skillvault-publisher 0.12.0 → 0.13.2

package/dist/index.js

@@ -3891,11 +3891,11 @@ function __metadata(metadataKey, metadataValue) {
 }
 function __awaiter(thisArg, _arguments, P, generator) {
   function adopt(value) {
-    return value instanceof P ? value : new P(function(resolve11) {
-      resolve11(value);
+    return value instanceof P ? value : new P(function(resolve12) {
+      resolve12(value);
     });
   }
-  return new (P || (P = Promise))(function(resolve11, reject) {
+  return new (P || (P = Promise))(function(resolve12, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -3911,7 +3911,7 @@ function __awaiter(thisArg, _arguments, P, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve11(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve12(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -4102,14 +4102,14 @@ function __asyncValues(o) {
   }, i);
   function verb(n) {
     i[n] = o[n] && function(v) {
-      return new Promise(function(resolve11, reject) {
-        v = o[n](v), settle(resolve11, reject, v.done, v.value);
+      return new Promise(function(resolve12, reject) {
+        v = o[n](v), settle(resolve12, reject, v.done, v.value);
       });
     };
   }
-  function settle(resolve11, reject, d, v) {
+  function settle(resolve12, reject, d, v) {
     Promise.resolve(v).then(function(v2) {
-      resolve11({ value: v2, done: d });
+      resolve12({ value: v2, done: d });
     }, reject);
   }
 }
@@ -5054,9 +5054,9 @@ var require_clone = __commonJS({
           } else if (_instanceof(parent2, nativeSet)) {
             child = new nativeSet();
           } else if (_instanceof(parent2, nativePromise)) {
-            child = new nativePromise(function(resolve11, reject) {
+            child = new nativePromise(function(resolve12, reject) {
               parent2.then(function(value) {
-                resolve11(_clone(value, depth2 - 1));
+                resolve12(_clone(value, depth2 - 1));
               }, function(err) {
                 reject(_clone(err, depth2 - 1));
               });
@@ -151595,7 +151595,7 @@ function confColor(c) {
   return SV.sirenRed500;
 }
 async function generatePdfReport(data, outputPath) {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const doc = new import_pdfkit.default({
       size: "A4",
       margins: { top: 72, bottom: 0, left: 56, right: 56 },
@@ -151742,7 +151742,7 @@ async function generatePdfReport(data, outputPath) {
     yPos += 72;
     drawPageFooter(doc, leftMargin, contentWidth, pageWidth, pageNum);
     doc.end();
-    stream.on("finish", resolve11);
+    stream.on("finish", resolve12);
     stream.on("error", reject);
   });
 }
@@ -151804,7 +151804,7 @@ var init_pdf_report = __esm({
 });
 
 // dist/index.js
-import { Command as Command36 } from "commander";
+import { Command as Command37 } from "commander";
 import { readFileSync as readFileSync18 } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname as dirname5, join as join17 } from "node:path";
@@ -151926,6 +151926,41 @@ var loginCommand = new Command("login").description("Authenticate with the Skill
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify(body2)
       });
+      if (loginRes.status === 403) {
+        const err = await loginRes.json().catch(() => null);
+        if (err?.error === "production_login_disabled") {
+          console.log(chalk.dim("Production server: pivoting to magic-link verification..."));
+          const mlRes = await fetch(`${serverUrl}/auth/magic-link`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ email: options.email })
+          });
+          if (mlRes.ok) {
+            const mlData = await mlRes.json().catch(() => ({}));
+            if (mlData.status === "sent") {
+              console.log();
+              console.log(chalk.green("  Verification email sent."));
+              console.log();
+              console.log(chalk.bold("  Next steps:"));
+              console.log(`    1. Check ${chalk.cyan(options.email)} for an email from SkillVault`);
+              console.log("    2. Click the magic link to sign in to the dashboard");
+              console.log("    3. On the dashboard, go to Settings \u2192 Profile");
+              console.log("    4. Copy your CLI token and run:");
+              console.log(chalk.cyan(`         skillvault-publisher login --token <pasted_token>`));
+              console.log();
+              process.exit(0);
+            }
+            if (mlData.status === "not_found") {
+              console.error(chalk.red(`No account found for ${options.email}.`));
+              console.error(chalk.dim("Create one at https://app.getskillvault.com/login first."));
+              process.exit(1);
+            }
+          }
+          console.error(chalk.red("Failed to send verification email."));
+          console.error(chalk.dim(err.message || "Unknown error"));
+          process.exit(1);
+        }
+      }
       if (!loginRes.ok) {
         const err = await loginRes.json().catch(() => null);
         const reason = err?.message || err?.error || loginRes.statusText || `HTTP ${loginRes.status}`;
@@ -152070,7 +152105,7 @@ var registerCommand = new Command2("register").description("Create a new publish
     let verified = false;
     const maxAttempts = 120;
     for (let i = 0; i < maxAttempts; i++) {
-      await new Promise((resolve11) => setTimeout(resolve11, 3e3));
+      await new Promise((resolve12) => setTimeout(resolve12, 3e3));
       try {
         const statusRes = await fetch(`${serverUrl}/publishers/${publisher_id}/verification-status`);
         if (statusRes.ok) {
@@ -153152,7 +153187,8 @@ The server will clean up automatically. If the problem persists, re-run with --f
     }
     const publishResult = await publishRes.json().catch(() => ({}));
     const wasUnlinked = existingManifest === null;
-    if (!options.noLink && sessionPublisherId) {
+    const publishAccepted = publishResult.status !== "rejected";
+    if (publishAccepted && !options.noLink && sessionPublisherId) {
       const linkedAt = existingManifest?.linked_at ?? (/* @__PURE__ */ new Date()).toISOString();
       const newManifest = {
         ...existingManifest ?? {},
@@ -153186,6 +153222,26 @@ The server will clean up automatically. If the problem persists, re-run with --f
     if (publishResult.status === "unchanged") {
       console.log(chalk5.yellow(`Content unchanged for ${skillName} v${version}. No new version created.`));
       console.log(chalk5.dim(`  Use --force to publish anyway.`));
+    } else if (publishResult.status === "rejected") {
+      const reasonMessage = publishResult.public_reason?.message || "Skill rejected by the security review pipeline.";
+      process.stderr.write(chalk5.red(`
+Publish rejected: ${reasonMessage}
+`));
+      process.stderr.write(chalk5.dim(`  Run \`skillvault-publisher skill-status ${skillName}\` for more details.
+`));
+      process.stderr.write(chalk5.dim(`  Download a rejection report with \`skillvault-publisher skill-status ${skillName} --review-report <file>\`.
+`));
+      process.exit(1);
+    } else if (publishResult.status === "under_review") {
+      console.log(chalk5.yellow(`
+Skill queued for review: ${skillName} v${version}`));
+      if (publishResult.review_id) {
+        console.log(chalk5.dim(`  Review ID:  ${publishResult.review_id}`));
+      }
+      console.log(chalk5.dim(`  Skill ID:   ${publishResult.skill_id || "n/a"}`));
+      console.log(chalk5.dim(`  Capability: ${capabilityName}`));
+      console.log(chalk5.dim("  Reviews usually complete within a few minutes."));
+      console.log(chalk5.dim(`  Check status with \`skillvault-publisher skill-status ${skillName}\` (or listen on your webhook).`));
     } else {
       console.log(chalk5.green(`Published ${skillName} v${version}`));
       console.log(chalk5.dim(`  Skill ID:   ${publishResult.skill_id || "n/a"}`));
@@ -153674,8 +153730,17 @@ var whoamiCommand = new Command9("whoami").description("Show current user, activ
       console.log(JSON.stringify({
         host_id: data.host_id ?? config.host_id,
         agent_id: data.agent_id ?? config.agent_id,
-        ...config.publisher_id ? { publisher_id: config.publisher_id } : {},
-        ...config.email ? { email: config.email } : {},
+        ...authMe ? {
+          publisher_id: authMe.publisher_id,
+          publisher_name: authMe.publisher_name,
+          email: authMe.email,
+          role: authMe.role,
+          is_owner: authMe.is_owner,
+          ...authMe.skill_acls ? { skill_acls: authMe.skill_acls } : {}
+        } : {
+          ...config.publisher_id ? { publisher_id: config.publisher_id } : {},
+          ...config.email ? { email: config.email } : {}
+        },
         device_fingerprint: fingerprint,
         server_url: config.server_url,
         status: data.status,
@@ -153683,6 +153748,18 @@ var whoamiCommand = new Command9("whoami").description("Show current user, activ
       }, null, 2));
       return;
     }
+    let skillsById = /* @__PURE__ */ new Map();
+    if (authMe?.role === "member" && authMe.skill_acls && authMe.skill_acls.length > 0) {
+      try {
+        const skillsRes = await fetch(`${config.server_url}/skills`, { headers: ctx.headers });
+        if (skillsRes.ok) {
+          const sd = await skillsRes.json();
+          for (const s of sd.skills)
+            skillsById.set(s.id, s);
+        }
+      } catch {
+      }
+    }
     console.log();
     console.log(chalk10.bold("  Skill Vault Identity"));
     console.log();
@@ -153695,6 +153772,20 @@ var whoamiCommand = new Command9("whoami").description("Show current user, activ
       if (!authMe.is_owner) {
         console.log(`  ${chalk10.dim("  (you are a team member of this publisher)".padEnd(22))}`);
       }
+      if (authMe.role === "member" && authMe.skill_acls) {
+        if (authMe.skill_acls.length === 0) {
+          console.log(`  ${chalk10.dim("Skill access:".padEnd(22))} ${chalk10.dim("(none yet \u2014 publish a new skill to auto-own it)")}`);
+        } else {
+          console.log(`  ${"Skill access:".padEnd(22)}`);
+          for (const a of authMe.skill_acls) {
