skillvault-publisher 0.11.2 → 0.13.1

package/dist/index.js

@@ -237,10 +237,10 @@ var require_utils = __commonJS({
         sum += a.length;
       }
       const res = new Uint8Array(sum);
-      for (let i = 0, pad3 = 0; i < arrays.length; i++) {
+      for (let i = 0, pad4 = 0; i < arrays.length; i++) {
         const a = arrays[i];
-        res.set(a, pad3);
-        pad3 += a.length;
+        res.set(a, pad4);
+        pad4 += a.length;
       }
       return res;
     }
@@ -1769,10 +1769,10 @@ var require_utils2 = __commonJS({
         sum += a.length;
       }
       const res = new Uint8Array(sum);
-      for (let i = 0, pad3 = 0; i < arrays.length; i++) {
+      for (let i = 0, pad4 = 0; i < arrays.length; i++) {
         const a = arrays[i];
-        res.set(a, pad3);
-        pad3 += a.length;
+        res.set(a, pad4);
+        pad4 += a.length;
       }
       return res;
     }
@@ -3891,11 +3891,11 @@ function __metadata(metadataKey, metadataValue) {
 }
 function __awaiter(thisArg, _arguments, P, generator) {
   function adopt(value) {
-    return value instanceof P ? value : new P(function(resolve10) {
-      resolve10(value);
+    return value instanceof P ? value : new P(function(resolve12) {
+      resolve12(value);
     });
   }
-  return new (P || (P = Promise))(function(resolve10, reject) {
+  return new (P || (P = Promise))(function(resolve12, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -3911,7 +3911,7 @@ function __awaiter(thisArg, _arguments, P, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve10(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve12(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -4102,14 +4102,14 @@ function __asyncValues(o) {
   }, i);
   function verb(n) {
     i[n] = o[n] && function(v) {
-      return new Promise(function(resolve10, reject) {
-        v = o[n](v), settle(resolve10, reject, v.done, v.value);
+      return new Promise(function(resolve12, reject) {
+        v = o[n](v), settle(resolve12, reject, v.done, v.value);
       });
     };
   }
-  function settle(resolve10, reject, d, v) {
+  function settle(resolve12, reject, d, v) {
     Promise.resolve(v).then(function(v2) {
-      resolve10({ value: v2, done: d });
+      resolve12({ value: v2, done: d });
     }, reject);
   }
 }
@@ -5054,9 +5054,9 @@ var require_clone = __commonJS({
           } else if (_instanceof(parent2, nativeSet)) {
             child = new nativeSet();
           } else if (_instanceof(parent2, nativePromise)) {
-            child = new nativePromise(function(resolve10, reject) {
+            child = new nativePromise(function(resolve12, reject) {
               parent2.then(function(value) {
-                resolve10(_clone(value, depth2 - 1));
+                resolve12(_clone(value, depth2 - 1));
               }, function(err) {
                 reject(_clone(err, depth2 - 1));
               });
@@ -145431,7 +145431,7 @@ var require_pdfkit = __commonJS({
         return `${this.ref.id} 0 R`;
       }
     };
-    var pad3 = (str, length) => (Array(length + 1).join("0") + str).slice(-length);
+    var pad4 = (str, length) => (Array(length + 1).join("0") + str).slice(-length);
     var escapableRe = /[\n\r\t\b\f()\\]/g;
     var escapable = {
       "\n": "\\n",
@@ -145487,7 +145487,7 @@ var require_pdfkit = __commonJS({
         } else if (object instanceof PDFAbstractReference || object instanceof PDFTree || object instanceof SpotColor) {
           return object.toString();
         } else if (object instanceof Date) {
-          let string = `D:${pad3(object.getUTCFullYear(), 4)}` + pad3(object.getUTCMonth() + 1, 2) + pad3(object.getUTCDate(), 2) + pad3(object.getUTCHours(), 2) + pad3(object.getUTCMinutes(), 2) + pad3(object.getUTCSeconds(), 2) + "Z";
+          let string = `D:${pad4(object.getUTCFullYear(), 4)}` + pad4(object.getUTCMonth() + 1, 2) + pad4(object.getUTCDate(), 2) + pad4(object.getUTCHours(), 2) + pad4(object.getUTCMinutes(), 2) + pad4(object.getUTCSeconds(), 2) + "Z";
           if (encryptFn) {
             string = encryptFn(Buffer.from(string, "ascii")).toString("binary");
             string = string.replace(escapableRe, (c) => escapable[c]);
@@ -151595,7 +151595,7 @@ function confColor(c) {
   return SV.sirenRed500;
 }
 async function generatePdfReport(data, outputPath) {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve12, reject) => {
     const doc = new import_pdfkit.default({
       size: "A4",
       margins: { top: 72, bottom: 0, left: 56, right: 56 },
@@ -151742,7 +151742,7 @@ async function generatePdfReport(data, outputPath) {
     yPos += 72;
     drawPageFooter(doc, leftMargin, contentWidth, pageWidth, pageNum);
     doc.end();
-    stream.on("finish", resolve10);
+    stream.on("finish", resolve12);
     stream.on("error", reject);
   });
 }
@@ -151804,7 +151804,7 @@ var init_pdf_report = __esm({
 });
 
 // dist/index.js
-import { Command as Command35 } from "commander";
+import { Command as Command37 } from "commander";
 import { readFileSync as readFileSync18 } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname as dirname5, join as join17 } from "node:path";
@@ -151813,6 +151813,7 @@ import { dirname as dirname5, join as join17 } from "node:path";
 import { Command } from "commander";
 import chalk from "chalk";
 import { randomBytes } from "node:crypto";
+import { createInterface } from "node:readline/promises";
 
 // dist/credentials.js
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, rmSync, existsSync as existsSync2, openSync as openSync2, closeSync as closeSync2, unlinkSync as unlinkSync2 } from "node:fs";
@@ -151861,7 +151862,43 @@ function removeKeypair() {
 }
 
 // dist/commands/login.js
-var loginCommand = new Command("login").description("Authenticate with the Skill Vault server").option("--email <email>", "Your publisher account email").option("--token <token>", "Authenticate with a publisher session JWT (Bearer token from dashboard)").option("--license-key <key>", "Authenticate with a license key (customer)").option("--code <code>", "Redeem an invite code after login").option("--server <url>", "Server URL", "https://api.getskillvault.com").action(async (options) => {
+async function chooseFromMultiple(available, publisherFlag) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    if (publisherFlag) {
+      const match = available.find((p) => p.publisher_id === publisherFlag);
+      if (match)
+        return match;
+      console.error(chalk.red(`Publisher ${publisherFlag} not in your accessible list.`));
+    }
+    console.error(chalk.red("Multiple publishers available for this email. Pass --publisher <id> to choose:"));
+    for (const p of available) {
+      console.error(chalk.dim(`  --publisher ${p.publisher_id}  (${p.publisher_name || "unnamed"}, role: ${p.role})`));
+    }
+    process.exit(1);
+  }
+  console.log();
+  console.log(chalk.bold("  This email has access to multiple publishers:"));
+  console.log();
+  available.forEach((p, idx) => {
+    const roleColor = p.role === "owner" ? chalk.green : p.role === "admin" ? chalk.cyan : chalk.dim;
+    console.log(`  ${chalk.bold(`[${idx + 1}]`)} ${p.publisher_name || p.publisher_id}  ${chalk.dim(`(${p.publisher_id})`)}  ${roleColor(p.role)}`);
+  });
+  console.log();
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    while (true) {
+      const answer = (await rl.question(`  Pick a publisher [1-${available.length}]: `)).trim();
+      const idx = parseInt(answer, 10);
+      if (Number.isInteger(idx) && idx >= 1 && idx <= available.length) {
+        return available[idx - 1];
+      }
+      console.log(chalk.red(`  Invalid choice \u2014 enter a number between 1 and ${available.length}`));
+    }
+  } finally {
+    rl.close();
+  }
+}
+var loginCommand = new Command("login").description("Authenticate with the Skill Vault server").option("--email <email>", "Your publisher account email").option("--token <token>", "Authenticate with a publisher session JWT (Bearer token from dashboard)").option("--license-key <key>", "Authenticate with a license key (customer)").option("--code <code>", "Redeem an invite code after login").option("--publisher <id>", "Disambiguate when your email has access to multiple publisher accounts").option("--server <url>", "Server URL", "https://api.getskillvault.com").action(async (options) => {
   try {
     const serverUrl = options.server;
     const publisherToken = options.token || process.env.SKILLVAULT_TOKEN || null;
@@ -151881,22 +151918,52 @@ var loginCommand = new Command("login").description("Authenticate with the Skill
       publisherIdentity = { publisher_id: me.publisher_id, email: me.email, name: me.name };
     } else if (options.email) {
       console.log(chalk.dim(`Authenticating as ${options.email}...`));
+      const body2 = { email: options.email };
+      if (options.publisher)
+        body2.publisher_id = options.publisher;
       const loginRes = await fetch(`${serverUrl}/auth/login`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ email: options.email })
+        body: JSON.stringify(body2)
       });
       if (!loginRes.ok) {
-        const err = await loginRes.json().catch(() => ({ message: loginRes.statusText }));
-        console.error(chalk.red(`Login failed: ${err.message}`));
+        const err = await loginRes.json().catch(() => null);
+        const reason = err?.message || err?.error || loginRes.statusText || `HTTP ${loginRes.status}`;
+        console.error(chalk.red(`Login failed: ${reason}`));
         if (loginRes.status === 404) {
           console.error(chalk.dim("No account found. Create one at https://app.getskillvault.com/login"));
+          console.error(chalk.dim("Or ask a team owner to add your email via `skillvault-publisher team add`."));
         }
         process.exit(1);
       }
       const loginData = await loginRes.json();
-      sessionToken = loginData.session_token;
-      publisherIdentity = { publisher_id: loginData.publisher_id, email: loginData.email, name: loginData.name };
+      if ("multiple_choice" in loginData && loginData.multiple_choice) {
+        const chosen = await chooseFromMultiple(loginData.available_publishers, options.publisher);
+        const retryRes = await fetch(`${serverUrl}/auth/login`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ email: options.email, publisher_id: chosen.publisher_id })
+        });
+        if (!retryRes.ok) {
+          const err = await retryRes.json().catch(() => null);
+          const reason = err?.message || err?.error || retryRes.statusText;
+          console.error(chalk.red(`Login retry failed: ${reason}`));
+          process.exit(1);
+        }
+        const retryData = await retryRes.json();
+        sessionToken = retryData.session_token;
+        publisherIdentity = { publisher_id: retryData.publisher_id, email: retryData.email, name: retryData.name };
+        if (retryData.role && retryData.role !== "owner") {
+          console.log(chalk.dim(`  Logged in as ${chalk.bold(retryData.role)} of ${chosen.publisher_name || retryData.publisher_id}`));
+        }
+      } else {
+        const single = loginData;
+        sessionToken = single.session_token;
+        publisherIdentity = { publisher_id: single.publisher_id, email: single.email, name: single.name };
+        if (single.role && single.role !== "owner") {
+          console.log(chalk.dim(`  Logged in as ${chalk.bold(single.role)} of ${single.publisher_id}`));
+        }
+      }
     } else if (!options.licenseKey) {
       console.error(chalk.red("Publisher identity required."));
       console.error("");
@@ -152003,7 +152070,7 @@ var registerCommand = new Command2("register").description("Create a new publish
     let verified = false;
     const maxAttempts = 120;
     for (let i = 0; i < maxAttempts; i++) {
-      await new Promise((resolve10) => setTimeout(resolve10, 3e3));
+      await new Promise((resolve12) => setTimeout(resolve12, 3e3));
       try {
         const statusRes = await fetch(`${serverUrl}/publishers/${publisher_id}/verification-status`);
         if (statusRes.ok) {
@@ -152094,7 +152161,7 @@ var logoutCommand = new Command3("logout").description("Remove stored credential
 import { Command as Command4 } from "commander";
 import chalk5 from "chalk";
 import { readFileSync as readFileSync6, existsSync as existsSync6, statSync as statSync3 } from "node:fs";
-import { resolve as resolve4, join as join6 } from "node:path";
+import { resolve as resolve5, join as join6 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 
 // ../shared/dist/crypto.js
@@ -152212,7 +152279,7 @@ function readVaultMetadata(data) {
 // ../shared/dist/packer.js
 import { readFileSync as readFileSync3, readdirSync, existsSync as existsSync3 } from "node:fs";
 import { writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "node:fs";
-import { join as join3, relative } from "node:path";
+import { join as join3, relative, resolve as resolve2, isAbsolute, sep } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 var DEFAULT_IGNORE = /* @__PURE__ */ new Set([
   "node_modules",
@@ -152245,10 +152312,12 @@ function collectFiles(dir, base, ignoreSet) {
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
     if (ignoreSet.has(entry.name))
       continue;
+    if (entry.isSymbolicLink())
+      continue;
     const fullPath = join3(dir, entry.name);
     if (entry.isDirectory()) {
       entries.push(...collectFiles(fullPath, base, ignoreSet));
-    } else {
+    } else if (entry.isFile()) {
       entries.push({
         path: relative(base, fullPath),
         content: readFileSync3(fullPath)
@@ -152529,17 +152598,57 @@ function extractPotentialHeartbeats(content) {
   return values;
 }
 
+// ../shared/dist/skill-name.js
+var MAX_SKILL_NAME_LENGTH = 64;
+var ALLOWED_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/;
+var InvalidSkillNameError = class extends Error {
+  reason;
+  name;
+  constructor(reason, name) {
+    super(`invalid skill name: ${reason}`);
+    this.reason = reason;
+    this.name = name;
+    this.name = "InvalidSkillNameError";
+  }
+};
+function validateSkillName(name) {
+  if (typeof name !== "string") {
+    throw new InvalidSkillNameError("must be a string", String(name));
+  }
+  if (name.length === 0) {
+    throw new InvalidSkillNameError("must not be empty", name);
+  }
+  if (name.length > MAX_SKILL_NAME_LENGTH) {
+    throw new InvalidSkillNameError(`exceeds ${MAX_SKILL_NAME_LENGTH} characters`, name);
+  }
+  for (let i = 0; i < name.length; i++) {
+    const code = name.charCodeAt(i);
+    if (code < 32 || code === 127) {
+      throw new InvalidSkillNameError(`contains control character (0x${code.toString(16).padStart(2, "0")})`, name);
+    }
+  }
+  if (name.includes("..")) {
+    throw new InvalidSkillNameError('contains parent-directory segment "..", which is not allowed in path components', name);
+  }
+  if (name.includes("/") || name.includes("\\")) {
+    throw new InvalidSkillNameError("contains a path separator, which is not allowed in skill names", name);
