed2 = read3 ? ["*", "execution-grants:*", "execution-grants:read"] : method === "POST" ? ["*", "execution-grants:*", "execution-grants:resolve", "skills:read", "skills:*"] : ["*", "execution-grants:*", "execution-grants:write"];
+    const allowed2 = read4 ? ["*", "execution-grants:*", "execution-grants:read"] : method === "POST" ? ["*", "execution-grants:*", "execution-grants:resolve", "skills:read", "skills:*"] : ["*", "execution-grants:*", "execution-grants:write"];
     return allowed2.some((scope) => scopes.has(scope));
   }
   if (scopes.has("*"))
     return true;
-  const read2 = method === "GET" || method === "HEAD";
-  if (resource === "capabilities" && read2)
+  const read3 = method === "GET" || method === "HEAD";
+  if (resource === "capabilities" && read3)
     return true;
   let allowed;
   if (resource === "runs" || resource === "executions") {
-    allowed = read2 ? ["runs:read", "runs:*", "skills:read", "skills:*"] : ["runs:write", "runs:*"];
+    allowed = read3 ? ["runs:read", "runs:*", "skills:read", "skills:*"] : ["runs:write", "runs:*"];
   } else if (resource === "stations") {
-    allowed = read2 ? ["stations:read", "stations:*", "skills:read", "skills:*"] : ["stations:write", "stations:*", "skills:*"];
+    allowed = read3 ? ["stations:read", "stations:*", "skills:read", "skills:*"] : ["stations:write", "stations:*", "skills:*"];
   } else if (["skills", "pins", "tags", "profiles", "capabilities"].includes(resource)) {
-    allowed = read2 ? ["skills:read", "skills:*"] : ["skills:write", "skills:publish", "skills:*"];
+    allowed = read3 ? ["skills:read", "skills:*"] : ["skills:write", "skills:publish", "skills:*"];
   } else
     return true;
   return allowed.some((scope) => scopes.has(scope));
@@ -55053,17 +55482,17 @@ function permitsSkillsRoute(principal, method, resource) {
 
 // src/server/migrations-dir.ts
 import { existsSync as existsSync15 } from "fs";
-import { dirname as dirname20, join as join33 } from "path";
+import { dirname as dirname21, join as join34 } from "path";
 var MIGRATION_DIALECTS = ["postgres", "sqlite"];
 var MAX_WALK_UP = 6;
 function findMigrationsRoot(startDirs = defaultStartDirs()) {
   for (const start of startDirs) {
     let dir = start;
     for (let level = 0;level < MAX_WALK_UP; level += 1) {
-      const candidate2 = join33(dir, "migrations");
-      if (MIGRATION_DIALECTS.some((dialect) => existsSync15(join33(candidate2, dialect))))
+      const candidate2 = join34(dir, "migrations");
+      if (MIGRATION_DIALECTS.some((dialect) => existsSync15(join34(candidate2, dialect))))
         return candidate2;
-      const parent = dirname20(dir);
+      const parent = dirname21(dir);
       if (parent === dir)
         break;
       dir = parent;
@@ -55075,7 +55504,7 @@ function resolveMigrationsDir(dialect, root4 = findMigrationsRoot()) {
   if (!root4) {
     throw new Error(`could not locate the migrations directory for dialect "${dialect}". ` + `Expected a migrations/${dialect}/ folder alongside the package root.`);
   }
-  const dir = join33(root4, dialect);
+  const dir = join34(root4, dialect);
   if (!existsSync15(dir)) {
     throw new Error(`migrations directory not found: ${dir}`);
   }
@@ -55177,6 +55606,18 @@ function rowToSkill(row) {
     ...row.replacement_slug ? { replacementSlug: String(row.replacement_slug) } : {}
   };
 }
+function rowToPublishedSelectionState(row) {
+  return {
+    slug: String(row.slug),
+    version: String(row.version),
+    current: row.skill_exists ? {
+      lifecycle: row.lifecycle === "archived" ? "archived" : "active",
+      ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {}
+    } : null,
+    versionBundleSha256: typeof row.bundle_sha256 === "string" ? row.bundle_sha256 : null,
+    bundleAvailable: Boolean(row.bundle_available)
+  };
+}
 function rowToPin(row) {
   return {
     orgId: String(row.org_id),
@@ -55356,7 +55797,7 @@ class SqliteSkillsStore {
   constructor(path = SQLITE_MEMORY_PATH, options = {}) {