+            const sk = skillsById.get(a.skill_id);
+            const label = sk?.name || a.skill_id;
+            const roleColor2 = a.role === "owner" ? chalk10.green : a.role === "write" ? chalk10.cyan : chalk10.dim;
+            const action = a.role === "owner" ? "publish + delete" : a.role === "write" ? "publish new versions" : "view only";
+            console.log(`    ${chalk10.cyan(label.padEnd(20))}  ${roleColor2(a.role.padEnd(8))}  ${chalk10.dim(action)}`);
+          }
+        }
+      }
     } else {
       if (config.publisher_id) {
         console.log(`  ${"Publisher ID:".padEnd(22)} ${config.publisher_id}`);
@@ -153961,11 +154052,13 @@ var listCommand = new Command13("list").description("List your published skills"
     const nameWidth = Math.max(20, ...skills.map((s) => s.name.length + 2));
     const verWidth = 10;
     const statusWidth = 10;
+    const reviewWidth = 8;
     const capWidth = Math.max(24, ...skills.map((s) => s.capability_name.length + 2));
     const header = [
       chalk14.dim("Name".padEnd(nameWidth)),
       chalk14.dim("Version".padEnd(verWidth)),
       chalk14.dim("Status".padEnd(statusWidth)),
+      chalk14.dim("Review".padEnd(reviewWidth)),
       chalk14.dim("Capability".padEnd(capWidth)),
       chalk14.dim("Created")
     ].join("  ");
@@ -153977,10 +154070,29 @@ var listCommand = new Command13("list").description("List your published skills"
         year: "numeric"
       });
       const statusColor = skill.status === "active" ? chalk14.green : chalk14.dim;
+      let reviewCell;
+      switch (skill.review_state) {
+        case "approved":
+          reviewCell = chalk14.green("ok".padEnd(reviewWidth));
+          break;
+        case "queued":
+        case "running":
+          reviewCell = chalk14.yellow("review".padEnd(reviewWidth));
+          break;
+        case "rejected":
+          reviewCell = chalk14.red("reject".padEnd(reviewWidth));
+          break;
+        case "needs_human_review":
+          reviewCell = chalk14.yellow("human".padEnd(reviewWidth));
+          break;
+        default:
+          reviewCell = chalk14.dim("-".padEnd(reviewWidth));
+      }
       const row = [
         chalk14.cyan(skill.name.padEnd(nameWidth)),
         chalk14.green(("v" + skill.latest_version).padEnd(verWidth)),
         statusColor(skill.status.padEnd(statusWidth)),
+        reviewCell,
         chalk14.dim(skill.capability_name.padEnd(capWidth)),
         chalk14.dim(createdDate)
       ].join("  ");
@@ -155055,7 +155167,9 @@ var skillDeleteCommand = new Command20("skill-delete").description("Permanently
 // dist/commands/skill-status.js
 import { Command as Command21 } from "commander";
 import chalk18 from "chalk";
-var skillStatusCommand = new Command21("skill-status").description("Show detailed status for a skill").argument("[skill-name]", "Name of the skill to inspect (defaults to workspace skill)").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default skill-name").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').action(async (skillNameArg, options) => {
+import { writeFileSync as writeFileSync10 } from "node:fs";
+import { resolve as resolve9 } from "node:path";
+var skillStatusCommand = new Command21("skill-status").description("Show detailed status for a skill").argument("[skill-name]", "Name of the skill to inspect (defaults to workspace skill)").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default skill-name").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--review-report <file>", "Write a public review report (JSON) to <file>").action(async (skillNameArg, options) => {
   try {
     const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
     const skillName = skillNameArg ?? ctx.defaultSkillName ?? void 0;
@@ -155077,17 +155191,56 @@ var skillStatusCommand = new Command21("skill-status").description("Show detaile
       sessionFetch(ctx, "/grants")
     ]);
     const activeGrants = grantsData.grants.filter((g) => g.capability === detail.capability_name && g.status === "active");
+    if (options.reviewReport) {
+      const report = {
+        skill_id: detail.id,
+        capability_name: detail.capability_name,
+        version: detail.latest_version,
+        review_state: detail.review_state ?? null,
+        public_reason_code: detail.latest_review?.public_reason_code ?? null,
+        public_reason_message: detail.latest_review?.public_reason_message ?? null,
+        last_review_at: detail.latest_review?.last_review_at ?? null
+      };
+      const reportPath = resolve9(options.reviewReport);
+      writeFileSync10(reportPath, JSON.stringify(report, null, 2) + "\n");
+      process.stderr.write(chalk18.green(`Wrote review report to ${reportPath}
+`));
+    }
     if (options.json) {
       console.log(JSON.stringify({ ...detail, active_grants: activeGrants.length }, null, 2));
       return;
     }
     const statusColor = detail.status === "active" ? chalk18.green : detail.status === "archived" ? chalk18.yellow : chalk18.dim;
     const createdDate = new Date(detail.created_at).toLocaleDateString("en-US", { month: "short", day: "numeric", year: "numeric" });
+    const reviewState = detail.review_state ?? "approved";
+    let reviewLabel;
+    switch (reviewState) {
+      case "approved":
+        reviewLabel = chalk18.green("Approved");
+        break;
+      case "queued":
+      case "running":
+        reviewLabel = chalk18.yellow("Under review");
+        break;
+      case "rejected":
+        reviewLabel = chalk18.red("Rejected");
+        break;
+      case "needs_human_review":
+        reviewLabel = chalk18.yellow("Awaiting review");
+        break;
+      default:
+        reviewLabel = chalk18.dim(reviewState);
+    }
+    const lastReviewAt = detail.latest_review?.last_review_at ? new Date(detail.latest_review.last_review_at).toLocaleDateString("en-US", { month: "short", day: "numeric", year: "numeric" }) : null;
     console.log();
     console.log(chalk18.bold(`  ${detail.name}`));
     console.log();
     console.log(`  Capability:     ${detail.capability_name}`);
     console.log(`  Status:         ${statusColor(detail.status)}`);
+    console.log(`  Review:         ${reviewLabel}${lastReviewAt ? chalk18.dim(` (${lastReviewAt})`) : ""}`);
+    if (reviewState === "rejected" && detail.latest_review?.public_reason_message) {
+      console.log(`  Reason:         ${chalk18.red(detail.latest_review.public_reason_message)}`);
+    }
     console.log(`  Version:        ${chalk18.green("v" + detail.latest_version)}`);
     console.log(`  Created:        ${chalk18.dim(createdDate)}`);
     console.log(`  ID:             ${chalk18.dim(detail.id)}`);
@@ -155144,10 +155297,199 @@ var skillUnarchiveCommand = new Command22("skill-unarchive").description("Restor
   }
 });
 
-// dist/commands/grants.js
+// dist/commands/skill-acl.js
 import { Command as Command23 } from "commander";
 import chalk20 from "chalk";
-var grantsCommand = new Command23("grants").description("List capability grants issued to customers").option("--status <status>", "Filter by status: active, revoked, expired").option("--skill <name>", "Filter to grants for a specific skill (capability)").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default --skill").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--all", "Disable workspace --skill default; show grants for all skills").action(async (options) => {
+var VALID_ROLES = /* @__PURE__ */ new Set(["read", "write", "owner"]);
+async function resolveSkill(ctx, skillName) {
+  const data = await sessionFetch(ctx, "/skills");
+  const skill = data.skills.find((s) => s.name.toLowerCase() === skillName.toLowerCase() || s.capability_name.toLowerCase() === skillName.toLowerCase());
+  if (!skill) {
+    process.stderr.write(chalk20.red(`Skill not found: ${skillName}
+`));
+    process.stderr.write(chalk20.dim("Run `skillvault-publisher list` to see your skills.\n"));
+    process.exit(1);
+  }
+  return skill;
+}
+async function runList(ctx, skill, options) {
+  const data = await sessionFetch(ctx, `/skills/${skill.id}/acls`);
+  const acls = data.acls || [];
+  if (options.json) {
+    console.log(JSON.stringify({ skill: skill.name, skill_id: skill.id, acls }, null, 2));
+    return;
+  }
+  console.log();
+  console.log(chalk20.bold(`  ACL grants on ${chalk20.cyan(skill.name)}`));
+  console.log();
+  if (acls.length === 0) {
+    console.log(chalk20.dim("  No ACL grants. Account owners and admins always have full access."));
+    console.log(chalk20.dim(`  Add a member: skillvault-publisher skill-acl ${skill.name} add <email> --role read|write|owner`));
+    console.log();
+    return;
+  }
+  const emailWidth = Math.max(20, ...acls.map((a) => a.email.length + 2));
+  const roleWidth = 8;
+  const header = [
+    chalk20.dim("Email".padEnd(emailWidth)),
+    chalk20.dim("Role".padEnd(roleWidth)),
+    chalk20.dim("Granted by")
+  ].join("  ");
+  console.log(`  ${header}`);
+  console.log(`  ${chalk20.dim("-".repeat(emailWidth + roleWidth + 24))}`);
+  for (const a of acls) {
+    const roleColor = a.role === "owner" ? chalk20.green : a.role === "write" ? chalk20.cyan : chalk20.dim;
+    const row = [
+      a.email.padEnd(emailWidth),
+      roleColor(a.role.padEnd(roleWidth)),
+      chalk20.dim(a.granted_by || "(self)")
+    ].join("  ");
+    console.log(`  ${row}`);
+  }
+  console.log();
+}
+async function runAdd(ctx, skill, email, options) {
+  if (!options.role) {
+    process.stderr.write(chalk20.red("Error: --role is required (read|write|owner)\n"));
+    process.exit(1);
+  }
+  const role = options.role.toLowerCase();
+  if (!VALID_ROLES.has(role)) {
+    process.stderr.write(chalk20.red(`Invalid --role value: ${options.role}
+`));
+    process.stderr.write(chalk20.dim("  Must be one of: read, write, owner\n"));
+    process.exit(1);
+  }
+  const res = await fetch(`${ctx.serverUrl}/skills/${skill.id}/acls`, {
+    method: "POST",
+    headers: ctx.headers,
+    body: JSON.stringify({ email, role })
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    if (body.error === "not_a_team_member") {
+      process.stderr.write(chalk20.red(`${email} is not a member of this team.