+  }
+  if (!ALLOWED_PATTERN.test(name)) {
+    throw new InvalidSkillNameError(`must match ${ALLOWED_PATTERN.source} (ASCII letters, digits, dashes, underscores; must start with a letter or digit)`, name);
+  }
+}
+
 // dist/session.js
 import chalk4 from "chalk";
 
 // dist/publisher-workspace.js
 import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, existsSync as existsSync4 } from "node:fs";
-import { join as join4, dirname as dirname3, resolve as resolve2 } from "node:path";
+import { join as join4, dirname as dirname3, resolve as resolve3 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 var MANIFEST_DIRNAME = ".skillvault-publisher";
 var MANIFEST_FILENAME = "workspace.json";
 function workspaceRootsFor(dir) {
-  const abs = resolve2(dir);
+  const abs = resolve3(dir);
   const manifestPath = join4(abs, MANIFEST_DIRNAME, MANIFEST_FILENAME);
   return {
     dir: abs,
@@ -152586,7 +152695,7 @@ function saveWorkspace(dir, manifest) {
   writeFileSync4(manifestPath, JSON.stringify(manifest, null, 2), { mode: 420 });
 }
 function findWorkspace(cwd) {
-  const start = resolve2(cwd ?? process.cwd());
+  const start = resolve3(cwd ?? process.cwd());
   const home = homedir3();
   let dir = start;
   while (true) {
@@ -152658,8 +152767,9 @@ async function sessionFetch(ctx, path, options) {
     process.exit(1);
   }
   if (!res.ok) {
-    const err = await res.json().catch(() => ({ message: res.statusText }));
-    process.stderr.write(chalk4.red(`Error: ${err.message}
+    const err = await res.json().catch(() => null);
+    const reason = err?.message || err?.error || res.statusText || `HTTP ${res.status}`;
+    process.stderr.write(chalk4.red(`Error: ${reason}
 `));
     process.exit(1);
   }
@@ -152696,7 +152806,7 @@ function requireCommandContext(opts = {}) {
 
 // dist/publisher-workspaces-registry.js
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync5, statSync as statSync2 } from "node:fs";
-import { dirname as dirname4, join as join5, resolve as resolve3 } from "node:path";
+import { dirname as dirname4, join as join5, resolve as resolve4 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 var REGISTRY_VERSION = 1;
 var MANIFEST_DIRNAME2 = ".skillvault-publisher";
@@ -152730,7 +152840,7 @@ function listWorkspaces() {
   const live = [];
   let pruned = false;
   for (const entry of reg.workspaces) {
-    const path = resolve3(entry.path);
+    const path = resolve4(entry.path);
     let stillThere = false;
     try {
       const st = statSync2(path);
@@ -152755,8 +152865,8 @@ function listWorkspaces() {
 }
 function registerWorkspace(entry) {
   const reg = readRegistry();
-  const normalized = { ...entry, path: resolve3(entry.path) };
-  const idx = reg.workspaces.findIndex((w) => resolve3(w.path) === normalized.path);
+  const normalized = { ...entry, path: resolve4(entry.path) };
+  const idx = reg.workspaces.findIndex((w) => resolve4(w.path) === normalized.path);
   if (idx >= 0) {
     reg.workspaces[idx] = normalized;
   } else {
@@ -152766,9 +152876,9 @@ function registerWorkspace(entry) {
 }
 function unregisterWorkspace(path) {
   const reg = readRegistry();
-  const target = resolve3(path);
+  const target = resolve4(path);
   const before = reg.workspaces.length;
-  reg.workspaces = reg.workspaces.filter((w) => resolve3(w.path) !== target);
+  reg.workspaces = reg.workspaces.filter((w) => resolve4(w.path) !== target);
   if (reg.workspaces.length !== before)
     writeRegistry(reg);
 }
@@ -152798,9 +152908,9 @@ var publishCommand = new Command4("publish").description("Encrypt and publish a
     const config = ctx.config;
     const workspaceCtx = resolveWorkspaceContext({
       workspaceFlag: options.workspace,
-      cwd: directory ? resolve4(directory) : process.cwd()
+      cwd: directory ? resolve5(directory) : process.cwd()
     });
-    const dirPath = options.workspace ? resolve4(options.workspace) : directory ? resolve4(directory) : workspaceCtx?.dir ?? process.cwd();
+    const dirPath = options.workspace ? resolve5(options.workspace) : directory ? resolve5(directory) : workspaceCtx?.dir ?? process.cwd();
     if (!existsSync6(dirPath) || !statSync3(dirPath).isDirectory()) {
       process.stderr.write(chalk5.red(`Error: "${dirPath}" is not a valid directory
 `));
@@ -152821,6 +152931,17 @@ var publishCommand = new Command4("publish").description("Encrypt and publish a
       process.stderr.write(chalk5.red("Error: Skill name required \u2014 set in SKILL.md frontmatter or use --name\n"));
       process.exit(1);
     }
+    try {
+      validateSkillName(skillName);
+    } catch (err) {
+      if (err instanceof InvalidSkillNameError) {
+        process.stderr.write(chalk5.red(`Error: ${err.message}
+`));
+        process.stderr.write(chalk5.dim("Skill names must be ASCII letters, digits, dashes, or underscores (1-64 chars).\n"));
+        process.exit(1);
+      }
+      throw err;
+    }
     if (!description) {
       process.stderr.write(chalk5.red("Error: Description required \u2014 set in SKILL.md frontmatter or use --description\n"));
       process.exit(1);
@@ -153031,7 +153152,8 @@ The server will clean up automatically. If the problem persists, re-run with --f
     }
     const publishResult = await publishRes.json().catch(() => ({}));
     const wasUnlinked = existingManifest === null;
-    if (!options.noLink && sessionPublisherId) {
+    const publishAccepted = publishResult.status !== "rejected";
+    if (publishAccepted && !options.noLink && sessionPublisherId) {
       const linkedAt = existingManifest?.linked_at ?? (/* @__PURE__ */ new Date()).toISOString();
       const newManifest = {
         ...existingManifest ?? {},
@@ -153065,6 +153187,26 @@ The server will clean up automatically. If the problem persists, re-run with --f
     if (publishResult.status === "unchanged") {
       console.log(chalk5.yellow(`Content unchanged for ${skillName} v${version}. No new version created.`));
       console.log(chalk5.dim(`  Use --force to publish anyway.`));
+    } else if (publishResult.status === "rejected") {
+      const reasonMessage = publishResult.public_reason?.message || "Skill rejected by the security review pipeline.";
+      process.stderr.write(chalk5.red(`
+Publish rejected: ${reasonMessage}
+`));
+      process.stderr.write(chalk5.dim(`  Run \`skillvault-publisher skill-status ${skillName}\` for more details.
+`));
+      process.stderr.write(chalk5.dim(`  Download a rejection report with \`skillvault-publisher skill-status ${skillName} --review-report <file>\`.
+`));
+      process.exit(1);
+    } else if (publishResult.status === "under_review") {
+      console.log(chalk5.yellow(`
+Skill queued for review: ${skillName} v${version}`));
+      if (publishResult.review_id) {
+        console.log(chalk5.dim(`  Review ID:  ${publishResult.review_id}`));
+      }
+      console.log(chalk5.dim(`  Skill ID:   ${publishResult.skill_id || "n/a"}`));
+      console.log(chalk5.dim(`  Capability: ${capabilityName}`));
+      console.log(chalk5.dim("  Reviews usually complete within a few minutes."));
+      console.log(chalk5.dim(`  Check status with \`skillvault-publisher skill-status ${skillName}\` (or listen on your webhook).`));
     } else {
       console.log(chalk5.green(`Published ${skillName} v${version}`));
       console.log(chalk5.dim(`  Skill ID:   ${publishResult.skill_id || "n/a"}`));
@@ -153092,7 +153234,7 @@ import chalk6 from "chalk";
 var searchCommand = new Command5("search").description("Search for skills in the registry").argument("<query>", "Search query").option("--type <type>", "Filter by capability type").option("--publisher <publisher>", "Filter by publisher name or ID").option("--mine", "Show only your own published skills").option("--json", "Output results as JSON").action(async (query, options) => {
   try {
     const config = getConfig();
-    const serverUrl = config?.server_url ?? "http://localhost:3001";
+    const serverUrl = config?.server_url ?? "https://api.getskillvault.com";
     let publisherFilter = options.publisher;
     if (options.mine) {
       if (!config) {
@@ -153253,7 +153395,7 @@ var licensesCommand = new Command7("licenses").description("List your active ski
 import { Command as Command8 } from "commander";
 import chalk9 from "chalk";
 import { readFileSync as readFileSync8, existsSync as existsSync7, statSync as statSync4 } from "node:fs";
-import { resolve as resolve5, join as join7 } from "node:path";
+import { resolve as resolve6, join as join7 } from "node:path";
 import { createHash as createHash4 } from "node:crypto";
 function parseFrontmatter2(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -153304,7 +153446,7 @@ var updateCommand = new Command8("update").description("Push a new version of an
   try {
     const ctx = requireSession();
     const config = ctx.config;
-    const dirPath = resolve5(directory);
+    const dirPath = resolve6(directory);
     if (!existsSync7(dirPath) || !statSync4(dirPath).isDirectory()) {
       process.stderr.write(chalk9.red(`Error: "${dirPath}" is not a valid directory
 `));
@@ -153487,6 +153629,14 @@ var whoamiCommand = new Command9("whoami").description("Show current user, activ
     const ctx = requireSession();
     const config = ctx.config;
     const fingerprint = getDeviceFingerprint();
+    let authMe = null;
+    try {
+      const meRes = await fetch(`${config.server_url}/auth/me`, { headers: ctx.headers });
+      if (meRes.ok) {
+        authMe = await meRes.json();
+      }
+    } catch {
+    }
     const response = await fetch(`${config.server_url}/agent/status?agent_id=${encodeURIComponent(config.agent_id)}`, {
       headers: ctx.headers
     });
@@ -153495,29 +153645,48 @@ var whoamiCommand = new Command9("whoami").description("Show current user, activ
         console.log(JSON.stringify({
           host_id: config.host_id,
           agent_id: config.agent_id,
-          ...config.publisher_id ? { publisher_id: config.publisher_id } : {},
-          ...config.email ? { email: config.email } : {},
+          ...authMe ? {
+            publisher_id: authMe.publisher_id,
+            publisher_name: authMe.publisher_name,
+            email: authMe.email,
+            role: authMe.role,
+            is_owner: authMe.is_owner
+          } : {
+            ...config.publisher_id ? { publisher_id: config.publisher_id } : {},
+            ...config.email ? { email: config.email } : {}
+          },
           device_fingerprint: fingerprint,
           server_url: config.server_url,
-          server_status: "unreachable"
+          server_status: "agent_status_unreachable"
         }, null, 2));
         return;
       }
       console.log();
       console.log(chalk10.bold("  Skill Vault Identity"));
       console.log();
-      if (config.publisher_id) {
-        console.log(`  ${"Publisher ID:".padEnd(22)} ${config.publisher_id}`);
-      }
-      if (config.email) {
-        console.log(`  ${"Email:".padEnd(22)} ${config.email}`);
+      if (authMe) {
+        const roleColor = authMe.role === "owner" ? chalk10.green : authMe.role === "admin" ? chalk10.cyan : chalk10.dim;
+        const roleLabel = authMe.role || (authMe.is_owner ? "owner" : "member");
+        console.log(`  ${"You:".padEnd(22)} ${authMe.email}  ${roleColor(`(${roleLabel})`)}`);
+        const publisherDisplay = authMe.publisher_name ? `${authMe.publisher_name}  ${chalk10.dim(`(${authMe.publisher_id})`)}` : authMe.publisher_id;
+        console.log(`  ${"Publisher:".padEnd(22)} ${publisherDisplay}`);
+        if (!authMe.is_owner) {
+          console.log(`  ${chalk10.dim("  (you are a team member of this publisher)".padEnd(22))}`);
+        }
+      } else {
+        if (config.publisher_id) {
+          console.log(`  ${"Publisher ID:".padEnd(22)} ${config.publisher_id}`);
+        }
+        if (config.email) {
+          console.log(`  ${"Email:".padEnd(22)} ${config.email}`);
+        }
       }
       console.log(`  ${"Host ID:".padEnd(22)} ${config.host_id}`);
       console.log(`  ${"Agent ID:".padEnd(22)} ${config.agent_id}`);
       console.log(`  ${"Device Fingerprint:".padEnd(22)} ${fingerprint}`);
       console.log(`  ${"Server:".padEnd(22)} ${config.server_url}`);
       console.log();
-      console.log(chalk10.yellow(`  Server unreachable (${response.status}). Showing local config only.`));
+      console.log(chalk10.yellow(`  Status endpoint unreachable (${response.status}); skipped grants list.`));
       console.log();
       return;
     }
@@ -153526,8 +153695,17 @@ var whoamiCommand = new Command9("whoami").description("Show current user, activ
       console.log(JSON.stringify({
         host_id: data.host_id ?? config.host_id,
         agent_id: data.agent_id ?? config.agent_id,
-        ...config.publisher_id ? { publisher_id: config.publisher_id } : {},
-        ...config.email ? { email: config.email } : {},
+        ...authMe ? {
+          publisher_id: authMe.publisher_id,
+          publisher_name: authMe.publisher_name,
+          email: authMe.email,
+          role: authMe.role,
+          is_owner: authMe.is_owner,
+          ...authMe.skill_acls ? { skill_acls: authMe.skill_acls } : {}
+        } : {
+          ...config.publisher_id ? { publisher_id: config.publisher_id } : {},
+          ...config.email ? { email: config.email } : {}
+        },
         device_fingerprint: fingerprint,
         server_url: config.server_url,
         status: data.status,
@@ -153535,14 +153713,51 @@ var whoamiCommand = new Command9("whoami").description("Show current user, activ
       }, null, 2));
       return;
     }
+    let skillsById = /* @__PURE__ */ new Map();
+    if (authMe?.role === "member" && authMe.skill_acls && authMe.skill_acls.length > 0) {
+      try {
+        const skillsRes = await fetch(`${config.server_url}/skills`, { headers: ctx.headers });
+        if (skillsRes.ok) {
+          const sd = await skillsRes.json();
+          for (const s of sd.skills)
+            skillsById.set(s.id, s);
+        }
+      } catch {
+      }
+    }
     console.log();
     console.log(chalk10.bold("  Skill Vault Identity"));
     console.log();
-    if (config.publisher_id) {
-      console.log(`  ${"Publisher ID:".padEnd(22)} ${config.publisher_id}`);
-    }
-    if (config.email) {
-      console.log(`  ${"Email:".padEnd(22)} ${config.email}`);
+    if (authMe) {
+      const roleColor = authMe.role === "owner" ? chalk10.green : authMe.role === "admin" ? chalk10.cyan : chalk10.dim;
+      const roleLabel = authMe.role || (authMe.is_owner ? "owner" : "member");
+      console.log(`  ${"You:".padEnd(22)} ${authMe.email}  ${roleColor(`(${roleLabel})`)}`);
+      const publisherDisplay = authMe.publisher_name ? `${authMe.publisher_name}  ${chalk10.dim(`(${authMe.publisher_id})`)}` : authMe.publisher_id;
+      console.log(`  ${"Publisher:".padEnd(22)} ${publisherDisplay}`);
+      if (!authMe.is_owner) {
+        console.log(`  ${chalk10.dim("  (you are a team member of this publisher)".padEnd(22))}`);