     const inMemory = path === SQLITE_MEMORY_PATH;
     if (!inMemory)
-      mkdirSync11(dirname21(path), { recursive: true });
+      mkdirSync11(dirname22(path), { recursive: true });
     this.db = openDatabase(path);
     this.db.exec(`PRAGMA busy_timeout = ${Math.max(0, options.busyTimeoutMs ?? 5000)}`);
     if (!inMemory)
@@ -55951,6 +56392,22 @@ class SqliteSkillsStore {
     const row = this.get("SELECT * FROM skills_versions WHERE org_id = ? AND slug = ? AND version = ? LIMIT 1", [principal.orgId, slug, version2]);
     return row ? rowToSkillVersion(row) : null;
   }
+  async getPublishedSelectionStates(principal, selections2) {
+    if (selections2.length > MAX_PROFILE_SELECTIONS)
+      throw new RangeError("Published selection lookup exceeds the profile selection limit");
+    if (!selections2.length)
+      return [];
+    const requested = JSON.stringify(selections2.map(({ slug, version: version2 }) => ({ slug, version: version2 })));
+    return this.all(`SELECT json_extract(q.value, '$.slug') AS slug, json_extract(q.value, '$.version') AS version,
+         r.slug IS NOT NULL AS skill_exists, r.lifecycle, r.tombstoned_at,
+         v.bundle_sha256, b.sha256 IS NOT NULL AS bundle_available
+       FROM json_each(?) q
+       LEFT JOIN skills_registry r ON r.org_id = ? AND r.slug = json_extract(q.value, '$.slug')
+       LEFT JOIN skills_versions v ON v.org_id = ?
+         AND v.slug = json_extract(q.value, '$.slug') AND v.version = json_extract(q.value, '$.version')
+       LEFT JOIN skills_bundles b ON b.org_id = ? AND b.sha256 = v.bundle_sha256
+       ORDER BY CAST(q.key AS INTEGER)`, [requested, principal.orgId, principal.orgId, principal.orgId]).map(rowToPublishedSelectionState);
+  }
   async pinSkill(principal, slug, metadata = {}) {
     const row = this.get(`INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
        VALUES (?, ?, ?, ?, ?)
@@ -56019,7 +56476,7 @@ function applySqliteMigrations(db, migrationsDir = resolveMigrationsDir("sqlite"
   const appliedNow = [];
   for (const file of files) {
     const version2 = file.replace(/\.sql$/, "");
-    const text2 = readFileSync22(join34(migrationsDir, file), "utf8");
+    const text2 = readFileSync22(join35(migrationsDir, file), "utf8");
     const apply = db.transaction(() => {
       const already = db.query("SELECT 1 AS present FROM schema_migrations WHERE version = ? LIMIT 1").get(version2);
       if (already)
@@ -56166,7 +56623,7 @@ class SqliteGovernanceStore {
   closed = false;
   constructor(path = SQLITE_MEMORY_PATH, options = {}) {
     if (path !== SQLITE_MEMORY_PATH)
-      mkdirSync12(dirname22(path), { recursive: true });
+      mkdirSync12(dirname23(path), { recursive: true });
     this.db = new Database2(path, { create: true, readwrite: true });
     this.db.exec("PRAGMA busy_timeout = 5000");
     this.db.exec("PRAGMA foreign_keys = ON");
@@ -57079,16 +57536,21 @@ function selected(value) {
   return selections2;
 }
 async function validatePublished(store, principal, selections2) {
-  for (const selection2 of selections2) {
-    const current = await store.getSkill(principal, selection2.slug);
+  const states = await store.getPublishedSelectionStates(principal, selections2);
+  if (states.length !== selections2.length)
+    throw new SkillRequestError(503, "SELECTION_UNAVAILABLE", "Selected publication state is unavailable");
+  for (const [index, selection2] of selections2.entries()) {
+    const state2 = states[index];
+    if (!state2 || state2.slug !== selection2.slug || state2.version !== selection2.version)
+      throw new SkillRequestError(503, "SELECTION_UNAVAILABLE", "Selected publication state is unavailable");
+    const current = state2.current;
     if (!current || current.tombstonedAt)
       throw new SkillRequestError(current?.tombstonedAt ? 410 : 404, "SELECTION_UNAVAILABLE", `Selected skill '${selection2.slug}' is unavailable`);
     if (current.lifecycle === "archived")