+`));
+      process.stderr.write(chalk20.dim(`Add them first: skillvault-publisher team add ${email} --role member
+`));
+      process.exit(1);
+    }
+    process.stderr.write(chalk20.red(`Failed to grant: ${body.message || body.error || res.statusText}
+`));
+    process.exit(1);
+  }
+  if (options.json) {
+    console.log(JSON.stringify(body, null, 2));
+    return;
+  }
+  if (body.note) {
+    console.log(chalk20.yellow(`  ${body.note}`));
+    return;
+  }
+  const acl = body.acl;
+  console.log(chalk20.green(`Granted ${acl.email} ${chalk20.bold(acl.role)} on ${skill.name}`));
+}
+async function runRemove(ctx, skill, target, options) {
+  const data = await sessionFetch(ctx, `/skills/${skill.id}/acls`);
+  const acls = data.acls || [];
+  let acl;
+  if (target.startsWith("acl_")) {
+    acl = acls.find((a) => a.id === target);
+  } else {
+    acl = acls.find((a) => a.email.toLowerCase() === target.toLowerCase());
+  }
+  if (!acl) {
+    process.stderr.write(chalk20.red(`No ACL row matches: ${target}
+`));
+    process.exit(1);
+  }
+  if (!options.yes) {
+    console.log();
+    console.log(chalk20.yellow.bold("  Warning: ") + `This revokes ${acl.role} access on ${chalk20.cyan(skill.name)} for ${chalk20.cyan(acl.email)}.`);
+    console.log(chalk20.dim("  Add --yes to confirm."));
+    console.log();
+    process.exit(0);
+  }
+  const res = await fetch(`${ctx.serverUrl}/skills/${skill.id}/acls/${acl.id}`, {
+    method: "DELETE",
+    headers: ctx.headers
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    if (body.error === "last_owner") {
+      process.stderr.write(chalk20.red("Cannot remove the last owner ACL on this skill.\n"));
+      process.stderr.write(chalk20.dim("  Grant another member owner access first, or have an account admin manage it.\n"));
+      process.exit(1);
+    }
+    process.stderr.write(chalk20.red(`Failed to remove: ${body.message || body.error || res.statusText}
+`));
+    process.exit(1);
+  }
+  if (options.json) {
+    console.log(JSON.stringify({ removed: true, acl_id: acl.id, email: acl.email, role: acl.role }, null, 2));
+    return;
+  }
+  console.log(chalk20.green(`Removed ${acl.email} (${acl.role}) from ${skill.name}`));
+}
+var skillAclCommand = new Command23("skill-acl").description("Manage per-skill ACL grants for team members").argument("<skill-name>", 'Skill to manage (or "list"/"add"/"remove" if using a workspace default)').argument("<action>", "Action: list | add | remove").argument("[target]", "Email (for add/remove) \u2014 not used by list").option("--role <role>", "Role for add: read | write | owner").option("--yes", "Skip confirmation on remove").option("--workspace <path>", "Use workspace at <path> to default skill-name").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--json", "Output as JSON").action(async (skillNameArg, actionArg, targetArg, options) => {
+  try {
+    let skillName = skillNameArg;
+    let action = actionArg;
+    let target = targetArg;
+    const isActionVerb = (s) => s === "list" || s === "add" || s === "remove";
+    if (isActionVerb(skillNameArg) && !isActionVerb(actionArg)) {
+      action = skillNameArg;
+      target = actionArg;
+      skillName = "";
+    }
+    const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
+    if (!skillName) {
+      if (!ctx.defaultSkillName) {
+        process.stderr.write(chalk20.red("Error: No skill name provided and no workspace context.\n"));
+        process.stderr.write(chalk20.dim("  Pass <skill-name> or run from a linked workspace directory.\n"));
+        process.exit(1);
+      }
+      skillName = ctx.defaultSkillName;
+    }
+    if (!isActionVerb(action)) {
+      process.stderr.write(chalk20.red(`Unknown action: ${action}
+`));
+      process.stderr.write(chalk20.dim("  Must be one of: list, add, remove\n"));
+      process.exit(1);
+    }
+    const skill = await resolveSkill(ctx, skillName);
+    if (action === "list") {
+      await runList(ctx, skill, options);
+      return;
+    }
+    if (action === "add") {
+      if (!target) {
+        process.stderr.write(chalk20.red("Error: add requires <email>\n"));
+        process.exit(1);
+      }
+      await runAdd(ctx, skill, target, options);
+      return;
+    }
+    if (action === "remove") {
+      if (!target) {
+        process.stderr.write(chalk20.red("Error: remove requires <email-or-id>\n"));
+        process.exit(1);
+      }
+      await runRemove(ctx, skill, target, options);
+      return;
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(chalk20.red(`skill-acl failed: ${message}
+`));
+    process.exit(1);
+  }
+});
+
+// dist/commands/grants.js
+import { Command as Command24 } from "commander";
+import chalk21 from "chalk";
+var grantsCommand = new Command24("grants").description("List capability grants issued to customers").option("--status <status>", "Filter by status: active, revoked, expired").option("--skill <name>", "Filter to grants for a specific skill (capability)").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default --skill").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--all", "Disable workspace --skill default; show grants for all skills").action(async (options) => {
   try {
     const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
     const data = await sessionFetch(ctx, "/grants");
@@ -155165,18 +155507,18 @@ var grantsCommand = new Command23("grants").description("List capability grants
       return;
     }
     if (grants.length === 0) {
-      console.log(chalk20.dim("No grants found."));
+      console.log(chalk21.dim("No grants found."));
       return;
     }
     console.log();
-    console.log(chalk20.bold("  Capability Grants"));
+    console.log(chalk21.bold("  Capability Grants"));
     console.log();
     const pad4 = (s, n) => s.padEnd(n).slice(0, n);
     const header = `${pad4("Grant ID", 22)} ${pad4("Skill", 24)} ${pad4("Customer", 22)} ${pad4("Status", 10)} ${pad4("Granted", 12)} ${"Expires"}`;
-    console.log(`  ${chalk20.dim(header)}`);
-    console.log(`  ${chalk20.dim("\u2500".repeat(header.length))}`);
+    console.log(`  ${chalk21.dim(header)}`);
+    console.log(`  ${chalk21.dim("\u2500".repeat(header.length))}`);
     for (const grant of grants) {
-      const statusColor = grant.status === "active" ? chalk20.green : grant.status === "revoked" ? chalk20.red : grant.status === "expired" ? chalk20.yellow : chalk20.white;
+      const statusColor = grant.status === "active" ? chalk21.green : grant.status === "revoked" ? chalk21.red : grant.status === "expired" ? chalk21.yellow : chalk21.white;
       const row = [
         pad4(grant.id, 22),
         pad4(grant.capability, 24),
@@ -155188,20 +155530,20 @@ var grantsCommand = new Command23("grants").description("List capability grants
       console.log(`  ${row}`);
     }
     console.log();
-    console.log(chalk20.dim(`  ${grants.length} grant${grants.length !== 1 ? "s" : ""} total`));
+    console.log(chalk21.dim(`  ${grants.length} grant${grants.length !== 1 ? "s" : ""} total`));
     console.log();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk20.red(`Error: ${message}
+    process.stderr.write(chalk21.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/revoke-grant.js
-import { Command as Command24 } from "commander";
-import chalk21 from "chalk";
-var revokeGrantCommand = new Command24("revoke-grant").description("Revoke a capability grant by ID").argument("<grant-id>", "Grant ID to revoke (e.g., gnt_xxx)").option("--yes", "Skip confirmation and revoke immediately").option("--json", "Output as JSON").option("--workspace <path>", "Resolve workspace context (informational only \u2014 grant ID is authoritative)").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').action(async (grantId, options) => {
+import { Command as Command25 } from "commander";
+import chalk22 from "chalk";
+var revokeGrantCommand = new Command25("revoke-grant").description("Revoke a capability grant by ID").argument("<grant-id>", "Grant ID to revoke (e.g., gnt_xxx)").option("--yes", "Skip confirmation and revoke immediately").option("--json", "Output as JSON").option("--workspace <path>", "Resolve workspace context (informational only \u2014 grant ID is authoritative)").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').action(async (grantId, options) => {
   try {
     const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
     if (!options.yes) {
@@ -155212,7 +155554,7 @@ var revokeGrantCommand = new Command24("revoke-grant").description("Revoke a cap
         return;
       }
       console.log();
-      console.log(chalk21.bold("  Grant details"));
+      console.log(chalk22.bold("  Grant details"));
       console.log();
       console.log(`  ID:       ${grant.id}`);
       console.log(`  Skill:    ${grant.skill}`);
@@ -155221,7 +155563,7 @@ var revokeGrantCommand = new Command24("revoke-grant").description("Revoke a cap
       console.log(`  Granted:  ${new Date(grant.granted_at).toLocaleDateString()}`);
       console.log(`  Expires:  ${grant.expires_at ? new Date(grant.expires_at).toLocaleDateString() : "never"}`);
       console.log();
-      console.log(chalk21.yellow("  Add --yes to confirm revocation."));
+      console.log(chalk22.yellow("  Add --yes to confirm revocation."));
       console.log();
       return;
     }
@@ -155230,19 +155572,19 @@ var revokeGrantCommand = new Command24("revoke-grant").description("Revoke a cap
       console.log(JSON.stringify(result.grant, null, 2));
       return;
     }
-    console.log(chalk21.green(`Revoked grant ${result.grant.id} for ${result.grant.skill}`));
+    console.log(chalk22.green(`Revoked grant ${result.grant.id} for ${result.grant.skill}`));
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk21.red(`Error: ${message}
+    process.stderr.write(chalk22.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/customers.js
-import { Command as Command25 } from "commander";
-import chalk22 from "chalk";
-var customersCommand = new Command25("customers").description("List your customers").option("--json", "Output as JSON").option("--workspace <path>", "Resolve workspace context (defaults from CWD)").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').action(async (options) => {
+import { Command as Command26 } from "commander";
+import chalk23 from "chalk";
+var customersCommand = new Command26("customers").description("List your customers").option("--json", "Output as JSON").option("--workspace <path>", "Resolve workspace context (defaults from CWD)").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').action(async (options) => {
   const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
   try {
     const data = await sessionFetch(ctx, "/customers");
@@ -155252,19 +155594,19 @@ var customersCommand = new Command25("customers").description("List your custome
       return;
     }
     if (customers.length === 0) {
-      console.log(chalk22.dim("No customers found."));
+      console.log(chalk23.dim("No customers found."));
       return;
     }
     console.log();
-    console.log(chalk22.bold("  Customers"));
+    console.log(chalk23.bold("  Customers"));
     console.log();
     const pad4 = (s, n) => s.padEnd(n).slice(0, n);
     const header = `${pad4("Email", 32)}  ${pad4("Skills", 8)}  ${pad4("Loads", 8)}  ${pad4("Status", 10)}  Last Active`;
-    console.log(`  ${chalk22.dim(header)}`);
-    console.log(`  ${chalk22.dim("\u2500".repeat(header.length))}`);
+    console.log(`  ${chalk23.dim(header)}`);
+    console.log(`  ${chalk23.dim("\u2500".repeat(header.length))}`);
     for (const c of customers) {
-      const statusColor = c.status === "active" ? chalk22.green : chalk22.dim;
-      const lastActive = c.last_active_at ? new Date(c.last_active_at).toLocaleDateString() : chalk22.dim("never");
+      const statusColor = c.status === "active" ? chalk23.green : chalk23.dim;
+      const lastActive = c.last_active_at ? new Date(c.last_active_at).toLocaleDateString() : chalk23.dim("never");
       const row = [
         pad4(c.email, 32),
         pad4(String(c.skills_count), 8),
@@ -155275,25 +155617,25 @@ var customersCommand = new Command25("customers").description("List your custome
       console.log(`  ${row}`);
     }
     console.log();
-    console.log(chalk22.dim(`  ${customers.length} customer${customers.length !== 1 ? "s" : ""} total`));
+    console.log(chalk23.dim(`  ${customers.length} customer${customers.length !== 1 ? "s" : ""} total`));
     console.log();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk22.red(`Error: ${message}
+    process.stderr.write(chalk23.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/analytics.js
-import { Command as Command26 } from "commander";
-import chalk23 from "chalk";
-var analyticsCommand = new Command26("analytics").description("View publisher analytics").option("--days <n>", "Number of days to look back", "30").option("--skill <name>", "Filter top skills/stats to a specific skill").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default --skill").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--all", "Disable workspace --skill default; show analytics for all skills").action(async (options) => {
+import { Command as Command27 } from "commander";
+import chalk24 from "chalk";
+var analyticsCommand = new Command27("analytics").description("View publisher analytics").option("--days <n>", "Number of days to look back", "30").option("--skill <name>", "Filter top skills/stats to a specific skill").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default --skill").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--all", "Disable workspace --skill default; show analytics for all skills").action(async (options) => {
   const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
   try {
     const days = parseInt(options.days, 10);
     if (isNaN(days) || days < 1) {
-      process.stderr.write(chalk23.red("--days must be a positive number.\n"));
+      process.stderr.write(chalk24.red("--days must be a positive number.\n"));
       process.exit(1);
     }
     const end = /* @__PURE__ */ new Date();
@@ -155306,11 +155648,11 @@ var analyticsCommand = new Command26("analytics").description("View publisher an
       return;
     }
     console.log();
-    console.log(chalk23.bold("  Publisher Analytics"));
+    console.log(chalk24.bold("  Publisher Analytics"));
     console.log();
-    console.log(`  ${chalk23.bold("Active Licenses:")}    ${data.active_licenses}`);
-    console.log(`  ${chalk23.bold("Total Decryptions:")}  ${data.total_decryptions}`);
-    console.log(`  ${chalk23.bold("Period:")}             Last ${days} day${days !== 1 ? "s" : ""} (${start.toLocaleDateString()} \u2013 ${end.toLocaleDateString()})`);
+    console.log(`  ${chalk24.bold("Active Licenses:")}    ${data.active_licenses}`);
+    console.log(`  ${chalk24.bold("Total Decryptions:")}  ${data.total_decryptions}`);
+    console.log(`  ${chalk24.bold("Period:")}             Last ${days} day${days !== 1 ? "s" : ""} (${start.toLocaleDateString()} \u2013 ${end.toLocaleDateString()})`);
     const effectiveSkill = options.skill ?? (options.all ? void 0 : ctx.defaultSkillName ?? void 0);
     const filterSkill = (skillName) => !effectiveSkill || skillName.toLowerCase() === effectiveSkill.toLowerCase();
     const statsMap = new Map((data.skill_stats || []).map((s) => [s.skill_name, s]));
@@ -155319,12 +155661,12 @@ var analyticsCommand = new Command26("analytics").description("View publisher an
     }
     if (data.top_skills && data.top_skills.length > 0) {
       console.log();
-      console.log(chalk23.bold("  Top Skills"));
+      console.log(chalk24.bold("  Top Skills"));
       console.log();
       const pad4 = (s, n) => s.padEnd(n).slice(0, n);
       const header = `${pad4("Skill", 28)}  ${pad4("Decryptions", 14)}  Active Licenses`;
-      console.log(`  ${chalk23.dim(header)}`);
-      console.log(`  ${chalk23.dim("\u2500".repeat(header.length))}`);
+      console.log(`  ${chalk24.dim(header)}`);
+      console.log(`  ${chalk24.dim("\u2500".repeat(header.length))}`);
       for (const skill of data.top_skills) {
         const stats = statsMap.get(skill.name);
         const row = [
@@ -155336,27 +155678,27 @@ var analyticsCommand = new Command26("analytics").description("View publisher an
       }
     } else {
       console.log();
-      console.log(chalk23.dim("  No skill activity in this period."));
+      console.log(chalk24.dim("  No skill activity in this period."));
     }
     console.log();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk23.red(`Error: ${message}
+    process.stderr.write(chalk24.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/webhook.js
-import { Command as Command27 } from "commander";
-import chalk24 from "chalk";
-var webhookCommand = new Command27("webhook").description("Manage publisher webhook (set, test, status)").argument("<action>", "Action: set, test, or status").option("--url <url>", "Webhook URL (required for set)").option("--json", "Output as JSON").action(async (action, options) => {
+import { Command as Command28 } from "commander";
+import chalk25 from "chalk";
+var webhookCommand = new Command28("webhook").description("Manage publisher webhook (set, test, status)").argument("<action>", "Action: set, test, or status").option("--url <url>", "Webhook URL (required for set)").option("--json", "Output as JSON").action(async (action, options) => {
   try {
     const ctx = requireSession();
     switch (action) {
       case "set": {
         if (!options.url) {
-          process.stderr.write(chalk24.red("Missing --url option. Usage: skillvault-publisher webhook set --url <url>\n"));
+          process.stderr.write(chalk25.red("Missing --url option. Usage: skillvault-publisher webhook set --url <url>\n"));
           process.exit(1);
         }
         const data = await sessionFetch(ctx, `/publishers/${ctx.publisherId}/webhook`, { method: "POST", body: { url: options.url } });
@@ -155365,12 +155707,12 @@ var webhookCommand = new Command27("webhook").description("Manage publisher webh
           return;
         }
         console.log();
-        console.log(chalk24.green("  Webhook configured"));
+        console.log(chalk25.green("  Webhook configured"));
         console.log();
         console.log(`  ${"URL:".padEnd(18)} ${data.webhook_url}`);
-        console.log(`  ${"Signing Secret:".padEnd(18)} ${chalk24.yellow(data.signing_secret)}`);
+        console.log(`  ${"Signing Secret:".padEnd(18)} ${chalk25.yellow(data.signing_secret)}`);
         console.log();
-        console.log(chalk24.dim("  Store the signing secret securely. It will not be shown again."));
+        console.log(chalk25.dim("  Store the signing secret securely. It will not be shown again."));
         console.log();
         break;
       }
@@ -155381,7 +155723,7 @@ var webhookCommand = new Command27("webhook").description("Manage publisher webh
           return;
         }
         console.log();
-        console.log(chalk24.green("  Test event sent to webhook URL"));
+        console.log(chalk25.green("  Test event sent to webhook URL"));
         console.log();
         break;
       }
@@ -155393,36 +155735,36 @@ var webhookCommand = new Command27("webhook").description("Manage publisher webh
         }
         console.log();
         if (data.webhook_url) {
-          console.log(chalk24.bold("  Webhook Status"));
+          console.log(chalk25.bold("  Webhook Status"));
           console.log();
           console.log(`  ${"URL:".padEnd(12)} ${data.webhook_url}`);
-          console.log(`  ${"Status:".padEnd(12)} ${chalk24.green("configured")}`);
+          console.log(`  ${"Status:".padEnd(12)} ${chalk25.green("configured")}`);
         } else {
-          console.log(chalk24.dim("  No webhook configured."));
+          console.log(chalk25.dim("  No webhook configured."));
           console.log();
-          console.log(chalk24.dim("  Set one with: skillvault-publisher webhook set --url <url>"));
+          console.log(chalk25.dim("  Set one with: skillvault-publisher webhook set --url <url>"));
         }
         console.log();
         break;
       }
       default:
-        process.stderr.write(chalk24.red(`Unknown action: ${action}
+        process.stderr.write(chalk25.red(`Unknown action: ${action}
 `));
-        process.stderr.write(chalk24.dim("Valid actions: set, test, status\n"));
+        process.stderr.write(chalk25.dim("Valid actions: set, test, status\n"));
         process.exit(1);
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk24.red(`Error: ${message}
+    process.stderr.write(chalk25.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/audit.js
-import { Command as Command28 } from "commander";
-import chalk25 from "chalk";
-var auditCommand = new Command28("audit").description("View audit log events").option("--type <event_type>", "Filter by event type").option("--skill <name>", "Filter by capability/skill name").option("--since <date>", "Filter events since ISO date").option("--limit <n>", "Number of events to return", "20").option("--export <format>", "Export as csv or json").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default --skill").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--all", "Disable workspace --skill default; show events for all skills").action(async (options) => {
+import { Command as Command29 } from "commander";
+import chalk26 from "chalk";
+var auditCommand = new Command29("audit").description("View audit log events").option("--type <event_type>", "Filter by event type").option("--skill <name>", "Filter by capability/skill name").option("--since <date>", "Filter events since ISO date").option("--limit <n>", "Number of events to return", "20").option("--export <format>", "Export as csv or json").option("--json", "Output as JSON").option("--workspace <path>", "Use workspace at <path> to default --skill").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').option("--all", "Disable workspace --skill default; show events for all skills").action(async (options) => {