+      }
+      if (authMe.role === "member" && authMe.skill_acls) {
+        if (authMe.skill_acls.length === 0) {
+          console.log(`  ${chalk10.dim("Skill access:".padEnd(22))} ${chalk10.dim("(none yet \u2014 publish a new skill to auto-own it)")}`);
+        } else {
+          console.log(`  ${"Skill access:".padEnd(22)}`);
+          for (const a of authMe.skill_acls) {
+            const sk = skillsById.get(a.skill_id);
+            const label = sk?.name || a.skill_id;
+            const roleColor2 = a.role === "owner" ? chalk10.green : a.role === "write" ? chalk10.cyan : chalk10.dim;
+            const action = a.role === "owner" ? "publish + delete" : a.role === "write" ? "publish new versions" : "view only";
+            console.log(`    ${chalk10.cyan(label.padEnd(20))}  ${roleColor2(a.role.padEnd(8))}  ${chalk10.dim(action)}`);
+          }
+        }
+      }
+    } else {
+      if (config.publisher_id) {
+        console.log(`  ${"Publisher ID:".padEnd(22)} ${config.publisher_id}`);
+      }
+      if (config.email) {
+        console.log(`  ${"Email:".padEnd(22)} ${config.email}`);
+      }
     }
     console.log(`  ${"Host ID:".padEnd(22)} ${data.host_id ?? config.host_id}`);
     console.log(`  ${"Agent ID:".padEnd(22)} ${data.agent_id ?? config.agent_id}`);
@@ -153627,7 +153842,7 @@ var reportCommand = new Command10("report").description("Report a telemetry even
 import { Command as Command11 } from "commander";
 import chalk12 from "chalk";
 import { existsSync as existsSync8, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "node:fs";
-import { resolve as resolve6, join as join8 } from "node:path";
+import { resolve as resolve7, join as join8 } from "node:path";
 function toTitleCase(name) {
   return name.split(/[-_]/).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
 }
@@ -153664,7 +153879,7 @@ var initCommand = new Command11("init").description("Scaffold a new skill direct
     process.stderr.write(chalk12.dim("  skillvault-publisher init my-awesome-skill\n"));
     process.exit(1);
   }
-  const dirPath = resolve6(name);
+  const dirPath = resolve7(name);
   if (existsSync8(dirPath)) {
     process.stderr.write(chalk12.red(`Error: Directory "${name}" already exists.
 `));
@@ -153779,11 +153994,9 @@ var listCommand = new Command13("list").description("List your published skills"
       headers: ctx.headers
     });
     if (!response.ok) {
-      const err = await response.json().catch(() => ({
-        error: "unknown",
-        message: response.statusText
-      }));
-      process.stderr.write(chalk14.red(`Failed to list skills: ${err.message}
+      const err = await response.json().catch(() => null);
+      const reason = err?.message || err?.error || response.statusText || `HTTP ${response.status}`;
+      process.stderr.write(chalk14.red(`Failed to list skills: ${reason}
 `));
       process.exit(1);
     }
@@ -153804,11 +154017,13 @@ var listCommand = new Command13("list").description("List your published skills"
     const nameWidth = Math.max(20, ...skills.map((s) => s.name.length + 2));
     const verWidth = 10;
     const statusWidth = 10;
+    const reviewWidth = 8;
     const capWidth = Math.max(24, ...skills.map((s) => s.capability_name.length + 2));
     const header = [
       chalk14.dim("Name".padEnd(nameWidth)),
       chalk14.dim("Version".padEnd(verWidth)),
       chalk14.dim("Status".padEnd(statusWidth)),
+      chalk14.dim("Review".padEnd(reviewWidth)),
       chalk14.dim("Capability".padEnd(capWidth)),
       chalk14.dim("Created")
     ].join("  ");
@@ -153820,10 +154035,29 @@ var listCommand = new Command13("list").description("List your published skills"
         year: "numeric"
       });
       const statusColor = skill.status === "active" ? chalk14.green : chalk14.dim;
+      let reviewCell;
+      switch (skill.review_state) {
+        case "approved":
+          reviewCell = chalk14.green("ok".padEnd(reviewWidth));
+          break;
+        case "queued":
+        case "running":
+          reviewCell = chalk14.yellow("review".padEnd(reviewWidth));
+          break;
+        case "rejected":
+          reviewCell = chalk14.red("reject".padEnd(reviewWidth));
+          break;
+        case "needs_human_review":
+          reviewCell = chalk14.yellow("human".padEnd(reviewWidth));
+          break;
+        default:
+          reviewCell = chalk14.dim("-".padEnd(reviewWidth));
+      }
       const row = [
         chalk14.cyan(skill.name.padEnd(nameWidth)),
         chalk14.green(("v" + skill.latest_version).padEnd(verWidth)),
         statusColor(skill.status.padEnd(statusWidth)),
+        reviewCell,
         chalk14.dim(skill.capability_name.padEnd(capWidth)),
         chalk14.dim(createdDate)
       ].join("  ");
@@ -153842,7 +154076,7 @@ var listCommand = new Command13("list").description("List your published skills"
 import { Command as Command14 } from "commander";
 import chalk15 from "chalk";
 import { readFileSync as readFileSync9, existsSync as existsSync9, statSync as statSync5, readdirSync as readdirSync2 } from "node:fs";
-import { resolve as resolve7, join as join9, basename } from "node:path";
+import { resolve as resolve8, join as join9, basename } from "node:path";
 import { createHash as createHash6 } from "node:crypto";
 function parseFrontmatter3(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -153990,7 +154224,7 @@ var publishAllCommand = new Command14("publish-all").description("Discover and p
       skillDirs = entries.map((e) => e.path);
       console.log(chalk15.dim(`Iterating ${skillDirs.length} registered workspace${skillDirs.length === 1 ? "" : "s"}` + (options.current ? " (current account only)" : "") + "..."));
     } else {
-      const rootDir = resolve7(directory);
+      const rootDir = resolve8(directory);
       if (!existsSync9(rootDir) || !statSync5(rootDir).isDirectory()) {
         process.stderr.write(chalk15.red(`Error: "${rootDir}" is not a valid directory
 `));
@@ -154270,12 +154504,12 @@ var inviteListCommand = new Command15("list").description("List all invites").op
     }
     console.log(`Invites (${invites.length}):
 `);
-    const pad3 = (s, n) => s.padEnd(n).slice(0, n);
-    console.log(chalk16.dim(`${pad3("Code", 14)} ${pad3("Email", 30)} ${pad3("Status", 10)} ${pad3("Skills", 25)} ${pad3("Created", 12)}`));
+    const pad4 = (s, n) => s.padEnd(n).slice(0, n);
+    console.log(chalk16.dim(`${pad4("Code", 14)} ${pad4("Email", 30)} ${pad4("Status", 10)} ${pad4("Skills", 25)} ${pad4("Created", 12)}`));
     console.log(chalk16.dim("\u2500".repeat(95)));
     for (const inv of invites) {
       const statusColor = inv.status === "redeemed" ? chalk16.green : inv.status === "expired" ? chalk16.dim : chalk16.yellow;
-      console.log(`${pad3(inv.code, 14)} ${pad3(inv.customer_email || "(open)", 30)} ${statusColor(pad3(inv.status, 10))} ${pad3(inv.capabilities.join(", ") || "(none)", 25)} ${pad3(new Date(inv.created_at).toLocaleDateString(), 12)}`);
+      console.log(`${pad4(inv.code, 14)} ${pad4(inv.customer_email || "(open)", 30)} ${statusColor(pad4(inv.status, 10))} ${pad4(inv.capabilities.join(", ") || "(none)", 25)} ${pad4(new Date(inv.created_at).toLocaleDateString(), 12)}`);
     }
   } catch (err) {
     process.stderr.write(chalk16.red(`Error: ${err instanceof Error ? err.message : String(err)}
@@ -154898,7 +155132,9 @@ var skillDeleteCommand = new Command20("skill-delete").description("Permanently
 // dist/commands/skill-status.js
 import { Command as Command21 } from "commander";
 import chalk18 from "chalk";
-var skillStatusCommand = new Command21("skill-status").description("Show detailed status for a skill").argument("[skill-name]", "Name of the skill to inspect (defaults to workspace skill)").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default skill-name").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').action(async (skillNameArg, options) => {
+import { writeFileSync as writeFileSync10 } from "node:fs";
+import { resolve as resolve9 } from "node:path";
+var skillStatusCommand = new Command21("skill-status").description("Show detailed status for a skill").argument("[skill-name]", "Name of the skill to inspect (defaults to workspace skill)").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default skill-name").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--review-report <file>", "Write a public review report (JSON) to <file>").action(async (skillNameArg, options) => {
   try {
     const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
     const skillName = skillNameArg ?? ctx.defaultSkillName ?? void 0;
@@ -154920,17 +155156,56 @@ var skillStatusCommand = new Command21("skill-status").description("Show detaile
       sessionFetch(ctx, "/grants")
     ]);
     const activeGrants = grantsData.grants.filter((g) => g.capability === detail.capability_name && g.status === "active");
+    if (options.reviewReport) {
+      const report = {
+        skill_id: detail.id,
+        capability_name: detail.capability_name,
+        version: detail.latest_version,
+        review_state: detail.review_state ?? null,
+        public_reason_code: detail.latest_review?.public_reason_code ?? null,
+        public_reason_message: detail.latest_review?.public_reason_message ?? null,
+        last_review_at: detail.latest_review?.last_review_at ?? null
+      };
+      const reportPath = resolve9(options.reviewReport);
+      writeFileSync10(reportPath, JSON.stringify(report, null, 2) + "\n");
+      process.stderr.write(chalk18.green(`Wrote review report to ${reportPath}
+`));
+    }
     if (options.json) {
       console.log(JSON.stringify({ ...detail, active_grants: activeGrants.length }, null, 2));
       return;
     }
     const statusColor = detail.status === "active" ? chalk18.green : detail.status === "archived" ? chalk18.yellow : chalk18.dim;
     const createdDate = new Date(detail.created_at).toLocaleDateString("en-US", { month: "short", day: "numeric", year: "numeric" });
+    const reviewState = detail.review_state ?? "approved";
+    let reviewLabel;
+    switch (reviewState) {
+      case "approved":
+        reviewLabel = chalk18.green("Approved");
+        break;
+      case "queued":
+      case "running":
+        reviewLabel = chalk18.yellow("Under review");
+        break;
+      case "rejected":
+        reviewLabel = chalk18.red("Rejected");
+        break;
+      case "needs_human_review":
+        reviewLabel = chalk18.yellow("Awaiting review");
+        break;
+      default:
+        reviewLabel = chalk18.dim(reviewState);
+    }
+    const lastReviewAt = detail.latest_review?.last_review_at ? new Date(detail.latest_review.last_review_at).toLocaleDateString("en-US", { month: "short", day: "numeric", year: "numeric" }) : null;
     console.log();
     console.log(chalk18.bold(`  ${detail.name}`));
     console.log();
     console.log(`  Capability:     ${detail.capability_name}`);
     console.log(`  Status:         ${statusColor(detail.status)}`);
+    console.log(`  Review:         ${reviewLabel}${lastReviewAt ? chalk18.dim(` (${lastReviewAt})`) : ""}`);
+    if (reviewState === "rejected" && detail.latest_review?.public_reason_message) {
+      console.log(`  Reason:         ${chalk18.red(detail.latest_review.public_reason_message)}`);
+    }
     console.log(`  Version:        ${chalk18.green("v" + detail.latest_version)}`);
     console.log(`  Created:        ${chalk18.dim(createdDate)}`);
     console.log(`  ID:             ${chalk18.dim(detail.id)}`);
@@ -154987,10 +155262,199 @@ var skillUnarchiveCommand = new Command22("skill-unarchive").description("Restor
   }
 });
 
-// dist/commands/grants.js
+// dist/commands/skill-acl.js
 import { Command as Command23 } from "commander";
 import chalk20 from "chalk";
-var grantsCommand = new Command23("grants").description("List capability grants issued to customers").option("--status <status>", "Filter by status: active, revoked, expired").option("--skill <name>", "Filter to grants for a specific skill (capability)").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default --skill").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--all", "Disable workspace --skill default; show grants for all skills").action(async (options) => {
+var VALID_ROLES = /* @__PURE__ */ new Set(["read", "write", "owner"]);
+async function resolveSkill(ctx, skillName) {
+  const data = await sessionFetch(ctx, "/skills");
+  const skill = data.skills.find((s) => s.name.toLowerCase() === skillName.toLowerCase() || s.capability_name.toLowerCase() === skillName.toLowerCase());
+  if (!skill) {
+    process.stderr.write(chalk20.red(`Skill not found: ${skillName}
+`));
+    process.stderr.write(chalk20.dim("Run `skillvault-publisher list` to see your skills.\n"));
+    process.exit(1);
+  }
+  return skill;
+}
+async function runList(ctx, skill, options) {
+  const data = await sessionFetch(ctx, `/skills/${skill.id}/acls`);
+  const acls = data.acls || [];
+  if (options.json) {
+    console.log(JSON.stringify({ skill: skill.name, skill_id: skill.id, acls }, null, 2));
+    return;
+  }
+  console.log();
+  console.log(chalk20.bold(`  ACL grants on ${chalk20.cyan(skill.name)}`));
+  console.log();
+  if (acls.length === 0) {
+    console.log(chalk20.dim("  No ACL grants. Account owners and admins always have full access."));
+    console.log(chalk20.dim(`  Add a member: skillvault-publisher skill-acl ${skill.name} add <email> --role read|write|owner`));
+    console.log();
+    return;
+  }
+  const emailWidth = Math.max(20, ...acls.map((a) => a.email.length + 2));
+  const roleWidth = 8;
+  const header = [
+    chalk20.dim("Email".padEnd(emailWidth)),
+    chalk20.dim("Role".padEnd(roleWidth)),
+    chalk20.dim("Granted by")
+  ].join("  ");
+  console.log(`  ${header}`);
+  console.log(`  ${chalk20.dim("-".repeat(emailWidth + roleWidth + 24))}`);
+  for (const a of acls) {
+    const roleColor = a.role === "owner" ? chalk20.green : a.role === "write" ? chalk20.cyan : chalk20.dim;
+    const row = [
+      a.email.padEnd(emailWidth),
+      roleColor(a.role.padEnd(roleWidth)),
+      chalk20.dim(a.granted_by || "(self)")
+    ].join("  ");
+    console.log(`  ${row}`);
+  }
+  console.log();
+}
+async function runAdd(ctx, skill, email, options) {
+  if (!options.role) {
+    process.stderr.write(chalk20.red("Error: --role is required (read|write|owner)\n"));
+    process.exit(1);
+  }
+  const role = options.role.toLowerCase();
+  if (!VALID_ROLES.has(role)) {
+    process.stderr.write(chalk20.red(`Invalid --role value: ${options.role}
+`));
+    process.stderr.write(chalk20.dim("  Must be one of: read, write, owner\n"));
+    process.exit(1);
+  }
+  const res = await fetch(`${ctx.serverUrl}/skills/${skill.id}/acls`, {
+    method: "POST",
+    headers: ctx.headers,
+    body: JSON.stringify({ email, role })
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    if (body.error === "not_a_team_member") {
+      process.stderr.write(chalk20.red(`${email} is not a member of this team.