       throw new SkillRequestError(409, "SELECTION_ARCHIVED", `Selected skill '${selection2.slug}' is archived`);
-    const version2 = await store.getSkillVersion(principal, selection2.slug, selection2.version);
-    if (!version2 || `sha256:${version2.bundleSha256}` !== selection2.bundleDigest)
+    if (!state2.versionBundleSha256 || `sha256:${state2.versionBundleSha256}` !== selection2.bundleDigest)
       throw new SkillRequestError(409, "SELECTION_VERSION_MISMATCH", `Selected version of '${selection2.slug}' does not match its published digest`);
-    if (!await store.getSkillBundle(principal, version2.bundleSha256))
+    if (!state2.bundleAvailable)
       throw new SkillRequestError(503, "SELECTION_BUNDLE_UNAVAILABLE", "Selected bundle is unavailable");
   }
 }
@@ -57254,7 +57716,7 @@ async function handleProfileApi(store, principal, request2, parts, config) {
 // src/server/runtime-store.ts
 import { Database as Database3 } from "bun:sqlite";
 import { mkdirSync as mkdirSync13 } from "fs";
-import { dirname as dirname23 } from "path";
+import { dirname as dirname24 } from "path";
 
 // src/sdk/execution/types.ts
 var EXECUTION_PROTOCOL_VERSION = REMOTE_SKILL_RUN_CONTRACT_VERSION;
@@ -57310,7 +57772,7 @@ class RuntimeExecutionStore {
     }
     const path = target.kind === "sqlite" ? target.path : ":memory:";
     if (path !== ":memory:")
-      mkdirSync13(dirname23(path), { recursive: true });
+      mkdirSync13(dirname24(path), { recursive: true });
     const db = new Database3(path);
     db.run("PRAGMA busy_timeout=5000");
     db.run("PRAGMA journal_mode=WAL");
@@ -58334,7 +58796,7 @@ function createReceiptService(store) {
 var import_client36 = __toESM(require_client2(), 1);
 var import_core2 = __toESM(require_dist_cjs2(), 1);
 var import_client37 = __toESM(require_client(), 1);
-var import_config39 = __toESM(require_config(), 1);
+var import_config40 = __toESM(require_config(), 1);
 var import_endpoints8 = __toESM(require_endpoints(), 1);
 var import_protocols10 = __toESM(require_protocols(), 1);
 var import_retry6 = __toESM(require_retry(), 1);
@@ -58473,7 +58935,7 @@ var package_default3 = {
 var import_client32 = __toESM(require_client2(), 1);
 var import_httpAuthSchemes6 = __toESM(require_httpAuthSchemes(), 1);
 var import_client33 = __toESM(require_client(), 1);
-var import_config38 = __toESM(require_config(), 1);
+var import_config39 = __toESM(require_config(), 1);
 var import_retry5 = __toESM(require_retry(), 1);
 var import_serde6 = __toESM(require_serde(), 1);
 var import_node_http_handler3 = __toESM(require_dist_cjs6(), 1);
@@ -61415,7 +61877,7 @@ var getRuntimeConfig4 = (config) => {
 // node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
 var getRuntimeConfig5 = (config) => {
   import_client33.emitWarningIfUnsupportedVersion(process.version);
-  const defaultsMode = import_config38.resolveDefaultsModeConfig(config);
+  const defaultsMode = import_config39.resolveDefaultsModeConfig(config);
   const defaultConfigProvider = () => defaultsMode().then(import_client33.loadConfigsForDefaultMode);
   const clientSharedValues = getRuntimeConfig4(config);
   import_client32.emitWarningIfUnsupportedVersion(process.version);
@@ -61428,21 +61890,21 @@ var getRuntimeConfig5 = (config) => {
     ...config,
     runtime: "node",
     defaultsMode,
-    authSchemePreference: config?.authSchemePreference ?? import_config38.loadConfig(import_httpAuthSchemes6.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
+    authSchemePreference: config?.authSchemePreference ?? import_config39.loadConfig(import_httpAuthSchemes6.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde6.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
     defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client32.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default3.version }),
-    maxAttempts: config?.maxAttempts ?? import_config38.loadConfig(import_retry5.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