   try {
     const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
     const effectiveSkill = options.skill ?? (options.all ? void 0 : ctx.defaultSkillName ?? void 0);
@@ -155437,7 +155779,7 @@ var auditCommand = new Command28("audit").description("View audit log events").o
     if (options.export) {
       const format = options.export.toLowerCase();
       if (format !== "csv" && format !== "json") {
-        process.stderr.write(chalk25.red('Export format must be "csv" or "json".\n'));
+        process.stderr.write(chalk26.red('Export format must be "csv" or "json".\n'));
         process.exit(1);
       }
       params.set("format", format);
@@ -155456,16 +155798,16 @@ var auditCommand = new Command28("audit").description("View audit log events").o
       return;
     }
     if (events.length === 0) {
-      console.log(chalk25.dim("No audit events found."));
+      console.log(chalk26.dim("No audit events found."));
       return;
     }
     console.log();
-    console.log(chalk25.bold("  Audit Log"));
+    console.log(chalk26.bold("  Audit Log"));
     console.log();
     const pad4 = (s, n) => s.padEnd(n).slice(0, n);
     const header = `${pad4("Event Type", 22)} ${pad4("Skill", 24)} ${pad4("Agent", 20)} ${"Time"}`;
-    console.log(`  ${chalk25.dim(header)}`);
-    console.log(`  ${chalk25.dim("\u2500".repeat(header.length))}`);
+    console.log(`  ${chalk26.dim(header)}`);
+    console.log(`  ${chalk26.dim("\u2500".repeat(header.length))}`);
     for (const event of events) {
       const skill = event.capability ? event.capability.replace(/^skill\//, "") : "-";
       const agent = event.agent_id ? event.agent_id.slice(0, 18) : "-";
@@ -155479,45 +155821,45 @@ var auditCommand = new Command28("audit").description("View audit log events").o
       console.log(`  ${row}`);
     }
     console.log();
-    console.log(chalk25.dim(`  Showing ${events.length} event${events.length !== 1 ? "s" : ""}`));
+    console.log(chalk26.dim(`  Showing ${events.length} event${events.length !== 1 ? "s" : ""}`));
     if (data.has_more) {
-      console.log(chalk25.dim(`  More results available`));
+      console.log(chalk26.dim(`  More results available`));
     }
     console.log();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk25.red(`Error: ${message}
+    process.stderr.write(chalk26.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/investigate.js
-import { Command as Command29 } from "commander";
-import chalk26 from "chalk";
-import { readFileSync as readFileSync15, mkdirSync as mkdirSync9, writeFileSync as writeFileSync10 } from "node:fs";
+import { Command as Command30 } from "commander";
+import chalk27 from "chalk";
+import { readFileSync as readFileSync15, mkdirSync as mkdirSync9, writeFileSync as writeFileSync11 } from "node:fs";
 import { join as join14 } from "node:path";
-var orange = chalk26.hex("#f97316");
+var orange = chalk27.hex("#f97316");
 function riskColor2(level) {
   switch (level.toLowerCase()) {
     case "low":
-      return chalk26.green;
+      return chalk27.green;
     case "watch":
-      return chalk26.yellow;
+      return chalk27.yellow;
     case "alert":
       return orange;
     case "critical":
-      return chalk26.red;
+      return chalk27.red;
     default:
-      return chalk26.white;
+      return chalk27.white;
   }
 }
 function confidenceColor(c) {
   if (c >= 0.9)
-    return chalk26.green;
+    return chalk27.green;
   if (c >= 0.5)
-    return chalk26.yellow;
-  return chalk26.red;
+    return chalk27.yellow;
+  return chalk27.red;
 }
 function pad(s, n) {
   return s.padEnd(n).slice(0, n);
@@ -155533,30 +155875,30 @@ function toRawGitHubUrl(url) {
 }
 function displayResults(report) {
   console.log();
-  console.log(chalk26.bold("  Investigation Results"));
+  console.log(chalk27.bold("  Investigation Results"));
   console.log();
-  console.log(`  ${chalk26.bold("Investigation ID:")} ${report.investigation_id}`);
-  console.log(`  ${chalk26.bold("Skill:")}            ${report.skill_name}`);
-  console.log(`  ${chalk26.bold("Total Licensees:")}  ${report.total_licensees}`);
-  console.log(`  ${chalk26.bold("Timestamp:")}        ${new Date(report.created_at).toLocaleString()}`);
+  console.log(`  ${chalk27.bold("Investigation ID:")} ${report.investigation_id}`);
+  console.log(`  ${chalk27.bold("Skill:")}            ${report.skill_name}`);
+  console.log(`  ${chalk27.bold("Total Licensees:")}  ${report.total_licensees}`);
+  console.log(`  ${chalk27.bold("Timestamp:")}        ${new Date(report.created_at).toLocaleString()}`);
   if (report.heartbeat_matches.length > 0) {
     console.log();
     const maxConf = Math.max(...report.heartbeat_matches.map((m) => m.confidence));
     const confStr = (maxConf * 100).toFixed(0) + "%";
     const confFn = confidenceColor(maxConf);
-    console.log(`  ${chalk26.bold("Forensic Match:")}   ${confFn(confStr + " confidence")} (${report.heartbeat_matches.length} match${report.heartbeat_matches.length !== 1 ? "es" : ""})`);
+    console.log(`  ${chalk27.bold("Forensic Match:")}   ${confFn(confStr + " confidence")} (${report.heartbeat_matches.length} match${report.heartbeat_matches.length !== 1 ? "es" : ""})`);
   }
   console.log();
   if (report.suspects.length === 0) {
-    console.log(chalk26.dim("  No suspects identified."));
+    console.log(chalk27.dim("  No suspects identified."));
     console.log();
     return;
   }
-  console.log(chalk26.bold("  Suspect Ranking"));
+  console.log(chalk27.bold("  Suspect Ranking"));
   console.log();
   const header = `${pad("Suspect", 24)} ${pad("Risk Level", 12)} ${pad("Confidence", 12)} ${pad("Anomalies", 10)} ${"Strikes"}`;
-  console.log(`  ${chalk26.dim(header)}`);
-  console.log(`  ${chalk26.dim("\u2500".repeat(header.length))}`);
+  console.log(`  ${chalk27.dim(header)}`);
+  console.log(`  ${chalk27.dim("\u2500".repeat(header.length))}`);
   for (const s of report.suspects) {
     const colorFn = riskColor2(s.risk_level);
     const label = s.customer_email || s.licensee_id.slice(0, 22);
@@ -155570,8 +155912,8 @@ function displayResults(report) {
     console.log(`  ${row}`);
   }
   console.log();
-  console.log(chalk26.dim(`  Full evidence retained server-side (ID: ${report.investigation_id})`));
-  console.log(chalk26.dim("  Contact investigations@getskillvault.com for the complete evidence package."));
+  console.log(chalk27.dim(`  Full evidence retained server-side (ID: ${report.investigation_id})`));
+  console.log(chalk27.dim("  Contact investigations@getskillvault.com for the complete evidence package."));
   console.log();
 }
 function buildHtmlReport(report, _auditEvents, metadata) {
@@ -155816,7 +156158,7 @@ ${report.suspects.length > 0 ? `<table>
 </body>
 </html>`;
 }
-var investigateCommand = new Command29("investigate").description("Investigate a suspected skill leak").argument("<skill-name>", "Name of the skill to investigate").option("--url <url>", "Fetch leaked content from a URL (GitHub raw, gist, etc.)").option("--file <path>", "Read leaked content from a local file").option("--report <dir>", "Generate full investigation report package to directory").option("--json", "Output as JSON").action(async (skillName, options) => {
+var investigateCommand = new Command30("investigate").description("Investigate a suspected skill leak").argument("<skill-name>", "Name of the skill to investigate").option("--url <url>", "Fetch leaked content from a URL (GitHub raw, gist, etc.)").option("--file <path>", "Read leaked content from a local file").option("--report <dir>", "Generate full investigation report package to directory").option("--json", "Output as JSON").action(async (skillName, options) => {
   try {
     const ctx = requireSession();
     let leakedContent;
@@ -155824,12 +156166,12 @@ var investigateCommand = new Command29("investigate").description("Investigate a
     if (options.url) {
       const rawUrl = toRawGitHubUrl(options.url);
       if (rawUrl !== options.url) {
-        console.log(chalk26.dim(`  Auto-converted GitHub blob URL to raw URL`));
+        console.log(chalk27.dim(`  Auto-converted GitHub blob URL to raw URL`));
       }
-      console.log(chalk26.dim(`  Fetching leaked content from ${rawUrl}...`));
+      console.log(chalk27.dim(`  Fetching leaked content from ${rawUrl}...`));
       const resp = await fetch(rawUrl);
       if (!resp.ok) {
-        process.stderr.write(chalk26.red(`Failed to fetch URL: ${resp.status} ${resp.statusText}
+        process.stderr.write(chalk27.red(`Failed to fetch URL: ${resp.status} ${resp.statusText}
 `));
         process.exit(1);
       }
@@ -155840,24 +156182,24 @@ var investigateCommand = new Command29("investigate").description("Investigate a
         leakedContent = readFileSync15(options.file, "utf-8");
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        process.stderr.write(chalk26.red(`Failed to read file: ${msg}
+        process.stderr.write(chalk27.red(`Failed to read file: ${msg}
 `));
         process.exit(1);
       }
       sourceLabel = options.file;
     } else {
-      process.stderr.write(chalk26.red("Provide leaked content with --url <url> or --file <path>.\n"));
+      process.stderr.write(chalk27.red("Provide leaked content with --url <url> or --file <path>.\n"));
       process.exit(1);
     }
-    console.log(chalk26.dim(`  Loaded ${leakedContent.length.toLocaleString()} chars of leaked content`));
+    console.log(chalk27.dim(`  Loaded ${leakedContent.length.toLocaleString()} chars of leaked content`));
     const skillsData = await sessionFetch(ctx, "/skills");
     const skill = skillsData.skills.find((s) => s.name.toLowerCase() === skillName.toLowerCase());
     if (!skill) {
-      process.stderr.write(chalk26.red(`Skill "${skillName}" not found. Use \`skillvault-publisher list\` to see your skills.
+      process.stderr.write(chalk27.red(`Skill "${skillName}" not found. Use \`skillvault-publisher list\` to see your skills.
 `));
       process.exit(1);
     }
-    console.log(chalk26.dim(`  Running investigation on "${skill.name}"...`));
+    console.log(chalk27.dim(`  Running investigation on "${skill.name}"...`));
     const report = await sessionFetch(ctx, `/publishers/${ctx.publisherId}/investigate`, {
       method: "POST",
       body: { skill_id: skill.id, leaked_content: leakedContent }
@@ -155883,13 +156225,13 @@ var investigateCommand = new Command29("investigate").description("Investigate a
         source: sourceLabel,
         notice: "This is an executive summary. Full evidence is retained server-side. Contact investigations@getskillvault.com for the complete evidence package."
       };
-      writeFileSync10(join14(dir, "metadata.json"), JSON.stringify(metadata, null, 2) + "\n");
-      writeFileSync10(join14(dir, "summary.json"), JSON.stringify({
+      writeFileSync11(join14(dir, "metadata.json"), JSON.stringify(metadata, null, 2) + "\n");
+      writeFileSync11(join14(dir, "summary.json"), JSON.stringify({
         _generated_by: "SkillVault (https://getskillvault.com)",
         ...report
       }, null, 2) + "\n");
       const html = buildHtmlReport(report, [], metadata);
-      writeFileSync10(join14(dir, "report.html"), html);
+      writeFileSync11(join14(dir, "report.html"), html);
       const pdfPath = join14(dir, "report.pdf");
       const { generatePdfReport: generatePdfReport2 } = await Promise.resolve().then(() => (init_pdf_report(), pdf_report_exports));
       await generatePdfReport2({
@@ -155903,23 +156245,23 @@ var investigateCommand = new Command29("investigate").description("Investigate a
         heartbeat_matches: report.heartbeat_matches,
         audit_events: []
       }, pdfPath);
-      console.log(chalk26.green(`  Report saved to ${dir}/`) + chalk26.dim(" (4 files)"));
-      console.log(chalk26.dim(`  PDF:  report.pdf`));
-      console.log(chalk26.dim(`  Full evidence retained server-side (ID: ${report.investigation_id})`));
+      console.log(chalk27.green(`  Report saved to ${dir}/`) + chalk27.dim(" (4 files)"));
+      console.log(chalk27.dim(`  PDF:  report.pdf`));
+      console.log(chalk27.dim(`  Full evidence retained server-side (ID: ${report.investigation_id})`));
       console.log();
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk26.red(`Error: ${message}
+    process.stderr.write(chalk27.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/watchtower.js
-import { Command as Command30 } from "commander";
-import chalk27 from "chalk";
-var watchtowerCommand = new Command30("watchtower").description("Watchtower security dashboard").option("--json", "Output as JSON").option("--workspace <path>", "Resolve workspace context (defaults from CWD)").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').action(async (options) => {
+import { Command as Command31 } from "commander";
+import chalk28 from "chalk";
+var watchtowerCommand = new Command31("watchtower").description("Watchtower security dashboard").option("--json", "Output as JSON").option("--workspace <path>", "Resolve workspace context (defaults from CWD)").option("--quiet", 'Suppress the "(using workspace \u2026)" stderr note').action(async (options) => {
   const ctx = requireCommandContext({ workspaceFlag: options.workspace, quiet: options.quiet });
   try {
     const data = await sessionFetch(ctx, `/publishers/${ctx.publisherId}/watchtower`);
@@ -155930,30 +156272,30 @@ var watchtowerCommand = new Command30("watchtower").description("Watchtower secu
     const { summary } = data;
     const pad4 = (s, n) => s.padEnd(n).slice(0, n);
     console.log();
-    console.log(chalk27.bold("  Watchtower \u2014 Security Overview"));
+    console.log(chalk28.bold("  Watchtower \u2014 Security Overview"));
     console.log();
-    console.log(`  ${chalk27.bold("Skills")} ${summary.total_skills}  ${chalk27.dim("|")}  ${chalk27.bold("Licenses")} ${summary.total_licenses}  ${chalk27.dim("|")}  ${chalk27.bold("Alerts (7d)")} ${summary.active_alerts > 0 ? chalk27.yellow(String(summary.active_alerts)) : "0"}  ${chalk27.dim("|")}  ${chalk27.bold("Flagged")} ${summary.flagged_customers > 0 ? chalk27.red(String(summary.flagged_customers)) : "0"}  ${chalk27.dim("|")}  ${chalk27.bold("Suspended")} ${summary.suspended_grants > 0 ? chalk27.red(String(summary.suspended_grants)) : "0"}`);
+    console.log(`  ${chalk28.bold("Skills")} ${summary.total_skills}  ${chalk28.dim("|")}  ${chalk28.bold("Licenses")} ${summary.total_licenses}  ${chalk28.dim("|")}  ${chalk28.bold("Alerts (7d)")} ${summary.active_alerts > 0 ? chalk28.yellow(String(summary.active_alerts)) : "0"}  ${chalk28.dim("|")}  ${chalk28.bold("Flagged")} ${summary.flagged_customers > 0 ? chalk28.red(String(summary.flagged_customers)) : "0"}  ${chalk28.dim("|")}  ${chalk28.bold("Suspended")} ${summary.suspended_grants > 0 ? chalk28.red(String(summary.suspended_grants)) : "0"}`);
     if (data.flagged_customers && data.flagged_customers.length > 0) {
       console.log();
-      console.log(chalk27.bold("  Flagged Customers"));
+      console.log(chalk28.bold("  Flagged Customers"));
       console.log();
       const header = `${pad4("Agent ID", 20)}  ${pad4("Risk Score", 12)}  ${pad4("Level", 10)}  ${pad4("Strikes", 9)}  ${pad4("Status", 12)}  Skills`;
-      console.log(`  ${chalk27.dim(header)}`);
-      console.log(`  ${chalk27.dim("\u2500".repeat(header.length))}`);
+      console.log(`  ${chalk28.dim(header)}`);
+      console.log(`  ${chalk28.dim("\u2500".repeat(header.length))}`);
       for (const c of data.flagged_customers) {
         const agentShort = c.agent_id.length > 18 ? c.agent_id.slice(0, 18) + "\u2026" : c.agent_id;
         let levelColored;
         if (c.risk_level === "critical") {
-          levelColored = chalk27.red.bold(pad4(c.risk_level, 10));
+          levelColored = chalk28.red.bold(pad4(c.risk_level, 10));
         } else if (c.risk_level === "high") {
-          levelColored = chalk27.red(pad4(c.risk_level, 10));
+          levelColored = chalk28.red(pad4(c.risk_level, 10));
         } else if (c.risk_level === "medium") {
-          levelColored = chalk27.yellow(pad4(c.risk_level, 10));
+          levelColored = chalk28.yellow(pad4(c.risk_level, 10));
         } else {
-          levelColored = chalk27.dim(pad4(c.risk_level, 10));
+          levelColored = chalk28.dim(pad4(c.risk_level, 10));
         }
-        const statusColored = c.status === "suspended" ? chalk27.red(pad4(c.status, 12)) : pad4(c.status, 12);
-        const skills = c.capabilities.length > 0 ? c.capabilities.join(", ") : chalk27.dim("none");
+        const statusColored = c.status === "suspended" ? chalk28.red(pad4(c.status, 12)) : pad4(c.status, 12);
+        const skills = c.capabilities.length > 0 ? c.capabilities.join(", ") : chalk28.dim("none");
         const row = [
           pad4(agentShort, 20),
           pad4(String(c.risk_score), 12),
@@ -155967,15 +156309,15 @@ var watchtowerCommand = new Command30("watchtower").description("Watchtower secu
     }
     if (data.recent_events && data.recent_events.length > 0) {
       console.log();
-      console.log(chalk27.bold("  Recent Security Events"));
+      console.log(chalk28.bold("  Recent Security Events"));
       console.log();
       const header = `${pad4("Event Type", 28)}  ${pad4("Skill", 24)}  ${pad4("Agent", 20)}  Time`;
-      console.log(`  ${chalk27.dim(header)}`);
-      console.log(`  ${chalk27.dim("\u2500".repeat(header.length))}`);
+      console.log(`  ${chalk28.dim(header)}`);
+      console.log(`  ${chalk28.dim("\u2500".repeat(header.length))}`);
       const events = data.recent_events.slice(0, 10);
       for (const e of events) {
-        const skill = e.capability ? e.capability.replace(/^skill\//, "") : chalk27.dim("-");
-        const agent = e.agent_id ? e.agent_id.slice(0, 18) : chalk27.dim("-");
+        const skill = e.capability ? e.capability.replace(/^skill\//, "") : chalk28.dim("-");
+        const agent = e.agent_id ? e.agent_id.slice(0, 18) : chalk28.dim("-");
         const time = new Date(e.created_at).toLocaleString();
         const row = [
           pad4(e.event_type, 28),
@@ -155988,25 +156330,25 @@ var watchtowerCommand = new Command30("watchtower").description("Watchtower secu
     }
     if ((!data.flagged_customers || data.flagged_customers.length === 0) && (!data.recent_events || data.recent_events.length === 0)) {
       console.log();
-      console.log(chalk27.green("  All clear \u2014 no security alerts in the last 7 days."));
+      console.log(chalk28.green("  All clear \u2014 no security alerts in the last 7 days."));
     }
     console.log();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk27.red(`Error: ${message}
+    process.stderr.write(chalk28.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/watermark-decode.js
-import { Command as Command31 } from "commander";
-import chalk28 from "chalk";
+import { Command as Command32 } from "commander";
+import chalk29 from "chalk";
 import { readFileSync as readFileSync16 } from "node:fs";
-var watermarkDecodeCommand = new Command31("watermark-decode").description("Analyze leaked content for forensic watermarks (local-only)").option("--file <path>", "Path to file with leaked content").option("--json", "Output as JSON").action(async (options) => {
+var watermarkDecodeCommand = new Command32("watermark-decode").description("Analyze leaked content for forensic watermarks (local-only)").option("--file <path>", "Path to file with leaked content").option("--json", "Output as JSON").action(async (options) => {
   try {
     if (!options.file) {
-      process.stderr.write(chalk28.red("Provide --file <path> with the leaked content\n"));
+      process.stderr.write(chalk29.red("Provide --file <path> with the leaked content\n"));
       process.exit(1);
     }
     let content;
@@ -156014,7 +156356,7 @@ var watermarkDecodeCommand = new Command31("watermark-decode").description("Anal
       content = readFileSync16(options.file, "utf8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(chalk28.red(`Cannot read file: ${msg}
+      process.stderr.write(chalk29.red(`Cannot read file: ${msg}
 `));
       process.exit(1);
     }
@@ -156044,56 +156386,56 @@ var watermarkDecodeCommand = new Command31("watermark-decode").description("Anal
       return;
     }
     console.log();
-    console.log(chalk28.bold("  Watermark Analysis"));
+    console.log(chalk29.bold("  Watermark Analysis"));
     console.log();
-    console.log(chalk28.bold("  Zero-Width Watermark"));
+    console.log(chalk29.bold("  Zero-Width Watermark"));
     if (watermark.found) {
-      console.log(`  Licensee ID: ${chalk28.green.bold(watermark.licenseeId)}`);
+      console.log(`  Licensee ID: ${chalk29.green.bold(watermark.licenseeId)}`);
     } else {
-      console.log(`  ${chalk28.dim("Not found")}`);
+      console.log(`  ${chalk29.dim("Not found")}`);
     }
     console.log();
-    console.log(chalk28.bold("  Heartbeat Markers"));
+    console.log(chalk29.bold("  Heartbeat Markers"));
     if (heartbeats.hb1) {
-      console.log(`  HB1: ${chalk28.green(heartbeats.hb1)}`);
+      console.log(`  HB1: ${chalk29.green(heartbeats.hb1)}`);
     } else {
-      console.log(`  HB1: ${chalk28.dim("Not found")}`);
+      console.log(`  HB1: ${chalk29.dim("Not found")}`);
     }
     if (heartbeats.hb2) {
-      console.log(`  HB2: ${chalk28.green(heartbeats.hb2)}`);
+      console.log(`  HB2: ${chalk29.green(heartbeats.hb2)}`);
     } else {
-      console.log(`  HB2: ${chalk28.dim("Not found")}`);
+      console.log(`  HB2: ${chalk29.dim("Not found")}`);
     }
     if (candidates.length > 0) {
-      console.log(`  ${chalk28.dim(`${candidates.length} potential heartbeat candidate${candidates.length !== 1 ? "s" : ""} found`)}`);
+      console.log(`  ${chalk29.dim(`${candidates.length} potential heartbeat candidate${candidates.length !== 1 ? "s" : ""} found`)}`);
     }
     console.log();
-    console.log(chalk28.bold("  Semantic Fingerprint"));
+    console.log(chalk29.bold("  Semantic Fingerprint"));
     if (hasFingerprint) {
       const binaryStr = fingerprint.map((v) => v === 1 ? "1" : v === -1 ? "X" : "0").join("");
       const variationPoints = fingerprint.filter((v) => v !== 0).length;
-      console.log(`  Pattern: ${chalk28.cyan(binaryStr)}`);
-      console.log(`  ${chalk28.dim(`${variationPoints} variation point${variationPoints !== 1 ? "s" : ""} detected`)}`);
+      console.log(`  Pattern: ${chalk29.cyan(binaryStr)}`);
+      console.log(`  ${chalk29.dim(`${variationPoints} variation point${variationPoints !== 1 ? "s" : ""} detected`)}`);
     } else {
-      console.log(`  ${chalk28.dim("No variation points detected")}`);
+      console.log(`  ${chalk29.dim("No variation points detected")}`);
     }
     console.log();
-    const countColor = signalsDetected > 0 ? chalk28.green.bold : chalk28.dim;
+    const countColor = signalsDetected > 0 ? chalk29.green.bold : chalk29.dim;
     console.log(`  ${countColor(`${signalsDetected} of 4`)} forensic signals detected`);
     console.log();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk28.red(`Error: ${message}
+    process.stderr.write(chalk29.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/link.js
-import { Command as Command32 } from "commander";
-import chalk29 from "chalk";
+import { Command as Command33 } from "commander";
+import chalk30 from "chalk";
 import { existsSync as existsSync14, readFileSync as readFileSync17, statSync as statSync6 } from "node:fs";
-import { resolve as resolve9, join as join15 } from "node:path";
+import { resolve as resolve10, join as join15 } from "node:path";
 function parseFrontmatter4(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!match)
@@ -156112,12 +156454,12 @@ function parseFrontmatter4(content) {
   }
   return result;
 }
-var linkCommand = new Command32("link").description("Link a skill source directory to your publisher account").argument("[directory]", "Skill directory to link (defaults to CWD)").option("--workspace <path>", "Explicit workspace directory (precedence over positional)").option("--force", "Overwrite an existing link to a different publisher_id").option("--name <name>", "Override skill name (defaults to SKILL.md frontmatter name)").option("--capability <cap>", "Override capability_name (advanced \u2014 usually matches skill name)").action(async (directory, options) => {
+var linkCommand = new Command33("link").description("Link a skill source directory to your publisher account").argument("[directory]", "Skill directory to link (defaults to CWD)").option("--workspace <path>", "Explicit workspace directory (precedence over positional)").option("--force", "Overwrite an existing link to a different publisher_id").option("--name <name>", "Override skill name (defaults to SKILL.md frontmatter name)").option("--capability <cap>", "Override capability_name (advanced \u2014 usually matches skill name)").action(async (directory, options) => {
   try {
     const ctx = requireSession();
-    const dirPath = options.workspace ? resolve9(options.workspace) : directory ? resolve9(directory) : process.cwd();
+    const dirPath = options.workspace ? resolve10(options.workspace) : directory ? resolve10(directory) : process.cwd();
     if (!existsSync14(dirPath) || !statSync6(dirPath).isDirectory()) {
-      process.stderr.write(chalk29.red(`Error: "${dirPath}" is not a valid directory
+      process.stderr.write(chalk30.red(`Error: "${dirPath}" is not a valid directory
 `));
       process.exit(1);
     }
@@ -156127,17 +156469,17 @@ var linkCommand = new Command32("link").description("Link a skill source directo
     const existing = loadWorkspace(dirPath);
     const skillName = options.name || existing?.skill_name || frontmatter.name;
     if (!skillName) {
-      process.stderr.write(chalk29.red("Error: Cannot determine skill name.\n"));
-      process.stderr.write(chalk29.dim("  Pass --name <name> or set `name:` in SKILL.md frontmatter.\n"));
+      process.stderr.write(chalk30.red("Error: Cannot determine skill name.\n"));
+      process.stderr.write(chalk30.dim("  Pass --name <name> or set `name:` in SKILL.md frontmatter.\n"));
       process.exit(1);
     }
     const capabilityName = options.capability || existing?.capability_name || `skill/${skillName.toLowerCase()}`;
     if (existing && existing.publisher_id !== ctx.publisherId && !options.force) {
-      process.stderr.write(chalk29.red(`Error: This directory is already linked to publisher ${existing.publisher_id}.
+      process.stderr.write(chalk30.red(`Error: This directory is already linked to publisher ${existing.publisher_id}.
 `));
-      process.stderr.write(chalk29.dim(`  You are logged in as ${ctx.publisherId}.
+      process.stderr.write(chalk30.dim(`  You are logged in as ${ctx.publisherId}.
 `));
-      process.stderr.write(chalk29.cyan("  Use --force to re-link to your account.\n"));
+      process.stderr.write(chalk30.cyan("  Use --force to re-link to your account.\n"));
       process.exit(1);
     }
     const linkedAt = existing?.linked_at ?? (/* @__PURE__ */ new Date()).toISOString();
@@ -156159,41 +156501,41 @@ var linkCommand = new Command32("link").description("Link a skill source directo
       last_published_at: manifest.last_published_at
     });
     const action = existing ? "Re-linked" : "Linked";
-    console.log(chalk29.green(`${action} "${skillName}" \u2192 ${capabilityName}`));
-    console.log(chalk29.dim(`  Directory:  ${dirPath}`));
-    console.log(chalk29.dim(`  Publisher:  ${ctx.publisherId}`));
-    console.log(chalk29.dim(`  Manifest:   .skillvault-publisher/workspace.json`));
+    console.log(chalk30.green(`${action} "${skillName}" \u2192 ${capabilityName}`));
+    console.log(chalk30.dim(`  Directory:  ${dirPath}`));
+    console.log(chalk30.dim(`  Publisher:  ${ctx.publisherId}`));
+    console.log(chalk30.dim(`  Manifest:   .skillvault-publisher/workspace.json`));
     if (!existing) {
       console.log();
-      console.log(chalk29.cyan("  Tip: commit .skillvault-publisher/workspace.json so teammates and CI can find this skill."));
+      console.log(chalk30.cyan("  Tip: commit .skillvault-publisher/workspace.json so teammates and CI can find this skill."));
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk29.red(`Link failed: ${message}
+    process.stderr.write(chalk30.red(`Link failed: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/unlink.js
-import { Command as Command33 } from "commander";
-import chalk30 from "chalk";
+import { Command as Command34 } from "commander";
+import chalk31 from "chalk";
 import { existsSync as existsSync15, rmSync as rmSync2, statSync as statSync7 } from "node:fs";
-import { resolve as resolve10, join as join16 } from "node:path";
-var unlinkCommand = new Command33("unlink").description("Remove the workspace link from a skill source directory").argument("[directory]", "Skill directory to unlink (defaults to CWD)").option("--workspace <path>", "Explicit workspace directory (precedence over positional)").option("--keep-registry", "Remove the manifest file but leave the registry entry").action(async (directory, options) => {
+import { resolve as resolve11, join as join16 } from "node:path";
+var unlinkCommand = new Command34("unlink").description("Remove the workspace link from a skill source directory").argument("[directory]", "Skill directory to unlink (defaults to CWD)").option("--workspace <path>", "Explicit workspace directory (precedence over positional)").option("--keep-registry", "Remove the manifest file but leave the registry entry").action(async (directory, options) => {
   try {
-    const dirPath = options.workspace ? resolve10(options.workspace) : directory ? resolve10(directory) : process.cwd();
+    const dirPath = options.workspace ? resolve11(options.workspace) : directory ? resolve11(directory) : process.cwd();
     if (!existsSync15(dirPath) || !statSync7(dirPath).isDirectory()) {
-      process.stderr.write(chalk30.red(`Error: "${dirPath}" is not a valid directory
+      process.stderr.write(chalk31.red(`Error: "${dirPath}" is not a valid directory
 `));
       process.exit(1);
     }
     const manifest = loadWorkspace(dirPath);
     if (!manifest) {
-      process.stderr.write(chalk30.red("Error: No workspace manifest found at this directory.\n"));
-      process.stderr.write(chalk30.dim(`  Looked for: ${join16(dirPath, ".skillvault-publisher", "workspace.json")}
+      process.stderr.write(chalk31.red("Error: No workspace manifest found at this directory.\n"));
+      process.stderr.write(chalk31.dim(`  Looked for: ${join16(dirPath, ".skillvault-publisher", "workspace.json")}
 `));
-      process.stderr.write(chalk30.dim("  Run `skillvault-publisher link` first to create one.\n"));
+      process.stderr.write(chalk31.dim("  Run `skillvault-publisher link` first to create one.\n"));
       process.exit(1);
     }
     const { manifestPath } = workspaceRootsFor(dirPath);
@@ -156201,7 +156543,7 @@ var unlinkCommand = new Command33("unlink").description("Remove the workspace li
       rmSync2(manifestPath);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      process.stderr.write(chalk30.red(`Failed to remove manifest: ${message}
+      process.stderr.write(chalk31.red(`Failed to remove manifest: ${message}
 `));
       process.exit(1);
     }
@@ -156213,25 +156555,25 @@ var unlinkCommand = new Command33("unlink").description("Remove the workspace li
     if (!options.keepRegistry) {
       unregisterWorkspace(dirPath);
     }
-    console.log(chalk30.green(`Unlinked "${manifest.skill_name}" (${manifest.capability_name})`));
-    console.log(chalk30.dim(`  Directory:  ${dirPath}`));
+    console.log(chalk31.green(`Unlinked "${manifest.skill_name}" (${manifest.capability_name})`));
+    console.log(chalk31.dim(`  Directory:  ${dirPath}`));
     if (options.keepRegistry) {
-      console.log(chalk30.dim("  Registry entry kept (--keep-registry)"));
+      console.log(chalk31.dim("  Registry entry kept (--keep-registry)"));
     }
     console.log();
-    console.log(chalk30.dim("  Note: SKILL.md and source files are untouched."));
-    console.log(chalk30.dim("  Note: The skill on the server is NOT deleted. Use `skill-delete` for that."));
+    console.log(chalk31.dim("  Note: SKILL.md and source files are untouched."));
+    console.log(chalk31.dim("  Note: The skill on the server is NOT deleted. Use `skill-delete` for that."));
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk30.red(`Unlink failed: ${message}
+    process.stderr.write(chalk31.red(`Unlink failed: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/workspaces.js
-import { Command as Command34 } from "commander";
-import chalk31 from "chalk";
+import { Command as Command35 } from "commander";
+import chalk32 from "chalk";
 function formatDate(iso) {
   if (!iso)
     return "-";
@@ -156266,8 +156608,8 @@ function listAction(options) {
     return;
   }
   if (filtered.length === 0) {
-    console.log(chalk31.dim("No workspaces linked."));
-    console.log(chalk31.dim("  Run `skillvault-publisher link` from a skill source directory to create one."));
+    console.log(chalk32.dim("No workspaces linked."));
+    console.log(chalk32.dim("  Run `skillvault-publisher link` from a skill source directory to create one."));
     return;
   }
   const pathWidth = Math.min(Math.max(20, ...filtered.map((w) => w.path.length)), 50);
@@ -156275,27 +156617,27 @@ function listAction(options) {
   const pubWidth = Math.max(10, ...filtered.map((w) => w.publisher_id.length));
   console.log();
   const header = `${pad2("PATH", pathWidth)}  ${pad2("PUBLISHER", pubWidth)}  ${pad2("SKILL", skillWidth)}  ${pad2("VERSION", 10)}  ${pad2("LAST PUBLISHED", 14)}  SOURCE`;
-  console.log(`  ${chalk31.dim(header)}`);
-  console.log(`  ${chalk31.dim("\u2500".repeat(header.length))}`);
+  console.log(`  ${chalk32.dim(header)}`);
+  console.log(`  ${chalk32.dim("\u2500".repeat(header.length))}`);
   for (const w of filtered) {
     const isOther = currentAccount !== null && w.publisher_id !== currentAccount;
     const path = w.path.length > pathWidth ? "\u2026" + w.path.slice(-(pathWidth - 1)) : w.path;
     const row = `${pad2(path, pathWidth)}  ${pad2(w.publisher_id, pubWidth)}  ${pad2(w.skill_name, skillWidth)}  ${pad2(w.last_published_version ?? "-", 10)}  ${pad2(formatDate(w.last_published_at), 14)}  ${w.source}`;
     if (isOther) {
-      console.log(`  ${chalk31.dim(row + "  [other account]")}`);
+      console.log(`  ${chalk32.dim(row + "  [other account]")}`);
     } else {
       console.log(`  ${row}`);
     }
   }
   console.log();
-  console.log(chalk31.dim(`  ${filtered.length} workspace${filtered.length === 1 ? "" : "s"}` + (options.current ? " (filtered to current account)" : "")));
+  console.log(chalk32.dim(`  ${filtered.length} workspace${filtered.length === 1 ? "" : "s"}` + (options.current ? " (filtered to current account)" : "")));
 }
-var workspacesCommand = new Command34("workspaces").description("List linked skill source directories (workspaces)").option("--json", "Output as JSON").option("--current", "Only show workspaces matching the current logged-in publisher").action((options) => {
+var workspacesCommand = new Command35("workspaces").description("List linked skill source directories (workspaces)").option("--json", "Output as JSON").option("--current", "Only show workspaces matching the current logged-in publisher").action((options) => {
   try {
     listAction(options);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk31.red(`Error: ${message}
+    process.stderr.write(chalk32.red(`Error: ${message}
 `));
     process.exit(1);
   }
@@ -156311,28 +156653,28 @@ workspacesCommand.command("find").description("Print the absolute path of a work
     console.log(match.path);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk31.red(`Error: ${message}
+    process.stderr.write(chalk32.red(`Error: ${message}
 `));
     process.exit(1);
   }
 });
 
 // dist/commands/team.js
-import { Command as Command35 } from "commander";
-import chalk32 from "chalk";
+import { Command as Command36 } from "commander";
+import chalk33 from "chalk";
 function formatRole(role) {
   if (role === "owner")
-    return chalk32.green("owner");
+    return chalk33.green("owner");
   if (role === "admin")
-    return chalk32.cyan("admin");
-  return chalk32.dim("member");
+    return chalk33.cyan("admin");
+  return chalk33.dim("member");
 }
 function formatStatus(status) {
   if (status === "active")
-    return chalk32.green("active");
+    return chalk33.green("active");
   if (status === "pending")
-    return chalk32.yellow("pending");
-  return chalk32.dim(status);
+    return chalk33.yellow("pending");
+  return chalk33.dim(status);
 }
 function pad3(s, n) {
   const visible = s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -156340,7 +156682,7 @@ function pad3(s, n) {
     return s;
   return s + " ".repeat(n - visible.length);
 }
-var teamCommand = new Command35("team").description("Manage your publisher team members").option("--json", "Output as JSON").action(async (options) => {
+var teamCommand = new Command36("team").description("Manage your publisher team members").option("--json", "Output as JSON").action(async (options) => {
   try {
     const ctx = requireSession();
     const data = await sessionFetch(ctx, `/publishers/${ctx.publisherId}/team`);
@@ -156351,27 +156693,27 @@ var teamCommand = new Command35("team").description("Manage your publisher team
     }
     if (members.length === 0) {
       console.log();
-      console.log(chalk32.dim("  No team members yet. Invite someone:"));
-      console.log(chalk32.cyan("    skillvault-publisher team add <email> [--role member|admin]"));
+      console.log(chalk33.dim("  No team members yet. Invite someone:"));
+      console.log(chalk33.cyan("    skillvault-publisher team add <email> [--role member|admin]"));
       console.log();
       return;
     }
     console.log();
-    console.log(chalk32.bold(`  Team members (${members.length})`));
+    console.log(chalk33.bold(`  Team members (${members.length})`));
     console.log();
-    const header = `${pad3(chalk32.dim("Email"), 36)}  ${pad3(chalk32.dim("Role"), 14)}  ${pad3(chalk32.dim("Status"), 14)}  ${chalk32.dim("Member ID")}`;
+    const header = `${pad3(chalk33.dim("Email"), 36)}  ${pad3(chalk33.dim("Role"), 14)}  ${pad3(chalk33.dim("Status"), 14)}  ${chalk33.dim("Member ID")}`;
     console.log(`  ${header}`);
-    console.log(`  ${chalk32.dim("\u2500".repeat(80))}`);
+    console.log(`  ${chalk33.dim("\u2500".repeat(80))}`);
     for (const m of members) {
-      const row = `${pad3(m.email, 36)}  ${pad3(formatRole(m.role), 14)}  ${pad3(formatStatus(m.status), 14)}  ${chalk32.dim(m.id)}`;
+      const row = `${pad3(m.email, 36)}  ${pad3(formatRole(m.role), 14)}  ${pad3(formatStatus(m.status), 14)}  ${chalk33.dim(m.id)}`;
       console.log(`  ${row}`);
     }
     console.log();
-    console.log(chalk32.dim(`  Logged in as publisher ${ctx.publisherId}`));
+    console.log(chalk33.dim(`  Logged in as publisher ${ctx.publisherId}`));
     console.log();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk32.red(`team list failed: ${message}
+    process.stderr.write(chalk33.red(`team list failed: ${message}
 `));
     process.exit(1);
   }
@@ -156379,7 +156721,7 @@ var teamCommand = new Command35("team").description("Manage your publisher team
 teamCommand.command("add").description("Invite someone to your publisher team. Sends a magic-link email.").argument("<email>", "The email address to invite").option("--role <role>", "Role: member (default) or admin", "member").option("--name <name>", "Display name for the invitee (optional)").option("--json", "Output as JSON").action(async (email, options) => {
   try {
     if (!["member", "admin"].includes(options.role)) {
-      process.stderr.write(chalk32.red(`Invalid role "${options.role}". Use --role member or --role admin.
+      process.stderr.write(chalk33.red(`Invalid role "${options.role}". Use --role member or --role admin.
 `));
       process.exit(1);
     }
@@ -156393,17 +156735,17 @@ teamCommand.command("add").description("Invite someone to your publisher team. S
       return;
     }
     console.log();
-    console.log(chalk32.green(`  \u2713 Invited ${email} as ${formatRole(options.role)}`));
-    console.log(chalk32.dim(`    Member ID:  ${member.id}`));
-    console.log(chalk32.dim(`    Status:     ${formatStatus(member.status)}`));
+    console.log(chalk33.green(`  \u2713 Invited ${email} as ${formatRole(options.role)}`));
+    console.log(chalk33.dim(`    Member ID:  ${member.id}`));
+    console.log(chalk33.dim(`    Status:     ${formatStatus(member.status)}`));
     console.log();
-    console.log(chalk32.dim("  A magic-link invitation email has been sent. The new member can"));
-    console.log(chalk32.dim("  click the link to activate, then run:"));
-    console.log(chalk32.cyan(`    skillvault-publisher login --email ${email}`));
+    console.log(chalk33.dim("  A magic-link invitation email has been sent. The new member can"));
+    console.log(chalk33.dim("  click the link to activate, then run:"));
+    console.log(chalk33.cyan(`    skillvault-publisher login --email ${email}`));
     console.log();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk32.red(`team add failed: ${message}
+    process.stderr.write(chalk33.red(`team add failed: ${message}
 `));
     process.exit(1);
   }
@@ -156415,30 +156757,30 @@ teamCommand.command("remove").description("Remove a team member by email or memb
     const members = listData.members || [];
     const member = members.find((m) => m.id === target || m.email === target);
     if (!member) {
-      process.stderr.write(chalk32.red(`No team member found matching "${target}".
+      process.stderr.write(chalk33.red(`No team member found matching "${target}".
 `));
-      process.stderr.write(chalk32.dim("Run `skillvault-publisher team` to see the current list.\n"));
+      process.stderr.write(chalk33.dim("Run `skillvault-publisher team` to see the current list.\n"));
       process.exit(1);
     }
     if (member.role === "owner") {
-      process.stderr.write(chalk32.red("Cannot remove the owner of a publisher account.\n"));
+      process.stderr.write(chalk33.red("Cannot remove the owner of a publisher account.\n"));
       process.exit(1);
     }
     if (member.status === "removed") {
-      process.stderr.write(chalk32.yellow(`${member.email} is already removed.
+      process.stderr.write(chalk33.yellow(`${member.email} is already removed.
 `));
       process.exit(0);
     }
     if (!options.yes) {
       console.log();
-      console.log(chalk32.yellow.bold("  Warning: ") + "This will revoke " + chalk32.bold(member.email) + `'s access to publisher ${ctx.publisherId}.`);
+      console.log(chalk33.yellow.bold("  Warning: ") + "This will revoke " + chalk33.bold(member.email) + `'s access to publisher ${ctx.publisherId}.`);
       console.log();
-      console.log(`  Email:    ${chalk32.cyan(member.email)}`);
+      console.log(`  Email:    ${chalk33.cyan(member.email)}`);
       console.log(`  Role:     ${formatRole(member.role)}`);
       console.log(`  Status:   ${formatStatus(member.status)}`);
-      console.log(`  Added:    ${chalk32.dim(new Date(member.created_at).toLocaleDateString())}`);
+      console.log(`  Added:    ${chalk33.dim(new Date(member.created_at).toLocaleDateString())}`);
       console.log();
-      console.log(chalk32.dim("  Add --yes to confirm."));
+      console.log(chalk33.dim("  Add --yes to confirm."));
       console.log();
       process.exit(0);
     }
@@ -156447,10 +156789,10 @@ teamCommand.command("remove").description("Remove a team member by email or memb
       console.log(JSON.stringify({ removed: true, member_id: member.id, email: member.email }, null, 2));
       return;
     }
-    console.log(chalk32.green(`  \u2713 Removed ${member.email} from the team`));
+    console.log(chalk33.green(`  \u2713 Removed ${member.email} from the team`));
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(chalk32.red(`team remove failed: ${message}
+    process.stderr.write(chalk33.red(`team remove failed: ${message}
 `));
     process.exit(1);
   }
@@ -156459,7 +156801,7 @@ teamCommand.command("remove").description("Remove a team member by email or memb
 // dist/index.js
 var __dirname2 = dirname5(fileURLToPath(import.meta.url));
 var pkg = JSON.parse(readFileSync18(join17(__dirname2, "..", "package.json"), "utf8"));
-var program = new Command36();
+var program = new Command37();
 program.name("skillvault-publisher").description("SkillVault publisher CLI \u2014 publish, manage, and distribute encrypted skills").version(pkg.version).addHelpText("after", `
 
 Getting Started:
@@ -156492,6 +156834,7 @@ program.addCommand(sessionCleanupCommand);
 program.addCommand(skillDeleteCommand);
 program.addCommand(skillStatusCommand);
 program.addCommand(skillUnarchiveCommand);
+program.addCommand(skillAclCommand);
 program.addCommand(grantsCommand);
 program.addCommand(revokeGrantCommand);
 program.addCommand(customersCommand);