+`));
+      process.stderr.write(chalk20.dim(`Add them first: skillvault-publisher team add ${email} --role member
+`));
+      process.exit(1);
+    }
+    process.stderr.write(chalk20.red(`Failed to grant: ${body.message || body.error || res.statusText}
+`));
+    process.exit(1);
+  }
+  if (options.json) {
+    console.log(JSON.stringify(body, null, 2));
+    return;
+  }
+  if (body.note) {
+    console.log(chalk20.yellow(`  ${body.note}`));
+    return;
+  }
+  const acl = body.acl;
+  console.log(chalk20.green(`Granted ${acl.email} ${chalk20.bold(acl.role)} on ${skill.name}`));
+}
+async function runRemove(ctx, skill, target, options) {
+  const data = await sessionFetch(ctx, `/skills/${skill.id}/acls`);
+  const acls = data.acls || [];
+  let acl;
+  if (target.startsWith("acl_")) {
+    acl = acls.find((a) => a.id === target);
+  } else {
+    acl = acls.find((a) => a.email.toLowerCase() === target.toLowerCase());
+  }
+  if (!acl) {
+    process.stderr.write(chalk20.red(`No ACL row matches: ${target}
+`));
+    process.exit(1);
+  }
+  if (!options.yes) {
+    console.log();
+    console.log(chalk20.yellow.bold("  Warning: ") + `This revokes ${acl.role} access on ${chalk20.cyan(skill.name)} for ${chalk20.cyan(acl.email)}.`);
+    console.log(chalk20.dim("  Add --yes to confirm."));
+    console.log();
+    process.exit(0);
+  }
+  const res = await fetch(`${ctx.serverUrl}/skills/${skill.id}/acls/${acl.id}`, {
+    method: "DELETE",
+    headers: ctx.headers
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    if (body.error === "last_owner") {
+      process.stderr.write(chalk20.red("Cannot remove the last owner ACL on this skill.\n"));
+      process.stderr.write(chalk20.dim("  Grant another member owner access first, or have an account admin manage it.\n"));
+      process.exit(1);
+    }
+    process.stderr.write(chalk20.red(`Failed to remove: ${body.message || body.error || res.statusText}
+`));
+    process.exit(1);
+  }
+  if (options.json) {
+    console.log(JSON.stringify({ removed: true, acl_id: acl.id, email: acl.email, role: acl.role }, null, 2));
+    return;
+  }
+  console.log(chalk20.green(`Removed ${acl.email} (${acl.role}) from ${skill.name}`));
+}
+var skillAclCommand = new Command23("skill-acl").description("Manage per-skill ACL grants for team members").argument("<skill-name>", 'Skill to manage (or "list"/"add"/"remove" if using a workspace default)').argument("<action>", "Action: list | add | remove").argument("[target]", "Email (for add/remove) \u2014 not used by list").option("--role <role>", "Role for add: read | write | owner").option("--yes", "Skip confirmation on remove").option("--workspace <path>", "Use workspace at <path> to default skill-name").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--json", "Output as JSON").action(async (skillNameArg, actionArg, targetArg, options) => {
+  try {
+    let skillName = skillNameArg;
+    let action = actionArg;
+    let target = targetArg;
+    const isActionVerb = (s) => s === "list" || s === "add" || s === "remove";
+    if (isActionVerb(skillNameArg) && !isActionVerb(actionArg)) {
+      action = skillNameArg;
+      target = actionArg;
+      skillName = "";
+    }
+    const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
+    if (!skillName) {
+      if (!ctx.defaultSkillName) {
+        process.stderr.write(chalk20.red("Error: No skill name provided and no workspace context.\n"));
+        process.stderr.write(chalk20.dim("  Pass <skill-name> or run from a linked workspace directory.\n"));
+        process.exit(1);
+      }
+      skillName = ctx.defaultSkillName;
+    }
+    if (!isActionVerb(action)) {
+      process.stderr.write(chalk20.red(`Unknown action: ${action}
+`));
+      process.stderr.write(chalk20.dim("  Must be one of: list, add, remove\n"));
+      process.exit(1);
+    }
+    const skill = await resolveSkill(ctx, skillName);
+    if (action === "list") {
+      await runList(ctx, skill, options);
+      return;
+    }
+    if (action === "add") {
+      if (!target) {
+        process.stderr.write(chalk20.red("Error: add requires <email>\n"));
+        process.exit(1);
+      }
+      await runAdd(ctx, skill, target, options);
+      return;
+    }
+    if (action === "remove") {
+      if (!target) {
+        process.stderr.write(chalk20.red("Error: remove requires <email-or-id>\n"));
+        process.exit(1);
+      }
+      await runRemove(ctx, skill, target, options);
+      return;
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(chalk20.red(`skill-acl failed: ${message}
+`));
+    process.exit(1);
+  }
+});
+
+// dist/commands/grants.js
+import { Command as Command24 } from "commander";
+import chalk21 from "chalk";
+var grantsCommand = new Command24("grants").description("List capability grants issued to customers").option("--status <status>", "Filter by status: active, revoked, expired").option("--skill <name>", "Filter to grants for a specific skill (capability)").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default --skill").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--all", "Disable workspace --skill default; show grants for all skills").action(async (options) => {
   try {
     const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
     const data = await sessionFetch(ctx, "/grants");
@@ -155008,43 +155472,43 @@ var grantsCommand = new Command23("grants").description("List capability grants
       return;
     }
     if (grants.length === 0) {
-      console.log(chalk20.dim("No grants found."));
+      console.log(chalk21.dim("No grants found."));
       return;
     }
     console.log();
-    console.log(chalk20.bold("  Capability Grants"));
+    console.log(chalk21.bold("  Capability Grants"));
     console.log();
-    const pad3 = (s, n) => s.padEnd(n).slice(0, n);
-    const header = `${pad3("Grant ID", 22)} ${pad3("Skill", 24)} ${pad3("Customer", 22)} ${pad3("Status", 10)} ${pad3("Granted", 12)} ${"Expires"}`;
-    console.log(`  ${chalk20.dim(header)}`);
-    console.log(`  ${chalk20.dim("\u2500".repeat(header.length))}`);
+    const pad4 = (s, n) => s.padEnd(n).slice(0, n);
+    const header = `${pad4("Grant ID", 22)} ${pad4("Skill", 24)} ${pad4("Customer", 22)} ${pad4("Status", 10)} ${pad4("Granted", 12)} ${"Expires"}`;
+    console.log(`  ${chalk21.dim(header)}`);
+    console.log(`  ${chalk21.dim("\u2500".repeat(header.length))}`);
     for (const grant of grants) {
-      const statusColor = grant.status === "active" ? chalk20.green : grant.status === "revoked" ? chalk20.red : grant.status === "expired" ? chalk20.yellow : chalk20.white;
+      const statusColor = grant.status === "active" ? chalk21.green : grant.status === "revoked" ? chalk21.red : grant.status === "expired" ? chalk21.yellow : chalk21.white;
       const row = [
-        pad3(grant.id, 22),
-        pad3(grant.capability, 24),
-        pad3(grant.customer_id || "-", 22),
-        statusColor(pad3(grant.status, 10)),
-        pad3(new Date(grant.created_at).toLocaleDateString(), 12),
+        pad4(grant.id, 22),
+        pad4(grant.capability, 24),
+        pad4(grant.customer_id || "-", 22),
+        statusColor(pad4(grant.status, 10)),
+        pad4(new Date(grant.created_at).toLocaleDateString(), 12),
         grant.expires_at ? new Date(grant.expires_at).toLocaleDateString() : "never"
       ].join(" ");
       console.log(`  ${row}`);
     }
     console.log();
-    console.log(chalk20.dim(`  ${grants.length} grant${grants.length !== 1 ? "s" : ""} total`));
+    console.log(chalk21.dim(`  ${grants.length} grant${grants.length !== 1 ? "s" : ""} total`));
     console.log();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk20.red(`Error: ${message}
+    process.stderr.write(chalk21.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/revoke-grant.js
-import { Command as Command24 } from "commander";
-import chalk21 from "chalk";
-var revokeGrantCommand = new Command24("revoke-grant").description("Revoke a capability grant by ID").argument("<grant-id>", "Grant ID to revoke (e.g., gnt_xxx)").option("--yes", "Skip confirmation and revoke immediately").option("--json", "Output as JSON").option("--workspace <path>", "Resolve workspace context (informational only \u2014 grant ID is authoritative)").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').action(async (grantId, options) => {
+import { Command as Command25 } from "commander";
+import chalk22 from "chalk";
+var revokeGrantCommand = new Command25("revoke-grant").description("Revoke a capability grant by ID").argument("<grant-id>", "Grant ID to revoke (e.g., gnt_xxx)").option("--yes", "Skip confirmation and revoke immediately").option("--json", "Output as JSON").option("--workspace <path>", "Resolve workspace context (informational only \u2014 grant ID is authoritative)").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').action(async (grantId, options) => {
   try {
     const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
     if (!options.yes) {
@@ -155055,7 +155519,7 @@ var revokeGrantCommand = new Command24("revoke-grant").description("Revoke a cap
         return;
       }
       console.log();
-      console.log(chalk21.bold("  Grant details"));
+      console.log(chalk22.bold("  Grant details"));
       console.log();
       console.log(`  ID:       ${grant.id}`);
       console.log(`  Skill:    ${grant.skill}`);
@@ -155064,7 +155528,7 @@ var revokeGrantCommand = new Command24("revoke-grant").description("Revoke a cap
       console.log(`  Granted:  ${new Date(grant.granted_at).toLocaleDateString()}`);
       console.log(`  Expires:  ${grant.expires_at ? new Date(grant.expires_at).toLocaleDateString() : "never"}`);
       console.log();
-      console.log(chalk21.yellow("  Add --yes to confirm revocation."));
+      console.log(chalk22.yellow("  Add --yes to confirm revocation."));
       console.log();
       return;
     }
@@ -155073,19 +155537,19 @@ var revokeGrantCommand = new Command24("revoke-grant").description("Revoke a cap
       console.log(JSON.stringify(result.grant, null, 2));
       return;
     }
-    console.log(chalk21.green(`Revoked grant ${result.grant.id} for ${result.grant.skill}`));
+    console.log(chalk22.green(`Revoked grant ${result.grant.id} for ${result.grant.skill}`));
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk21.red(`Error: ${message}
+    process.stderr.write(chalk22.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/customers.js
-import { Command as Command25 } from "commander";
-import chalk22 from "chalk";
-var customersCommand = new Command25("customers").description("List your customers").option("--json", "Output as JSON").option("--workspace <path>", "Resolve workspace context (defaults from CWD)").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').action(async (options) => {
+import { Command as Command26 } from "commander";
+import chalk23 from "chalk";
+var customersCommand = new Command26("customers").description("List your customers").option("--json", "Output as JSON").option("--workspace <path>", "Resolve workspace context (defaults from CWD)").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').action(async (options) => {
   const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
   try {
     const data = await sessionFetch(ctx, "/customers");
@@ -155095,48 +155559,48 @@ var customersCommand = new Command25("customers").description("List your custome
       return;
     }
     if (customers.length === 0) {
-      console.log(chalk22.dim("No customers found."));
+      console.log(chalk23.dim("No customers found."));
       return;
     }
     console.log();
-    console.log(chalk22.bold("  Customers"));
+    console.log(chalk23.bold("  Customers"));
     console.log();
-    const pad3 = (s, n) => s.padEnd(n).slice(0, n);
-    const header = `${pad3("Email", 32)}  ${pad3("Skills", 8)}  ${pad3("Loads", 8)}  ${pad3("Status", 10)}  Last Active`;
-    console.log(`  ${chalk22.dim(header)}`);
-    console.log(`  ${chalk22.dim("\u2500".repeat(header.length))}`);
+    const pad4 = (s, n) => s.padEnd(n).slice(0, n);
+    const header = `${pad4("Email", 32)}  ${pad4("Skills", 8)}  ${pad4("Loads", 8)}  ${pad4("Status", 10)}  Last Active`;
+    console.log(`  ${chalk23.dim(header)}`);
+    console.log(`  ${chalk23.dim("\u2500".repeat(header.length))}`);
     for (const c of customers) {
-      const statusColor = c.status === "active" ? chalk22.green : chalk22.dim;
-      const lastActive = c.last_active_at ? new Date(c.last_active_at).toLocaleDateString() : chalk22.dim("never");
+      const statusColor = c.status === "active" ? chalk23.green : chalk23.dim;
+      const lastActive = c.last_active_at ? new Date(c.last_active_at).toLocaleDateString() : chalk23.dim("never");
       const row = [