-    region: config?.region ?? import_config38.loadConfig(import_config38.NODE_REGION_CONFIG_OPTIONS, { ...import_config38.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
+    maxAttempts: config?.maxAttempts ?? import_config39.loadConfig(import_retry5.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
+    region: config?.region ?? import_config39.loadConfig(import_config39.NODE_REGION_CONFIG_OPTIONS, { ...import_config39.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
     requestHandler: import_node_http_handler3.NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
-    retryMode: config?.retryMode ?? import_config38.loadConfig({
+    retryMode: config?.retryMode ?? import_config39.loadConfig({
       ...import_retry5.NODE_RETRY_MODE_CONFIG_OPTIONS,
       default: async () => (await defaultConfigProvider()).retryMode || import_retry5.DEFAULT_RETRY_MODE
     }, config),
     streamCollector: config?.streamCollector ?? import_node_http_handler3.streamCollector,
-    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config38.loadConfig(import_config38.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    useFipsEndpoint: config?.useFipsEndpoint ?? import_config38.loadConfig(import_config38.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    userAgentAppId: config?.userAgentAppId ?? import_config38.loadConfig(import_client32.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config39.loadConfig(import_config39.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    useFipsEndpoint: config?.useFipsEndpoint ?? import_config39.loadConfig(import_config39.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    userAgentAppId: config?.userAgentAppId ?? import_config39.loadConfig(import_client32.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
   };
 };
 
@@ -61507,7 +61969,7 @@ class ECSClient extends import_client37.Client {
     const _config_1 = resolveClientEndpointParameters3(_config_0);
     const _config_2 = import_client36.resolveUserAgentConfig(_config_1);
     const _config_3 = import_retry6.resolveRetryConfig(_config_2);
-    const _config_4 = import_config39.resolveRegionConfig(_config_3);
+    const _config_4 = import_config40.resolveRegionConfig(_config_3);
     const _config_5 = import_client36.resolveHostHeaderConfig(_config_4);
     const _config_6 = import_endpoints8.resolveEndpointConfig(_config_5);
     const _config_7 = resolveHttpAuthSchemeConfig3(_config_6);
@@ -62006,13 +62468,13 @@ async function inspectPureBundle(bytes, contract) {
     throw Error("Pure entrypoint integrity failed");
   if (entries.some((e5) => e5.path.split("/").includes("node_modules")))
     throw Error("Pure bundle cannot supply dependencies");
-  const read2 = (name) => {
+  const read3 = (name) => {
     const entry2 = entries.find((e5) => e5.path === name);
     if (!entry2)
       throw Error("Pure bundle manifest missing");
     return object5(uniqueJson(Buffer.from(entry2.bytes).toString("utf8")));
   };
-  const manifest = read2("skill.json"), runtime = object5(manifest.runtime), pkg = read2("package.json");
+  const manifest = read3("skill.json"), runtime = object5(manifest.runtime), pkg = read3("package.json");
   if (manifest.kind !== "executable" || runtime.runtime !== "bun" || runtime.entrypoint !== contract.entrypoint || !Array.isArray(runtime.env) || runtime.env.length !== 0 || runtime.system_deps !== undefined && (!Array.isArray(runtime.system_deps) || runtime.system_deps.length !== 0) || runtime.needs_network === true || manifest.needs_network === true)
     throw Error("Pure bundle requires a credential-free self-contained Bun entrypoint");
   for (const key of ["dependencies", "optionalDependencies", "peerDependencies", "devDependencies", "scripts"])
@@ -62977,6 +63439,25 @@ class MemorySkillsStore {
     const found = this.versions.get(versionKey(principal.orgId, slug, version2));
     return found && found.orgId === principal.orgId ? found : null;
