@jarel/myskills 0.1.0-beta.19 → 0.1.0-beta.20

package/dist/index.js

@@ -269,10 +269,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path18) {
-  if (!path18)
+function getElementAtPath(obj, path19) {
+  if (!path19)
     return obj;
-  return path18.reduce((acc, key) => acc?.[key], obj);
+  return path19.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -531,11 +531,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path18, issues) {
+function prefixIssues(path19, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path18);
+    iss.path.unshift(path19);
     return iss;
   });
 }
@@ -1056,16 +1056,16 @@ function flattenError(error62, mapper = (issue4) => issue4.message) {
 }
 function formatError(error62, mapper = (issue4) => issue4.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path18 = []) => {
+  const processError = (error63, path19 = []) => {
     for (const issue4 of error63.issues) {
       if (issue4.code === "invalid_union" && issue4.errors.length) {
-        issue4.errors.map((issues) => processError({ issues }, [...path18, ...issue4.path]));
+        issue4.errors.map((issues) => processError({ issues }, [...path19, ...issue4.path]));
       } else if (issue4.code === "invalid_key") {
-        processError({ issues: issue4.issues }, [...path18, ...issue4.path]);
+        processError({ issues: issue4.issues }, [...path19, ...issue4.path]);
       } else if (issue4.code === "invalid_element") {
-        processError({ issues: issue4.issues }, [...path18, ...issue4.path]);
+        processError({ issues: issue4.issues }, [...path19, ...issue4.path]);
       } else {
-        const fullpath = [...path18, ...issue4.path];
+        const fullpath = [...path19, ...issue4.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue4));
         } else {
@@ -1104,17 +1104,17 @@ function formatError(error62, mapper = (issue4) => issue4.message) {
 }
 function treeifyError(error62, mapper = (issue4) => issue4.message) {
   const result = { errors: [] };
-  const processError = (error63, path18 = []) => {
+  const processError = (error63, path19 = []) => {
     var _a3;
     for (const issue4 of error63.issues) {
       if (issue4.code === "invalid_union" && issue4.errors.length) {
-        issue4.errors.map((issues) => processError({ issues }, [...path18, ...issue4.path]));
+        issue4.errors.map((issues) => processError({ issues }, [...path19, ...issue4.path]));
       } else if (issue4.code === "invalid_key") {
-        processError({ issues: issue4.issues }, [...path18, ...issue4.path]);
+        processError({ issues: issue4.issues }, [...path19, ...issue4.path]);
       } else if (issue4.code === "invalid_element") {
-        processError({ issues: issue4.issues }, [...path18, ...issue4.path]);
+        processError({ issues: issue4.issues }, [...path19, ...issue4.path]);
       } else {
-        const fullpath = [...path18, ...issue4.path];
+        const fullpath = [...path19, ...issue4.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue4));
           continue;
@@ -1153,8 +1153,8 @@ function treeifyError(error62, mapper = (issue4) => issue4.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path18 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path18) {
+  const path19 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path19) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -19150,13 +19150,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path18 = ref.slice(1).split("/").filter(Boolean);
-  if (path18.length === 0) {
+  const path19 = ref.slice(1).split("/").filter(Boolean);
+  if (path19.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path18[0] === defsKey) {
-    const key = path18[1] === void 0 ? void 0 : decodeJSONPointerSegment(path18[1]);
+  if (path19[0] === defsKey) {
+    const key = path19[1] === void 0 ? void 0 : decodeJSONPointerSegment(path19[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -21082,27 +21082,27 @@ function unknownKeys(value, allowed) {
   const allowedSet = new Set(allowed);
   return Object.keys(value).filter((key) => !allowedSet.has(key)).sort();
 }
-function issue2(errors, code, message, path18) {
-  errors.push(path18 ? { code, message, path: path18 } : { code, message });
+function issue2(errors, code, message, path19) {
+  errors.push(path19 ? { code, message, path: path19 } : { code, message });
 }
-function checkUnknownKeys(value, allowed, path18, errors) {
+function checkUnknownKeys(value, allowed, path19, errors) {
   for (const key of unknownKeys(value, allowed)) {
-    issue2(errors, "ARCHITECTURE_TARGET_UNKNOWN_FIELD", `Field '${key}' is not accepted.`, `${path18}.${key}`);
+    issue2(errors, "ARCHITECTURE_TARGET_UNKNOWN_FIELD", `Field '${key}' is not accepted.`, `${path19}.${key}`);
   }
 }
-function checkSensitiveKeys(value, path18, errors) {
+function checkSensitiveKeys(value, path19, errors) {
   if (Array.isArray(value)) {
     for (const [index, item] of value.entries())
-      checkSensitiveKeys(item, `${path18}[${index}]`, errors);
+      checkSensitiveKeys(item, `${path19}[${index}]`, errors);
     return;
   }
   if (!isRecord2(value))
     return;
   for (const [key, item] of Object.entries(value)) {
     if (isSensitiveMetadataKey(key) && !safeKnownKeys.has(key)) {
-      issue2(errors, "ARCHITECTURE_TARGET_SENSITIVE_FIELD", `Field '${key}' is not permitted in metadata-only target records.`, `${path18}.${key}`);
+      issue2(errors, "ARCHITECTURE_TARGET_SENSITIVE_FIELD", `Field '${key}' is not permitted in metadata-only target records.`, `${path19}.${key}`);
     }
-    checkSensitiveKeys(item, `${path18}.${key}`, errors);
+    checkSensitiveKeys(item, `${path19}.${key}`, errors);
   }
 }
 function validIdentifier(value, maximum = architectureTargetLimits.identifierLength) {
@@ -21130,40 +21130,40 @@ function normalizeMetadata(value) {
     normalized[key] = value[key];
   return normalized;
 }
-function validateMetadata2(value, path18, errors) {
+function validateMetadata2(value, path19, errors) {
   if (value === void 0)
     return void 0;
   if (!isRecord2(value)) {
-    issue2(errors, "ARCHITECTURE_TARGET_METADATA_INVALID", "Metadata must be a bounded object of scalar values.", path18);
+    issue2(errors, "ARCHITECTURE_TARGET_METADATA_INVALID", "Metadata must be a bounded object of scalar values.", path19);
     return void 0;
   }
   const entries = Object.entries(value);
   if (entries.length > architectureTargetLimits.metadataKeys) {
-    issue2(errors, "ARCHITECTURE_TARGET_LIMIT_EXCEEDED", `Metadata may contain at most ${architectureTargetLimits.metadataKeys} fields.`, path18);
+    issue2(errors, "ARCHITECTURE_TARGET_LIMIT_EXCEEDED", `Metadata may contain at most ${architectureTargetLimits.metadataKeys} fields.`, path19);
   }
   const normalized = {};
   for (const [key, item] of entries) {
     if (key.length === 0 || key.length > architectureTargetLimits.metadataKeyLength || isSensitiveMetadataKey(key)) {
-      issue2(errors, "ARCHITECTURE_TARGET_SENSITIVE_FIELD", `Metadata field '${key}' is not allowed.`, `${path18}.${key}`);
+      issue2(errors, "ARCHITECTURE_TARGET_SENSITIVE_FIELD", `Metadata field '${key}' is not allowed.`, `${path19}.${key}`);
     }
     if (!metadataKeyPattern.test(key)) {
-      issue2(errors, "ARCHITECTURE_TARGET_METADATA_INVALID", `Metadata field '${key}' must use a safe identifier shape.`, `${path18}.${key}`);
+      issue2(errors, "ARCHITECTURE_TARGET_METADATA_INVALID", `Metadata field '${key}' must use a safe identifier shape.`, `${path19}.${key}`);
     }
     if (item !== null && typeof item !== "string" && typeof item !== "number" && typeof item !== "boolean") {
-      issue2(errors, "ARCHITECTURE_TARGET_METADATA_INVALID", "Metadata values must be scalar.", `${path18}.${key}`);
+      issue2(errors, "ARCHITECTURE_TARGET_METADATA_INVALID", "Metadata values must be scalar.", `${path19}.${key}`);
       continue;
     }
     if (typeof item === "number" && !Number.isFinite(item)) {
-      issue2(errors, "ARCHITECTURE_TARGET_METADATA_INVALID", "Metadata numbers must be finite.", `${path18}.${key}`);
+      issue2(errors, "ARCHITECTURE_TARGET_METADATA_INVALID", "Metadata numbers must be finite.", `${path19}.${key}`);
       continue;
     }
     if (typeof item === "string") {
       if (item.length > architectureTargetLimits.metadataStringLength) {
-        issue2(errors, "ARCHITECTURE_TARGET_LIMIT_EXCEEDED", `Metadata strings must contain at most ${architectureTargetLimits.metadataStringLength} printable characters.`, `${path18}.${key}`);
+        issue2(errors, "ARCHITECTURE_TARGET_LIMIT_EXCEEDED", `Metadata strings must contain at most ${architectureTargetLimits.metadataStringLength} printable characters.`, `${path19}.${key}`);
         continue;
       }
       if (!textPattern.test(item) || unsafeMetadataValuePattern.test(item)) {
-        issue2(errors, "ARCHITECTURE_TARGET_SENSITIVE_FIELD", `Metadata value '${key}' contains unsafe or private content.`, `${path18}.${key}`);
+        issue2(errors, "ARCHITECTURE_TARGET_SENSITIVE_FIELD", `Metadata value '${key}' contains unsafe or private content.`, `${path19}.${key}`);
         continue;
       }
     }
@@ -21175,81 +21175,81 @@ function isSensitiveMetadataKey(key) {
   const normalized = key.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[\s_]+/g, "-").toLowerCase();
   return sensitiveMetadataKeyPattern.test(normalized);
 }
-function validateOwner(value, path18, errors) {
+function validateOwner(value, path19, errors) {
   if (!isRecord2(value)) {
-    issue2(errors, "ARCHITECTURE_TARGET_OWNER_INVALID", "Target owner must be an object.", path18);
+    issue2(errors, "ARCHITECTURE_TARGET_OWNER_INVALID", "Target owner must be an object.", path19);
     return void 0;
   }
-  checkUnknownKeys(value, ["type", "id"], path18, errors);
+  checkUnknownKeys(value, ["type", "id"], path19, errors);
   if (!isOneOf(value.type, architectureTargetOwnerReferenceTypes)) {
-    issue2(errors, "ARCHITECTURE_TARGET_OWNER_TYPE_INVALID", "Target owner type must be user, team, or organization.", `${path18}.type`);
+    issue2(errors, "ARCHITECTURE_TARGET_OWNER_TYPE_INVALID", "Target owner type must be user, team, or organization.", `${path19}.type`);
   }
   if (!validIdentifier(value.id))
-    issue2(errors, "ARCHITECTURE_TARGET_OWNER_ID_INVALID", "Target owner id must be a bounded identifier.", `${path18}.id`);
+    issue2(errors, "ARCHITECTURE_TARGET_OWNER_ID_INVALID", "Target owner id must be a bounded identifier.", `${path19}.id`);
   if (!isOneOf(value.type, architectureTargetOwnerReferenceTypes) || !validIdentifier(value.id))
     return void 0;
   return { type: value.type, id: value.id };
 }
-function validateAdapterDescriptor(value, path18, errors) {
+function validateAdapterDescriptor(value, path19, errors) {
   if (!isRecord2(value)) {
-    issue2(errors, "ARCHITECTURE_TARGET_ADAPTER_INVALID", "Target adapter descriptor must be an object.", path18);
+    issue2(errors, "ARCHITECTURE_TARGET_ADAPTER_INVALID", "Target adapter descriptor must be an object.", path19);
     return void 0;
   }
-  checkUnknownKeys(value, ["kind", "version", "contractVersion"], path18, errors);
+  checkUnknownKeys(value, ["kind", "version", "contractVersion"], path19, errors);
   if (typeof value.kind !== "string" || !adapterKindPattern.test(value.kind)) {
-    issue2(errors, "ARCHITECTURE_TARGET_ADAPTER_KIND_INVALID", "Adapter kind must be a lowercase bounded identifier.", `${path18}.kind`);
+    issue2(errors, "ARCHITECTURE_TARGET_ADAPTER_KIND_INVALID", "Adapter kind must be a lowercase bounded identifier.", `${path19}.kind`);
   }
   if (!validText(value.version, architectureTargetLimits.adapterVersionLength)) {
-    issue2(errors, "ARCHITECTURE_TARGET_ADAPTER_VERSION_INVALID", "Adapter version must be a bounded string.", `${path18}.version`);
+    issue2(errors, "ARCHITECTURE_TARGET_ADAPTER_VERSION_INVALID", "Adapter version must be a bounded string.", `${path19}.version`);
   }
   if (!architectureTargetAdapterContractVersions.includes(value.contractVersion)) {
-    issue2(errors, "ARCHITECTURE_TARGET_ADAPTER_CONTRACT_VERSION_INVALID", "Adapter contract version must be 1 or 2.", `${path18}.contractVersion`);
+    issue2(errors, "ARCHITECTURE_TARGET_ADAPTER_CONTRACT_VERSION_INVALID", "Adapter contract version must be 1 or 2.", `${path19}.contractVersion`);
   }
   if (typeof value.kind !== "string" || !adapterKindPattern.test(value.kind) || !validText(value.version, architectureTargetLimits.adapterVersionLength) || value.contractVersion !== 1 && value.contractVersion !== 2)
     return void 0;
   return { kind: value.kind, version: value.version, contractVersion: value.contractVersion };
 }
-function validateCapabilities(value, path18, errors, contractVersion = 1) {
+function validateCapabilities(value, path19, errors, contractVersion = 1) {
   if (!isRecord2(value)) {
-    issue2(errors, "ARCHITECTURE_TARGET_CAPABILITIES_INVALID", "Target capabilities must be an object.", path18);
+    issue2(errors, "ARCHITECTURE_TARGET_CAPABILITIES_INVALID", "Target capabilities must be an object.", path19);
     return void 0;
   }
-  checkUnknownKeys(value, architectureTargetCapabilityNames, path18, errors);
+  checkUnknownKeys(value, architectureTargetCapabilityNames, path19, errors);
   const normalized = {};
   const knownNames = new Set(architectureTargetCapabilityNames);
   for (const [key, item] of Object.entries(value)) {
     if (!knownNames.has(key))
       continue;
     if (typeof item !== "boolean") {
-      issue2(errors, "ARCHITECTURE_TARGET_CAPABILITY_INVALID", "Capability values must be boolean.", `${path18}.${key}`);
+      issue2(errors, "ARCHITECTURE_TARGET_CAPABILITY_INVALID", "Capability values must be boolean.", `${path19}.${key}`);
       continue;
     }
     if (contractVersion === 1 && architectureTargetMutationCapabilities.includes(key) && item === true) {
-      issue2(errors, "ARCHITECTURE_TARGET_MUTATION_CAPABILITY_ENABLED", "Mutation capabilities must be absent or explicitly false in contract version 1.", `${path18}.${key}`);
+      issue2(errors, "ARCHITECTURE_TARGET_MUTATION_CAPABILITY_ENABLED", "Mutation capabilities must be absent or explicitly false in contract version 1.", `${path19}.${key}`);
       continue;
     }
     normalized[key] = item;
   }
   if (contractVersion === 2 && (normalized.apply === true || normalized.rollback === true) && normalized["sync.write"] !== true) {
-    issue2(errors, "ARCHITECTURE_TARGET_MUTATION_CAPABILITY_ENABLED", "Contract version 2 requires sync.write when apply or rollback is enabled.", `${path18}.sync.write`);
+    issue2(errors, "ARCHITECTURE_TARGET_MUTATION_CAPABILITY_ENABLED", "Contract version 2 requires sync.write when apply or rollback is enabled.", `${path19}.sync.write`);
   }
   return normalized;
 }
-function validateConsent(value, path18, errors) {
+function validateConsent(value, path19, errors) {
   if (!isRecord2(value)) {
-    issue2(errors, "ARCHITECTURE_TARGET_CONSENT_INVALID", "Target consent must be an object.", path18);
+    issue2(errors, "ARCHITECTURE_TARGET_CONSENT_INVALID", "Target consent must be an object.", path19);
     return void 0;
   }
-  checkUnknownKeys(value, ["status", "requestedAt", "grantedAt", "deniedAt", "revokedAt"], path18, errors);
+  checkUnknownKeys(value, ["status", "requestedAt", "grantedAt", "deniedAt", "revokedAt"], path19, errors);
   if (!isOneOf(value.status, architectureTargetConsentStatuses))
-    issue2(errors, "ARCHITECTURE_TARGET_CONSENT_STATUS_INVALID", "Target consent status is invalid.", `${path18}.status`);
+    issue2(errors, "ARCHITECTURE_TARGET_CONSENT_STATUS_INVALID", "Target consent status is invalid.", `${path19}.status`);
   if (!validIsoTimestamp(value.requestedAt))
-    issue2(errors, "ARCHITECTURE_TARGET_CONSENT_TIMESTAMP_REQUIRED", "Consent requestedAt must be an ISO-8601 UTC timestamp.", `${path18}.requestedAt`);
+    issue2(errors, "ARCHITECTURE_TARGET_CONSENT_TIMESTAMP_REQUIRED", "Consent requestedAt must be an ISO-8601 UTC timestamp.", `${path19}.requestedAt`);
   const timestamps = ["grantedAt", "deniedAt", "revokedAt"];
   for (const timestamp of timestamps) {
     const item = value[timestamp];
     if (item !== void 0 && item !== null && !validIsoTimestamp(item)) {
-      issue2(errors, "ARCHITECTURE_TARGET_TIMESTAMP_INVALID", `${timestamp} must be an ISO-8601 UTC timestamp or null.`, `${path18}.${timestamp}`);
+      issue2(errors, "ARCHITECTURE_TARGET_TIMESTAMP_INVALID", `${timestamp} must be an ISO-8601 UTC timestamp or null.`, `${path19}.${timestamp}`);
     }
   }
   const requiredTimestamp = {
@@ -21260,7 +21260,7 @@ function validateConsent(value, path18, errors) {
   };
   const required2 = isOneOf(value.status, architectureTargetConsentStatuses) ? requiredTimestamp[value.status] : null;
   if (required2 && !validIsoTimestamp(value[required2])) {
-    issue2(errors, "ARCHITECTURE_TARGET_CONSENT_TIMESTAMP_REQUIRED", `Consent ${required2} is required for status '${value.status}'.`, `${path18}.${required2}`);
+    issue2(errors, "ARCHITECTURE_TARGET_CONSENT_TIMESTAMP_REQUIRED", `Consent ${required2} is required for status '${value.status}'.`, `${path19}.${required2}`);
   }
   if (!isOneOf(value.status, architectureTargetConsentStatuses) || !validIsoTimestamp(value.requestedAt))
     return void 0;
@@ -21272,11 +21272,11 @@ function validateConsent(value, path18, errors) {
     ...value.revokedAt === void 0 ? {} : { revokedAt: value.revokedAt }
   };
 }
-function validateOptionalTimestamp(value, path18, errors) {
+function validateOptionalTimestamp(value, path19, errors) {
   if (value === void 0)
     return void 0;
   if (!validIsoTimestamp(value)) {
-    issue2(errors, "ARCHITECTURE_TARGET_TIMESTAMP_INVALID", "Timestamp must be an ISO-8601 UTC timestamp.", path18);
+    issue2(errors, "ARCHITECTURE_TARGET_TIMESTAMP_INVALID", "Timestamp must be an ISO-8601 UTC timestamp.", path19);
     return void 0;
   }
   return value;
@@ -21494,34 +21494,34 @@ function architectureTargetCapabilitiesDigest(input2, contractVersion = 1) {
     throw new ArchitectureTargetValidationError(errors.length > 0 ? errors : [{ code: "ARCHITECTURE_TARGET_CAPABILITIES_INVALID", message: "Capabilities are invalid." }]);
   return sha256Hex(canonicalizeJson(normalizeCapabilities(normalized)));
 }
-function validateObservedSkill(value, path18, errors) {
+function validateObservedSkill(value, path19, errors) {
   if (!isRecord2(value)) {
-    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill must be an object.", path18);
+    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill must be an object.", path19);
     return void 0;
   }