-        pad3(c.email, 32),
-        pad3(String(c.skills_count), 8),
-        pad3(String(c.total_loads), 8),
-        statusColor(pad3(c.status, 10)),
+        pad4(c.email, 32),
+        pad4(String(c.skills_count), 8),
+        pad4(String(c.total_loads), 8),
+        statusColor(pad4(c.status, 10)),
         lastActive
       ].join("  ");
       console.log(`  ${row}`);
     }
     console.log();
-    console.log(chalk22.dim(`  ${customers.length} customer${customers.length !== 1 ? "s" : ""} total`));
+    console.log(chalk23.dim(`  ${customers.length} customer${customers.length !== 1 ? "s" : ""} total`));
     console.log();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk22.red(`Error: ${message}
+    process.stderr.write(chalk23.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/analytics.js
-import { Command as Command26 } from "commander";
-import chalk23 from "chalk";
-var analyticsCommand = new Command26("analytics").description("View publisher analytics").option("--days <n>", "Number of days to look back", "30").option("--skill <name>", "Filter top skills/stats to a specific skill").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default --skill").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--all", "Disable workspace --skill default; show analytics for all skills").action(async (options) => {
+import { Command as Command27 } from "commander";
+import chalk24 from "chalk";
+var analyticsCommand = new Command27("analytics").description("View publisher analytics").option("--days <n>", "Number of days to look back", "30").option("--skill <name>", "Filter top skills/stats to a specific skill").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default --skill").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--all", "Disable workspace --skill default; show analytics for all skills").action(async (options) => {
   const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
   try {
     const days = parseInt(options.days, 10);
     if (isNaN(days) || days < 1) {
-      process.stderr.write(chalk23.red("--days must be a positive number.\n"));
+      process.stderr.write(chalk24.red("--days must be a positive number.\n"));
       process.exit(1);
     }
     const end = /* @__PURE__ */ new Date();
@@ -155149,11 +155613,11 @@ var analyticsCommand = new Command26("analytics").description("View publisher an
       return;
     }
     console.log();
-    console.log(chalk23.bold("  Publisher Analytics"));
+    console.log(chalk24.bold("  Publisher Analytics"));
     console.log();
-    console.log(`  ${chalk23.bold("Active Licenses:")}    ${data.active_licenses}`);
-    console.log(`  ${chalk23.bold("Total Decryptions:")}  ${data.total_decryptions}`);
-    console.log(`  ${chalk23.bold("Period:")}             Last ${days} day${days !== 1 ? "s" : ""} (${start.toLocaleDateString()} \u2013 ${end.toLocaleDateString()})`);
+    console.log(`  ${chalk24.bold("Active Licenses:")}    ${data.active_licenses}`);
+    console.log(`  ${chalk24.bold("Total Decryptions:")}  ${data.total_decryptions}`);
+    console.log(`  ${chalk24.bold("Period:")}             Last ${days} day${days !== 1 ? "s" : ""} (${start.toLocaleDateString()} \u2013 ${end.toLocaleDateString()})`);
     const effectiveSkill = options.skill ?? (options.all ? void 0 : ctx.defaultSkillName ?? void 0);
     const filterSkill = (skillName) => !effectiveSkill || skillName.toLowerCase() === effectiveSkill.toLowerCase();
     const statsMap = new Map((data.skill_stats || []).map((s) => [s.skill_name, s]));
@@ -155162,44 +155626,44 @@ var analyticsCommand = new Command26("analytics").description("View publisher an
     }
     if (data.top_skills && data.top_skills.length > 0) {
       console.log();
-      console.log(chalk23.bold("  Top Skills"));
+      console.log(chalk24.bold("  Top Skills"));
       console.log();
-      const pad3 = (s, n) => s.padEnd(n).slice(0, n);
-      const header = `${pad3("Skill", 28)}  ${pad3("Decryptions", 14)}  Active Licenses`;
-      console.log(`  ${chalk23.dim(header)}`);
-      console.log(`  ${chalk23.dim("\u2500".repeat(header.length))}`);
+      const pad4 = (s, n) => s.padEnd(n).slice(0, n);
+      const header = `${pad4("Skill", 28)}  ${pad4("Decryptions", 14)}  Active Licenses`;
+      console.log(`  ${chalk24.dim(header)}`);
+      console.log(`  ${chalk24.dim("\u2500".repeat(header.length))}`);
       for (const skill of data.top_skills) {
         const stats = statsMap.get(skill.name);
         const row = [
-          pad3(skill.name, 28),
-          pad3(String(skill.decryptions), 14),
+          pad4(skill.name, 28),
+          pad4(String(skill.decryptions), 14),
           String(stats?.active_licenses ?? "-")
         ].join("  ");
         console.log(`  ${row}`);
       }
     } else {
       console.log();
-      console.log(chalk23.dim("  No skill activity in this period."));
+      console.log(chalk24.dim("  No skill activity in this period."));
     }
     console.log();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk23.red(`Error: ${message}
+    process.stderr.write(chalk24.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/webhook.js
-import { Command as Command27 } from "commander";
-import chalk24 from "chalk";
-var webhookCommand = new Command27("webhook").description("Manage publisher webhook (set, test, status)").argument("<action>", "Action: set, test, or status").option("--url <url>", "Webhook URL (required for set)").option("--json", "Output as JSON").action(async (action, options) => {
+import { Command as Command28 } from "commander";
+import chalk25 from "chalk";
+var webhookCommand = new Command28("webhook").description("Manage publisher webhook (set, test, status)").argument("<action>", "Action: set, test, or status").option("--url <url>", "Webhook URL (required for set)").option("--json", "Output as JSON").action(async (action, options) => {
   try {
     const ctx = requireSession();
     switch (action) {
       case "set": {
         if (!options.url) {
-          process.stderr.write(chalk24.red("Missing --url option. Usage: skillvault-publisher webhook set --url <url>\n"));
+          process.stderr.write(chalk25.red("Missing --url option. Usage: skillvault-publisher webhook set --url <url>\n"));
           process.exit(1);
         }
         const data = await sessionFetch(ctx, `/publishers/${ctx.publisherId}/webhook`, { method: "POST", body: { url: options.url } });
@@ -155208,12 +155672,12 @@ var webhookCommand = new Command27("webhook").description("Manage publisher webh
           return;
         }
         console.log();
-        console.log(chalk24.green("  Webhook configured"));
+        console.log(chalk25.green("  Webhook configured"));
         console.log();
         console.log(`  ${"URL:".padEnd(18)} ${data.webhook_url}`);
-        console.log(`  ${"Signing Secret:".padEnd(18)} ${chalk24.yellow(data.signing_secret)}`);
+        console.log(`  ${"Signing Secret:".padEnd(18)} ${chalk25.yellow(data.signing_secret)}`);
         console.log();
-        console.log(chalk24.dim("  Store the signing secret securely. It will not be shown again."));
+        console.log(chalk25.dim("  Store the signing secret securely. It will not be shown again."));
         console.log();
         break;
       }
@@ -155224,7 +155688,7 @@ var webhookCommand = new Command27("webhook").description("Manage publisher webh
           return;
         }
         console.log();
-        console.log(chalk24.green("  Test event sent to webhook URL"));
+        console.log(chalk25.green("  Test event sent to webhook URL"));
         console.log();
         break;
       }
@@ -155236,36 +155700,36 @@ var webhookCommand = new Command27("webhook").description("Manage publisher webh
         }
         console.log();
         if (data.webhook_url) {
-          console.log(chalk24.bold("  Webhook Status"));
+          console.log(chalk25.bold("  Webhook Status"));
           console.log();
           console.log(`  ${"URL:".padEnd(12)} ${data.webhook_url}`);
-          console.log(`  ${"Status:".padEnd(12)} ${chalk24.green("configured")}`);
+          console.log(`  ${"Status:".padEnd(12)} ${chalk25.green("configured")}`);
         } else {
-          console.log(chalk24.dim("  No webhook configured."));
+          console.log(chalk25.dim("  No webhook configured."));
           console.log();
-          console.log(chalk24.dim("  Set one with: skillvault-publisher webhook set --url <url>"));
+          console.log(chalk25.dim("  Set one with: skillvault-publisher webhook set --url <url>"));
         }
         console.log();
         break;
       }
       default:
-        process.stderr.write(chalk24.red(`Unknown action: ${action}
+        process.stderr.write(chalk25.red(`Unknown action: ${action}
 `));
-        process.stderr.write(chalk24.dim("Valid actions: set, test, status\n"));
+        process.stderr.write(chalk25.dim("Valid actions: set, test, status\n"));
         process.exit(1);
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk24.red(`Error: ${message}
+    process.stderr.write(chalk25.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/audit.js
-import { Command as Command28 } from "commander";
-import chalk25 from "chalk";
-var auditCommand = new Command28("audit").description("View audit log events").option("--type <event_type>", "Filter by event type").option("--skill <name>", "Filter by capability/skill name").option("--since <date>", "Filter events since ISO date").option("--limit <n>", "Number of events to return", "20").option("--export <format>", "Export as csv or json").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default --skill").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--all", "Disable workspace --skill default; show events for all skills").action(async (options) => {
+import { Command as Command29 } from "commander";
+import chalk26 from "chalk";
+var auditCommand = new Command29("audit").description("View audit log events").option("--type <event_type>", "Filter by event type").option("--skill <name>", "Filter by capability/skill name").option("--since <date>", "Filter events since ISO date").option("--limit <n>", "Number of events to return", "20").option("--export <format>", "Export as csv or json").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default --skill").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--all", "Disable workspace --skill default; show events for all skills").action(async (options) => {
   try {
     const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
     const effectiveSkill = options.skill ?? (options.all ? void 0 : ctx.defaultSkillName ?? void 0);
@@ -155280,7 +155744,7 @@ var auditCommand = new Command28("audit").description("View audit log events").o
     if (options.export) {
       const format = options.export.toLowerCase();
       if (format !== "csv" && format !== "json") {
-        process.stderr.write(chalk25.red('Export format must be "csv" or "json".\n'));
+        process.stderr.write(chalk26.red('Export format must be "csv" or "json".\n'));
         process.exit(1);
       }
       params.set("format", format);
@@ -155299,68 +155763,68 @@ var auditCommand = new Command28("audit").description("View audit log events").o
       return;
     }
     if (events.length === 0) {
-      console.log(chalk25.dim("No audit events found."));
+      console.log(chalk26.dim("No audit events found."));
       return;
     }
     console.log();
-    console.log(chalk25.bold("  Audit Log"));
+    console.log(chalk26.bold("  Audit Log"));
     console.log();
-    const pad3 = (s, n) => s.padEnd(n).slice(0, n);
-    const header = `${pad3("Event Type", 22)} ${pad3("Skill", 24)} ${pad3("Agent", 20)} ${"Time"}`;
-    console.log(`  ${chalk25.dim(header)}`);
-    console.log(`  ${chalk25.dim("\u2500".repeat(header.length))}`);
+    const pad4 = (s, n) => s.padEnd(n).slice(0, n);
+    const header = `${pad4("Event Type", 22)} ${pad4("Skill", 24)} ${pad4("Agent", 20)} ${"Time"}`;
+    console.log(`  ${chalk26.dim(header)}`);
+    console.log(`  ${chalk26.dim("\u2500".repeat(header.length))}`);
     for (const event of events) {
       const skill = event.capability ? event.capability.replace(/^skill\//, "") : "-";
       const agent = event.agent_id ? event.agent_id.slice(0, 18) : "-";
       const time = new Date(event.created_at).toLocaleString();
       const row = [
-        pad3(event.event_type, 22),
-        pad3(skill, 24),
-        pad3(agent, 20),
+        pad4(event.event_type, 22),
+        pad4(skill, 24),
+        pad4(agent, 20),
         time
       ].join(" ");
       console.log(`  ${row}`);
     }
     console.log();
-    console.log(chalk25.dim(`  Showing ${events.length} event${events.length !== 1 ? "s" : ""}`));