   }
+  async getPublishedSelectionStates(principal, selections2) {
+    if (selections2.length > MAX_PROFILE_SELECTIONS)
+      throw new RangeError("Published selection lookup exceeds the profile selection limit");
+    return selections2.map(({ slug, version: version2 }) => {
+      const current = this.skills.get(skillKey(principal.orgId, slug));
+      const selectedVersion = this.versions.get(versionKey(principal.orgId, slug, version2));
+      const bundle2 = selectedVersion && this.bundles.get(skillKey(principal.orgId, selectedVersion.bundleSha256));
+      return {
+        slug,
+        version: version2,
+        current: current?.orgId === principal.orgId ? {
+          lifecycle: current.lifecycle,
+          ...current.tombstonedAt ? { tombstonedAt: current.tombstonedAt } : {}
+        } : null,
+        versionBundleSha256: selectedVersion?.orgId === principal.orgId ? selectedVersion.bundleSha256 : null,
+        bundleAvailable: bundle2?.orgId === principal.orgId
+      };
+    });
+  }
   async listSkills(principal) {
     return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt).sort((a4, b4) => a4.slug.localeCompare(b4.slug));
   }
@@ -63785,6 +64266,25 @@ class PostgresSkillsStore {
     `;
     return rows[0] ? rowToSkillVersion(rows[0]) : null;
   }
+  async getPublishedSelectionStates(principal, selections2) {
+    if (selections2.length > MAX_PROFILE_SELECTIONS)
+      throw new RangeError("Published selection lookup exceeds the profile selection limit");
+    if (!selections2.length)
+      return [];
+    const requested = JSON.stringify(selections2.map(({ slug, version: version2 }) => ({ slug, version: version2 })));
+    const rows = await this.sql`
+      SELECT q.value->>'slug' AS slug, q.value->>'version' AS version,
+        r.slug IS NOT NULL AS skill_exists, r.lifecycle, r.tombstoned_at,
+        v.bundle_sha256, b.sha256 IS NOT NULL AS bundle_available
+      FROM jsonb_array_elements(${requested}::text::jsonb) WITH ORDINALITY AS q(value, ordinal)
+      LEFT JOIN skills_registry r ON r.org_id = ${principal.orgId} AND r.slug = q.value->>'slug'
+      LEFT JOIN skills_versions v ON v.org_id = ${principal.orgId}
+        AND v.slug = q.value->>'slug' AND v.version = q.value->>'version'
+      LEFT JOIN skills_bundles b ON b.org_id = ${principal.orgId} AND b.sha256 = v.bundle_sha256
+      ORDER BY q.ordinal
+    `;
+    return rows.map(rowToPublishedSelectionState);
+  }
   async pinSkill(principal, slug, metadata = {}) {
     const rows = await this.sql`
       INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
@@ -87489,7 +87989,7 @@ function assertRecurringCapability(value, action) {
 }
 function recurringRequest(action, input2) {
   const row = input2, base = "/api/v1/recurring-consents";
-  const read2 = ["draft", "list", "get", "occurrences"].includes(action);
+  const read3 = ["draft", "list", "get", "occurrences"].includes(action);
   let path2 = action === "preview" ? `${base}/preview` : action === "draft" ? `/api/v1/recurring-consent-drafts/${row.draftId}` : action === "activate" ? `${base}/${row.draftId}/activate` : action === "list" ? base : `${base}/${row.consentId}${action === "get" ? "" : `/${action}`}`;
   if (action === "list" || action === "occurrences") {
     const query = new URLSearchParams;
@@ -87500,7 +88000,7 @@ function recurringRequest(action, input2) {
     if (query.size)
       path2 += `?${query}`;
   }
-  return { path: path2, read: read2, method: read2 ? "GET" : "POST", body: read2 ? undefined : JSON.stringify(action === "preview" ? input2 : action === "activate" ? row.approval : { contractVersion: 1 }) };
+  return { path: path2, read: read3, method: read3 ? "GET" : "POST", body: read3 ? undefined : JSON.stringify(action === "preview" ? input2 : action === "activate" ? row.approval : { contractVersion: 1 }) };
 }
 var budget = exports_external2.object({ reservedCredits: integer2, settledCredits: integer2, admittedOccurrences: integer2 });