-  checkUnknownKeys(value, ["skillRefId", "slug", "version", "digest", "kind", "enabled", "runtimeExposure", "configurationDigest", "configured", "managed", "supported", "metadata"], path18, errors);
+  checkUnknownKeys(value, ["skillRefId", "slug", "version", "digest", "kind", "enabled", "runtimeExposure", "configurationDigest", "configured", "managed", "supported", "metadata"], path19, errors);
   if (value.skillRefId !== void 0 && !validIdentifier(value.skillRefId))
-    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill skillRefId must be a bounded identifier.", `${path18}.skillRefId`);
+    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill skillRefId must be a bounded identifier.", `${path19}.skillRefId`);
   if (!validText(value.slug, architectureTargetLimits.identifierLength) || !identifierPattern.test(value.slug))
-    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill slug must be a bounded identifier.", `${path18}.slug`);
+    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill slug must be a bounded identifier.", `${path19}.slug`);
   if (value.version !== void 0 && !validText(value.version, architectureTargetLimits.versionLength))
-    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill version must be a bounded string.", `${path18}.version`);
+    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill version must be a bounded string.", `${path19}.version`);
   if (value.digest !== void 0 && !validDigest(value.digest))
-    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill digest must be a lowercase SHA-256 digest.", `${path18}.digest`);
+    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill digest must be a lowercase SHA-256 digest.", `${path19}.digest`);
   if (value.kind !== void 0 && value.kind !== "router" && value.kind !== "leaf")
-    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill kind must be router or leaf.", `${path18}.kind`);
+    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill kind must be router or leaf.", `${path19}.kind`);
   if (value.enabled !== void 0 && typeof value.enabled !== "boolean")
-    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill enabled must be boolean.", `${path18}.enabled`);
+    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill enabled must be boolean.", `${path19}.enabled`);
   if (value.runtimeExposure !== void 0 && !isOneOf(value.runtimeExposure, runtimeExposureModes))
-    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill runtimeExposure is invalid.", `${path18}.runtimeExposure`);
+    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill runtimeExposure is invalid.", `${path19}.runtimeExposure`);
   if (value.configurationDigest !== void 0 && !validDigest(value.configurationDigest))
-    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill configurationDigest must be a lowercase SHA-256 digest.", `${path18}.configurationDigest`);
+    issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", "Observed skill configurationDigest must be a lowercase SHA-256 digest.", `${path19}.configurationDigest`);
   for (const key of ["configured", "managed", "supported"]) {
     if (value[key] !== void 0 && typeof value[key] !== "boolean")
-      issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", `Observed skill ${key} must be boolean.`, `${path18}.${key}`);
+      issue2(errors, "ARCHITECTURE_TARGET_SKILL_INVALID", `Observed skill ${key} must be boolean.`, `${path19}.${key}`);
   }
-  const metadata = validateMetadata2(value.metadata, `${path18}.metadata`, errors);
-  if (errors.some((error62) => error62.path?.startsWith(path18)))
+  const metadata = validateMetadata2(value.metadata, `${path19}.metadata`, errors);
+  if (errors.some((error62) => error62.path?.startsWith(path19)))
     return void 0;
   return {
     ...value.skillRefId === void 0 ? {} : { skillRefId: value.skillRefId },
@@ -21538,34 +21538,34 @@ function validateObservedSkill(value, path18, errors) {
     ...metadata && Object.keys(metadata).length > 0 ? { metadata } : {}
   };
 }
-function validateConfigFinding(value, path18, errors) {
+function validateConfigFinding(value, path19, errors) {
   if (!isRecord2(value)) {
-    issue2(errors, "ARCHITECTURE_TARGET_CONFIG_FINDING_INVALID", "Configuration finding must be an object.", path18);
+    issue2(errors, "ARCHITECTURE_TARGET_CONFIG_FINDING_INVALID", "Configuration finding must be an object.", path19);
     return void 0;
   }
-  checkUnknownKeys(value, ["code", "severity", "count"], path18, errors);
+  checkUnknownKeys(value, ["code", "severity", "count"], path19, errors);
   if (typeof value.code !== "string" || !findingCodePattern.test(value.code))
-    issue2(errors, "ARCHITECTURE_TARGET_CONFIG_FINDING_INVALID", "Configuration finding code must be a bounded identifier.", `${path18}.code`);
+    issue2(errors, "ARCHITECTURE_TARGET_CONFIG_FINDING_INVALID", "Configuration finding code must be a bounded identifier.", `${path19}.code`);
   if (!isOneOf(value.severity, architectureTargetConfigFindingSeverities))
-    issue2(errors, "ARCHITECTURE_TARGET_CONFIG_FINDING_INVALID", "Configuration finding severity is invalid.", `${path18}.severity`);
+    issue2(errors, "ARCHITECTURE_TARGET_CONFIG_FINDING_INVALID", "Configuration finding severity is invalid.", `${path19}.severity`);
   if (typeof value.count !== "number" || !Number.isInteger(value.count) || value.count < 0 || value.count > architectureTargetLimits.counterMaximum)
-    issue2(errors, "ARCHITECTURE_TARGET_CONFIG_FINDING_INVALID", "Configuration finding count must be a bounded non-negative integer.", `${path18}.count`);
+    issue2(errors, "ARCHITECTURE_TARGET_CONFIG_FINDING_INVALID", "Configuration finding count must be a bounded non-negative integer.", `${path19}.count`);
   if (typeof value.code !== "string" || !findingCodePattern.test(value.code) || !isOneOf(value.severity, architectureTargetConfigFindingSeverities) || typeof value.count !== "number" || !Number.isInteger(value.count) || value.count < 0)
     return void 0;
   return { code: value.code, severity: value.severity, count: value.count };
 }
-function validatePromptAwareness(value, path18, errors) {
+function validatePromptAwareness(value, path19, errors) {
   if (!isRecord2(value)) {
-    issue2(errors, "ARCHITECTURE_TARGET_PROMPT_AWARENESS_INVALID", "Prompt awareness must be an object.", path18);
+    issue2(errors, "ARCHITECTURE_TARGET_PROMPT_AWARENESS_INVALID", "Prompt awareness must be an object.", path19);
     return void 0;
   }
-  checkUnknownKeys(value, ["detected", "count", "redacted"], path18, errors);
+  checkUnknownKeys(value, ["detected", "count", "redacted"], path19, errors);
   if (typeof value.detected !== "boolean")
-    issue2(errors, "ARCHITECTURE_TARGET_PROMPT_AWARENESS_INVALID", "Prompt awareness detected must be boolean.", `${path18}.detected`);
+    issue2(errors, "ARCHITECTURE_TARGET_PROMPT_AWARENESS_INVALID", "Prompt awareness detected must be boolean.", `${path19}.detected`);
   if (typeof value.count !== "number" || !Number.isInteger(value.count) || value.count < 0 || value.count > architectureTargetLimits.counterMaximum)
-    issue2(errors, "ARCHITECTURE_TARGET_PROMPT_AWARENESS_INVALID", "Prompt awareness count must be a bounded non-negative integer.", `${path18}.count`);
+    issue2(errors, "ARCHITECTURE_TARGET_PROMPT_AWARENESS_INVALID", "Prompt awareness count must be a bounded non-negative integer.", `${path19}.count`);
   if (value.redacted !== void 0 && typeof value.redacted !== "boolean")
-    issue2(errors, "ARCHITECTURE_TARGET_PROMPT_AWARENESS_INVALID", "Prompt awareness redacted must be boolean.", `${path18}.redacted`);
+    issue2(errors, "ARCHITECTURE_TARGET_PROMPT_AWARENESS_INVALID", "Prompt awareness redacted must be boolean.", `${path19}.redacted`);
   if (typeof value.detected !== "boolean" || typeof value.count !== "number" || !Number.isInteger(value.count) || value.count < 0 || value.redacted !== void 0 && typeof value.redacted !== "boolean")
     return void 0;
   return {
@@ -23216,9 +23216,9 @@ var require_yauzl = __commonJS({
     exports.Entry = Entry;
     exports.LocalFileHeader = LocalFileHeader;
     exports.RandomAccessReader = RandomAccessReader;
-    function openPromise(path18, options2) {
+    function openPromise(path19, options2) {
       return new Promise((resolve, reject) => {
-        open10(path18, { ...options2, lazyEntries: true }, function(err, zipfile) {
+        open10(path19, { ...options2, lazyEntries: true }, function(err, zipfile) {
           if (err) return reject(err);
           resolve(zipfile);
         });
@@ -23248,7 +23248,7 @@ var require_yauzl = __commonJS({
         });
       });
     }
-    function open10(path18, options2, callback) {
+    function open10(path19, options2, callback) {
       if (typeof options2 === "function") {
         callback = options2;
         options2 = null;
@@ -23260,7 +23260,7 @@ var require_yauzl = __commonJS({
       if (options2.validateEntrySizes == null) options2.validateEntrySizes = true;
       if (options2.strictFileNames == null) options2.strictFileNames = false;
       if (callback == null) callback = defaultCallback;
-      fs.open(path18, "r", function(err, fd) {
+      fs.open(path19, "r", function(err, fd) {
         if (err) return callback(err);
         fromFd(fd, options2, function(err2, zipfile) {
           if (err2) fs.close(fd, defaultCallback);
@@ -25041,10 +25041,10 @@ function comparisonResult(input2, baseFiles, targetFiles, baseBytes, targetBytes
     remaining -= preview.length;
     return { sha256: digest2(content), byteSize: Buffer.byteLength(content), preview, previewTruncated: preview.length < content.length, previewOmitted: binary ? "binary" : unchanged ? "unchanged" : null };
   };
-  const changes = [.../* @__PURE__ */ new Set([...before.keys(), ...after.keys()])].sort().map((path18) => {
-    const status = !before.has(path18) ? "added" : !after.has(path18) ? "removed" : before.get(path18) === after.get(path18) ? "unchanged" : "modified";
+  const changes = [.../* @__PURE__ */ new Set([...before.keys(), ...after.keys()])].sort().map((path19) => {
+    const status = !before.has(path19) ? "added" : !after.has(path19) ? "removed" : before.get(path19) === after.get(path19) ? "unchanged" : "modified";
     totals[status]++;
-    return { path: path18, status, base: side(before.get(path18), status === "unchanged"), target: side(after.get(path18), status === "unchanged") };
+    return { path: path19, status, base: side(before.get(path19), status === "unchanged"), target: side(after.get(path19), status === "unchanged") };
   });
   return { schemaVersion: 1, base: { ...input2.base, byteSize: baseBytes }, target: { ...input2.target, byteSize: targetBytes }, totals, changes, previewLimitCharacters: 32768, notice: "Compared complete content. Previews are bounded and may be omitted or truncated. No package code was executed." };
 }
@@ -25407,17 +25407,17 @@ var require_visit = __commonJS({
     visit2.BREAK = BREAK;
     visit2.SKIP = SKIP;
     visit2.REMOVE = REMOVE;
-    function visit_(key, node2, visitor, path18) {
-      const ctrl = callVisitor(key, node2, visitor, path18);
+    function visit_(key, node2, visitor, path19) {
+      const ctrl = callVisitor(key, node2, visitor, path19);
       if (identity2.isNode(ctrl) || identity2.isPair(ctrl)) {
-        replaceNode(key, path18, ctrl);
-        return visit_(key, ctrl, visitor, path18);
+        replaceNode(key, path19, ctrl);
+        return visit_(key, ctrl, visitor, path19);
       }
       if (typeof ctrl !== "symbol") {
         if (identity2.isCollection(node2)) {
-          path18 = Object.freeze(path18.concat(node2));
+          path19 = Object.freeze(path19.concat(node2));
           for (let i = 0; i < node2.items.length; ++i) {
-            const ci = visit_(i, node2.items[i], visitor, path18);
+            const ci = visit_(i, node2.items[i], visitor, path19);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -25428,13 +25428,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity2.isPair(node2)) {
-          path18 = Object.freeze(path18.concat(node2));
-          const ck = visit_("key", node2.key, visitor, path18);
+          path19 = Object.freeze(path19.concat(node2));
+          const ck = visit_("key", node2.key, visitor, path19);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node2.key = null;
-          const cv = visit_("value", node2.value, visitor, path18);
+          const cv = visit_("value", node2.value, visitor, path19);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -25455,17 +25455,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node2, visitor, path18) {
-      const ctrl = await callVisitor(key, node2, visitor, path18);
+    async function visitAsync_(key, node2, visitor, path19) {
+      const ctrl = await callVisitor(key, node2, visitor, path19);
       if (identity2.isNode(ctrl) || identity2.isPair(ctrl)) {
-        replaceNode(key, path18, ctrl);
-        return visitAsync_(key, ctrl, visitor, path18);
+        replaceNode(key, path19, ctrl);
+        return visitAsync_(key, ctrl, visitor, path19);
       }
       if (typeof ctrl !== "symbol") {
         if (identity2.isCollection(node2)) {
-          path18 = Object.freeze(path18.concat(node2));
+          path19 = Object.freeze(path19.concat(node2));
           for (let i = 0; i < node2.items.length; ++i) {
-            const ci = await visitAsync_(i, node2.items[i], visitor, path18);
+            const ci = await visitAsync_(i, node2.items[i], visitor, path19);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -25476,13 +25476,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity2.isPair(node2)) {
-          path18 = Object.freeze(path18.concat(node2));
-          const ck = await visitAsync_("key", node2.key, visitor, path18);
+          path19 = Object.freeze(path19.concat(node2));
+          const ck = await visitAsync_("key", node2.key, visitor, path19);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node2.key = null;
-          const cv = await visitAsync_("value", node2.value, visitor, path18);
+          const cv = await visitAsync_("value", node2.value, visitor, path19);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -25509,23 +25509,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node2, visitor, path18) {
+    function callVisitor(key, node2, visitor, path19) {
       if (typeof visitor === "function")
-        return visitor(key, node2, path18);
+        return visitor(key, node2, path19);
       if (identity2.isMap(node2))
-        return visitor.Map?.(key, node2, path18);
+        return visitor.Map?.(key, node2, path19);
       if (identity2.isSeq(node2))
-        return visitor.Seq?.(key, node2, path18);
+        return visitor.Seq?.(key, node2, path19);
       if (identity2.isPair(node2))
-        return visitor.Pair?.(key, node2, path18);
+        return visitor.Pair?.(key, node2, path19);
       if (identity2.isScalar(node2))
-        return visitor.Scalar?.(key, node2, path18);
+        return visitor.Scalar?.(key, node2, path19);
       if (identity2.isAlias(node2))
-        return visitor.Alias?.(key, node2, path18);
+        return visitor.Alias?.(key, node2, path19);
       return void 0;
     }
-    function replaceNode(key, path18, node2) {
-      const parent = path18[path18.length - 1];
+    function replaceNode(key, path19, node2) {
+      const parent = path19[path19.length - 1];
       if (identity2.isCollection(parent)) {
         parent.items[key] = node2;
       } else if (identity2.isPair(parent)) {
@@ -26137,10 +26137,10 @@ var require_Collection = __commonJS({
     var createNode = require_createNode();
     var identity2 = require_identity();
     var Node = require_Node();
-    function collectionFromPath(schema, path18, value) {
+    function collectionFromPath(schema, path19, value) {
       let v = value;
-      for (let i = path18.length - 1; i >= 0; --i) {
-        const k = path18[i];
+      for (let i = path19.length - 1; i >= 0; --i) {
+        const k = path19[i];
         if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
           const a = [];
           a[k] = v;
@@ -26159,7 +26159,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path18) => path18 == null || typeof path18 === "object" && !!path18[Symbol.iterator]().next().done;
+    var isEmptyPath = (path19) => path19 == null || typeof path19 === "object" && !!path19[Symbol.iterator]().next().done;
     var Collection = class extends Node.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -26189,11 +26189,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path18, value) {
-        if (isEmptyPath(path18))
+      addIn(path19, value) {
+        if (isEmptyPath(path19))
           this.add(value);
         else {
-          const [key, ...rest] = path18;
+          const [key, ...rest] = path19;
           const node2 = this.get(key, true);
           if (identity2.isCollection(node2))
             node2.addIn(rest, value);
@@ -26207,8 +26207,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path18) {
-        const [key, ...rest] = path18;
+      deleteIn(path19) {
+        const [key, ...rest] = path19;
         if (rest.length === 0)
           return this.delete(key);
         const node2 = this.get(key, true);
@@ -26222,8 +26222,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path18, keepScalar) {
-        const [key, ...rest] = path18;
+      getIn(path19, keepScalar) {
+        const [key, ...rest] = path19;
         const node2 = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity2.isScalar(node2) ? node2.value : node2;
@@ -26241,8 +26241,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path18) {
-        const [key, ...rest] = path18;
+      hasIn(path19) {
+        const [key, ...rest] = path19;
         if (rest.length === 0)
           return this.has(key);
         const node2 = this.get(key, true);
@@ -26252,8 +26252,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path18, value) {
-        const [key, ...rest] = path18;
+      setIn(path19, value) {
+        const [key, ...rest] = path19;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -28768,9 +28768,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path18, value) {
+      addIn(path19, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path18, value);
+          this.contents.addIn(path19, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -28845,14 +28845,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path18) {
-        if (Collection.isEmptyPath(path18)) {
+      deleteIn(path19) {
+        if (Collection.isEmptyPath(path19)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path18) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path19) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -28867,10 +28867,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path18, keepScalar) {