+    console.log(chalk26.dim(`  Showing ${events.length} event${events.length !== 1 ? "s" : ""}`));
     if (data.has_more) {
-      console.log(chalk25.dim(`  More results available`));
+      console.log(chalk26.dim(`  More results available`));
     }
     console.log();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk25.red(`Error: ${message}
+    process.stderr.write(chalk26.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/investigate.js
-import { Command as Command29 } from "commander";
-import chalk26 from "chalk";
-import { readFileSync as readFileSync15, mkdirSync as mkdirSync9, writeFileSync as writeFileSync10 } from "node:fs";
+import { Command as Command30 } from "commander";
+import chalk27 from "chalk";
+import { readFileSync as readFileSync15, mkdirSync as mkdirSync9, writeFileSync as writeFileSync11 } from "node:fs";
 import { join as join14 } from "node:path";
-var orange = chalk26.hex("#f97316");
+var orange = chalk27.hex("#f97316");
 function riskColor2(level) {
   switch (level.toLowerCase()) {
     case "low":
-      return chalk26.green;
+      return chalk27.green;
     case "watch":
-      return chalk26.yellow;
+      return chalk27.yellow;
     case "alert":
       return orange;
     case "critical":
-      return chalk26.red;
+      return chalk27.red;
     default:
-      return chalk26.white;
+      return chalk27.white;
   }
 }
 function confidenceColor(c) {
   if (c >= 0.9)
-    return chalk26.green;
+    return chalk27.green;
   if (c >= 0.5)
-    return chalk26.yellow;
-  return chalk26.red;
+    return chalk27.yellow;
+  return chalk27.red;
 }
 function pad(s, n) {
   return s.padEnd(n).slice(0, n);
@@ -155376,30 +155840,30 @@ function toRawGitHubUrl(url) {
 }
 function displayResults(report) {
   console.log();
-  console.log(chalk26.bold("  Investigation Results"));
+  console.log(chalk27.bold("  Investigation Results"));
   console.log();
-  console.log(`  ${chalk26.bold("Investigation ID:")} ${report.investigation_id}`);
-  console.log(`  ${chalk26.bold("Skill:")}            ${report.skill_name}`);
-  console.log(`  ${chalk26.bold("Total Licensees:")}  ${report.total_licensees}`);
-  console.log(`  ${chalk26.bold("Timestamp:")}        ${new Date(report.created_at).toLocaleString()}`);
+  console.log(`  ${chalk27.bold("Investigation ID:")} ${report.investigation_id}`);
+  console.log(`  ${chalk27.bold("Skill:")}            ${report.skill_name}`);
+  console.log(`  ${chalk27.bold("Total Licensees:")}  ${report.total_licensees}`);
+  console.log(`  ${chalk27.bold("Timestamp:")}        ${new Date(report.created_at).toLocaleString()}`);
   if (report.heartbeat_matches.length > 0) {
     console.log();
     const maxConf = Math.max(...report.heartbeat_matches.map((m) => m.confidence));
     const confStr = (maxConf * 100).toFixed(0) + "%";
     const confFn = confidenceColor(maxConf);
-    console.log(`  ${chalk26.bold("Forensic Match:")}   ${confFn(confStr + " confidence")} (${report.heartbeat_matches.length} match${report.heartbeat_matches.length !== 1 ? "es" : ""})`);
+    console.log(`  ${chalk27.bold("Forensic Match:")}   ${confFn(confStr + " confidence")} (${report.heartbeat_matches.length} match${report.heartbeat_matches.length !== 1 ? "es" : ""})`);
   }
   console.log();
   if (report.suspects.length === 0) {
-    console.log(chalk26.dim("  No suspects identified."));
+    console.log(chalk27.dim("  No suspects identified."));
     console.log();
     return;
   }
-  console.log(chalk26.bold("  Suspect Ranking"));
+  console.log(chalk27.bold("  Suspect Ranking"));
   console.log();
   const header = `${pad("Suspect", 24)} ${pad("Risk Level", 12)} ${pad("Confidence", 12)} ${pad("Anomalies", 10)} ${"Strikes"}`;
-  console.log(`  ${chalk26.dim(header)}`);
-  console.log(`  ${chalk26.dim("\u2500".repeat(header.length))}`);
+  console.log(`  ${chalk27.dim(header)}`);
+  console.log(`  ${chalk27.dim("\u2500".repeat(header.length))}`);
   for (const s of report.suspects) {
     const colorFn = riskColor2(s.risk_level);
     const label = s.customer_email || s.licensee_id.slice(0, 22);
@@ -155413,8 +155877,8 @@ function displayResults(report) {
     console.log(`  ${row}`);
   }
   console.log();
-  console.log(chalk26.dim(`  Full evidence retained server-side (ID: ${report.investigation_id})`));
-  console.log(chalk26.dim("  Contact investigations@getskillvault.com for the complete evidence package."));
+  console.log(chalk27.dim(`  Full evidence retained server-side (ID: ${report.investigation_id})`));
+  console.log(chalk27.dim("  Contact investigations@getskillvault.com for the complete evidence package."));
   console.log();
 }
 function buildHtmlReport(report, _auditEvents, metadata) {
@@ -155659,7 +156123,7 @@ ${report.suspects.length > 0 ? `<table>
 </body>
 </html>`;
 }
-var investigateCommand = new Command29("investigate").description("Investigate a suspected skill leak").argument("<skill-name>", "Name of the skill to investigate").option("--url <url>", "Fetch leaked content from a URL (GitHub raw, gist, etc.)").option("--file <path>", "Read leaked content from a local file").option("--report <dir>", "Generate full investigation report package to directory").option("--json", "Output as JSON").action(async (skillName, options) => {
+var investigateCommand = new Command30("investigate").description("Investigate a suspected skill leak").argument("<skill-name>", "Name of the skill to investigate").option("--url <url>", "Fetch leaked content from a URL (GitHub raw, gist, etc.)").option("--file <path>", "Read leaked content from a local file").option("--report <dir>", "Generate full investigation report package to directory").option("--json", "Output as JSON").action(async (skillName, options) => {
   try {
     const ctx = requireSession();
     let leakedContent;
@@ -155667,12 +156131,12 @@ var investigateCommand = new Command29("investigate").description("Investigate a
     if (options.url) {
       const rawUrl = toRawGitHubUrl(options.url);
       if (rawUrl !== options.url) {
-        console.log(chalk26.dim(`  Auto-converted GitHub blob URL to raw URL`));
+        console.log(chalk27.dim(`  Auto-converted GitHub blob URL to raw URL`));
       }
-      console.log(chalk26.dim(`  Fetching leaked content from ${rawUrl}...`));
+      console.log(chalk27.dim(`  Fetching leaked content from ${rawUrl}...`));
       const resp = await fetch(rawUrl);
       if (!resp.ok) {
-        process.stderr.write(chalk26.red(`Failed to fetch URL: ${resp.status} ${resp.statusText}
+        process.stderr.write(chalk27.red(`Failed to fetch URL: ${resp.status} ${resp.statusText}
 `));
         process.exit(1);
       }
@@ -155683,24 +156147,24 @@ var investigateCommand = new Command29("investigate").description("Investigate a
         leakedContent = readFileSync15(options.file, "utf-8");
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        process.stderr.write(chalk26.red(`Failed to read file: ${msg}
+        process.stderr.write(chalk27.red(`Failed to read file: ${msg}
 `));
         process.exit(1);
       }
       sourceLabel = options.file;
     } else {
-      process.stderr.write(chalk26.red("Provide leaked content with --url <url> or --file <path>.\n"));
+      process.stderr.write(chalk27.red("Provide leaked content with --url <url> or --file <path>.\n"));
       process.exit(1);
     }
-    console.log(chalk26.dim(`  Loaded ${leakedContent.length.toLocaleString()} chars of leaked content`));
+    console.log(chalk27.dim(`  Loaded ${leakedContent.length.toLocaleString()} chars of leaked content`));
     const skillsData = await sessionFetch(ctx, "/skills");
     const skill = skillsData.skills.find((s) => s.name.toLowerCase() === skillName.toLowerCase());
     if (!skill) {
-      process.stderr.write(chalk26.red(`Skill "${skillName}" not found. Use \`skillvault-publisher list\` to see your skills.
+      process.stderr.write(chalk27.red(`Skill "${skillName}" not found. Use \`skillvault-publisher list\` to see your skills.
 `));
       process.exit(1);
     }
-    console.log(chalk26.dim(`  Running investigation on "${skill.name}"...`));
+    console.log(chalk27.dim(`  Running investigation on "${skill.name}"...`));
     const report = await sessionFetch(ctx, `/publishers/${ctx.publisherId}/investigate`, {
       method: "POST",
       body: { skill_id: skill.id, leaked_content: leakedContent }
@@ -155726,13 +156190,13 @@ var investigateCommand = new Command29("investigate").description("Investigate a
         source: sourceLabel,
         notice: "This is an executive summary. Full evidence is retained server-side. Contact investigations@getskillvault.com for the complete evidence package."
       };
-      writeFileSync10(join14(dir, "metadata.json"), JSON.stringify(metadata, null, 2) + "\n");
-      writeFileSync10(join14(dir, "summary.json"), JSON.stringify({
+      writeFileSync11(join14(dir, "metadata.json"), JSON.stringify(metadata, null, 2) + "\n");
+      writeFileSync11(join14(dir, "summary.json"), JSON.stringify({
         _generated_by: "SkillVault (https://getskillvault.com)",
         ...report
       }, null, 2) + "\n");
       const html = buildHtmlReport(report, [], metadata);
-      writeFileSync10(join14(dir, "report.html"), html);
+      writeFileSync11(join14(dir, "report.html"), html);
       const pdfPath = join14(dir, "report.pdf");
       const { generatePdfReport: generatePdfReport2 } = await Promise.resolve().then(() => (init_pdf_report(), pdf_report_exports));
       await generatePdfReport2({
@@ -155746,23 +156210,23 @@ var investigateCommand = new Command29("investigate").description("Investigate a
         heartbeat_matches: report.heartbeat_matches,
         audit_events: []
       }, pdfPath);
-      console.log(chalk26.green(`  Report saved to ${dir}/`) + chalk26.dim(" (4 files)"));
-      console.log(chalk26.dim(`  PDF:  report.pdf`));
-      console.log(chalk26.dim(`  Full evidence retained server-side (ID: ${report.investigation_id})`));
+      console.log(chalk27.green(`  Report saved to ${dir}/`) + chalk27.dim(" (4 files)"));
+      console.log(chalk27.dim(`  PDF:  report.pdf`));
+      console.log(chalk27.dim(`  Full evidence retained server-side (ID: ${report.investigation_id})`));
       console.log();
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk26.red(`Error: ${message}
+    process.stderr.write(chalk27.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/watchtower.js
-import { Command as Command30 } from "commander";
-import chalk27 from "chalk";
-var watchtowerCommand = new Command30("watchtower").description("Watchtower security dashboard").option("--json", "Output as JSON").option("--workspace <path>", "Resolve workspace context (defaults from CWD)").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').action(async (options) => {
+import { Command as Command31 } from "commander";
+import chalk28 from "chalk";
+var watchtowerCommand = new Command31("watchtower").description("Watchtower security dashboard").option("--json", "Output as JSON").option("--workspace <path>", "Resolve workspace context (defaults from CWD)").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').action(async (options) => {
   const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
   try {
     const data = await sessionFetch(ctx, `/publishers/${ctx.publisherId}/watchtower`);
@@ -155771,37 +156235,37 @@ var watchtowerCommand = new Command30("watchtower").description("Watchtower secu
       return;
     }
     const { summary } = data;
-    const pad3 = (s, n) => s.padEnd(n).slice(0, n);
+    const pad4 = (s, n) => s.padEnd(n).slice(0, n);
     console.log();
-    console.log(chalk27.bold("  Watchtower \u2014 Security Overview"));
+    console.log(chalk28.bold("  Watchtower \u2014 Security Overview"));
     console.log();
-    console.log(`  ${chalk27.bold("Skills")} ${summary.total_skills}  ${chalk27.dim("|")}  ${chalk27.bold("Licenses")} ${summary.total_licenses}  ${chalk27.dim("|")}  ${chalk27.bold("Alerts (7d)")} ${summary.active_alerts > 0 ? chalk27.yellow(String(summary.active_alerts)) : "0"}  ${chalk27.dim("|")}  ${chalk27.bold("Flagged")} ${summary.flagged_customers > 0 ? chalk27.red(String(summary.flagged_customers)) : "0"}  ${chalk27.dim("|")}  ${chalk27.bold("Suspended")} ${summary.suspended_grants > 0 ? chalk27.red(String(summary.suspended_grants)) : "0"}`);
+    console.log(`  ${chalk28.bold("Skills")} ${summary.total_skills}  ${chalk28.dim("|")}  ${chalk28.bold("Licenses")} ${summary.total_licenses}  ${chalk28.dim("|")}  ${chalk28.bold("Alerts (7d)")} ${summary.active_alerts > 0 ? chalk28.yellow(String(summary.active_alerts)) : "0"}  ${chalk28.dim("|")}  ${chalk28.bold("Flagged")} ${summary.flagged_customers > 0 ? chalk28.red(String(summary.flagged_customers)) : "0"}  ${chalk28.dim("|")}  ${chalk28.bold("Suspended")} ${summary.suspended_grants > 0 ? chalk28.red(String(summary.suspended_grants)) : "0"}`);