 var period = exports_external2.object({ startsAt: instant2, endsAt: instant2 });
@@ -88232,10 +88732,10 @@ async function readQuoteUnavailableCode(response) {
   let timer;
   let deadlineExceeded = false;
   const expired = Symbol("quote body deadline");
-  const deadline = new Promise((resolve18) => {
+  const deadline = new Promise((resolve19) => {
     timer = setTimeout(() => {
       deadlineExceeded = true;
-      resolve18(expired);
+      resolve19(expired);
       reader.cancel().catch(() => {});
     }, 1500);
   });
@@ -88761,24 +89261,24 @@ class RemoteSkillsClient {
     const identity3 = parseWorkspaceIdentity(identityValue, target.userId);
     if (identity3.user.membershipId !== target.membershipId)
       throw new WorkspaceIdentityMismatchError;
-    const request2 = invitationRequest(action, captured), read2 = action === "list" || action === "get";
+    const request2 = invitationRequest(action, captured), read3 = action === "list" || action === "get";
     let response, value;
     try {
       response = await connection.request(request2.path, { method: request2.method, ...request2.body ? { body: request2.body } : {}, credentials: "omit" });
       value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 64 * 1024 : 4096)));
     } catch {
-      throw read2 ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+      throw read3 ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
     }
     if (!response.ok) {
       const code = invitationFailure(value, response.status);
       if (code)
         throw new RemoteWorkspaceInvitationError(code);
-      throw read2 ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+      throw read3 ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
     }
     try {
       return parseInvitationResult(action, value, captured, identity3.organization.id);
     } catch {
-      throw read2 ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+      throw read3 ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
     }
   }
   previewRecurringConsent(request2, context) {
@@ -89708,12 +90208,12 @@ class RemotePrivatePublicationsClient {
       previous = view;
       if (!["queued", "verifying"].includes(view.state) || Date.now() >= until)
         return view;
-      await new Promise((resolve18) => {
+      await new Promise((resolve19) => {
         const timer = setTimeout(done, Math.min(1000, until - Date.now()));
         function done() {
           clearTimeout(timer);
           options.signal?.removeEventListener("abort", done);
-          resolve18();
+          resolve19();
         }
         options.signal?.addEventListener("abort", done, { once: true });
       });
@@ -89945,23 +90445,23 @@ class RemoteSkillsAuthClient {
   }
 }
 // src/lib/private-publication-recovery.ts
-import { constants as constants13, closeSync as closeSync17, fsyncSync as fsyncSync5, fstatSync as fstatSync17, lstatSync as lstatSync21, mkdirSync as mkdirSync14, openSync as openSync17, readSync as readSync12, realpathSync as realpathSync8, renameSync as renameSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname24, isAbsolute as isAbsolute18, join as join36, resolve as resolve18 } from "path";
+import { constants as constants13, closeSync as closeSync17, fsyncSync as fsyncSync5, fstatSync as fstatSync17, lstatSync as lstatSync22, mkdirSync as mkdirSync14, openSync as openSync17, readSync as readSync12, realpathSync as realpathSync9, renameSync as renameSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname25, isAbsolute as isAbsolute18, join as join37, resolve as resolve19 } from "path";
 import { randomUUID as randomUUID11 } from "crypto";
 var fail = () => {
   throw new PrivatePublicationError("PUBLICATION_RECOVERY_INVALID", "The recovery directory is invalid or changed. Preserve it and inspect the existing intent; do not start a replacement automatically.");
 };
 function safeDirectory(directory) {