-        if (Collection.isEmptyPath(path18))
+      getIn(path19, keepScalar) {
+        if (Collection.isEmptyPath(path19))
           return !keepScalar && identity2.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity2.isCollection(this.contents) ? this.contents.getIn(path18, keepScalar) : void 0;
+        return identity2.isCollection(this.contents) ? this.contents.getIn(path19, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -28881,10 +28881,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path18) {
-        if (Collection.isEmptyPath(path18))
+      hasIn(path19) {
+        if (Collection.isEmptyPath(path19))
           return this.contents !== void 0;
-        return identity2.isCollection(this.contents) ? this.contents.hasIn(path18) : false;
+        return identity2.isCollection(this.contents) ? this.contents.hasIn(path19) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -28901,13 +28901,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path18, value) {
-        if (Collection.isEmptyPath(path18)) {
+      setIn(path19, value) {
+        if (Collection.isEmptyPath(path19)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path18), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path19), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path18, value);
+          this.contents.setIn(path19, value);
         }
       }
       /**
@@ -30868,9 +30868,9 @@ var require_cst_visit = __commonJS({
     visit2.BREAK = BREAK;
     visit2.SKIP = SKIP;
     visit2.REMOVE = REMOVE;
-    visit2.itemAtPath = (cst, path18) => {
+    visit2.itemAtPath = (cst, path19) => {
       let item = cst;
-      for (const [field, index] of path18) {
+      for (const [field, index] of path19) {
         const tok = item?.[field];
         if (tok && "items" in tok) {
           item = tok.items[index];
@@ -30879,23 +30879,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit2.parentCollection = (cst, path18) => {
-      const parent = visit2.itemAtPath(cst, path18.slice(0, -1));
-      const field = path18[path18.length - 1][0];
+    visit2.parentCollection = (cst, path19) => {
+      const parent = visit2.itemAtPath(cst, path19.slice(0, -1));
+      const field = path19[path19.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path18, item, visitor) {
-      let ctrl = visitor(item, path18);
+    function _visit(path19, item, visitor) {
+      let ctrl = visitor(item, path19);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
         const token = item[field];
         if (token && "items" in token) {
           for (let i = 0; i < token.items.length; ++i) {
-            const ci = _visit(Object.freeze(path18.concat([[field, i]])), token.items[i], visitor);
+            const ci = _visit(Object.freeze(path19.concat([[field, i]])), token.items[i], visitor);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -30906,10 +30906,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field === "key")
-            ctrl = ctrl(item, path18);
+            ctrl = ctrl(item, path19);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path18) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path19) : ctrl;
     }
     exports.visit = visit2;
   }
@@ -33725,13 +33725,13 @@ __export(skill_improvement_exports, {
   readImprovementReport: () => readImprovementReport,
   runImprovementJob: () => runImprovementJob
 });
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
-import { access, lstat as lstat13, mkdir as mkdir2, open as open9, readFile as readFile2, realpath as realpath9, rm as rm2 } from "node:fs/promises";
+import { access, lstat as lstat13, mkdir as mkdir3, open as open9, readFile as readFile3, realpath as realpath9, rm as rm3 } from "node:fs/promises";
 import { constants as constants5 } from "node:fs";
-import os4 from "node:os";
-import path13 from "node:path";
+import os6 from "node:os";
+import path15 from "node:path";
 import { StringDecoder } from "node:string_decoder";
 async function createImprovementJob(options2) {
   requireSupportedImprovementHost();
@@ -33778,7 +33778,7 @@ async function createImprovementJob(options2) {
     ...suite ? { suite } : {},
     executable,
     executableDigest: await executableDigest(executable),
-    runnerPin: (await readFile2(executable)).subarray(0, 2).toString() === "#!" ? "launcher-only" : "native-binary",
+    runnerPin: (await readFile3(executable)).subarray(0, 2).toString() === "#!" ? "launcher-only" : "native-binary",
     runnerVersion,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     maxWallMinutes,
@@ -33786,8 +33786,8 @@ async function createImprovementJob(options2) {
     ...options2.registry ? { registry: options2.registry } : {}
   };
   const planDigest = digest4(plan);
-  await mkdir2(output2, { mode: 448 });
-  await atomicPrivateWrite(output2, path13.join(output2, "plan.json"), JSON.stringify({ plan, planDigest }, null, 2));
+  await mkdir3(output2, { mode: 448 });
+  await atomicPrivateWrite(output2, path15.join(output2, "plan.json"), JSON.stringify({ plan, planDigest }, null, 2));
   return { plan, planDigest };
 }
 async function runImprovementJob(options2) {
@@ -33807,7 +33807,7 @@ async function runImprovementJob(options2) {
     return snapshot.files;
   }));
   if (await executableDigest(plan.executable) !== plan.executableDigest) throw new ImprovementError("Runner executable changed after planning.");
-  const lock = path13.join(job, "started");
+  const lock = path15.join(job, "started");
   try {
     const file2 = await open9(lock, "wx", 384);
     await file2.close();
@@ -33819,7 +33819,7 @@ async function runImprovementJob(options2) {
   const startedAt = Date.now();
   const wallLimit = AbortSignal.timeout(plan.maxWallMinutes * 6e4);
   const signal = options2.signal ? AbortSignal.any([options2.signal, wallLimit]) : wallLimit;
-  const save = () => atomicPrivateWrite(job, path13.join(job, "report.json"), JSON.stringify(report, null, 2));
+  const save = () => atomicPrivateWrite(job, path15.join(job, "report.json"), JSON.stringify(report, null, 2));
   await save();
   const invoke = async (payload, stage) => {
     if (signal.aborted) throw new ImprovementError(wallLimit.aborted ? "Wall time budget exhausted." : "Run cancelled.");
@@ -33872,7 +33872,7 @@ async function runImprovementJob(options2) {
       loadSkillManifestFromPackageFiles(files2);
       validateCodexSkill(files2, source2.manifest.name);
       if (hasBlockingFindings(scanPackageFiles(files2).findings)) throw new ImprovementError("Candidate failed the package safety scan; evaluation was not started.");
-      await writeNewPackageTree(job, path13.join(job, "candidate"), files2);
+      await writeNewPackageTree(job, path15.join(job, "candidate"), files2);
       report.candidateDigest = treeDigest(files2);
       await options2.lifecycle?.candidate(report.candidateDigest, files2);
       await options2.lifecycle?.stage("propose", "completed", analysis.findings.length);
@@ -33920,7 +33920,7 @@ async function runImprovementJob(options2) {
 async function readImprovementReport(jobPath) {
   jobPath = systemAlias(jobPath);
   const { planDigest } = await readPlan(jobPath);
-  const report = JSON.parse(await readRegularText(path13.join(jobPath, "report.json"), MAX_STATE));
+  const report = JSON.parse(await readRegularText(path15.join(jobPath, "report.json"), MAX_STATE));
   if (report.schemaVersion !== 1 || report.provenance !== "local-report" || report.planDigest !== planDigest) throw new ImprovementError("Report does not match the accepted plan.");
   return report;
 }
@@ -33928,7 +33928,7 @@ async function exportImprovementCandidate(options2) {
   const { plan } = await readPlan(options2.jobPath);
   const report = await readImprovementReport(options2.jobPath);
   if (report.state !== "completed" || !report.candidateDigest) throw new ImprovementError("Only a completed candidate can be exported for review.");
-  const snapshot = await checkedPackage(path13.join(options2.jobPath, "candidate"));
+  const snapshot = await checkedPackage(path15.join(options2.jobPath, "candidate"));
   if (treeDigest(snapshot.files) !== report.candidateDigest) throw new ImprovementError("Candidate digest changed since evaluation.");
   if (snapshot.manifest.version !== plan.targetVersion) throw new ImprovementError("Candidate identity does not match the plan.");
   const output2 = await destination(options2.outputPath);
@@ -33938,7 +33938,7 @@ async function exportImprovementCandidate(options2) {
 }
 async function readImprovementPlan(job) {
   job = systemAlias(job);
-  const value = JSON.parse(await readRegularText(path13.join(job, "plan.json"), MAX_STATE));
+  const value = JSON.parse(await readRegularText(path15.join(job, "plan.json"), MAX_STATE));
   if (isRecord7(value) && isRecord7(value.plan) && value.plan.adapter === "codex-text-v1") throw new ImprovementError("This job was planned for the retired codex-text-v1 adapter. Codex execution is disabled until it passes a future isolation gate; create a new plan for Claude Code. No fallback runner is used.");
   if (!isRecord7(value) || !isRecord7(value.plan) || value.plan.schemaVersion !== 1 || value.plan.adapter !== "claude-code-text-v1" || digest4(value.plan) !== value.planDigest) throw new ImprovementError("Plan digest is invalid or the plan changed.");
   return value;
@@ -33985,21 +33985,21 @@ function validateAnalysis(value) {
   return { disposition: value.disposition, findings: value.findings.map((f) => ({ id: f.id, severity: f.severity, summary: f.summary })), changes: value.changes.map((f) => ({ path: f.path, content: f.content })), rationale: value.rationale };
 }
 async function destination(input2) {
-  const absolute2 = path13.resolve(input2);
-  const parent = await realpath9(path13.dirname(absolute2));
+  const absolute2 = path15.resolve(input2);
+  const parent = await realpath9(path15.dirname(absolute2));
   await assertRegularDirectory(parent);
-  return path13.join(parent, path13.basename(absolute2));
+  return path15.join(parent, path15.basename(absolute2));
 }
 function systemAlias(input2) {
-  const absolute2 = path13.resolve(input2);
+  const absolute2 = path15.resolve(input2);
   if (process.platform === "darwin" && ["/tmp", "/var", "/etc"].some((prefix) => absolute2 === prefix || absolute2.startsWith(prefix + "/"))) return "/private" + absolute2;
   return absolute2;
 }
 function assertSeparate(a, b) {
-  if (a === b || a.startsWith(b + path13.sep) || b.startsWith(a + path13.sep)) throw new ImprovementError("Job and export paths must not overlap source, reviewer, or job directories.");
+  if (a === b || a.startsWith(b + path15.sep) || b.startsWith(a + path15.sep)) throw new ImprovementError("Job and export paths must not overlap source, reviewer, or job directories.");
 }
 async function resolveExecutable(input2) {
-  const candidates = input2.includes(path13.sep) ? [path13.resolve(input2)] : (process.env.PATH ?? "").split(path13.delimiter).filter(Boolean).map((p) => path13.join(p, input2));
+  const candidates = input2.includes(path15.sep) ? [path15.resolve(input2)] : (process.env.PATH ?? "").split(path15.delimiter).filter(Boolean).map((p) => path15.join(p, input2));
   for (const candidate of candidates) {
     try {
       const resolved = await realpath9(candidate);
@@ -34012,10 +34012,10 @@ async function resolveExecutable(input2) {
   throw new ImprovementError("Claude Code executable is unavailable. Install Claude Code and sign in with your existing account before planning a run.");
 }
 async function executableDigest(executable) {
-  return createHash6("sha256").update(await readFile2(executable)).digest("hex");
+  return createHash8("sha256").update(await readFile3(executable)).digest("hex");
 }
 function claudeEnvironment(tmp) {
-  const env = { PATH: process.env.PATH, HOME: os4.homedir(), TMPDIR: tmp, LANG: "en_US.UTF-8" };
+  const env = { PATH: process.env.PATH, HOME: os6.homedir(), TMPDIR: tmp, LANG: "en_US.UTF-8" };
   for (const name of ["USER", "LOGNAME", "SHELL", "CLAUDE_CONFIG_DIR"]) if (process.env[name]) env[name] = process.env[name];
   return env;
 }
@@ -34027,7 +34027,7 @@ async function inspectImprovementRunner(input2) {
   const executable = await resolveExecutable(input2 ?? "claude");
   let version2;
   try {
-    const { stdout: stdout2 } = await promisify(execFile)(executable, ["--version"], { timeout: 1e4, maxBuffer: 4096, encoding: "utf8", env: claudeEnvironment(os4.tmpdir()) });
+    const { stdout: stdout2 } = await promisify(execFile)(executable, ["--version"], { timeout: 1e4, maxBuffer: 4096, encoding: "utf8", env: claudeEnvironment(os6.tmpdir()) });
     version2 = /^([0-9]+\.[0-9]+\.[0-9]+) \(Claude Code\)\s*$/.exec(stdout2)?.[1];
   } catch {
   }
@@ -34087,8 +34087,8 @@ function claudeEventViolation(state, event, model, runnerVersion) {
   return claudeFailure.invalid;
 }
 async function invokeClaude(plan, job, call, payload, stage, signal) {
-  const scratch = path13.join(job, `call-${call}`);
-  await mkdir2(scratch, { mode: 448 });
+  const scratch = path15.join(job, `call-${call}`);
+  await mkdir3(scratch, { mode: 448 });
   const string4 = { type: "string" };
   const schema = stage === "evaluate" ? { type: "object", additionalProperties: false, properties: { response: string4 }, required: ["response"] } : {
     type: "object",
@@ -34217,7 +34217,7 @@ async function invokeClaude(plan, job, call, payload, stage, signal) {
     if (JSON.stringify(state.value).length > MAX_OUTPUT) throw new ImprovementError("Runner output limit exceeded.");
     return { value: state.value, observedModel: plan.model };
   } finally {
-    await rm2(scratch, { recursive: true, force: true });
+    await rm3(scratch, { recursive: true, force: true });
   }
 }
 var ImprovementError, MAX_OUTPUT, MAX_STATE, MAX_STREAM, MAX_EVENT, digest4, treeDigest, readPlan, MINIMUM_CLAUDE_VERSION, CLAUDE_SYSTEM_PROMPT, allowedClaudePlugins, claudeFailure;
@@ -34233,7 +34233,7 @@ var init_skill_improvement = __esm({
     MAX_STATE = 8 * 1024 * 1024;
     MAX_STREAM = 16 * 1024 * 1024;
     MAX_EVENT = 4 * 1024 * 1024;
-    digest4 = (value) => createHash6("sha256").update(JSON.stringify(value)).digest("hex");
+    digest4 = (value) => createHash8("sha256").update(JSON.stringify(value)).digest("hex");
     treeDigest = (files2) => digest4({ files: [...files2].sort((a, b) => a.path.localeCompare(b.path)) });
     readPlan = readImprovementPlan;
     MINIMUM_CLAUDE_VERSION = [2, 1, 283];
@@ -34260,9 +34260,9 @@ __export(skill_improvement_registry_exports, {
   shareImprovementEvidence: () => shareImprovementEvidence,
   shareRecordedImprovementEvidence: () => shareRecordedImprovementEvidence
 });
-import { createHash as createHash7 } from "node:crypto";
-import { mkdir as mkdir3, realpath as realpath10 } from "node:fs/promises";
-import path14 from "node:path";
+import { createHash as createHash9 } from "node:crypto";
+import { mkdir as mkdir4, realpath as realpath10 } from "node:fs/promises";
+import path16 from "node:path";
 async function fetchImprovementJob(api, input2) {
   const response = await api.get(`${base2}/plans/${encodeURIComponent(input2.planId)}`);
   const record5 = checkedRecord(response.plan, input2.planId);
@@ -34297,14 +34297,14 @@ async function fetchImprovementJob(api, input2) {
     if (snapshot.artifact.sha256 !== pin.artifactSha256) throw new Error("A downloaded release differs from the prepared artifact digest.");
     return snapshot;
   }));
-  const output2 = path14.join(await realpath10(path14.dirname(path14.resolve(input2.outputPath))), path14.basename(input2.outputPath));
+  const output2 = path16.join(await realpath10(path16.dirname(path16.resolve(input2.outputPath))), path16.basename(input2.outputPath));
   const inputs = `${output2}.inputs`;
-  await mkdir3(inputs, { mode: 448 });
-  const sourcePath = path14.join(inputs, "source");
+  await mkdir4(inputs, { mode: 448 });
+  const sourcePath = path16.join(inputs, "source");
   await writeNewPackageTree(inputs, sourcePath, snapshots[0].files);
   const reviewerPaths = [];
   for (let i = 1; i < snapshots.length; i += 1) {
-    const dir = path14.join(inputs, `reviewer-${i}`);
+    const dir = path16.join(inputs, `reviewer-${i}`);
     await writeNewPackageTree(inputs, dir, snapshots[i].files);
     reviewerPaths.push(dir);
   }
@@ -34340,7 +34340,7 @@ async function registryLifecycle(api, jobPath, coordinatorVersion) {
   let runId;
   let sequence = 0;
   const jobRoot = await realpath10(jobPath);
-  const statePath = path14.join(jobRoot, "registry-run.json");
+  const statePath = path16.join(jobRoot, "registry-run.json");
   const save = async (reportSha256) => atomicPrivateWrite(jobRoot, statePath, JSON.stringify({ planDigest, planId: binding.planId, runId, sequence, reportSha256: reportSha256 ?? null }, null, 2));
   const event = async (value) => {
     if (!runId) throw new Error("The registry run has not started.");
@@ -34443,7 +34443,7 @@ async function shareImprovementEvidence(api, input2) {
   if (!plan.registry || plan.registry.apiUrl !== api.apiUrl) throw new Error("Evidence sharing requires the original registry endpoint and plan.");
   if (plan.registry.record.plan.resultSharing === "local-only") throw new Error("This plan is local-only; evidence sharing was not authorized.");
   if (input2.disclosure !== "summary") throw new Error("This adapter shares summary evidence only. Raw findings stay local.");
-  const state = JSON.parse(await readRegularText(path14.join(await realpath10(input2.jobPath), "registry-run.json"), 64e3));
+  const state = JSON.parse(await readRegularText(path16.join(await realpath10(input2.jobPath), "registry-run.json"), 64e3));
   if (!state || state.planDigest !== planDigest || typeof state.runId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:@+-]{0,127}$/.test(state.runId) || typeof state.reportSha256 !== "string" || !/^[0-9a-f]{64}$/.test(state.reportSha256)) throw new Error("No confirmed registry completion is available to share.");
   return postImprovementEvidence(api, state.runId, state.reportSha256, input2.disclosure, input2.proposals);
 }
@@ -34460,7 +34460,7 @@ var init_skill_improvement_registry = __esm({
     init_dist();
     init_install_filesystem();
     init_skill_improvement();
-    hash2 = (value) => createHash7("sha256").update(canonicalizeJson(value)).digest("hex");
+    hash2 = (value) => createHash9("sha256").update(canonicalizeJson(value)).digest("hex");
     base2 = "/v1/improvements";
   }
 });
@@ -34531,9 +34531,9 @@ function option(input2, key) {