     if (data.flagged_customers && data.flagged_customers.length > 0) {
       console.log();
-      console.log(chalk27.bold("  Flagged Customers"));
+      console.log(chalk28.bold("  Flagged Customers"));
       console.log();
-      const header = `${pad3("Agent ID", 20)}  ${pad3("Risk Score", 12)}  ${pad3("Level", 10)}  ${pad3("Strikes", 9)}  ${pad3("Status", 12)}  Skills`;
-      console.log(`  ${chalk27.dim(header)}`);
-      console.log(`  ${chalk27.dim("\u2500".repeat(header.length))}`);
+      const header = `${pad4("Agent ID", 20)}  ${pad4("Risk Score", 12)}  ${pad4("Level", 10)}  ${pad4("Strikes", 9)}  ${pad4("Status", 12)}  Skills`;
+      console.log(`  ${chalk28.dim(header)}`);
+      console.log(`  ${chalk28.dim("\u2500".repeat(header.length))}`);
       for (const c of data.flagged_customers) {
         const agentShort = c.agent_id.length > 18 ? c.agent_id.slice(0, 18) + "\u2026" : c.agent_id;
         let levelColored;
         if (c.risk_level === "critical") {
-          levelColored = chalk27.red.bold(pad3(c.risk_level, 10));
+          levelColored = chalk28.red.bold(pad4(c.risk_level, 10));
         } else if (c.risk_level === "high") {
-          levelColored = chalk27.red(pad3(c.risk_level, 10));
+          levelColored = chalk28.red(pad4(c.risk_level, 10));
         } else if (c.risk_level === "medium") {
-          levelColored = chalk27.yellow(pad3(c.risk_level, 10));
+          levelColored = chalk28.yellow(pad4(c.risk_level, 10));
         } else {
-          levelColored = chalk27.dim(pad3(c.risk_level, 10));
+          levelColored = chalk28.dim(pad4(c.risk_level, 10));
         }
-        const statusColored = c.status === "suspended" ? chalk27.red(pad3(c.status, 12)) : pad3(c.status, 12);
-        const skills = c.capabilities.length > 0 ? c.capabilities.join(", ") : chalk27.dim("none");
+        const statusColored = c.status === "suspended" ? chalk28.red(pad4(c.status, 12)) : pad4(c.status, 12);
+        const skills = c.capabilities.length > 0 ? c.capabilities.join(", ") : chalk28.dim("none");
         const row = [
-          pad3(agentShort, 20),
-          pad3(String(c.risk_score), 12),
+          pad4(agentShort, 20),
+          pad4(String(c.risk_score), 12),
           levelColored,
-          pad3(String(c.strike_count), 9),
+          pad4(String(c.strike_count), 9),
           statusColored,
           skills
         ].join("  ");
@@ -155810,20 +156274,20 @@ var watchtowerCommand = new Command30("watchtower").description("Watchtower secu
     }
     if (data.recent_events && data.recent_events.length > 0) {
       console.log();
-      console.log(chalk27.bold("  Recent Security Events"));
+      console.log(chalk28.bold("  Recent Security Events"));
       console.log();
-      const header = `${pad3("Event Type", 28)}  ${pad3("Skill", 24)}  ${pad3("Agent", 20)}  Time`;
-      console.log(`  ${chalk27.dim(header)}`);
-      console.log(`  ${chalk27.dim("\u2500".repeat(header.length))}`);
+      const header = `${pad4("Event Type", 28)}  ${pad4("Skill", 24)}  ${pad4("Agent", 20)}  Time`;
+      console.log(`  ${chalk28.dim(header)}`);
+      console.log(`  ${chalk28.dim("\u2500".repeat(header.length))}`);
       const events = data.recent_events.slice(0, 10);
       for (const e of events) {
-        const skill = e.capability ? e.capability.replace(/^skill\//, "") : chalk27.dim("-");
-        const agent = e.agent_id ? e.agent_id.slice(0, 18) : chalk27.dim("-");
+        const skill = e.capability ? e.capability.replace(/^skill\//, "") : chalk28.dim("-");
+        const agent = e.agent_id ? e.agent_id.slice(0, 18) : chalk28.dim("-");
         const time = new Date(e.created_at).toLocaleString();
         const row = [
-          pad3(e.event_type, 28),
-          pad3(skill, 24),
-          pad3(agent, 20),
+          pad4(e.event_type, 28),
+          pad4(skill, 24),
+          pad4(agent, 20),
           time
         ].join("  ");
         console.log(`  ${row}`);
@@ -155831,25 +156295,25 @@ var watchtowerCommand = new Command30("watchtower").description("Watchtower secu
     }
     if ((!data.flagged_customers || data.flagged_customers.length === 0) && (!data.recent_events || data.recent_events.length === 0)) {
       console.log();
-      console.log(chalk27.green("  All clear \u2014 no security alerts in the last 7 days."));
+      console.log(chalk28.green("  All clear \u2014 no security alerts in the last 7 days."));
     }
     console.log();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk27.red(`Error: ${message}
+    process.stderr.write(chalk28.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/watermark-decode.js
-import { Command as Command31 } from "commander";
-import chalk28 from "chalk";
+import { Command as Command32 } from "commander";
+import chalk29 from "chalk";
 import { readFileSync as readFileSync16 } from "node:fs";
-var watermarkDecodeCommand = new Command31("watermark-decode").description("Analyze leaked content for forensic watermarks (local-only)").option("--file <path>", "Path to file with leaked content").option("--json", "Output as JSON").action(async (options) => {
+var watermarkDecodeCommand = new Command32("watermark-decode").description("Analyze leaked content for forensic watermarks (local-only)").option("--file <path>", "Path to file with leaked content").option("--json", "Output as JSON").action(async (options) => {
   try {
     if (!options.file) {
-      process.stderr.write(chalk28.red("Provide --file <path> with the leaked content\n"));
+      process.stderr.write(chalk29.red("Provide --file <path> with the leaked content\n"));
       process.exit(1);
     }
     let content;
@@ -155857,7 +156321,7 @@ var watermarkDecodeCommand = new Command31("watermark-decode").description("Anal
       content = readFileSync16(options.file, "utf8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(chalk28.red(`Cannot read file: ${msg}
+      process.stderr.write(chalk29.red(`Cannot read file: ${msg}
 `));
       process.exit(1);
     }
@@ -155887,56 +156351,56 @@ var watermarkDecodeCommand = new Command31("watermark-decode").description("Anal
       return;
     }
     console.log();
-    console.log(chalk28.bold("  Watermark Analysis"));
+    console.log(chalk29.bold("  Watermark Analysis"));
     console.log();
-    console.log(chalk28.bold("  Zero-Width Watermark"));
+    console.log(chalk29.bold("  Zero-Width Watermark"));
     if (watermark.found) {
-      console.log(`  Licensee ID: ${chalk28.green.bold(watermark.licenseeId)}`);
+      console.log(`  Licensee ID: ${chalk29.green.bold(watermark.licenseeId)}`);
     } else {
-      console.log(`  ${chalk28.dim("Not found")}`);
+      console.log(`  ${chalk29.dim("Not found")}`);
     }
     console.log();
-    console.log(chalk28.bold("  Heartbeat Markers"));
+    console.log(chalk29.bold("  Heartbeat Markers"));
     if (heartbeats.hb1) {
-      console.log(`  HB1: ${chalk28.green(heartbeats.hb1)}`);
+      console.log(`  HB1: ${chalk29.green(heartbeats.hb1)}`);
     } else {
-      console.log(`  HB1: ${chalk28.dim("Not found")}`);
+      console.log(`  HB1: ${chalk29.dim("Not found")}`);
     }
     if (heartbeats.hb2) {
-      console.log(`  HB2: ${chalk28.green(heartbeats.hb2)}`);
+      console.log(`  HB2: ${chalk29.green(heartbeats.hb2)}`);
     } else {
-      console.log(`  HB2: ${chalk28.dim("Not found")}`);
+      console.log(`  HB2: ${chalk29.dim("Not found")}`);
     }
     if (candidates.length > 0) {
-      console.log(`  ${chalk28.dim(`${candidates.length} potential heartbeat candidate${candidates.length !== 1 ? "s" : ""} found`)}`);
+      console.log(`  ${chalk29.dim(`${candidates.length} potential heartbeat candidate${candidates.length !== 1 ? "s" : ""} found`)}`);
     }
     console.log();
-    console.log(chalk28.bold("  Semantic Fingerprint"));
+    console.log(chalk29.bold("  Semantic Fingerprint"));
     if (hasFingerprint) {
       const binaryStr = fingerprint.map((v) => v === 1 ? "1" : v === -1 ? "X" : "0").join("");
       const variationPoints = fingerprint.filter((v) => v !== 0).length;
-      console.log(`  Pattern: ${chalk28.cyan(binaryStr)}`);
-      console.log(`  ${chalk28.dim(`${variationPoints} variation point${variationPoints !== 1 ? "s" : ""} detected`)}`);
+      console.log(`  Pattern: ${chalk29.cyan(binaryStr)}`);
+      console.log(`  ${chalk29.dim(`${variationPoints} variation point${variationPoints !== 1 ? "s" : ""} detected`)}`);
     } else {
-      console.log(`  ${chalk28.dim("No variation points detected")}`);
+      console.log(`  ${chalk29.dim("No variation points detected")}`);
     }
     console.log();
-    const countColor = signalsDetected > 0 ? chalk28.green.bold : chalk28.dim;
+    const countColor = signalsDetected > 0 ? chalk29.green.bold : chalk29.dim;
     console.log(`  ${countColor(`${signalsDetected} of 4`)} forensic signals detected`);
     console.log();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk28.red(`Error: ${message}
+    process.stderr.write(chalk29.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/link.js
-import { Command as Command32 } from "commander";
-import chalk29 from "chalk";
+import { Command as Command33 } from "commander";
+import chalk30 from "chalk";
 import { existsSync as existsSync14, readFileSync as readFileSync17, statSync as statSync6 } from "node:fs";
-import { resolve as resolve8, join as join15 } from "node:path";
+import { resolve as resolve10, join as join15 } from "node:path";
 function parseFrontmatter4(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!match)
@@ -155955,12 +156419,12 @@ function parseFrontmatter4(content) {
   }
   return result;
 }
-var linkCommand = new Command32("link").description("Link a skill source directory to your publisher account").argument("[directory]", "Skill directory to link (defaults to CWD)").option("--workspace <path>", "Explicit workspace directory (precedence over positional)").option("--force", "Overwrite an existing link to a different publisher_id").option("--name <name>", "Override skill name (defaults to SKILL.md frontmatter name)").option("--capability <cap>", "Override capability_name (advanced \u2014 usually matches skill name)").action(async (directory, options) => {
+var linkCommand = new Command33("link").description("Link a skill source directory to your publisher account").argument("[directory]", "Skill directory to link (defaults to CWD)").option("--workspace <path>", "Explicit workspace directory (precedence over positional)").option("--force", "Overwrite an existing link to a different publisher_id").option("--name <name>", "Override skill name (defaults to SKILL.md frontmatter name)").option("--capability <cap>", "Override capability_name (advanced \u2014 usually matches skill name)").action(async (directory, options) => {
   try {
     const ctx = requireSession();
-    const dirPath = options.workspace ? resolve8(options.workspace) : directory ? resolve8(directory) : process.cwd();
+    const dirPath = options.workspace ? resolve10(options.workspace) : directory ? resolve10(directory) : process.cwd();
     if (!existsSync14(dirPath) || !statSync6(dirPath).isDirectory()) {
-      process.stderr.write(chalk29.red(`Error: "${dirPath}" is not a valid directory
+      process.stderr.write(chalk30.red(`Error: "${dirPath}" is not a valid directory
 `));
       process.exit(1);
     }
@@ -155970,17 +156434,17 @@ var linkCommand = new Command32("link").description("Link a skill source directo
     const existing = loadWorkspace(dirPath);
     const skillName = options.name || existing?.skill_name || frontmatter.name;
     if (!skillName) {
-      process.stderr.write(chalk29.red("Error: Cannot determine skill name.\n"));
-      process.stderr.write(chalk29.dim("  Pass --name <name> or set `name:` in SKILL.md frontmatter.\n"));
+      process.stderr.write(chalk30.red("Error: Cannot determine skill name.\n"));
+      process.stderr.write(chalk30.dim("  Pass --name <name> or set `name:` in SKILL.md frontmatter.\n"));
       process.exit(1);
     }
     const capabilityName = options.capability || existing?.capability_name || `skill/${skillName.toLowerCase()}`;
     if (existing && existing.publisher_id !== ctx.publisherId && !options.force) {
-      process.stderr.write(chalk29.red(`Error: This directory is already linked to publisher ${existing.publisher_id}.
+      process.stderr.write(chalk30.red(`Error: This directory is already linked to publisher ${existing.publisher_id}.
 `));
-      process.stderr.write(chalk29.dim(`  You are logged in as ${ctx.publisherId}.
+      process.stderr.write(chalk30.dim(`  You are logged in as ${ctx.publisherId}.