-  if (!isAbsolute18(directory) || directory !== resolve18(directory) || realpathSync8(directory) !== directory)
+  if (!isAbsolute18(directory) || directory !== resolve19(directory) || realpathSync9(directory) !== directory)
     return fail();
-  for (let path2 = directory;; path2 = dirname24(path2)) {
-    const stat2 = lstatSync21(path2);
+  for (let path2 = directory;; path2 = dirname25(path2)) {
+    const stat2 = lstatSync22(path2);
     if (!stat2.isDirectory() || stat2.isSymbolicLink())
       return fail();
-    if (path2 === dirname24(path2))
+    if (path2 === dirname25(path2))
       break;
   }
-  const own2 = lstatSync21(directory);
+  const own2 = lstatSync22(directory);
   if ((own2.mode & 63) !== 0 || process.getuid && own2.uid !== process.getuid())
     return fail();
   return { dev: own2.dev, ino: own2.ino };
@@ -89972,7 +90472,7 @@ function unchangedDirectory(directory, identity3) {
     return fail();
 }
 function readOwned(directory, name, max) {
-  const identity3 = safeDirectory(directory), file2 = join36(directory, name);
+  const identity3 = safeDirectory(directory), file2 = join37(directory, name);
   const fd = openSync17(file2, constants13.O_RDONLY | constants13.O_NOFOLLOW);
   try {
     const stat2 = fstatSync17(fd);
@@ -89996,7 +90496,7 @@ function readOwned(directory, name, max) {
   }
 }
 function writeOwned(directory, name, bytes) {
-  const fd = openSync17(join36(directory, name), constants13.O_WRONLY | constants13.O_CREAT | constants13.O_EXCL | constants13.O_NOFOLLOW, 384);
+  const fd = openSync17(join37(directory, name), constants13.O_WRONLY | constants13.O_CREAT | constants13.O_EXCL | constants13.O_NOFOLLOW, 384);
   try {
     writeFileSync10(fd, bytes);
     fsyncSync5(fd);
@@ -90009,7 +90509,7 @@ function save(directory, value) {
   writeOwned(directory, temporary, JSON.stringify(value) + `
 `);
   unchangedDirectory(directory, identity3);
-  renameSync6(join36(directory, temporary), join36(directory, "receipt.json"));
+  renameSync6(join37(directory, temporary), join37(directory, "receipt.json"));
   const fd = openSync17(directory, constants13.O_RDONLY | constants13.O_NOFOLLOW);
   try {
     fsyncSync5(fd);
@@ -90022,7 +90522,7 @@ function bind(client2, receipt) {
     throw new PrivatePublicationError("PUBLICATION_IDENTITY_CHANGED", "The fresh session does not match the recovery directory's server, account and membership.");
 }
 async function locked(directory, action) {
-  const identity3 = safeDirectory(directory), file2 = join36(directory, "operation.lock");
+  const identity3 = safeDirectory(directory), file2 = join37(directory, "operation.lock");
   let fd;
   try {
     fd = openSync17(file2, constants13.O_WRONLY | constants13.O_CREAT | constants13.O_EXCL | constants13.O_NOFOLLOW, 384);
@@ -90038,7 +90538,7 @@ async function locked(directory, action) {
   } finally {
     closeSync17(fd);
     unchangedDirectory(directory, identity3);
-    const now2 = lstatSync21(file2);
+    const now2 = lstatSync22(file2);
     if (now2.dev !== lock.dev || now2.ino !== lock.ino || !now2.isFile() || now2.isSymbolicLink())
       fail();
     unlinkSync5(file2);
@@ -90090,11 +90590,11 @@ async function preparePrivatePublication(client2, sourceDirectory, recoveryDirec
     phase: "prepared",
     intent: null
   };
-  if (!isAbsolute18(recoveryDirectory) || resolve18(recoveryDirectory) !== recoveryDirectory || realpathSync8(dirname24(recoveryDirectory)) !== dirname24(recoveryDirectory))
+  if (!isAbsolute18(recoveryDirectory) || resolve19(recoveryDirectory) !== recoveryDirectory || realpathSync9(dirname25(recoveryDirectory)) !== dirname25(recoveryDirectory))
     return fail();
   mkdirSync14(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
-  const parent = openSync17(dirname24(recoveryDirectory), constants13.O_RDONLY | constants13.O_NOFOLLOW);
+  const parent = openSync17(dirname25(recoveryDirectory), constants13.O_RDONLY | constants13.O_NOFOLLOW);
   try {
     fsyncSync5(parent);
   } finally {