   if (typeof value !== "string" || !value) throw new Error(`--${key} requires a file.`);
   return value;
 }
-async function readInput(context, path18) {
+async function readInput(context, path19) {
   try {
-    return await context.readInput(path18);
+    return await context.readInput(path19);
   } catch {
     throw new Error("Evaluation input must be a bounded valid JSON object.");
   }
@@ -35045,52 +35045,466 @@ function decodeResponseUtf8(bytes2) {
   }
 }
 
+// src/device-login-store.ts
+init_install_filesystem();
+import { createHash as createHash5 } from "node:crypto";
+import os5 from "node:os";
+import path9 from "node:path";
+
+// src/token-store.ts
+import { createHash as createHash4 } from "node:crypto";
+import { chmod, mkdir as mkdir2, readFile, rm as rm2, writeFile } from "node:fs/promises";
+import os4 from "node:os";
+import path8 from "node:path";
+var KEYRING_SERVICE = "ai.jarel.myskills.cli";
+function createTokenStore(env = process.env, namespace) {
+  const fileStore = createFileTokenStore(env);
+  if (env.MYSKILLS_TOKEN_STORE === "file" || env.MYSKILLS_TOKEN_FILE) {
+    return fileStore;
+  }
+  return createKeyringTokenStore(fileStore, void 0, namespace);
+}
+function createFileTokenStore(env = process.env) {
+  const filePath = tokenFilePath(env);
+  return {
+    async get(apiUrl) {
+      return (await readPayload(filePath)).tokens[normalizeApiUrl(apiUrl)] ?? null;
+    },
+    async set(apiUrl, token) {
+      const payload = await readPayload(filePath);
+      payload.tokens[normalizeApiUrl(apiUrl)] = token;
+      await writePayload(filePath, payload);
+    },
+    async delete(apiUrl) {
+      const payload = await readPayload(filePath);
+      delete payload.tokens[normalizeApiUrl(apiUrl)];
+      if (Object.keys(payload.tokens).length === 0) {
+        await rm2(filePath, { force: true });
+        return;
+      }
+      await writePayload(filePath, payload);
+    },
+    describe() {
+      return {
+        backend: "file",
+        filePath
+      };
+    }
+  };
+}
+function createKeyringTokenStore(fallback, backend = nativeKeyringBackend, namespace) {
+  const credentialKey = (apiUrl) => keyringCredentialKey(apiUrl, namespace);
+  let usedFallback = false;
+  return {
+    async get(apiUrl) {
+      let raw;
+      try {
+        raw = await backend.get(credentialKey(apiUrl));
+      } catch {
+        throw new Error("Cannot read the OS keyring. Unlock or restore keyring access, or explicitly select MYSKILLS_TOKEN_STORE=file.");
+      }
+      if (raw === null) {
+        const token2 = await fallback.get(apiUrl);
+        usedFallback = token2 !== null;
+        return token2;
+      }
+      let token;
+      try {
+        token = parseStoredToken(JSON.parse(raw));
+      } catch {
+        token = null;
+      }
+      if (!token) {
+        throw new Error("The OS keyring credential has an invalid format. Remove it with myskills logout, then log in again.");
+      }
+      usedFallback = false;
+      return token;
+    },
+    async set(apiUrl, token) {
+      try {
+        await backend.set(credentialKey(apiUrl), JSON.stringify(token));
+      } catch {
+        throw new Error("Cannot save the token in the OS keyring. Unlock or restore keyring access, or explicitly select MYSKILLS_TOKEN_STORE=file.");
+      }
+      usedFallback = false;
+      try {
+        await fallback.delete(apiUrl);
+      } catch {
+        throw new Error("The token was saved in the OS keyring, but the older file credential could not be removed. Token storage cleanup is incomplete.");
+      }
+    },
+    async delete(apiUrl) {
+      const results = await Promise.allSettled([backend.delete(credentialKey(apiUrl)), fallback.delete(apiUrl)]);
+      const failed = results.flatMap((result, index) => result.status === "rejected" ? [index === 0 ? "OS keyring" : "file"] : []);
+      if (failed.length > 0) {
+        throw new Error(`Logout cleanup is incomplete: could not remove the ${failed.join(" and ")} credential. Restore storage access and retry logout.`);
+      }
+      usedFallback = false;
+    },
+    async describe() {
+      const fallbackInfo = await fallback.describe?.();
+      if (usedFallback && fallbackInfo) {
+        return fallbackInfo;
+      }
+      return {
+        backend: "keyring",
+        fallbackFilePath: fallbackInfo?.filePath
+      };
+    }
+  };
+}
+var nativeKeyringBackend = {
+  async get(apiUrl) {
+    const { Entry } = await import("@napi-rs/keyring");
+    return new Entry(KEYRING_SERVICE, keyringAccount(apiUrl)).getPassword();
+  },
+  async set(apiUrl, raw) {
+    const { Entry } = await import("@napi-rs/keyring");
+    new Entry(KEYRING_SERVICE, keyringAccount(apiUrl)).setPassword(raw);
+  },
+  async delete(apiUrl) {
+    const { Entry } = await import("@napi-rs/keyring");
+    new Entry(KEYRING_SERVICE, keyringAccount(apiUrl)).deletePassword();
+  }
+};
+function keyringCredentialKey(apiUrl, namespace) {
+  const prefix = namespace === void 0 ? "" : `config-profile:${createHash4("sha256").update(namespace).digest("hex")}:`;
+  return `${prefix}${normalizeApiUrl(apiUrl)}`;
+}
+function tokenFilePath(env) {
+  if (env.MYSKILLS_TOKEN_FILE) {
+    return path8.resolve(env.MYSKILLS_TOKEN_FILE);
+  }
+  if (env.MYSKILLS_CONFIG_DIR) {
+    return path8.join(path8.resolve(env.MYSKILLS_CONFIG_DIR), "tokens.json");
+  }
+  const baseDir = env.XDG_CONFIG_HOME ? path8.join(env.XDG_CONFIG_HOME, "myskills-app") : path8.join(os4.homedir(), ".config", "myskills-app");
+  return path8.join(baseDir, "tokens.json");
+}
+async function readPayload(filePath) {
+  try {
+    const raw = await readFile(filePath, "utf8");
+    return parsePayload(raw);
+  } catch (error62) {
+    if (isNodeError(error62) && error62.code === "ENOENT") {
+      return { version: 1, tokens: {} };
+    }
+    throw error62;
+  }
+}
+async function writePayload(filePath, payload) {
+  await mkdir2(path8.dirname(filePath), { recursive: true, mode: 448 });
+  await writeFile(filePath, `${JSON.stringify(payload, null, 2)}
+`, { mode: 384 });
+  await chmod(filePath, 384);
+}
+function parsePayload(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("Token store file contains invalid JSON. Repair or remove the file before logging in again.");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("Token store file must contain a JSON object.");
+  }
+  const record5 = parsed;
+  if (record5.version !== 1 || !record5.tokens || typeof record5.tokens !== "object" || Array.isArray(record5.tokens)) {
+    throw new Error("Token store file has an unsupported format.");
+  }
+  const tokens = {};
+  for (const [apiUrl, token] of Object.entries(record5.tokens)) {
+    const parsedToken = parseStoredToken(token);
+    if (parsedToken) {
+      tokens[normalizeApiUrl(apiUrl)] = parsedToken;
+    }
+  }
+  return { version: 1, tokens };
+}
+function parseStoredToken(input2) {
+  if (!input2 || typeof input2 !== "object" || Array.isArray(input2)) {
+    return null;
+  }
+  const record5 = input2;
+  if (record5.kind !== "session" && record5.kind !== "api" || typeof record5.token !== "string" || !record5.token) {
+    return null;
+  }
+  return {
+    kind: record5.kind,
+    token: record5.token,
+    email: typeof record5.email === "string" ? record5.email : void 0,
+    expiresAt: typeof record5.expiresAt === "string" ? record5.expiresAt : void 0
+  };
+}
+function normalizeApiUrl(apiUrl) {
+  return apiUrl.replace(/\/+$/, "");
+}
+function keyringAccount(apiUrl) {
+  return `api-url:${Buffer.from(normalizeApiUrl(apiUrl)).toString("base64url")}`;
+}
+function isNodeError(error62) {
+  return error62 instanceof Error && "code" in error62;
+}
+
+// src/device-login-store.ts
+var DeviceLoginError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+function createDeviceLoginStore(namespace, backend = nativeKeyringBackend, lockDirectory) {
+  const key = (apiUrl) => `device-login:${keyringCredentialKey(apiUrl, namespace)}`;
+  return {
+    async get(apiUrl) {
+      let raw;
+      try {
+        raw = await backend.get(key(apiUrl));
+      } catch {
+        throw unavailable();
+      }
+      if (raw === null) return null;
+      try {
+        if (raw.length > 16384) throw new Error();
+        const value = JSON.parse(raw);
+        if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error();
+        return value;
+      } catch {
+        throw new DeviceLoginError("The pending browser login is invalid. Run myskills logout for this API and configuration profile, then log in again.", "DEVICE_LOGIN_STATE_INVALID");
+      }
+    },
+    async set(apiUrl, request) {
+      try {
+        await backend.set(key(apiUrl), JSON.stringify(request));
+      } catch {
+        throw unavailable();
+      }
+    },
+    async delete(apiUrl) {
+      try {
+        await backend.delete(key(apiUrl));
+      } catch {
+        throw new DeviceLoginError("Pending browser login cleanup failed. Restore OS keyring access and retry logout for this API and configuration profile.", "DEVICE_LOGIN_CLEANUP_FAILED");
+      }
+    },
+    async withLock(apiUrl, work) {
+      const directory = path9.join(lockDirectory ?? deviceLoginLockDirectory(), createHash5("sha256").update(key(apiUrl)).digest("hex"));
+      let acquired = false;
+      try {
+        return await withInstallRootLock(directory, async () => {
+          acquired = true;
+          return work();
+        });
+      } catch (error62) {
+        if (acquired) throw error62;
+        throw new DeviceLoginError("Browser login is busy or its process lock could not be acquired. Wait for the other command to exit and retry; preserve an ambiguous lock for operator recovery.", "DEVICE_LOGIN_BUSY");
+      }
+    }
+  };
+}
+function deviceLoginLockDirectory() {
+  try {
+    const home = os5.userInfo().homedir;
+    if (!path9.isAbsolute(home)) throw new Error();
+    return path9.join(home, ".config", "myskills-app", "device-login-locks");
+  } catch {
+    throw new DeviceLoginError("Cannot determine the OS-account home for secure browser-login locking. Configure a valid OS account before browser login or logout; HOME overrides are not used.", "DEVICE_LOGIN_LOCK_UNAVAILABLE");
+  }
+}
+function unavailable() {
+  return new DeviceLoginError("Cannot access secure pending-login storage in the OS keyring. Unlock or restore keyring access, or explicitly use login --method browser --no-resume for an in-memory request.", "DEVICE_LOGIN_STORE_UNAVAILABLE");
+}
+
 // src/device-login.ts
-async function browserDeviceLogin(apiUrl, scopes, runtime) {
-  const api = new URL(apiUrl);
-  if (api.protocol !== "https:" && !(api.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(api.hostname))) throw new Error("Browser login requires HTTPS, except on loopback.");
-  async function post(path18, body) {
-    const signal = AbortSignal.timeout(15e3);
-    const response = await runtime.fetch(`${apiUrl}/v1/auth/device/${path18}`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body), signal, redirect: "error" });
-    const text = decodeResponseUtf8(await readBoundedResponse(response, 16384, signal));
-    const result = JSON.parse(text);
-    if (!result || typeof result !== "object" || Array.isArray(result)) throw new Error("Invalid device login response.");
-    if (!response.ok) throw new Error(`Browser login request failed (HTTP ${response.status}).`);
-    return result;
+async function browserDeviceLogin(apiUrl, scopes, runtime, noResume = false) {
+  apiUrl = apiUrl.replace(/\/+$/, "");
+  const api = safeUrl(apiUrl);
+  if (api.username || api.password || api.search || api.hash) throw invalidResponse();
+  if (!noResume && !runtime.deviceLoginStore) throw new DeviceLoginError("No secure pending-login store is configured. Use login --method browser --no-resume explicitly for an in-memory request.", "DEVICE_LOGIN_STORE_UNAVAILABLE");
+  const controller = new AbortController();
+  const interrupt = () => controller.abort();
+  process.once("SIGINT", interrupt);
+  process.once("SIGTERM", interrupt);
+  const signal = runtime.deviceLogin?.signal ? AbortSignal.any([controller.signal, runtime.deviceLogin.signal]) : controller.signal;
+  const now = runtime.deviceLogin?.now ?? Date.now;
+  const sleep = runtime.deviceLogin?.sleep ?? ((milliseconds, abort) => delay(milliseconds, void 0, { signal: abort }));
+  const store = noResume ? void 0 : runtime.deviceLoginStore;
+  const requestedScopes = scopes ? [...new Set(scopes)].sort() : null;
+  let request;
+  async function post(path19, body, deadline) {
+    const budget = deadline === void 0 ? 15e3 : Math.min(15e3, deadline - now());
+    if (budget <= 0) throw expired();
+    const abort = AbortSignal.any([signal, AbortSignal.timeout(Math.max(1, Math.floor(budget)))]);
+    try {
+      const response = await runtime.fetch(`${apiUrl}/v1/auth/device/${path19}`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body), signal: abort, redirect: "error" });
+      if (!response.ok) throw new DeviceLoginError(`Browser login request failed (HTTP ${response.status}). Retry before the original deadline if a pending request exists.`, "DEVICE_LOGIN_REQUEST_FAILED");
+      const text = decodeResponseUtf8(await readBoundedResponse(response, 16384, abort));
+      let result;
+      try {
+        result = JSON.parse(text);
+      } catch {
+        throw invalidResponse();
+      }
+      if (!result || typeof result !== "object" || Array.isArray(result)) throw invalidResponse();
+      return result;
+    } catch (error62) {
+      if (error62 instanceof DeviceLoginError) throw error62;
+      if (deadline !== void 0 && now() >= deadline) throw expired();
+      throw interrupted();
+    }
   }
-  const request = await post("start", scopes ? { scopes } : {});
-  if (typeof request.deviceCode !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(request.deviceCode) || typeof request.userCode !== "string" || !/^[23456789ABCDEFGHJKLMNPQRSTUVWXYZ]{5}-[23456789ABCDEFGHJKLMNPQRSTUVWXYZ]{5}$/.test(request.userCode) || typeof request.verificationUri !== "string" || typeof request.expiresIn !== "number" || request.expiresIn < 1 || request.expiresIn > 600) throw new Error("Invalid device login response.");
-  const verification = new URL(request.verificationUri);
-  if (verification.protocol !== "https:" && !(verification.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(verification.hostname)) || verification.username || verification.password || verification.search || verification.hash || verification.pathname !== "/auth/device") throw new Error("Invalid device verification URL.");
-  let interval = pollInterval(request.interval);
-  const deadline = Date.now() + request.expiresIn * 1e3;
-  runtime.io.stdout(`Open ${verification.href} and enter device code ${request.userCode}.`);
-  runtime.io.stdout("Review the permissions in your browser. Waiting for your decision\u2026");
-  while (Date.now() < deadline) {
-    await delay(Math.min(interval * 1e3, Math.max(1, deadline - Date.now())));
-    if (Date.now() >= deadline) break;
-    const result = await post("poll", { deviceCode: request.deviceCode });
-    if (result.status === "pending" || result.status === "slow_down") {
-      interval = pollInterval(result.interval);
-      continue;
+  async function clearPending(outcome) {
+    try {
+      await store?.delete(apiUrl);
+    } catch {
+      throw new DeviceLoginError(`${outcome?.message ?? "The credential was saved."} Pending browser login cleanup failed; restore OS keyring access and retry logout.`, outcome?.code ?? "DEVICE_LOGIN_CLEANUP_FAILED");
     }
-    if (result.status === "authorized") {
-      if (typeof result.token !== "string" || !/^aiss_[A-Za-z0-9_-]{43}$/.test(result.token) || typeof result.email !== "string" || typeof result.expiresAt !== "string" || !Number.isFinite(Date.parse(result.expiresAt)) || Date.parse(result.expiresAt) <= Date.now()) throw new Error("Invalid device credential response.");
-      if (!runtime.tokenStore) throw new Error("No credential store is configured.");
-      await runtime.tokenStore.set(apiUrl, { kind: "api", token: result.token, email: result.email, expiresAt: result.expiresAt });
-      await runtime.configStore?.setApiUrl(apiUrl);
-      runtime.io.stdout(`${result.email.replace(/[\u0000-\u001F\u007F-\u009F]/gu, " ")}	logged-in	expires=${result.expiresAt}`);
-      return;
+  }
+  async function run() {
+    if (signal.aborted) throw interrupted();
+    if (noResume && runtime.deviceLoginStore) {
+      let previous2;
+      try {
+        previous2 = await runtime.deviceLoginStore.get(apiUrl);
+      } catch (error63) {
+        if (!(error63 instanceof DeviceLoginError) || error63.code !== "DEVICE_LOGIN_STORE_UNAVAILABLE") throw error63;
+        previous2 = null;
+        runtime.io.stdout("Secure pending state could not be checked. Run logout after keyring access returns before using resumable login again.");
+      }
+      if (previous2 !== null) throw new DeviceLoginError("A pending browser login already exists. Run myskills logout for this API and configuration profile before starting an independent --no-resume request.", "DEVICE_LOGIN_PENDING_EXISTS");
+    }
+    const previous = await store?.get(apiUrl);
+    if (previous !== null && previous !== void 0) {
+      request = pendingRequest(previous);
+      if (Math.min(Date.parse(request.expiresAt), request.deadline) <= now()) {
+        const error63 = expired();
+        await clearPending(error63);
+        throw error63;
+      }
+      if (Date.parse(request.expiresAt) > now() + 6e5) throw invalidState();
+      if (JSON.stringify(request.scopes) !== JSON.stringify(requestedScopes)) throw new DeviceLoginError("A pending browser login requests different scopes. Repeat the same --scopes choice, or run myskills logout for this API and configuration profile before starting a new request.", "DEVICE_LOGIN_SCOPES_MISMATCH");
+      runtime.io.stdout("Resuming the pending browser login.");
+    } else {
+      if (noResume) runtime.io.stdout("Browser login resume is disabled. Interruption requires a new code.");
+      const startedAt = now();
+      const result = await post("start", scopes ? { scopes } : {});
+      if (typeof result.expiresIn !== "number" || !Number.isFinite(result.expiresIn) || result.expiresIn < 1 || result.expiresIn > 600) throw invalidResponse();
+      request = pendingRequest({ ...result, version: 1, scopes: requestedScopes, deadline: Math.min(Date.parse(String(result.expiresAt)), startedAt + result.expiresIn * 1e3), nextPollAt: now() + pollInterval(result.interval) * 1e3 });
+      if (Date.parse(request.expiresAt) > now() + 6e5) throw invalidResponse();
+      if (request.deadline <= now()) throw expired();
+      await store?.set(apiUrl, request);
+    }
+    const deadline = Math.min(Date.parse(request.expiresAt), request.deadline);
+    runtime.io.stdout(`Open ${request.verificationUri} and enter device code ${request.userCode}.`);
+    runtime.io.stdout(`Browser login expires at ${new Date(deadline).toISOString()}. Review the permissions in your browser. Waiting for your decision\u2026`);
+    while (now() < deadline) {
+      if (signal.aborted) throw interrupted();
+      try {
+        await sleep(Math.max(0, Math.min(request.nextPollAt, deadline) - now()), signal);
+      } catch {
+        throw interrupted();
+      }
+      if (signal.aborted) throw interrupted();
+      if (now() >= deadline) break;
+      request.nextPollAt = now() + request.interval * 1e3;
+      await store?.set(apiUrl, request);
+      let result;
+      try {
+        result = await post("poll", { deviceCode: request.deviceCode }, deadline);
+      } catch (error64) {
+        if (error64 instanceof DeviceLoginError && error64.code === "DEVICE_LOGIN_EXPIRED") await clearPending(error64);
+        throw error64;
+      }
+      if (result.status === "pending" || result.status === "slow_down") {
+        request.interval = pollInterval(result.interval);
+        request.nextPollAt = now() + request.interval * 1e3;
+        await store?.set(apiUrl, request);
+        continue;
+      }
+      if (result.status === "authorized") {
+        if (typeof result.token !== "string" || !/^aiss_[A-Za-z0-9_-]{43}$/.test(result.token) || typeof result.email !== "string" || typeof result.expiresAt !== "string" || !Number.isFinite(Date.parse(result.expiresAt)) || Date.parse(result.expiresAt) <= now()) {
+          const error64 = invalidResponse();
+          await clearPending(error64);
+          throw error64;
+        }
+        try {
+          if (!runtime.tokenStore) throw new Error();
+          await runtime.tokenStore.set(apiUrl, { kind: "api", token: result.token, email: result.email, expiresAt: result.expiresAt });
+        } catch {
+          const error64 = new DeviceLoginError("Browser authorization completed, but credential saving was not confirmed. This one-time code cannot be redeemed again. Check myskills auth status; if necessary revoke the CLI browser login token in account settings and start a new login.", "DEVICE_LOGIN_TOKEN_SAVE_FAILED");
+          await clearPending(error64);
+          throw error64;
+        }
+        await clearPending();
+        try {
+          await runtime.configStore?.setApiUrl(apiUrl);
+        } catch {
+          throw new DeviceLoginError("The browser login credential was saved, but saving the selected API URL failed. Use --api-url for this registry and repair the configuration store.", "DEVICE_LOGIN_CONFIG_SAVE_FAILED");
+        }
+        runtime.io.stdout(`${result.email.replace(/[\u0000-\u001F\u007F-\u009F]/gu, " ")}	logged-in	expires=${result.expiresAt}`);
+        return;
+      }
+      const error63 = result.status === "denied" ? new DeviceLoginError("Browser login denied. Start again to request a new code.", "DEVICE_LOGIN_DENIED") : result.status === "expired" ? expired() : result.status === "invalid" ? new DeviceLoginError("Browser login is invalid or already redeemed. A lost response after one-time redemption cannot be recovered. Check myskills auth status or revoke the CLI browser login token in account settings, then start again.", "DEVICE_LOGIN_INVALID") : invalidResponse();
+      await clearPending(error63);
+      throw error63;
     }
-    if (["denied", "expired", "invalid"].includes(String(result.status))) throw new Error(`Browser login ${result.status}.`);
-    throw new Error("Invalid device login response.");
+    const error62 = expired();
+    await clearPending(error62);
+    throw error62;
+  }
+  try {
+    if (runtime.deviceLoginStore) await runtime.deviceLoginStore.withLock(apiUrl, run);
+    else await run();
+  } finally {
+    process.removeListener("SIGINT", interrupt);
+    process.removeListener("SIGTERM", interrupt);
+  }
+  function interrupted() {
+    return new DeviceLoginError(request && store ? `Browser login interrupted. Repeat the same login command before ${new Date(request.deadline).toISOString()} to resume. A response lost after one-time redemption cannot be recovered.` : "Browser login interrupted. Start again to request a new code.", "DEVICE_LOGIN_INTERRUPTED");
+  }
+}
+function pendingRequest(input2) {
+  if (!input2 || typeof input2 !== "object" || Array.isArray(input2)) throw invalidState();
+  const value = input2;
+  if (value.version !== 1 || typeof value.deviceCode !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value.deviceCode) || typeof value.userCode !== "string" || !/^[23456789ABCDEFGHJKLMNPQRSTUVWXYZ]{5}-[23456789ABCDEFGHJKLMNPQRSTUVWXYZ]{5}$/.test(value.userCode) || typeof value.verificationUri !== "string" || typeof value.expiresAt !== "string" || !Number.isFinite(Date.parse(value.expiresAt)) || !(value.scopes === null || Array.isArray(value.scopes) && value.scopes.length > 0 && value.scopes.length <= 100 && value.scopes.every((scope) => typeof scope === "string" && /^[a-z][a-z-]*:[a-z][a-z-]*$/.test(scope))) || typeof value.deadline !== "number" || !Number.isFinite(value.deadline) || value.deadline > Date.parse(value.expiresAt) || typeof value.nextPollAt !== "number" || !Number.isFinite(value.nextPollAt)) throw invalidState();
+  const verification = safeUrl(value.verificationUri);
+  if (verification.username || verification.password || verification.search || verification.hash || verification.pathname !== "/auth/device") throw invalidState();
+  return {
+    version: 1,
+    deviceCode: value.deviceCode,
+    userCode: value.userCode,
+    verificationUri: verification.href,
+    expiresAt: value.expiresAt,
+    deadline: value.deadline,
+    scopes: value.scopes === null ? null : [...new Set(value.scopes)].sort(),
+    interval: pollInterval(value.interval),
+    nextPollAt: value.nextPollAt
+  };
+}
+function safeUrl(value) {
+  let url3;
+  try {
+    url3 = new URL(value);
+  } catch {
+    throw invalidResponse();
   }
-  throw new Error("Browser login expired. Start again to request a new code.");
+  if (url3.protocol !== "https:" && !(url3.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url3.hostname))) throw new DeviceLoginError("Browser login requires HTTPS, except on loopback.", "DEVICE_LOGIN_URL_INVALID");
+  return url3;
 }
 function pollInterval(value) {
-  if (typeof value !== "number" || !Number.isInteger(value) || value < 5 || value > 60) throw new Error("Invalid device polling interval.");
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 5 || value > 60) throw invalidResponse();
   return value;
 }
+function expired() {
+  return new DeviceLoginError("Browser login expired. Start again to request a new code.", "DEVICE_LOGIN_EXPIRED");
+}
+function invalidResponse() {
+  return new DeviceLoginError("Invalid browser login response.", "DEVICE_LOGIN_RESPONSE_INVALID");
+}
+function invalidState() {
+  return new DeviceLoginError("The pending browser login is invalid. Run myskills logout for this API and configuration profile, then log in again.", "DEVICE_LOGIN_STATE_INVALID");
+}
 
 // src/cli.ts
 init_dist();
@@ -35485,8 +35899,8 @@ var organizationReadPaths = {
 };
 async function runRegistryCollaborationCommand(input2, context) {
   const [action, ...args] = input2.args;
-  const send = async (method, path18, body) => {
-    context.output(await context.request(method, path18, body));
+  const send = async (method, path19, body) => {
+    context.output(await context.request(method, path19, body));
   };
   if (input2.command === "skills" && action === "managed") {
     if (args.length) {
@@ -35634,7 +36048,7 @@ function role(input2, allowed) {
 
 // src/account-admin-commands.ts
 import { lstat as lstat8, open as open5, unlink } from "node:fs/promises";
-import path8 from "node:path";
+import path10 from "node:path";
 var accountAdminHelp = [
   "  account register --email <email> [--name <name>]  (prompts for a password and an optional invitation token)",
   "  account verify-email-request|password-reset-request --email <email>",
@@ -35938,7 +36352,7 @@ async function requiredSecret(context, label, trim = false) {
   return value;
 }
 async function withReservedOutput(output2, action, lostMessage) {
-  const file2 = path8.resolve(output2);
+  const file2 = path10.resolve(output2);
   let handle;
   try {
     handle = await open5(file2, "wx", 384);
@@ -36117,16 +36531,16 @@ async function runArchitectureTargetCommand(input2, context) {
 // src/cli.ts
 init_dist2();
 init_dist();
-import { createHash as createHash8, randomUUID as randomUUID3 } from "node:crypto";
-import { lstat as lstat14, mkdir as mkdir4, readFile as readFile3, readdir as readdir6, realpath as realpath11, rename as rename3, rm as rm3, stat as stat3, writeFile } from "node:fs/promises";
-import os5 from "node:os";
-import path15 from "node:path";
+import { createHash as createHash10, randomUUID as randomUUID3 } from "node:crypto";
+import { lstat as lstat14, mkdir as mkdir5, readFile as readFile4, readdir as readdir6, realpath as realpath11, rename as rename3, rm as rm4, stat as stat3, writeFile as writeFile2 } from "node:fs/promises";
+import os7 from "node:os";
+import path17 from "node:path";
 
 // src/codex-readonly-adapter.ts
 init_dist();
 import { constants as fsConstants } from "node:fs";
 import { open as open6, lstat as lstat9, readdir as readdir5 } from "node:fs/promises";
-import path9 from "node:path";
+import path11 from "node:path";
 var codexAdapterProfiles = ["personal", "work", "shared"];
 var codexAdapterDescriptor = Object.freeze({
   kind: "codex",
@@ -36253,7 +36667,7 @@ var CodexReadOnlyArchitectureTargetAdapter = class {
   #clock;
   constructor(optionsOrRoot, profile, clock) {
     const options2 = typeof optionsOrRoot === "string" ? { root: optionsOrRoot, profile, clock } : optionsOrRoot;
-    if (typeof options2.root !== "string" || !options2.root || !path9.isAbsolute(options2.root)) {
+    if (typeof options2.root !== "string" || !options2.root || !path11.isAbsolute(options2.root)) {
       throw new TypeError("A consented absolute target root is required.");
     }
     if (!isCodexAdapterProfile(options2.profile)) {
@@ -36262,7 +36676,7 @@ var CodexReadOnlyArchitectureTargetAdapter = class {
     if (options2.clock !== void 0 && typeof options2.clock !== "function") {
       throw new TypeError("The adapter clock must be a function.");
     }
-    this.#root = path9.resolve(options2.root);
+    this.#root = path11.resolve(options2.root);
     this.#profile = options2.profile;
     this.#clock = options2.clock ?? (() => /* @__PURE__ */ new Date());
   }
@@ -36393,7 +36807,7 @@ var CodexReadOnlyArchitectureTargetAdapter = class {
     return result;
   }
   async #readMetadataFile(relativeName) {
-    const filePath = path9.join(this.#root, relativeName);
+    const filePath = path11.join(this.#root, relativeName);
     let handle;
     try {
       handle = await open6(filePath, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
@@ -36417,7 +36831,7 @@ var CodexReadOnlyArchitectureTargetAdapter = class {
     }
   }
   async #readSkills(profileResolutions, routerPolicy, findings) {
-    const skillsDirectory = path9.join(this.#root, SKILLS_DIRECTORY);
+    const skillsDirectory = path11.join(this.#root, SKILLS_DIRECTORY);
     let entries;
     try {
       const directory = await lstat9(skillsDirectory);
@@ -36450,7 +36864,7 @@ var CodexReadOnlyArchitectureTargetAdapter = class {
     return skills.sort(compareSkills);
   }
   async #readSkill(directorySlug, profileResolutions, routerPolicy, findings) {
-    const skillPath = path9.join(this.#root, SKILLS_DIRECTORY, directorySlug, "SKILL.md");
+    const skillPath = path11.join(this.#root, SKILLS_DIRECTORY, directorySlug, "SKILL.md");
     const frontmatter = await readFrontmatter(skillPath);
     if (frontmatter.status === "missing") findings.add("skill-frontmatter-missing");
     if (frontmatter.status === "invalid") findings.add("skill-frontmatter-invalid");
@@ -36817,10 +37231,10 @@ var CompanionLease = class {
 
 // src/codex-bootstrap.ts
 init_dist2();
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { constants as fsConstants2 } from "node:fs";
-import { lstat as lstat10, open as open7, opendir as opendir3, readFile, realpath as realpath6, stat as stat2, unlink as unlink2 } from "node:fs/promises";
-import path10 from "node:path";
+import { lstat as lstat10, open as open7, opendir as opendir3, readFile as readFile2, realpath as realpath6, stat as stat2, unlink as unlink2 } from "node:fs/promises";
+import path12 from "node:path";
 import { TextDecoder as TextDecoder3 } from "node:util";
 var CODEX_BOOTSTRAP_REPORT_SCHEMA = "myskills.codex-bootstrap-dry-run.v3";
 var CODEX_BOOTSTRAP_CONTRACT_VERSIONS = Object.freeze({
@@ -36961,7 +37375,7 @@ async function readCodexBootstrapContextFile(contextPath) {
   }
   let text;
   try {
-    text = await readFile(path10.resolve(contextPath), "utf8");
+    text = await readFile2(path12.resolve(contextPath), "utf8");
   } catch {
     throw new CodexBootstrapError("BOOTSTRAP_CONTEXT_INVALID", "The work context file could not be read.");
   }
@@ -37211,14 +37625,14 @@ async function normalizePaths(input2) {
   if (sourceRoots.length === 0) {
     throw new CodexBootstrapError("BOOTSTRAP_SOURCE_ROOT_REQUIRED", "At least one typed work or shared source root is required.");
   }
-  const liveSkillsRoot = path10.resolve(input2.liveSkillsRoot);
+  const liveSkillsRoot = path12.resolve(input2.liveSkillsRoot);
   const realLiveRoot = await existingDirectoryRealpath(liveSkillsRoot, "BOOTSTRAP_ROOT_INVALID");
   const normalizedSourceRoots = [];
   for (const source2 of sourceRoots) {
     if (!SOURCE_TYPES.includes(source2.type) || !isAbsolutePath(source2.root)) {
       throw new CodexBootstrapError("BOOTSTRAP_SOURCE_ROOT_INVALID", "Every source root must be an absolute, typed work or shared directory.");
     }
-    const root = path10.resolve(source2.root);
+    const root = path12.resolve(source2.root);
     const realRoot = await existingDirectoryRealpath(root, "BOOTSTRAP_SOURCE_ROOT_INVALID");
     if (pathsOverlap2(realRoot, realLiveRoot) || normalizedSourceRoots.some((existing) => pathsOverlap2(existing.realRoot, realRoot))) {
       throw new CodexBootstrapError("BOOTSTRAP_ROOT_OVERLAP", "Source and target roots must be separate trust compartments.");
@@ -37226,8 +37640,8 @@ async function normalizePaths(input2) {
     normalizedSourceRoots.push({ type: source2.type, root, realRoot });
   }
   const requestedReportPath = await resolveReportPath(input2);
-  const reportParent = await secureReportParent(path10.dirname(requestedReportPath));
-  const reportPath = path10.join(reportParent, path10.basename(requestedReportPath));
+  const reportParent = await secureReportParent(path12.dirname(requestedReportPath));
+  const reportPath = path12.join(reportParent, path12.basename(requestedReportPath));
   if (isContained(realLiveRoot, reportParent) || normalizedSourceRoots.some((source2) => isContained(source2.realRoot, reportParent))) {
     throw new CodexBootstrapError("BOOTSTRAP_OUTPUT_UNSAFE", "The report location must be outside source and target roots.");
   }
@@ -37267,7 +37681,7 @@ function rawSourceRoots(input2) {
   if (input2.sharedSourceRoot !== void 0) roots.push({ type: "shared", root: input2.sharedSourceRoot });
   const unique = /* @__PURE__ */ new Map();
   for (const source2 of roots) {
-    const normalizedRoot = typeof source2.root === "string" ? path10.resolve(source2.root) : String(source2.root);
+    const normalizedRoot = typeof source2.root === "string" ? path12.resolve(source2.root) : String(source2.root);
     unique.set(`${String(source2.type)}\0${normalizedRoot}`, source2);
   }
   return [...unique.values()];
@@ -37277,7 +37691,7 @@ async function resolveReportPath(input2) {
   if (!isAbsolutePath(requested)) {
     throw new CodexBootstrapError("BOOTSTRAP_OUTPUT_REQUIRED", "An absolute report path is required.");
   }
-  const absolute2 = path10.resolve(requested);
+  const absolute2 = path12.resolve(requested);
   let requestedStat;
   try {
     requestedStat = await lstat10(absolute2);
@@ -37287,14 +37701,14 @@ async function resolveReportPath(input2) {
   if (requestedStat?.isSymbolicLink()) {
     throw new CodexBootstrapError("BOOTSTRAP_OUTPUT_UNSAFE", "The report location must not be a symlink.");
   }
-  if (requestedStat?.isDirectory() || requested.endsWith(path10.sep)) return path10.join(absolute2, "dry-run-report.json");
+  if (requestedStat?.isDirectory() || requested.endsWith(path12.sep)) return path12.join(absolute2, "dry-run-report.json");
   if (requestedStat && !requestedStat.isFile()) {
     throw new CodexBootstrapError("BOOTSTRAP_OUTPUT_INVALID", "The report location must be a regular file.");
   }
   return absolute2;
 }
 async function secureReportParent(parentPath) {
-  const lexicalParent = path10.resolve(parentPath);
+  const lexicalParent = path12.resolve(parentPath);
   const realParent = await existingDirectoryRealpath(lexicalParent, "BOOTSTRAP_OUTPUT_INVALID");
   let parentStats;
   try {
@@ -37335,13 +37749,13 @@ async function selectSources(paths, selectors, exclusions) {
     const roots = paths.sourceRoots.filter((source2) => selector.sourceType === void 0 || source2.type === selector.sourceType);
     const matches = [];
     for (const source2 of roots) {
-      const sourceDir = path10.join(source2.realRoot, selector.slug);
+      const sourceDir = path12.join(source2.realRoot, selector.slug);
       try {
         const entry = await lstat10(sourceDir);
         if (entry.isSymbolicLink() || !entry.isDirectory()) continue;
         const realSourceDir = await realpath6(sourceDir);
         if (!isContained(source2.realRoot, realSourceDir)) throw new Error("source path escape");
-        const liveDir = path10.join(paths.realLiveRoot, selector.slug);
+        const liveDir = path12.join(paths.realLiveRoot, selector.slug);
         matches.push({
           slug: selector.slug,
           sourceType: source2.type,
@@ -37572,8 +37986,8 @@ function safeFinding(finding) {
   return { category: finding.category, severity: finding.severity, ...finding.path ? { path: finding.path } : {} };
 }
 async function captureTargetAbsence(targetPath, boundaryRoot) {
-  const absoluteTargetPath = path10.resolve(targetPath);
-  const parentPath = path10.dirname(absoluteTargetPath);
+  const absoluteTargetPath = path12.resolve(targetPath);
+  const parentPath = path12.dirname(absoluteTargetPath);
   const parentStats = await lstat10(parentPath, { bigint: true });
   if (parentStats.isSymbolicLink() || !parentStats.isDirectory()) throw new Error("target absence parent is not regular");
   const parentRealPath = await realpath6(parentPath);
@@ -37584,7 +37998,7 @@ async function captureTargetAbsence(targetPath, boundaryRoot) {
     if (nodeErrorCode(error62) === "ENOENT") {
       return {
         targetPath: absoluteTargetPath,
-        boundaryRoot: path10.resolve(boundaryRoot),
+        boundaryRoot: path12.resolve(boundaryRoot),
         parentPath,
         parentRealPath,
         parentStats
@@ -37620,8 +38034,8 @@ async function readBootstrapSnapshot(rootPath, boundaryRoot, testHooks) {
   if (typeof NO_FOLLOW_FLAG !== "number" || NO_FOLLOW_FLAG === 0 || typeof DIRECTORY_FLAG !== "number" || DIRECTORY_FLAG === 0) {
     throw new Error("secure filesystem flags unavailable");
   }
-  const absoluteRoot = path10.resolve(rootPath);
-  const absoluteBoundaryRoot = path10.resolve(boundaryRoot);
+  const absoluteRoot = path12.resolve(rootPath);
+  const absoluteBoundaryRoot = path12.resolve(boundaryRoot);
   const state = { directories: [], files: [], identities: [], entries: 0, totalBytes: 0 };
   await readBootstrapDirectory(absoluteRoot, absoluteBoundaryRoot, "", 0, state, testHooks);
   if (!state.rootPath || !state.rootRealPath || !state.rootStats || state.directories.length === 0 || state.files.length !== state.identities.length) {
@@ -37670,7 +38084,7 @@ async function readBootstrapDirectory(directoryPath, boundaryRoot, relativePrefi
       entryNames: entries.map((entry) => entry.name)
     });
     for (const entry of entries) {
-      const entryPath = path10.join(directoryPath, entry.name);
+      const entryPath = path12.join(directoryPath, entry.name);
       const relativePath = relativePrefix ? `${relativePrefix}/${entry.name}` : entry.name;
       if (entry.isSymbolicLink()) throw new Error("snapshot symlink is not allowed");
       if (isSensitiveSnapshotPath(relativePath)) throw new Error("snapshot sensitive path is not allowed");
@@ -37819,7 +38233,7 @@ function snapshotToPackageFiles(snapshot) {
   return Object.freeze(snapshot.files.map((file2) => Object.freeze({ path: file2.path, content: file2.content })));
 }
 function snapshotArtifactIdentity(snapshot) {
-  const hash3 = createHash4("sha256");
+  const hash3 = createHash6("sha256");
   for (const file2 of snapshot.files) {
     const pathBytes = Buffer.from(file2.path, "utf8");
     const contentBytes = Buffer.from(file2.content, "utf8");
@@ -37988,7 +38402,7 @@ function compareOrdinal2(left, right) {
   return left === right ? 0 : left < right ? -1 : 1;
 }
 function sha256(value) {
-  return createHash4("sha256").update(value, "utf8").digest("hex");
+  return createHash6("sha256").update(value, "utf8").digest("hex");
 }
 function normalizeTimestamp(value) {
   const timestamp = value ?? (/* @__PURE__ */ new Date()).toISOString();
@@ -38074,7 +38488,7 @@ async function verifyReportPathAfterWrite(paths, reportHandle, parentBefore, ope
 async function cleanupReportDestination(reportPath, openedIdentity) {
   if (!openedIdentity) return;
   try {
-    const parentPath = path10.dirname(reportPath);
+    const parentPath = path12.dirname(reportPath);
     const parentReal = await realpath6(parentPath);
     const reportReal = await realpath6(reportPath);
     if (parentReal !== parentPath || reportReal !== reportPath) return;
@@ -38084,7 +38498,7 @@ async function cleanupReportDestination(reportPath, openedIdentity) {
   }
 }
 function isAbsolutePath(value) {
-  return typeof value === "string" && value.length > 0 && path10.isAbsolute(value) && !value.includes("\0");
+  return typeof value === "string" && value.length > 0 && path12.isAbsolute(value) && !value.includes("\0");
 }
 function isSensitiveSnapshotPath(relativePath) {
   const segments = relativePath.split("/");
@@ -38097,8 +38511,8 @@ function isRecord6(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isContained(root, target) {
-  const relative = path10.relative(path10.resolve(root), path10.resolve(target));
-  return relative === "" || !relative.startsWith("..") && !path10.isAbsolute(relative);
+  const relative = path12.relative(path12.resolve(root), path12.resolve(target));
+  return relative === "" || !relative.startsWith("..") && !path12.isAbsolute(relative);
 }
 function pathsOverlap2(left, right) {
   return isContained(left, right) || isContained(right, left);
@@ -38111,7 +38525,7 @@ function nodeErrorCode(error62) {
 init_dist2();
 init_install_filesystem();
 import { lstat as lstat11, realpath as realpath7 } from "node:fs/promises";
-import path11 from "node:path";
+import path13 from "node:path";
 var DEFAULT_VERSION = "0.1.0";
 var DEFAULT_LICENSE = "UNLICENSED";
 var DEFAULT_SUMMARY = "Describe what this skill does.";
@@ -38138,11 +38552,11 @@ async function initSkillPackage(options2) {
 ` },
     { path: "SKILL.md", content: skillDocument(manifest.name, manifest.summary) }
   ];
-  const requestedOutput = path11.resolve(options2.output ?? path11.join(process.cwd(), options2.name));
+  const requestedOutput = path13.resolve(options2.output ?? path13.join(process.cwd(), options2.name));
   if (CONTROL_CHARACTER_PATTERN3.test(requestedOutput)) {
     throw new SkillInitInputError("Output path must not contain control characters.");
   }
-  const requestedParent = path11.dirname(requestedOutput);
+  const requestedParent = path13.dirname(requestedOutput);
   try {
     await assertRegularDirectory(requestedParent);
   } catch {
@@ -38155,7 +38569,7 @@ async function initSkillPackage(options2) {
   } catch {
     throw new SkillInitDestinationError(`Output parent must be an existing regular directory: ${requestedParent}.`);
   }
-  const outputPath = path11.join(parent, path11.basename(requestedOutput));
+  const outputPath = path13.join(parent, path13.basename(requestedOutput));
   let destinationExists = false;
   try {
     await lstat11(outputPath);
@@ -38224,10 +38638,10 @@ function isNonBlankText(value) {
 // src/author-package.ts
 init_dist2();
 init_install_filesystem();
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { constants as constants4 } from "node:fs";
 import { lstat as lstat12, open as open8, realpath as realpath8 } from "node:fs/promises";
-import path12 from "node:path";
+import path14 from "node:path";
 var SkillPackageDestinationError = class extends Error {
   constructor(message) {
     super(message);
@@ -38236,14 +38650,14 @@ var SkillPackageDestinationError = class extends Error {
 };
 async function packageSkill(options2, fault) {
   if (process.platform !== "darwin" && process.platform !== "linux") throw new Error("Local skill packaging requires macOS or Linux.");
-  const inputPath = await systemAliasPath(path12.resolve(options2.path));
-  const outputPath = await systemAliasPath(path12.resolve(options2.output));
+  const inputPath = await systemAliasPath(path14.resolve(options2.path));
+  const outputPath = await systemAliasPath(path14.resolve(options2.output));
   if (/[\u0000-\u001f\u007f-\u009f]/u.test(inputPath + outputPath)) throw new Error("Package paths must not contain control characters.");
-  if (path12.extname(outputPath).toLowerCase() !== ".zip") throw new SkillPackageDestinationError("Output must name a .zip file.");
+  if (path14.extname(outputPath).toLowerCase() !== ".zip") throw new SkillPackageDestinationError("Output must name a .zip file.");
   const source2 = await lstat12(inputPath, { bigint: true });
   if (!source2.isDirectory() || source2.isSymbolicLink()) throw new Error("Package input must be a regular directory.");
   const sourcePath = await realpath8(inputPath);
-  const parentPath = path12.dirname(outputPath);
+  const parentPath = path14.dirname(outputPath);
   assertOutsideSource(sourcePath, parentPath);
   const parent = await openDirectoryWithoutSymlinks(parentPath);
   try {
@@ -38255,7 +38669,7 @@ async function packageSkill(options2, fault) {
     await fault?.("checked");
     assertIdentity(source2, await lstat12(inputPath, { bigint: true }));
     await assertDestinationParent(parentPath, parent, parentIdentity, sourcePath);
-    const destination2 = process.platform === "linux" ? `/proc/self/fd/${parent.fd}/${path12.basename(outputPath)}` : outputPath;
+    const destination2 = process.platform === "linux" ? `/proc/self/fd/${parent.fd}/${path14.basename(outputPath)}` : outputPath;
     const noFollow = process.platform === "darwin" ? 536870912 : constants4.O_NOFOLLOW;
     let output2;
     try {
@@ -38279,7 +38693,7 @@ async function packageSkill(options2, fault) {
     }
     return {
       output: outputPath,
-      sha256: createHash5("sha256").update(bytes2).digest("hex"),
+      sha256: createHash7("sha256").update(bytes2).digest("hex"),
       size: bytes2.byteLength,
       manifest: snapshot.manifest,
       scan: snapshot.scan
@@ -38289,8 +38703,8 @@ async function packageSkill(options2, fault) {
   }
 }
 function assertOutsideSource(sourcePath, directory) {
-  const relative = path12.relative(sourcePath, directory);
-  if (relative === "" || !relative.startsWith(`..${path12.sep}`) && relative !== ".." && !path12.isAbsolute(relative)) {
+  const relative = path14.relative(sourcePath, directory);
+  if (relative === "" || !relative.startsWith(`..${path14.sep}`) && relative !== ".." && !path14.isAbsolute(relative)) {
     throw new SkillPackageDestinationError("Output parent must be outside the source package directory.");
   }
 }
@@ -38329,13 +38743,13 @@ async function systemAliasPath(requested) {
   if (!alias) return requested;
   const resolved = await realpath8(alias);
   if (resolved !== `/private${alias}`) throw new Error("Package system path alias has an unexpected destination.");
-  return path12.join(resolved, path12.relative(alias, requested));
+  return path14.join(resolved, path14.relative(alias, requested));
 }
 
 // src/cli.ts
 var DEFAULT_API_URL = "http://localhost:3001";
 var SCOPE_TARGET_LIST_LIMIT = 500;
-var CLI_VERSION = "0.1.0-beta.19";
+var CLI_VERSION = "0.1.0-beta.20";
 var CLI_VISIBILITY_SCOPES = ["public", "authenticated", "organization", "team", "private", "explicit-users"];
 var LOGIN_AUTH_METHODS = ["password", "api-key", "browser"];
 var OBSERVED_IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
@@ -38374,8 +38788,7 @@ var CODEX_OBSERVATION_OPTIONS = /* @__PURE__ */ new Set([
 async function runCli(argv, runtime) {
   let parsed;
   let namespace;
-  const enrollmentDirectory = runtime.workspaceEnrollmentStateDirectory ?? workspaceEnrollmentDirectory(runtime.env);
-  const legacyEnrollmentDirectory = runtime.workspaceEnrollmentStateDirectory ? void 0 : legacyWorkspaceEnrollmentDirectory(runtime.env);
+  const enrollmentEnv = runtime.env;
   try {
     const selected = selectConfigurationProfile(argv, runtime.env);
     parsed = parseArgs(selected.argv);
@@ -38400,15 +38813,15 @@ async function runCli(argv, runtime) {
       if (parsed.options.workspace && parsed.options.dir) throw new CliError("Choose --workspace or --dir, not both.", 2);
       const workspace = optionalStringOption(parsed, "workspace");
       if (workspace) {
-        if (!path15.isAbsolute(workspace)) throw new CliError("Workspace must be an absolute directory.", 2);
+        if (!path17.isAbsolute(workspace)) throw new CliError("Workspace must be an absolute directory.", 2);
         if (parsed.options.platform && parsed.options.platform !== "codex") throw new CliError("Workspace installation supports the Codex platform.", 2);
         await assertRegularDirectory(workspace);
         const canonicalWorkspace = await realpath11(workspace);
-        if (canonicalWorkspace === os5.homedir() || [".codex", ".agents"].some((directory) => {
-          const relative = path15.relative(path15.join(os5.homedir(), directory), canonicalWorkspace);
-          return relative === "" || !relative.startsWith("..") && !path15.isAbsolute(relative);
+        if (canonicalWorkspace === os7.homedir() || [".codex", ".agents"].some((directory) => {
+          const relative = path17.relative(path17.join(os7.homedir(), directory), canonicalWorkspace);
+          return relative === "" || !relative.startsWith("..") && !path17.isAbsolute(relative);
         })) throw new CliError("Choose a project workspace, not global configuration.", 2);
-        await ensureSafeDirectory(canonicalWorkspace, path15.join(canonicalWorkspace, ".agents", "skills"));
+        await ensureSafeDirectory(canonicalWorkspace, path17.join(canonicalWorkspace, ".agents", "skills"));
         parsed.options.workspace = canonicalWorkspace;
       }
       const root = installRoot(parsed, runtime);
@@ -38419,11 +38832,15 @@ async function runCli(argv, runtime) {
             await lstat14(workspaceBindingPath(canonicalRoot));
             throw new CliError("This installation root belongs to an enrolled Codex workspace. Use --workspace for workspace mutations.", 2);
           } catch (error62) {
-            if (!isNodeError(error62) || error62.code !== "ENOENT") throw error62;
+            if (!isNodeError2(error62) || error62.code !== "ENOENT") throw error62;
           }
         }
         const managedMutation = parsed.command === "architecture-artifacts" || parsed.command === "codex" && parsed.args[0] === "enroll" || ["install", "update", "rollback", "companion"].includes(parsed.command);
-        if (workspace && managedMutation) return withWorkspaceEnrollment(String(parsed.options.workspace), enrollmentDirectory, parsed.command === "codex" && parsed.args[0] === "enroll", () => dispatchCli(parsed, runtime), { legacyDirectory: legacyEnrollmentDirectory, onAuthorityWait: runtime.workspaceEnrollmentWait });
+        if (workspace && managedMutation) {
+          const enrollmentDirectory = runtime.workspaceEnrollmentStateDirectory ?? workspaceEnrollmentDirectory(enrollmentEnv);
+          const legacyEnrollmentDirectory = runtime.workspaceEnrollmentStateDirectory ? void 0 : legacyWorkspaceEnrollmentDirectory(enrollmentEnv);
+          return withWorkspaceEnrollment(String(parsed.options.workspace), enrollmentDirectory, parsed.command === "codex" && parsed.args[0] === "enroll", () => dispatchCli(parsed, runtime), { legacyDirectory: legacyEnrollmentDirectory, onAuthorityWait: runtime.workspaceEnrollmentWait });
+        }
         return dispatchCli(parsed, runtime);
       });
     }
@@ -38599,9 +39016,9 @@ function parityCommandContext(parsed, runtime) {
     },
     async writeOutput(outputPath, contents) {
       try {
-        await writeFile(path15.resolve(outputPath), contents, { mode: 384, flag: "wx" });
+        await writeFile2(path17.resolve(outputPath), contents, { mode: 384, flag: "wx" });
       } catch (error62) {
-        if (isNodeError(error62) && error62.code === "EEXIST") throw new CliError("The output path already exists. Choose a new file; existing files are not replaced.", 1, "OUTPUT_EXISTS");
+        if (isNodeError2(error62) && error62.code === "EEXIST") throw new CliError("The output path already exists. Choose a new file; existing files are not replaced.", 1, "OUTPUT_EXISTS");
         throw error62;
       }
     }
@@ -38800,7 +39217,7 @@ async function initCommand(parsed, runtime) {
   }
   const quotedPath = displayCliPath(result.outputPath);
   const next = {
-    edit: displayCliPath(path15.join(result.outputPath, "SKILL.md")),
+    edit: displayCliPath(path17.join(result.outputPath, "SKILL.md")),
     validate: `myskills validate --path ${quotedPath}`,
     scan: `myskills scan --path ${quotedPath}`,
     submit: `myskills submit --path ${quotedPath}`
@@ -38936,9 +39353,9 @@ async function loginCommand(parsed, runtime) {
   const method = await loginAuthMethod(parsed, runtime);
   if (method === "browser") {
     try {
-      await browserDeviceLogin(apiUrl, optionalStringOption(parsed, "scopes")?.split(",").map((scope) => scope.trim()), runtime);
+      await browserDeviceLogin(apiUrl, optionalStringOption(parsed, "scopes")?.split(",").map((scope) => scope.trim()), runtime, parsed.options["no-resume"] === true);
     } catch (error62) {
-      throw new CliError(error62 instanceof Error ? error62.message : "Browser login failed.", 1);
+      throw new CliError(error62 instanceof DeviceLoginError ? error62.message : "Browser login failed.", 1, error62 instanceof DeviceLoginError ? error62.code : "DEVICE_LOGIN_FAILED");
     }
     return 0;
   }
@@ -38990,6 +39407,39 @@ async function completeMfaLogin(loginResponse, parsed, runtime) {
   return authSessionFromResponse(verifyResponse);
 }
 async function logoutCommand(parsed, runtime) {
+  const apiUrl = apiBaseUrl(parsed, runtime);
+  if (runtime.deviceLoginStore) {
+    try {
+      return await runtime.deviceLoginStore.withLock(apiUrl, async () => {
+        let pending = null;
+        let cleanupFailed = false;
+        try {
+          pending = await runtime.deviceLoginStore.get(apiUrl).catch((error62) => {
+            if (error62 instanceof DeviceLoginError && error62.code === "DEVICE_LOGIN_STATE_INVALID") return true;
+            throw error62;
+          });
+          await runtime.deviceLoginStore.delete(apiUrl);
+        } catch {
+          cleanupFailed = true;
+        }
+        let result;
+        try {
+          result = await logoutCredential(parsed, runtime, pending !== null);
+        } catch (error62) {
+          if (cleanupFailed) throw new CliError("Credential logout was attempted, but pending browser login cleanup could not be confirmed. Restore OS keyring access and retry logout; check account settings for remote revocation.", 1, "DEVICE_LOGIN_CLEANUP_FAILED");
+          throw error62;
+        }
+        if (cleanupFailed) throw new CliError("Credential logout completed, but pending browser login cleanup could not be confirmed. Restore OS keyring access and retry logout before resuming browser login.", 1, "DEVICE_LOGIN_CLEANUP_FAILED");
+        return result;
+      });
+    } catch (error62) {
+      if (error62 instanceof DeviceLoginError) throw new CliError(error62.message, 1, error62.code);
+      throw error62;
+    }
+  }
+  return logoutCredential(parsed, runtime, false);
+}
+async function logoutCredential(parsed, runtime, removedPending) {
   const apiUrl = apiBaseUrl(parsed, runtime);
   let resolved;
   try {
@@ -39005,6 +39455,10 @@ async function logoutCommand(parsed, runtime) {
     throw new CliError("Stored credentials were unreadable. Local cleanup succeeded, but remote revocation could not be confirmed. Revoke the session or API token through the account settings.", 1, "LOGOUT_REMOTE_UNCONFIRMED");
   }
   if (!resolved) {
+    if (removedPending) {
+      runtime.io.stdout("pending browser login removed	local-only");
+      return 0;
+    }
     throw new CliError("Not logged in. Run myskills login, set MYSKILLS_TOKEN, or pass --token.", 1);
   }
   if (resolved.source === "store" && resolved.stored.kind === "api") {
@@ -39299,17 +39753,17 @@ async function reviewCommand(parsed, runtime) {
     }
     const outputPath = optionalStringOption(parsed, "output");
     if (outputPath) {
-      await mkdir4(path15.dirname(path15.resolve(outputPath)), { recursive: true });
-      await writeFile(path15.resolve(outputPath), response.text, { encoding: "utf8", mode: 384 });
+      await mkdir5(path17.dirname(path17.resolve(outputPath)), { recursive: true });
+      await writeFile2(path17.resolve(outputPath), response.text, { encoding: "utf8", mode: 384 });
     }
     if (parsed.options.json) {
       runtime.io.stdout(JSON.stringify({
         artifactSha256,
-        ...outputPath ? { output: path15.resolve(outputPath) } : {},
+        ...outputPath ? { output: path17.resolve(outputPath) } : {},
         payload: parseJsonResponse(`/v1/review/submissions/${submissionId}/bundle`, apiBaseUrl(parsed, runtime), response.text)
       }, null, 2));
     } else {
-      runtime.io.stdout([`artifactSha256=${artifactSha256}`, ...outputPath ? [`output=${path15.resolve(outputPath)}`] : []].map((field) => terminalSafeText(field)).join("	"));
+      runtime.io.stdout([`artifactSha256=${artifactSha256}`, ...outputPath ? [`output=${path17.resolve(outputPath)}`] : []].map((field) => terminalSafeText(field)).join("	"));
     }
     return 0;
   }
@@ -39716,7 +40170,7 @@ function assertCodexObservationOptions(parsed, healthOnly) {
 }
 function requiredCodexRoot(parsed) {
   const root = parsed.options.root;
-  if (typeof root !== "string" || !root || hasControlCharacter(root) || !path15.isAbsolute(root)) {
+  if (typeof root !== "string" || !root || hasControlCharacter(root) || !path17.isAbsolute(root)) {
     throw new CliError("An explicit absolute --root is required; the CLI does not discover a Codex home or profile.", 2, "CODEX_TARGET_ROOT_INVALID");
   }
   return root;
@@ -39768,7 +40222,7 @@ async function readCodexAdapterContext(parsed) {
   }
   let text;
   try {
-    text = await readFile3(path15.resolve(contextPath), "utf8");
+    text = await readFile4(path17.resolve(contextPath), "utf8");
   } catch {
     throw new CliError("The context JSON file could not be read.", 2, "CODEX_TARGET_CONTEXT_INVALID");
   }
@@ -40029,7 +40483,7 @@ async function releaseMetadataOptions(parsed) {
   const releaseNotesFile = optionalStringOption(parsed, "release-notes-file");
   const adapterContractVersion = optionalStringOption(parsed, "minimum-adapter-contract-version");
   const raw = {
-    ...releaseNotesFile ? { releaseNotes: await readFile3(path15.resolve(releaseNotesFile), "utf8") } : {},
+    ...releaseNotesFile ? { releaseNotes: await readFile4(path17.resolve(releaseNotesFile), "utf8") } : {},
     ...optionalStringOption(parsed, "change-kind") ? { changeKind: optionalStringOption(parsed, "change-kind") } : {},
     ...parsed.options["requires-user-action"] === true ? { requiresUserAction: true } : {},
     compatibility: {
@@ -40054,7 +40508,7 @@ async function exportCommand(parsed, runtime) {
   const outputDir = stringOption(parsed, "output");
   const token = await tokenOption(parsed, runtime) ?? void 0;
   const bundle = await downloadVerifiedBundle({ slug, version: version2, platform }, parsed, runtime, token);
-  const outputRoot = path15.resolve(outputDir);
+  const outputRoot = path17.resolve(outputDir);
   await exportPackageTree(bundle.files, outputRoot);
   runtime.io.stdout(terminalText`${slug}@${version2}\texported\tfiles=${bundle.files.length}\t${outputRoot}`);
   return 0;
@@ -40117,18 +40571,18 @@ async function verifiedLibraryReviewBundle(pathname, parsed, runtime, token) {
     throw new CliError("The review bundle response has no valid artifact digest. Nothing was printed or written.", 1, "ARTIFACT_HASH_MISSING");
   }
   const bytes2 = Buffer.from(response.text, "utf8");
-  if (createHash8("sha256").update(bytes2).digest("hex") !== artifactSha256 || expectedDigest !== void 0 && artifactSha256 !== expectedDigest) {
+  if (createHash10("sha256").update(bytes2).digest("hex") !== artifactSha256 || expectedDigest !== void 0 && artifactSha256 !== expectedDigest) {
     throw new CliError("The review bundle does not match its artifact digest. Nothing was printed or written; do not elevate this release.", 1, "ARTIFACT_HASH_MISMATCH");
   }
   const payload = parseJsonResponse(pathname, apiBaseUrl(parsed, runtime), response.text);
   if (!Array.isArray(payload.files)) throw new CliError("The review bundle is not an inspectable package.", 1, "ARTIFACT_INVALID");
   const outputPath = optionalStringOption(parsed, "output");
-  const output2 = outputPath ? path15.resolve(outputPath) : null;
+  const output2 = outputPath ? path17.resolve(outputPath) : null;
   if (output2) {
     try {
-      await writeFile(output2, bytes2, { mode: 384, flag: "wx" });
+      await writeFile2(output2, bytes2, { mode: 384, flag: "wx" });
     } catch (error62) {
-      if (isNodeError(error62) && error62.code === "EEXIST") throw new CliError("The output path already exists. Choose a new file; existing files are not replaced.", 1, "OUTPUT_EXISTS");
+      if (isNodeError2(error62) && error62.code === "EEXIST") throw new CliError("The output path already exists. Choose a new file; existing files are not replaced.", 1, "OUTPUT_EXISTS");
       throw error62;
     }
   }
@@ -40431,8 +40885,8 @@ async function rollbackCommand(parsed, runtime) {
     assertMatchingProvenance(existing, provenance);
   }
   const outputRoot = skillInstallPath(root, slug);
-  const sourceSnapshotPath = path15.resolve(previous.snapshotPath);
-  assertChildPath(path15.join(root, ".myskills-app", "history"), sourceSnapshotPath);
+  const sourceSnapshotPath = path17.resolve(previous.snapshotPath);
+  assertChildPath(path17.join(root, ".myskills-app", "history"), sourceSnapshotPath);
   if (!await pathExists(outputRoot) || !await pathExists(sourceSnapshotPath)) {
     throw new CliError(`${slug} cannot roll back because its active install or snapshot is missing.`, 1);
   }
@@ -40468,7 +40922,7 @@ async function rollbackCommand(parsed, runtime) {
   await runtime.installFault?.("prepared");
   await runtime.beforeInstallPromotion?.();
   await assertInstalledBytes(existing);
-  await ensureSafeDirectory(root, path15.dirname(recoverySnapshotPath));
+  await ensureSafeDirectory(root, path17.dirname(recoverySnapshotPath));
   await rename3(outputRoot, recoverySnapshotPath);
   transaction2 = { ...transaction2, state: "previous-staged" };
   await writeInstallTransaction(root, transaction2);
@@ -40496,14 +40950,14 @@ async function rollbackCommand(parsed, runtime) {
   transaction2 = { ...transaction2, state: "registry-committed" };
   await writeInstallTransaction(root, transaction2);
   await runtime.installFault?.("registry-committed");
-  await rm3(recoverySnapshotPath, { recursive: true, force: true });
-  await rm3(sourceSnapshotPath, { recursive: true, force: true });
-  await rm3(installTransactionPath(root, transactionId), { force: true });
+  await rm4(recoverySnapshotPath, { recursive: true, force: true });
+  await rm4(sourceSnapshotPath, { recursive: true, force: true });
+  await rm4(installTransactionPath(root, transactionId), { force: true });
   runtime.io.stdout(terminalText`${slug}@${previous.version}\trolled-back\tplatform=${previous.platform}\t${outputRoot}`);
   return 0;
 }
 function workspaceBindingPath(root) {
-  return path15.join(root, ".myskills-app", "codex-workspace.json");
+  return path17.join(root, ".myskills-app", "codex-workspace.json");
 }
 async function readWorkspaceBinding(root) {
   let input2;
@@ -40575,7 +41029,7 @@ async function codexWorkspaceCommand(parsed, runtime) {
       await lstat14(workspaceBindingPath(root));
       binding = await readWorkspaceBinding(root);
     } catch (error62) {
-      if (!isNodeError(error62) || error62.code !== "ENOENT") throw error62;
+      if (!isNodeError2(error62) || error62.code !== "ENOENT") throw error62;
     }
     if (binding) assertMatchingProvenance(binding, provenance);
     const requestedTarget = optionalStringOption(parsed, "target-id");
@@ -40594,7 +41048,7 @@ async function codexWorkspaceCommand(parsed, runtime) {
         profileId: parseArchitectureReference(stringOption(parsed, "profile-id"), "profile"),
         adapter: codexWorkspaceDescriptor,
         capabilities: codexWorkspaceCapabilities,
-        identityDigest: createHash8("sha256").update(randomUUID3()).digest("hex")
+        identityDigest: createHash10("sha256").update(randomUUID3()).digest("hex")
       }, parsed, runtime, token)).target);
     }
     binding = { schemaVersion: 1, rootDigest: workspaceRootDigest(root), provenance, target };
@@ -40812,7 +41266,7 @@ async function storedProjectRoot(parsed) {
   try {
     return (await canonicalScopeDirectory(value, { allowBroad: true, label: "The project directory" })).path;
   } catch (error62) {
-    if (typeof value === "string" && path15.isAbsolute(value)) return path15.resolve(value);
+    if (typeof value === "string" && path17.isAbsolute(value)) return path17.resolve(value);
     throw error62;
   }
 }
@@ -40951,7 +41405,7 @@ async function scopesEnroll(parsed, runtime) {
       const upgraded = record5.rootIdentity.dev === null;
       let backupName = null;
       if (upgraded) {
-        backupName = await backup(`workspace-scopes.root-identity.${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.${createHash8("sha256").update(snapshot.bytes).digest("hex").slice(0, 12)}.json`, snapshot.bytes);
+        backupName = await backup(`workspace-scopes.root-identity.${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.${createHash10("sha256").update(snapshot.bytes).digest("hex").slice(0, 12)}.json`, snapshot.bytes);
         await assertScopeRootUnchanged(location.path, current.identity);
         record5.rootIdentity = current.identity;
         await write(state);
@@ -41589,7 +42043,7 @@ async function installSkillVersion(input2) {
   if (existing) await assertInstalledBytes(existing);
   else if (await pathExists(outputRoot)) throw new CliError("Installation appeared after planning.", 1);
   if (snapshotPath && existing) {
-    await ensureSafeDirectory(input2.root, path15.dirname(snapshotPath));
+    await ensureSafeDirectory(input2.root, path17.dirname(snapshotPath));
     await rename3(outputRoot, snapshotPath);
     history.push({
       version: existing.version,
@@ -41606,7 +42060,7 @@ async function installSkillVersion(input2) {
     await input2.runtime.installFault?.("previous-staged");
   }
   await checkpointInstallPromotion(input2.root, input2.runtime);
-  await ensureSafeDirectory(input2.root, path15.dirname(outputRoot));
+  await ensureSafeDirectory(input2.root, path17.dirname(outputRoot));
   await rename3(stageRoot, outputRoot);
   transaction2 = { ...transaction2, state: "installed" };
   await writeInstallTransaction(input2.root, transaction2);
@@ -41630,7 +42084,7 @@ async function installSkillVersion(input2) {
   transaction2 = { ...transaction2, state: "registry-committed" };
   await writeInstallTransaction(input2.root, transaction2);
   await input2.runtime.installFault?.("registry-committed");
-  await rm3(installTransactionPath(input2.root, transactionId), { force: true });
+  await rm4(installTransactionPath(input2.root, transactionId), { force: true });
   return installed;
 }
 async function downloadVerifiedBundle(input2, parsed, runtime, token) {
@@ -41731,9 +42185,9 @@ function selectReleasePlatform(release, requestedPlatform) {
 function installRoot(parsed, runtime) {
   if (parsed.command === "codex" && !optionalStringOption(parsed, "workspace")) throw new CliError("Codex commands require an explicit --workspace <absolute-dir>.", 2);
   const workspace = optionalStringOption(parsed, "workspace");
-  if (workspace && (!path15.isAbsolute(workspace) || path15.resolve(workspace) === os5.homedir() || path15.resolve(workspace) === path15.join(os5.homedir(), ".codex"))) throw new CliError("Choose an absolute project workspace, not the home or global Codex directory.", 2);
-  const configured = optionalStringOption(parsed, "dir") ?? (workspace ? path15.join(workspace, ".agents", "skills") : void 0) ?? runtime.env.MYSKILLS_INSTALL_DIR ?? (runtime.env.XDG_DATA_HOME ? path15.join(runtime.env.XDG_DATA_HOME, "myskills-app", "skills") : void 0) ?? (runtime.env.HOME ? path15.join(runtime.env.HOME, ".local", "share", "myskills-app", "skills") : void 0) ?? path15.join(process.cwd(), ".myskills-app", "skills");
-  return path15.resolve(configured);
+  if (workspace && (!path17.isAbsolute(workspace) || path17.resolve(workspace) === os7.homedir() || path17.resolve(workspace) === path17.join(os7.homedir(), ".codex"))) throw new CliError("Choose an absolute project workspace, not the home or global Codex directory.", 2);
+  const configured = optionalStringOption(parsed, "dir") ?? (workspace ? path17.join(workspace, ".agents", "skills") : void 0) ?? runtime.env.MYSKILLS_INSTALL_DIR ?? (runtime.env.XDG_DATA_HOME ? path17.join(runtime.env.XDG_DATA_HOME, "myskills-app", "skills") : void 0) ?? (runtime.env.HOME ? path17.join(runtime.env.HOME, ".local", "share", "myskills-app", "skills") : void 0) ?? path17.join(process.cwd(), ".myskills-app", "skills");
+  return path17.resolve(configured);
 }
 async function readInstallRegistry(root) {
   assertInstallRootLocked(root);
@@ -41744,7 +42198,7 @@ async function readInstallRegistryFile(root) {
   try {
     return parseInstallRegistry(await readRegularText(installRegistryPath(root)), root);
   } catch (error62) {
-    if (isNodeError(error62) && error62.code === "ENOENT") {
+    if (isNodeError2(error62) && error62.code === "ENOENT") {
       return { version: 1, installations: {} };
     }
     throw error62;
@@ -41810,8 +42264,8 @@ function parseInstallHistory(input2, root) {
     if (typeof record5.version !== "string" || !parseSemanticVersion(record5.version) || typeof record5.platform !== "string" || typeof record5.snapshotPath !== "string") {
       return [];
     }
-    const snapshotPath = path15.resolve(record5.snapshotPath);
-    assertChildPath(path15.join(root, ".myskills-app", "history"), snapshotPath);
+    const snapshotPath = path17.resolve(record5.snapshotPath);
+    assertChildPath(path17.join(root, ".myskills-app", "history"), snapshotPath);
     return [{
       version: record5.version,
       platform: record5.platform,
@@ -42423,10 +42877,10 @@ async function readObservedStateFixture(inputPath) {
   if (hasControlCharacter(inputPath)) {
     throw new CliError("Observed-state fixture path contains control characters.", 2, "OBSERVED_STATE_INVALID");
   }
-  const resolvedPath = path15.resolve(inputPath);
+  const resolvedPath = path17.resolve(inputPath);
   let text;
   try {
-    text = await readFile3(resolvedPath, "utf8");
+    text = await readFile4(resolvedPath, "utf8");
   } catch {
     throw new CliError("Observed-state fixture could not be read.", 2, "OBSERVED_STATE_INVALID");
   }
@@ -42795,22 +43249,22 @@ function optionalRecordBoolean(record5, key) {
   return typeof value === "boolean" ? value : void 0;
 }
 function installRegistryPath(root) {
-  return path15.join(root, ".myskills-app", "installed.json");
+  return path17.join(root, ".myskills-app", "installed.json");
 }
 function installTransactionsRoot(root) {
-  return path15.join(root, ".myskills-app", "transactions");
+  return path17.join(root, ".myskills-app", "transactions");
 }
 function installTransactionPath(root, transactionId) {
-  return path15.join(installTransactionsRoot(root), `${transactionId}.json`);
+  return path17.join(installTransactionsRoot(root), `${transactionId}.json`);
 }
 function installStagePath(root, transactionId) {
-  return path15.join(root, ".myskills-app", "staging", transactionId);
+  return path17.join(root, ".myskills-app", "staging", transactionId);
 }
 function skillInstallPath(root, slug) {
-  return path15.join(root, parseInstallSlug(slug));
+  return path17.join(root, parseInstallSlug(slug));
 }
 function historySnapshotPath(root, slug, version2, transactionId = randomUUID3()) {
-  return path15.join(root, ".myskills-app", "history", parseInstallSlug(slug), `${transactionId}-${version2}`);
+  return path17.join(root, ".myskills-app", "history", parseInstallSlug(slug), `${transactionId}-${version2}`);
 }
 async function writeInstallTransaction(root, transaction2) {
   assertInstallRootLocked(root);
@@ -42840,33 +43294,33 @@ async function recoverInstallTransactions(root) {
     await assertRegularDirectory(installTransactionsRoot(root));
     entries = await readdir6(installTransactionsRoot(root), { withFileTypes: true });
   } catch (error62) {
-    if (isNodeError(error62) && error62.code === "ENOENT") return;
+    if (isNodeError2(error62) && error62.code === "ENOENT") return;
     throw error62;
   }
   const files2 = entries.filter((entry) => entry.isFile() && /^[0-9a-f-]{36}\.json$/.test(entry.name)).map((entry) => entry.name).sort();
   if (files2.length === 0) return;
   const registry2 = await readInstallRegistryFile(root);
   for (const filename of files2) {
-    const journalPath2 = path15.join(installTransactionsRoot(root), filename);
+    const journalPath2 = path17.join(installTransactionsRoot(root), filename);
     const transaction2 = parseInstallTransaction(await readRegularText(journalPath2), filename, root);
     const outputRoot = skillInstallPath(root, transaction2.slug);
     const stageRoot = installStagePath(root, transaction2.id);
     const snapshotPath = transaction2.previous && transaction2.snapshotCreated ? historySnapshotPath(root, transaction2.slug, transaction2.previous.version, transaction2.id) : null;
-    if (snapshotPath) await ensureSafeDirectory(root, path15.dirname(snapshotPath));
-    await ensureSafeDirectory(root, path15.dirname(stageRoot));
+    if (snapshotPath) await ensureSafeDirectory(root, path17.dirname(snapshotPath));
+    await ensureSafeDirectory(root, path17.dirname(stageRoot));
     const installed = registry2.installations[transaction2.slug];
     const candidateCommitted = Boolean(
       installed && installed.version === transaction2.targetVersion && installed.platform === transaction2.targetPlatform && installed.artifact.sha256 === transaction2.targetArtifact.sha256 && installed.contentDigest === transaction2.targetContentDigest && installed.contentDigestAlgorithm === transaction2.targetContentDigestAlgorithm && await pathExists(outputRoot) && await directoryMatchesDigest(outputRoot, transaction2.targetContentDigest, transaction2.targetContentDigestAlgorithm)
     );
     if (candidateCommitted) {
-      await rm3(stageRoot, { recursive: true, force: true });
+      await rm4(stageRoot, { recursive: true, force: true });
       if (transaction2.operation === "rollback") {
-        if (snapshotPath) await rm3(snapshotPath, { recursive: true, force: true });
+        if (snapshotPath) await rm4(snapshotPath, { recursive: true, force: true });
         if (transaction2.sourceSnapshotPath) {
-          await rm3(transaction2.sourceSnapshotPath, { recursive: true, force: true });
+          await rm4(transaction2.sourceSnapshotPath, { recursive: true, force: true });
         }
       }
-      await rm3(journalPath2, { force: true });
+      await rm4(journalPath2, { force: true });
       continue;
     }
     const previousAtOutput = Boolean(transaction2.previous?.contentDigest && await directoryMatchesDigest(outputRoot, transaction2.previous.contentDigest, transaction2.previous.contentDigestAlgorithm));
@@ -42881,8 +43335,8 @@ async function recoverInstallTransactions(root) {
         throw new CliError("Recovery snapshot does not match its verified bytes. Preserve both copies for operator recovery.", 1);
       }
       if (!previousAtOutput) {
-        await rm3(outputRoot, { recursive: true, force: true });
-        await ensureSafeDirectory(root, path15.dirname(outputRoot));
+        await rm4(outputRoot, { recursive: true, force: true });
+        await ensureSafeDirectory(root, path17.dirname(outputRoot));
         await rename3(snapshotPath, outputRoot);
       }
     } else if (transaction2.snapshotCreated) {
@@ -42890,17 +43344,17 @@ async function recoverInstallTransactions(root) {
         throw new CliError(`Install recovery for ${transaction2.slug} requires manual intervention; its rollback snapshot is missing.`, 1);
       }
     } else if (!transaction2.previous || transaction2.state !== "prepared") {
-      await rm3(outputRoot, { recursive: true, force: true });
+      await rm4(outputRoot, { recursive: true, force: true });
     }
-    await rm3(stageRoot, { recursive: true, force: true });
+    await rm4(stageRoot, { recursive: true, force: true });
     if (transaction2.previous) {
       registry2.installations[transaction2.slug] = transaction2.previous;
     } else {
       delete registry2.installations[transaction2.slug];
     }
     await writeInstallRegistry(root, registry2);
-    if (previousAtOutput && snapshotPath) await rm3(snapshotPath, { recursive: true, force: true });
-    await rm3(journalPath2, { force: true });
+    if (previousAtOutput && snapshotPath) await rm4(snapshotPath, { recursive: true, force: true });
+    await rm4(journalPath2, { force: true });
   }
 }
 function parseInstallTransaction(raw, filename, root) {
@@ -42933,8 +43387,8 @@ function parseInstallTransaction(raw, filename, root) {
     if (typeof record5.sourceSnapshotPath !== "string") {
       throw new CliError("Install rollback transaction is missing its source snapshot.", 1);
     }
-    sourceSnapshotPath = path15.resolve(record5.sourceSnapshotPath);
-    assertChildPath(path15.join(root, ".myskills-app", "history"), sourceSnapshotPath);
+    sourceSnapshotPath = path17.resolve(record5.sourceSnapshotPath);
+    assertChildPath(path17.join(root, ".myskills-app", "history"), sourceSnapshotPath);
   } else if (record5.sourceSnapshotPath !== void 0) {
     throw new CliError("Install transaction journal is invalid.", 1);
   }
@@ -42961,7 +43415,7 @@ function parseContentDigestAlgorithm(input2) {
 }
 function contentDigestForFiles(files2, algorithm) {
   const normalized = files2.map((file2) => ({ path: safeBundlePath(file2.path), content: file2.content })).sort((left, right) => algorithm === CONTENT_DIGEST_ALGORITHM ? left.path < right.path ? -1 : left.path > right.path ? 1 : 0 : left.path.localeCompare(right.path));
-  return createHash8("sha256").update(JSON.stringify(normalized)).digest("hex");
+  return createHash10("sha256").update(JSON.stringify(normalized)).digest("hex");
 }
 async function readStoredPackageSnapshot(inputPath) {
   const files2 = await readPackageFilesFromPath(inputPath);
@@ -43014,15 +43468,15 @@ async function pathExists(filePath) {
     await stat3(filePath);
     return true;
   } catch (error62) {
-    if (isNodeError(error62) && error62.code === "ENOENT") {
+    if (isNodeError2(error62) && error62.code === "ENOENT") {
       return false;
     }
     throw error62;
   }
 }
 function assertChildPath(root, target) {
-  const relative = path15.relative(path15.resolve(root), path15.resolve(target));
-  if (relative.startsWith("..") || path15.isAbsolute(relative)) {
+  const relative = path17.relative(path17.resolve(root), path17.resolve(target));
+  if (relative.startsWith("..") || path17.isAbsolute(relative)) {
     throw new CliError("Install registry contains an unsafe path.", 1);
   }
 }
@@ -43120,7 +43574,7 @@ async function apiFetch(pathname, parsed, runtime, init, artifact) {
   let text;
   try {
     const bytes2 = await readBoundedResponse(response, response.ok && artifact ? artifact.byteSize : MAX_PACKAGE_RESPONSE_BYTES, signal);
-    if (response.ok && artifact && (bytes2.length !== artifact.byteSize || createHash8("sha256").update(bytes2).digest("hex") !== artifact.sha256)) {
+    if (response.ok && artifact && (bytes2.length !== artifact.byteSize || createHash10("sha256").update(bytes2).digest("hex") !== artifact.sha256)) {
       throw new Error("Downloaded bundle did not match release metadata.");
     }
     text = decodeResponseUtf8(bytes2);
@@ -43332,11 +43786,11 @@ async function doctorTokenStoreCheck(runtime) {
 }
 async function doctorInstallDirCheck(parsed, runtime) {
   const root = installRoot(parsed, runtime);
-  const testFile = path15.join(root, ".myskills-app", `doctor-write-test-${randomUUID3()}`);
+  const testFile = path17.join(root, ".myskills-app", `doctor-write-test-${randomUUID3()}`);
   try {
     assertInstallRootLocked(root);
     await atomicPrivateWrite(root, testFile, "ok\n");
-    await rm3(testFile, { force: true });
+    await rm4(testFile, { force: true });
     return {
       name: "install_dir",
       ok: true,
@@ -43379,7 +43833,7 @@ async function filePermissions(filePath) {
   try {
     return ((await stat3(filePath)).mode & 511).toString(8).padStart(3, "0");
   } catch (error62) {
-    if (isNodeError(error62) && error62.code === "ENOENT") {
+    if (isNodeError2(error62) && error62.code === "ENOENT") {
       return null;
     }
     throw error62;
@@ -43605,7 +44059,7 @@ function releaseArtifact(response) {
     byteSize: record5.byteSize
   };
 }
-function isNodeError(error62) {
+function isNodeError2(error62) {
   return error62 instanceof Error && "code" in error62;
 }
 function parseBundlePayload(text) {
@@ -43654,7 +44108,7 @@ function parseArgs(argv) {
       continue;
     }
     const key = value.slice(2);
-    if (key === "json" || key === "api-key" || key === "health" || key === "clear-organizations" || key === "dry-run" || key === "allow-loopback-http" || key === "upload" || key === "include-prerelease" || key === "requires-user-action" || key === "accept-user-action" || key === "allow-cloud" || key === "accept-current-root") {
+    if (key === "json" || key === "api-key" || key === "no-resume" || key === "health" || key === "clear-organizations" || key === "dry-run" || key === "allow-loopback-http" || key === "upload" || key === "include-prerelease" || key === "requires-user-action" || key === "accept-user-action" || key === "allow-cloud" || key === "accept-current-root") {
       options2[key] = true;
       continue;
     }
@@ -43711,7 +44165,7 @@ function helpText(runtime) {
     "  search [query] [--limit <1-100>] [--cursor <cursor>] [--api-url <url>]",
     "  info <skill-slug> [--version <exact-version>] [--api-url <url>]",
     "  login [--api-url <url>] [--method <password|api-key|browser>] [--email <email>]",
-    "  login --method browser [--scopes profile:read,skills:read] (trusted browser consent)",
+    "  login --method browser [--scopes <comma-separated-scopes>] [--no-resume] (repeat to resume before the displayed deadline)",
     "  login --api-key [--api-url <url>]",
     "  logout [--api-url <url>] [--token <token>]",
     "  whoami [--api-url <url>] [--token <token>]",
@@ -43811,11 +44265,11 @@ var LibraryCurationUnavailableError = class extends CliError {
 
 // src/config-store.ts
 import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import os6 from "node:os";
-import path16 from "node:path";
+import os8 from "node:os";
+import path18 from "node:path";
 function createFileConfigStore(env = process.env) {
   const filePath = configFilePath(env);
-  let payload = readPayload(filePath);
+  let payload = readPayload2(filePath);
   return {
     getApiUrl() {
       return payload.apiUrl;
@@ -43825,7 +44279,7 @@ function createFileConfigStore(env = process.env) {
         ...payload,
         apiUrl: apiUrl.replace(/\/+$/, "")
       };
-      writePayload(filePath, payload);
+      writePayload2(filePath, payload);
     },
     async resetApiUrl() {
       payload = { version: 1 };
@@ -43835,31 +44289,31 @@ function createFileConfigStore(env = process.env) {
 }
 function configFilePath(env) {
   if (env.MYSKILLS_CONFIG_FILE) {
-    return path16.resolve(env.MYSKILLS_CONFIG_FILE);
+    return path18.resolve(env.MYSKILLS_CONFIG_FILE);
   }
   if (env.MYSKILLS_CONFIG_DIR) {
-    return path16.join(path16.resolve(env.MYSKILLS_CONFIG_DIR), "config.json");
+    return path18.join(path18.resolve(env.MYSKILLS_CONFIG_DIR), "config.json");
   }
-  const baseDir = env.XDG_CONFIG_HOME ? path16.join(env.XDG_CONFIG_HOME, "myskills-app") : path16.join(os6.homedir(), ".config", "myskills-app");
-  return path16.join(baseDir, "config.json");
+  const baseDir = env.XDG_CONFIG_HOME ? path18.join(env.XDG_CONFIG_HOME, "myskills-app") : path18.join(os8.homedir(), ".config", "myskills-app");
+  return path18.join(baseDir, "config.json");
 }
-function readPayload(filePath) {
+function readPayload2(filePath) {
   try {
-    return parsePayload(readFileSync(filePath, "utf8"));
+    return parsePayload2(readFileSync(filePath, "utf8"));
   } catch (error62) {
-    if (isNodeError2(error62) && error62.code === "ENOENT") {
+    if (isNodeError3(error62) && error62.code === "ENOENT") {
       return { version: 1 };
     }
     throw error62;
   }
 }
-function writePayload(filePath, payload) {
-  mkdirSync(path16.dirname(filePath), { recursive: true, mode: 448 });
+function writePayload2(filePath, payload) {
+  mkdirSync(path18.dirname(filePath), { recursive: true, mode: 448 });
   writeFileSync(filePath, `${JSON.stringify(payload, null, 2)}
 `, { mode: 384 });
   chmodSync(filePath, 384);
 }
-function parsePayload(raw) {
+function parsePayload2(raw) {
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("Config file must contain a JSON object.");
@@ -43873,198 +44327,6 @@ function parsePayload(raw) {
     apiUrl: typeof record5.apiUrl === "string" && record5.apiUrl ? record5.apiUrl.replace(/\/+$/, "") : void 0
   };
 }
-function isNodeError2(error62) {
-  return error62 instanceof Error && "code" in error62;
-}
-
-// src/token-store.ts
-import { createHash as createHash9 } from "node:crypto";
-import { chmod, mkdir as mkdir5, readFile as readFile4, rm as rm4, writeFile as writeFile2 } from "node:fs/promises";
-import os7 from "node:os";
-import path17 from "node:path";
-var KEYRING_SERVICE = "ai.jarel.myskills.cli";
-function createTokenStore(env = process.env, namespace) {
-  const fileStore = createFileTokenStore(env);
-  if (env.MYSKILLS_TOKEN_STORE === "file" || env.MYSKILLS_TOKEN_FILE) {
-    return fileStore;
-  }
-  return createKeyringTokenStore(fileStore, void 0, namespace);
-}
-function createFileTokenStore(env = process.env) {
-  const filePath = tokenFilePath(env);
-  return {
-    async get(apiUrl) {
-      return (await readPayload2(filePath)).tokens[normalizeApiUrl(apiUrl)] ?? null;
-    },
-    async set(apiUrl, token) {
-      const payload = await readPayload2(filePath);
-      payload.tokens[normalizeApiUrl(apiUrl)] = token;
-      await writePayload2(filePath, payload);
-    },
-    async delete(apiUrl) {
-      const payload = await readPayload2(filePath);
-      delete payload.tokens[normalizeApiUrl(apiUrl)];
-      if (Object.keys(payload.tokens).length === 0) {
-        await rm4(filePath, { force: true });
-        return;
-      }
-      await writePayload2(filePath, payload);
-    },
-    describe() {
-      return {
-        backend: "file",
-        filePath
-      };
-    }
-  };
-}
-function createKeyringTokenStore(fallback, backend = nativeKeyringBackend, namespace) {
-  const prefix = namespace === void 0 ? void 0 : `config-profile:${createHash9("sha256").update(namespace).digest("hex")}:`;
-  const credentialKey = (apiUrl) => prefix === void 0 ? apiUrl : `${prefix}${normalizeApiUrl(apiUrl)}`;
-  let usedFallback = false;
-  return {
-    async get(apiUrl) {
-      let raw;
-      try {
-        raw = await backend.get(credentialKey(apiUrl));
-      } catch {
-        throw new Error("Cannot read the OS keyring. Unlock or restore keyring access, or explicitly select MYSKILLS_TOKEN_STORE=file.");
-      }
-      if (raw === null) {
-        const token2 = await fallback.get(apiUrl);
-        usedFallback = token2 !== null;
-        return token2;
-      }
-      let token;
-      try {
-        token = parseStoredToken(JSON.parse(raw));
-      } catch {
-        token = null;
-      }
-      if (!token) {
-        throw new Error("The OS keyring credential has an invalid format. Remove it with myskills logout, then log in again.");
-      }
-      usedFallback = false;
-      return token;
-    },
-    async set(apiUrl, token) {
-      try {
-        await backend.set(credentialKey(apiUrl), JSON.stringify(token));
-      } catch {
-        throw new Error("Cannot save the token in the OS keyring. Unlock or restore keyring access, or explicitly select MYSKILLS_TOKEN_STORE=file.");
-      }
-      usedFallback = false;
-      try {
-        await fallback.delete(apiUrl);
-      } catch {
-        throw new Error("The token was saved in the OS keyring, but the older file credential could not be removed. Token storage cleanup is incomplete.");
-      }
-    },
-    async delete(apiUrl) {
-      const results = await Promise.allSettled([backend.delete(credentialKey(apiUrl)), fallback.delete(apiUrl)]);
-      const failed = results.flatMap((result, index) => result.status === "rejected" ? [index === 0 ? "OS keyring" : "file"] : []);
-      if (failed.length > 0) {
-        throw new Error(`Logout cleanup is incomplete: could not remove the ${failed.join(" and ")} credential. Restore storage access and retry logout.`);
-      }
-      usedFallback = false;
-    },
-    async describe() {
-      const fallbackInfo = await fallback.describe?.();
-      if (usedFallback && fallbackInfo) {
-        return fallbackInfo;
-      }
-      return {
-        backend: "keyring",
-        fallbackFilePath: fallbackInfo?.filePath
-      };
-    }
-  };
-}
-var nativeKeyringBackend = {
-  async get(apiUrl) {
-    const { Entry } = await import("@napi-rs/keyring");
-    return new Entry(KEYRING_SERVICE, keyringAccount(apiUrl)).getPassword();
-  },
-  async set(apiUrl, raw) {
-    const { Entry } = await import("@napi-rs/keyring");
-    new Entry(KEYRING_SERVICE, keyringAccount(apiUrl)).setPassword(raw);
-  },
-  async delete(apiUrl) {
-    const { Entry } = await import("@napi-rs/keyring");
-    new Entry(KEYRING_SERVICE, keyringAccount(apiUrl)).deletePassword();
-  }
-};
-function tokenFilePath(env) {
-  if (env.MYSKILLS_TOKEN_FILE) {
-    return path17.resolve(env.MYSKILLS_TOKEN_FILE);
-  }
-  if (env.MYSKILLS_CONFIG_DIR) {
-    return path17.join(path17.resolve(env.MYSKILLS_CONFIG_DIR), "tokens.json");
-  }
-  const baseDir = env.XDG_CONFIG_HOME ? path17.join(env.XDG_CONFIG_HOME, "myskills-app") : path17.join(os7.homedir(), ".config", "myskills-app");
-  return path17.join(baseDir, "tokens.json");
-}
-async function readPayload2(filePath) {
-  try {
-    const raw = await readFile4(filePath, "utf8");
-    return parsePayload2(raw);
-  } catch (error62) {
-    if (isNodeError3(error62) && error62.code === "ENOENT") {
-      return { version: 1, tokens: {} };
-    }
-    throw error62;
-  }
-}
-async function writePayload2(filePath, payload) {
-  await mkdir5(path17.dirname(filePath), { recursive: true, mode: 448 });
-  await writeFile2(filePath, `${JSON.stringify(payload, null, 2)}
-`, { mode: 384 });
-  await chmod(filePath, 384);
-}
-function parsePayload2(raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new Error("Token store file contains invalid JSON. Repair or remove the file before logging in again.");
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("Token store file must contain a JSON object.");
-  }
-  const record5 = parsed;
-  if (record5.version !== 1 || !record5.tokens || typeof record5.tokens !== "object" || Array.isArray(record5.tokens)) {
-    throw new Error("Token store file has an unsupported format.");
-  }
-  const tokens = {};
-  for (const [apiUrl, token] of Object.entries(record5.tokens)) {
-    const parsedToken = parseStoredToken(token);
-    if (parsedToken) {
-      tokens[normalizeApiUrl(apiUrl)] = parsedToken;
-    }
-  }
-  return { version: 1, tokens };
-}
-function parseStoredToken(input2) {
-  if (!input2 || typeof input2 !== "object" || Array.isArray(input2)) {
-    return null;
-  }
-  const record5 = input2;
-  if (record5.kind !== "session" && record5.kind !== "api" || typeof record5.token !== "string" || !record5.token) {
-    return null;
-  }
-  return {
-    kind: record5.kind,
-    token: record5.token,
-    email: typeof record5.email === "string" ? record5.email : void 0,
-    expiresAt: typeof record5.expiresAt === "string" ? record5.expiresAt : void 0
-  };
-}
-function normalizeApiUrl(apiUrl) {
-  return apiUrl.replace(/\/+$/, "");
-}
-function keyringAccount(apiUrl) {
-  return `api-url:${Buffer.from(normalizeApiUrl(apiUrl)).toString("base64url")}`;
-}
 function isNodeError3(error62) {
   return error62 instanceof Error && "code" in error62;
 }
@@ -44185,7 +44447,7 @@ try {
   const exitCode = await runCli(process.argv.slice(2), {
     env: process.env,
     fetch: fetchImpl,
-    createStores: (env, namespace) => ({ configStore: createFileConfigStore(env), tokenStore: createTokenStore(env, namespace) }),
+    createStores: (env, namespace) => ({ configStore: createFileConfigStore(env), tokenStore: createTokenStore(env, namespace), deviceLoginStore: createDeviceLoginStore(namespace) }),
     prompt,
     io: {
       stdout: (line) => console.log(line),