- move org.v-it.cap record assembly + putRecord out of shipCap into new pure src/lib/cap.js (publishCap) - expose it publicly via package.json exports as `vit/cap.js`; supports optional reply strong refs, app.bsky.embed.external, and caller-supplied rkey/swapCid for idempotent refreshes - shipCap now builds+writes through publishCap; CLI contract (flags, help, output, caps.jsonl, verbose dump, error guidance) unchanged - add unit tests (fake agent, exact-write + failure paths), an offline tarball resolve test, and a traversal invariant test Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>