 `));
-      process.stderr.write(chalk29.cyan("  Use --force to re-link to your account.\n"));
+      process.stderr.write(chalk30.cyan("  Use --force to re-link to your account.\n"));
       process.exit(1);
     }
     const linkedAt = existing?.linked_at ?? (/* @__PURE__ */ new Date()).toISOString();
@@ -156002,41 +156466,41 @@ var linkCommand = new Command32("link").description("Link a skill source directo
       last_published_at: manifest.last_published_at
     });
     const action = existing ? "Re-linked" : "Linked";
-    console.log(chalk29.green(`${action} "${skillName}" \u2192 ${capabilityName}`));
-    console.log(chalk29.dim(`  Directory:  ${dirPath}`));
-    console.log(chalk29.dim(`  Publisher:  ${ctx.publisherId}`));
-    console.log(chalk29.dim(`  Manifest:   .skillvault-publisher/workspace.json`));
+    console.log(chalk30.green(`${action} "${skillName}" \u2192 ${capabilityName}`));
+    console.log(chalk30.dim(`  Directory:  ${dirPath}`));
+    console.log(chalk30.dim(`  Publisher:  ${ctx.publisherId}`));
+    console.log(chalk30.dim(`  Manifest:   .skillvault-publisher/workspace.json`));
     if (!existing) {
       console.log();
-      console.log(chalk29.cyan("  Tip: commit .skillvault-publisher/workspace.json so teammates and CI can find this skill."));
+      console.log(chalk30.cyan("  Tip: commit .skillvault-publisher/workspace.json so teammates and CI can find this skill."));
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk29.red(`Link failed: ${message}
+    process.stderr.write(chalk30.red(`Link failed: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/unlink.js
-import { Command as Command33 } from "commander";
-import chalk30 from "chalk";
+import { Command as Command34 } from "commander";
+import chalk31 from "chalk";
 import { existsSync as existsSync15, rmSync as rmSync2, statSync as statSync7 } from "node:fs";
-import { resolve as resolve9, join as join16 } from "node:path";
-var unlinkCommand = new Command33("unlink").description("Remove the workspace link from a skill source directory").argument("[directory]", "Skill directory to unlink (defaults to CWD)").option("--workspace <path>", "Explicit workspace directory (precedence over positional)").option("--keep-registry", "Remove the manifest file but leave the registry entry").action(async (directory, options) => {
+import { resolve as resolve11, join as join16 } from "node:path";
+var unlinkCommand = new Command34("unlink").description("Remove the workspace link from a skill source directory").argument("[directory]", "Skill directory to unlink (defaults to CWD)").option("--workspace <path>", "Explicit workspace directory (precedence over positional)").option("--keep-registry", "Remove the manifest file but leave the registry entry").action(async (directory, options) => {
   try {
-    const dirPath = options.workspace ? resolve9(options.workspace) : directory ? resolve9(directory) : process.cwd();
+    const dirPath = options.workspace ? resolve11(options.workspace) : directory ? resolve11(directory) : process.cwd();
     if (!existsSync15(dirPath) || !statSync7(dirPath).isDirectory()) {
-      process.stderr.write(chalk30.red(`Error: "${dirPath}" is not a valid directory
+      process.stderr.write(chalk31.red(`Error: "${dirPath}" is not a valid directory
 `));
       process.exit(1);
     }
     const manifest = loadWorkspace(dirPath);
     if (!manifest) {
-      process.stderr.write(chalk30.red("Error: No workspace manifest found at this directory.\n"));
-      process.stderr.write(chalk30.dim(`  Looked for: ${join16(dirPath, ".skillvault-publisher", "workspace.json")}
+      process.stderr.write(chalk31.red("Error: No workspace manifest found at this directory.\n"));
+      process.stderr.write(chalk31.dim(`  Looked for: ${join16(dirPath, ".skillvault-publisher", "workspace.json")}
 `));
-      process.stderr.write(chalk30.dim("  Run `skillvault-publisher link` first to create one.\n"));
+      process.stderr.write(chalk31.dim("  Run `skillvault-publisher link` first to create one.\n"));
       process.exit(1);
     }
     const { manifestPath } = workspaceRootsFor(dirPath);
@@ -156044,7 +156508,7 @@ var unlinkCommand = new Command33("unlink").description("Remove the workspace li
       rmSync2(manifestPath);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      process.stderr.write(chalk30.red(`Failed to remove manifest: ${message}
+      process.stderr.write(chalk31.red(`Failed to remove manifest: ${message}
 `));
       process.exit(1);
     }
@@ -156056,25 +156520,25 @@ var unlinkCommand = new Command33("unlink").description("Remove the workspace li
     if (!options.keepRegistry) {
       unregisterWorkspace(dirPath);
     }
-    console.log(chalk30.green(`Unlinked "${manifest.skill_name}" (${manifest.capability_name})`));
-    console.log(chalk30.dim(`  Directory:  ${dirPath}`));
+    console.log(chalk31.green(`Unlinked "${manifest.skill_name}" (${manifest.capability_name})`));
+    console.log(chalk31.dim(`  Directory:  ${dirPath}`));
     if (options.keepRegistry) {
-      console.log(chalk30.dim("  Registry entry kept (--keep-registry)"));
+      console.log(chalk31.dim("  Registry entry kept (--keep-registry)"));
     }
     console.log();
-    console.log(chalk30.dim("  Note: SKILL.md and source files are untouched."));
-    console.log(chalk30.dim("  Note: The skill on the server is NOT deleted. Use `skill-delete` for that."));
+    console.log(chalk31.dim("  Note: SKILL.md and source files are untouched."));
+    console.log(chalk31.dim("  Note: The skill on the server is NOT deleted. Use `skill-delete` for that."));
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk30.red(`Unlink failed: ${message}
+    process.stderr.write(chalk31.red(`Unlink failed: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/workspaces.js
-import { Command as Command34 } from "commander";
-import chalk31 from "chalk";
+import { Command as Command35 } from "commander";
+import chalk32 from "chalk";
 function formatDate(iso) {
   if (!iso)
     return "-";
@@ -156109,8 +156573,8 @@ function listAction(options) {
     return;
   }
   if (filtered.length === 0) {
-    console.log(chalk31.dim("No workspaces linked."));
-    console.log(chalk31.dim("  Run `skillvault-publisher link` from a skill source directory to create one."));
+    console.log(chalk32.dim("No workspaces linked."));
+    console.log(chalk32.dim("  Run `skillvault-publisher link` from a skill source directory to create one."));
     return;
   }
   const pathWidth = Math.min(Math.max(20, ...filtered.map((w) => w.path.length)), 50);
@@ -156118,27 +156582,27 @@ function listAction(options) {
   const pubWidth = Math.max(10, ...filtered.map((w) => w.publisher_id.length));
   console.log();
   const header = `${pad2("PATH", pathWidth)}  ${pad2("PUBLISHER", pubWidth)}  ${pad2("SKILL", skillWidth)}  ${pad2("VERSION", 10)}  ${pad2("LAST PUBLISHED", 14)}  SOURCE`;
-  console.log(`  ${chalk31.dim(header)}`);
-  console.log(`  ${chalk31.dim("\u2500".repeat(header.length))}`);
+  console.log(`  ${chalk32.dim(header)}`);
+  console.log(`  ${chalk32.dim("\u2500".repeat(header.length))}`);
   for (const w of filtered) {
     const isOther = currentAccount !== null && w.publisher_id !== currentAccount;
     const path = w.path.length > pathWidth ? "\u2026" + w.path.slice(-(pathWidth - 1)) : w.path;
     const row = `${pad2(path, pathWidth)}  ${pad2(w.publisher_id, pubWidth)}  ${pad2(w.skill_name, skillWidth)}  ${pad2(w.last_published_version ?? "-", 10)}  ${pad2(formatDate(w.last_published_at), 14)}  ${w.source}`;
     if (isOther) {
-      console.log(`  ${chalk31.dim(row + "  [other account]")}`);
+      console.log(`  ${chalk32.dim(row + "  [other account]")}`);
     } else {
       console.log(`  ${row}`);
     }
   }
   console.log();
-  console.log(chalk31.dim(`  ${filtered.length} workspace${filtered.length === 1 ? "" : "s"}` + (options.current ? " (filtered to current account)" : "")));
+  console.log(chalk32.dim(`  ${filtered.length} workspace${filtered.length === 1 ? "" : "s"}` + (options.current ? " (filtered to current account)" : "")));
 }
-var workspacesCommand = new Command34("workspaces").description("List linked skill source directories (workspaces)").option("--json", "Output as JSON").option("--current", "Only show workspaces matching the current logged-in publisher").action((options) => {
+var workspacesCommand = new Command35("workspaces").description("List linked skill source directories (workspaces)").option("--json", "Output as JSON").option("--current", "Only show workspaces matching the current logged-in publisher").action((options) => {
   try {
     listAction(options);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk31.red(`Error: ${message}
+    process.stderr.write(chalk32.red(`Error: ${message}
 `));
     process.exit(1);
   }
@@ -156154,7 +156618,146 @@ workspacesCommand.command("find").description("Print the absolute path of a work
     console.log(match.path);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk31.red(`Error: ${message}
+    process.stderr.write(chalk32.red(`Error: ${message}
+`));
+    process.exit(1);
+  }
+});
+
+// dist/commands/team.js
+import { Command as Command36 } from "commander";
+import chalk33 from "chalk";
+function formatRole(role) {
+  if (role === "owner")
+    return chalk33.green("owner");
+  if (role === "admin")
+    return chalk33.cyan("admin");
+  return chalk33.dim("member");
+}
+function formatStatus(status) {
+  if (status === "active")
+    return chalk33.green("active");
+  if (status === "pending")
+    return chalk33.yellow("pending");
+  return chalk33.dim(status);
+}
+function pad3(s, n) {
+  const visible = s.replace(/\x1b\[[0-9;]*m/g, "");
+  if (visible.length >= n)
+    return s;
+  return s + " ".repeat(n - visible.length);
+}
+var teamCommand = new Command36("team").description("Manage your publisher team members").option("--json", "Output as JSON").action(async (options) => {
+  try {
+    const ctx = requireSession();
+    const data = await sessionFetch(ctx, `/publishers/${ctx.publisherId}/team`);
+    const members = data.members || [];
+    if (options.json) {
+      console.log(JSON.stringify(members, null, 2));
+      return;
+    }
+    if (members.length === 0) {
+      console.log();
+      console.log(chalk33.dim("  No team members yet. Invite someone:"));
+      console.log(chalk33.cyan("    skillvault-publisher team add <email> [--role member|admin]"));
+      console.log();
+      return;
+    }
+    console.log();
+    console.log(chalk33.bold(`  Team members (${members.length})`));
+    console.log();
+    const header = `${pad3(chalk33.dim("Email"), 36)}  ${pad3(chalk33.dim("Role"), 14)}  ${pad3(chalk33.dim("Status"), 14)}  ${chalk33.dim("Member ID")}`;
+    console.log(`  ${header}`);
+    console.log(`  ${chalk33.dim("\u2500".repeat(80))}`);
+    for (const m of members) {
+      const row = `${pad3(m.email, 36)}  ${pad3(formatRole(m.role), 14)}  ${pad3(formatStatus(m.status), 14)}  ${chalk33.dim(m.id)}`;
+      console.log(`  ${row}`);
+    }
+    console.log();
+    console.log(chalk33.dim(`  Logged in as publisher ${ctx.publisherId}`));
+    console.log();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(chalk33.red(`team list failed: ${message}
+`));
+    process.exit(1);
+  }
+});
+teamCommand.command("add").description("Invite someone to your publisher team. Sends a magic-link email.").argument("<email>", "The email address to invite").option("--role <role>", "Role: member (default) or admin", "member").option("--name <name>", "Display name for the invitee (optional)").option("--json", "Output as JSON").action(async (email, options) => {
+  try {
+    if (!["member", "admin"].includes(options.role)) {
+      process.stderr.write(chalk33.red(`Invalid role "${options.role}". Use --role member or --role admin.
+`));
+      process.exit(1);
+    }
+    const ctx = requireSession();
+    const member = await sessionFetch(ctx, `/publishers/${ctx.publisherId}/team`, {
+      method: "POST",
+      body: { email, role: options.role, name: options.name || null }
+    });
+    if (options.json) {
+      console.log(JSON.stringify(member, null, 2));
+      return;
+    }
+    console.log();
+    console.log(chalk33.green(`  \u2713 Invited ${email} as ${formatRole(options.role)}`));
+    console.log(chalk33.dim(`    Member ID:  ${member.id}`));
+    console.log(chalk33.dim(`    Status:     ${formatStatus(member.status)}`));
+    console.log();
+    console.log(chalk33.dim("  A magic-link invitation email has been sent. The new member can"));
+    console.log(chalk33.dim("  click the link to activate, then run:"));
+    console.log(chalk33.cyan(`    skillvault-publisher login --email ${email}`));
+    console.log();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(chalk33.red(`team add failed: ${message}
+`));
+    process.exit(1);
+  }
+});
+teamCommand.command("remove").description("Remove a team member by email or member ID").argument("<email-or-id>", "The member email address or member ID (tm_xxx)").option("--yes", "Skip confirmation").option("--json", "Output as JSON").action(async (target, options) => {
+  try {
+    const ctx = requireSession();
+    const listData = await sessionFetch(ctx, `/publishers/${ctx.publisherId}/team`);
+    const members = listData.members || [];
+    const member = members.find((m) => m.id === target || m.email === target);
+    if (!member) {
+      process.stderr.write(chalk33.red(`No team member found matching "${target}".
+`));
+      process.stderr.write(chalk33.dim("Run `skillvault-publisher team` to see the current list.\n"));
+      process.exit(1);
+    }
+    if (member.role === "owner") {
+      process.stderr.write(chalk33.red("Cannot remove the owner of a publisher account.\n"));
+      process.exit(1);
+    }
+    if (member.status === "removed") {
+      process.stderr.write(chalk33.yellow(`${member.email} is already removed.
+`));
+      process.exit(0);
+    }
+    if (!options.yes) {
+      console.log();
+      console.log(chalk33.yellow.bold("  Warning: ") + "This will revoke " + chalk33.bold(member.email) + `'s access to publisher ${ctx.publisherId}.`);
+      console.log();
+      console.log(`  Email:    ${chalk33.cyan(member.email)}`);
+      console.log(`  Role:     ${formatRole(member.role)}`);
+      console.log(`  Status:   ${formatStatus(member.status)}`);
+      console.log(`  Added:    ${chalk33.dim(new Date(member.created_at).toLocaleDateString())}`);
+      console.log();
+      console.log(chalk33.dim("  Add --yes to confirm."));
+      console.log();
+      process.exit(0);
+    }
+    await sessionFetch(ctx, `/publishers/${ctx.publisherId}/team/${member.id}`, { method: "DELETE" });
+    if (options.json) {
+      console.log(JSON.stringify({ removed: true, member_id: member.id, email: member.email }, null, 2));
+      return;
+    }
+    console.log(chalk33.green(`  \u2713 Removed ${member.email} from the team`));
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(chalk33.red(`team remove failed: ${message}
 `));
     process.exit(1);
   }
@@ -156163,7 +156766,7 @@ workspacesCommand.command("find").description("Print the absolute path of a work
 // dist/index.js
 var __dirname2 = dirname5(fileURLToPath(import.meta.url));
 var pkg = JSON.parse(readFileSync18(join17(__dirname2, "..", "package.json"), "utf8"));
-var program = new Command35();
+var program = new Command37();
 program.name("skillvault-publisher").description("SkillVault publisher CLI \u2014 publish, manage, and distribute encrypted skills").version(pkg.version).addHelpText("after", `
 
 Getting Started:
@@ -156196,6 +156799,7 @@ program.addCommand(sessionCleanupCommand);
 program.addCommand(skillDeleteCommand);
 program.addCommand(skillStatusCommand);
 program.addCommand(skillUnarchiveCommand);
+program.addCommand(skillAclCommand);
 program.addCommand(grantsCommand);
 program.addCommand(revokeGrantCommand);
 program.addCommand(customersCommand);
@@ -156208,6 +156812,7 @@ program.addCommand(watermarkDecodeCommand);
 program.addCommand(linkCommand);
 program.addCommand(unlinkCommand);
 program.addCommand(workspacesCommand);
+program.addCommand(teamCommand);
 program.parse();
 /*! Bundled license information: