@floomhq/floom 1.0.63 → 2.0.0

package/dist/index.js

@@ -0,0 +1,3663 @@
+#!/usr/bin/env node
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// ../../node_modules/.pnpm/bcryptjs@2.4.3/node_modules/bcryptjs/dist/bcrypt.js
+var require_bcrypt = __commonJS({
+  "../../node_modules/.pnpm/bcryptjs@2.4.3/node_modules/bcryptjs/dist/bcrypt.js"(exports, module) {
+    (function(global, factory) {
+      if (typeof define === "function" && define["amd"])
+        define([], factory);
+      else if (typeof __require === "function" && typeof module === "object" && module && module["exports"])
+        module["exports"] = factory();
+      else
+        (global["dcodeIO"] = global["dcodeIO"] || {})["bcrypt"] = factory();
+    })(exports, function() {
+      "use strict";
+      var bcrypt2 = {};
+      var randomFallback = null;
+      function random(len) {
+        if (typeof module !== "undefined" && module && module["exports"])
+          try {
+            return __require("crypto")["randomBytes"](len);
+          } catch (e) {
+          }
+        try {
+          var a;
+          (self["crypto"] || self["msCrypto"])["getRandomValues"](a = new Uint32Array(len));
+          return Array.prototype.slice.call(a);
+        } catch (e) {
+        }
+        if (!randomFallback)
+          throw Error("Neither WebCryptoAPI nor a crypto module is available. Use bcrypt.setRandomFallback to set an alternative");
+        return randomFallback(len);
+      }
+      var randomAvailable = false;
+      try {
+        random(1);
+        randomAvailable = true;
+      } catch (e) {
+      }
+      randomFallback = null;
+      bcrypt2.setRandomFallback = function(random2) {
+        randomFallback = random2;
+      };
+      bcrypt2.genSaltSync = function(rounds, seed_length) {
+        rounds = rounds || GENSALT_DEFAULT_LOG2_ROUNDS;
+        if (typeof rounds !== "number")
+          throw Error("Illegal arguments: " + typeof rounds + ", " + typeof seed_length);
+        if (rounds < 4)
+          rounds = 4;
+        else if (rounds > 31)
+          rounds = 31;
+        var salt = [];
+        salt.push("$2a$");
+        if (rounds < 10)
+          salt.push("0");
+        salt.push(rounds.toString());
+        salt.push("$");
+        salt.push(base64_encode(random(BCRYPT_SALT_LEN), BCRYPT_SALT_LEN));
+        return salt.join("");
+      };
+      bcrypt2.genSalt = function(rounds, seed_length, callback) {
+        if (typeof seed_length === "function")
+          callback = seed_length, seed_length = void 0;
+        if (typeof rounds === "function")
+          callback = rounds, rounds = void 0;
+        if (typeof rounds === "undefined")
+          rounds = GENSALT_DEFAULT_LOG2_ROUNDS;
+        else if (typeof rounds !== "number")
+          throw Error("illegal arguments: " + typeof rounds);
+        function _async(callback2) {
+          nextTick(function() {
+            try {
+              callback2(null, bcrypt2.genSaltSync(rounds));
+            } catch (err) {
+              callback2(err);
+            }
+          });
+        }
+        if (callback) {
+          if (typeof callback !== "function")
+            throw Error("Illegal callback: " + typeof callback);
+          _async(callback);
+        } else
+          return new Promise(function(resolve3, reject) {
+            _async(function(err, res) {
+              if (err) {
+                reject(err);
+                return;
+              }
+              resolve3(res);
+            });
+          });
+      };
+      bcrypt2.hashSync = function(s, salt) {
+        if (typeof salt === "undefined")
+          salt = GENSALT_DEFAULT_LOG2_ROUNDS;
+        if (typeof salt === "number")
+          salt = bcrypt2.genSaltSync(salt);
+        if (typeof s !== "string" || typeof salt !== "string")
+          throw Error("Illegal arguments: " + typeof s + ", " + typeof salt);
+        return _hash(s, salt);
+      };
+      bcrypt2.hash = function(s, salt, callback, progressCallback) {
+        function _async(callback2) {
+          if (typeof s === "string" && typeof salt === "number")
+            bcrypt2.genSalt(salt, function(err, salt2) {
+              _hash(s, salt2, callback2, progressCallback);
+            });
+          else if (typeof s === "string" && typeof salt === "string")
+            _hash(s, salt, callback2, progressCallback);
+          else
+            nextTick(callback2.bind(this, Error("Illegal arguments: " + typeof s + ", " + typeof salt)));
+        }
+        if (callback) {
+          if (typeof callback !== "function")
+            throw Error("Illegal callback: " + typeof callback);
+          _async(callback);
+        } else
+          return new Promise(function(resolve3, reject) {
+            _async(function(err, res) {
+              if (err) {
+                reject(err);
+                return;
+              }
+              resolve3(res);
+            });
+          });
+      };
+      function safeStringCompare(known, unknown) {
+        var right = 0, wrong = 0;
+        for (var i = 0, k = known.length; i < k; ++i) {
+          if (known.charCodeAt(i) === unknown.charCodeAt(i))
+            ++right;
+          else
+            ++wrong;
+        }
+        if (right < 0)
+          return false;
+        return wrong === 0;
+      }
+      bcrypt2.compareSync = function(s, hash) {
+        if (typeof s !== "string" || typeof hash !== "string")
+          throw Error("Illegal arguments: " + typeof s + ", " + typeof hash);
+        if (hash.length !== 60)
+          return false;
+        return safeStringCompare(bcrypt2.hashSync(s, hash.substr(0, hash.length - 31)), hash);
+      };
+      bcrypt2.compare = function(s, hash, callback, progressCallback) {
+        function _async(callback2) {
+          if (typeof s !== "string" || typeof hash !== "string") {
+            nextTick(callback2.bind(this, Error("Illegal arguments: " + typeof s + ", " + typeof hash)));
+            return;
+          }
+          if (hash.length !== 60) {
+            nextTick(callback2.bind(this, null, false));
+            return;
+          }
+          bcrypt2.hash(s, hash.substr(0, 29), function(err, comp) {
+            if (err)
+              callback2(err);
+            else
+              callback2(null, safeStringCompare(comp, hash));
+          }, progressCallback);
+        }
+        if (callback) {
+          if (typeof callback !== "function")
+            throw Error("Illegal callback: " + typeof callback);
+          _async(callback);
+        } else
+          return new Promise(function(resolve3, reject) {
+            _async(function(err, res) {
+              if (err) {
+                reject(err);
+                return;
+              }
+              resolve3(res);
+            });
+          });
+      };
+      bcrypt2.getRounds = function(hash) {
+        if (typeof hash !== "string")
+          throw Error("Illegal arguments: " + typeof hash);
+        return parseInt(hash.split("$")[2], 10);
+      };
+      bcrypt2.getSalt = function(hash) {
+        if (typeof hash !== "string")
+          throw Error("Illegal arguments: " + typeof hash);
+        if (hash.length !== 60)
+          throw Error("Illegal hash length: " + hash.length + " != 60");
+        return hash.substring(0, 29);
+      };
+      var nextTick = typeof process !== "undefined" && process && typeof process.nextTick === "function" ? typeof setImmediate === "function" ? setImmediate : process.nextTick : setTimeout;
+      function stringToBytes(str) {
+        var out = [], i = 0;
+        utfx.encodeUTF16toUTF8(function() {
+          if (i >= str.length) return null;
+          return str.charCodeAt(i++);
+        }, function(b) {
+          out.push(b);
+        });
+        return out;
+      }
+      var BASE64_CODE = "./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789".split("");
+      var BASE64_INDEX = [
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        0,
+        1,
+        54,
+        55,
+        56,
+        57,
+        58,
+        59,
+        60,
+        61,
+        62,
+        63,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        2,
+        3,
+        4,
+        5,
+        6,
+        7,
+        8,
+        9,
+        10,
+        11,
+        12,
+        13,
+        14,
+        15,
+        16,
+        17,
+        18,
+        19,
+        20,
+        21,
+        22,
+        23,
+        24,
+        25,
+        26,
+        27,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        28,
+        29,
+        30,
+        31,
+        32,
+        33,
+        34,
+        35,
+        36,
+        37,
+        38,
+        39,
+        40,
+        41,
+        42,
+        43,
+        44,
+        45,
+        46,
+        47,
+        48,
+        49,
+        50,
+        51,
+        52,
+        53,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1
+      ];
+      var stringFromCharCode = String.fromCharCode;
+      function base64_encode(b, len) {
+        var off = 0, rs = [], c1, c2;
+        if (len <= 0 || len > b.length)
+          throw Error("Illegal len: " + len);
+        while (off < len) {
+          c1 = b[off++] & 255;
+          rs.push(BASE64_CODE[c1 >> 2 & 63]);
+          c1 = (c1 & 3) << 4;
+          if (off >= len) {
+            rs.push(BASE64_CODE[c1 & 63]);
+            break;
+          }
+          c2 = b[off++] & 255;
+          c1 |= c2 >> 4 & 15;
+          rs.push(BASE64_CODE[c1 & 63]);
+          c1 = (c2 & 15) << 2;
+          if (off >= len) {
+            rs.push(BASE64_CODE[c1 & 63]);
+            break;
+          }
+          c2 = b[off++] & 255;
+          c1 |= c2 >> 6 & 3;
+          rs.push(BASE64_CODE[c1 & 63]);
+          rs.push(BASE64_CODE[c2 & 63]);
+        }
+        return rs.join("");
+      }
+      function base64_decode(s, len) {
+        var off = 0, slen = s.length, olen = 0, rs = [], c1, c2, c3, c4, o, code;
+        if (len <= 0)
+          throw Error("Illegal len: " + len);
+        while (off < slen - 1 && olen < len) {
+          code = s.charCodeAt(off++);
+          c1 = code < BASE64_INDEX.length ? BASE64_INDEX[code] : -1;
+          code = s.charCodeAt(off++);
+          c2 = code < BASE64_INDEX.length ? BASE64_INDEX[code] : -1;
+          if (c1 == -1 || c2 == -1)
+            break;
+          o = c1 << 2 >>> 0;
+          o |= (c2 & 48) >> 4;
+          rs.push(stringFromCharCode(o));
+          if (++olen >= len || off >= slen)
+            break;
+          code = s.charCodeAt(off++);
+          c3 = code < BASE64_INDEX.length ? BASE64_INDEX[code] : -1;
+          if (c3 == -1)
+            break;
+          o = (c2 & 15) << 4 >>> 0;
+          o |= (c3 & 60) >> 2;
+          rs.push(stringFromCharCode(o));
+          if (++olen >= len || off >= slen)
+            break;
+          code = s.charCodeAt(off++);
+          c4 = code < BASE64_INDEX.length ? BASE64_INDEX[code] : -1;
+          o = (c3 & 3) << 6 >>> 0;
+          o |= c4;
+          rs.push(stringFromCharCode(o));
+          ++olen;
+        }
+        var res = [];
+        for (off = 0; off < olen; off++)
+          res.push(rs[off].charCodeAt(0));
+        return res;
+      }
+      var utfx = (function() {
+        "use strict";
+        var utfx2 = {};
+        utfx2.MAX_CODEPOINT = 1114111;
+        utfx2.encodeUTF8 = function(src, dst) {
+          var cp2 = null;
+          if (typeof src === "number")
+            cp2 = src, src = function() {
+              return null;
+            };
+          while (cp2 !== null || (cp2 = src()) !== null) {
+            if (cp2 < 128)
+              dst(cp2 & 127);
+            else if (cp2 < 2048)
+              dst(cp2 >> 6 & 31 | 192), dst(cp2 & 63 | 128);
+            else if (cp2 < 65536)
+              dst(cp2 >> 12 & 15 | 224), dst(cp2 >> 6 & 63 | 128), dst(cp2 & 63 | 128);
+            else
+              dst(cp2 >> 18 & 7 | 240), dst(cp2 >> 12 & 63 | 128), dst(cp2 >> 6 & 63 | 128), dst(cp2 & 63 | 128);
+            cp2 = null;
+          }
+        };
+        utfx2.decodeUTF8 = function(src, dst) {
+          var a, b, c, d, fail = function(b2) {
+            b2 = b2.slice(0, b2.indexOf(null));
+            var err = Error(b2.toString());
+            err.name = "TruncatedError";
+            err["bytes"] = b2;
+            throw err;
+          };
+          while ((a = src()) !== null) {
+            if ((a & 128) === 0)
+              dst(a);
+            else if ((a & 224) === 192)
+              (b = src()) === null && fail([a, b]), dst((a & 31) << 6 | b & 63);
+            else if ((a & 240) === 224)
+              ((b = src()) === null || (c = src()) === null) && fail([a, b, c]), dst((a & 15) << 12 | (b & 63) << 6 | c & 63);
+            else if ((a & 248) === 240)
+              ((b = src()) === null || (c = src()) === null || (d = src()) === null) && fail([a, b, c, d]), dst((a & 7) << 18 | (b & 63) << 12 | (c & 63) << 6 | d & 63);
+            else throw RangeError("Illegal starting byte: " + a);
+          }
+        };
+        utfx2.UTF16toUTF8 = function(src, dst) {
+          var c1, c2 = null;
+          while (true) {
+            if ((c1 = c2 !== null ? c2 : src()) === null)
+              break;
+            if (c1 >= 55296 && c1 <= 57343) {
+              if ((c2 = src()) !== null) {
+                if (c2 >= 56320 && c2 <= 57343) {
+                  dst((c1 - 55296) * 1024 + c2 - 56320 + 65536);
+                  c2 = null;
+                  continue;
+                }
+              }
+            }
+            dst(c1);
+          }
+          if (c2 !== null) dst(c2);
+        };
+        utfx2.UTF8toUTF16 = function(src, dst) {
+          var cp2 = null;
+          if (typeof src === "number")
+            cp2 = src, src = function() {
+              return null;
+            };
+          while (cp2 !== null || (cp2 = src()) !== null) {
+            if (cp2 <= 65535)
+              dst(cp2);
+            else
+              cp2 -= 65536, dst((cp2 >> 10) + 55296), dst(cp2 % 1024 + 56320);
+            cp2 = null;
+          }
+        };
+        utfx2.encodeUTF16toUTF8 = function(src, dst) {
+          utfx2.UTF16toUTF8(src, function(cp2) {
+            utfx2.encodeUTF8(cp2, dst);
+          });
+        };
+        utfx2.decodeUTF8toUTF16 = function(src, dst) {
+          utfx2.decodeUTF8(src, function(cp2) {
+            utfx2.UTF8toUTF16(cp2, dst);
+          });
+        };
+        utfx2.calculateCodePoint = function(cp2) {
+          return cp2 < 128 ? 1 : cp2 < 2048 ? 2 : cp2 < 65536 ? 3 : 4;
+        };
+        utfx2.calculateUTF8 = function(src) {
+          var cp2, l = 0;
+          while ((cp2 = src()) !== null)
+            l += utfx2.calculateCodePoint(cp2);
+          return l;
+        };
+        utfx2.calculateUTF16asUTF8 = function(src) {
+          var n = 0, l = 0;
+          utfx2.UTF16toUTF8(src, function(cp2) {
+            ++n;
+            l += utfx2.calculateCodePoint(cp2);
+          });
+          return [n, l];
+        };
+        return utfx2;
+      })();
+      Date.now = Date.now || function() {
+        return +/* @__PURE__ */ new Date();
+      };
+      var BCRYPT_SALT_LEN = 16;
+      var GENSALT_DEFAULT_LOG2_ROUNDS = 10;
+      var BLOWFISH_NUM_ROUNDS = 16;
+      var MAX_EXECUTION_TIME = 100;
+      var P_ORIG = [
+        608135816,
+        2242054355,
+        320440878,
+        57701188,
+        2752067618,
+        698298832,
+        137296536,
+        3964562569,
+        1160258022,
+        953160567,
+        3193202383,
+        887688300,
+        3232508343,
+        3380367581,
+        1065670069,
+        3041331479,
+        2450970073,
+        2306472731
+      ];
+      var S_ORIG = [
+        3509652390,
+        2564797868,
+        805139163,
+        3491422135,
+        3101798381,
+        1780907670,
+        3128725573,
+        4046225305,
+        614570311,
+        3012652279,
+        134345442,
+        2240740374,
+        1667834072,
+        1901547113,
+        2757295779,
+        4103290238,
+        227898511,
+        1921955416,
+        1904987480,
+        2182433518,
+        2069144605,
+        3260701109,
+        2620446009,
+        720527379,
+        3318853667,
+        677414384,
+        3393288472,
+        3101374703,
+        2390351024,
+        1614419982,
+        1822297739,
+        2954791486,
+        3608508353,
+        3174124327,
+        2024746970,
+        1432378464,
+        3864339955,
+        2857741204,
+        1464375394,
+        1676153920,
+        1439316330,
+        715854006,
+        3033291828,
+        289532110,
+        2706671279,
+        2087905683,
+        3018724369,
+        1668267050,
+        732546397,
+        1947742710,
+        3462151702,
+        2609353502,
+        2950085171,
+        1814351708,
+        2050118529,
+        680887927,
+        999245976,
+        1800124847,
+        3300911131,
+        1713906067,
+        1641548236,
+        4213287313,
+        1216130144,
+        1575780402,
+        4018429277,
+        3917837745,
+        3693486850,
+        3949271944,
+        596196993,
+        3549867205,
+        258830323,
+        2213823033,
+        772490370,
+        2760122372,
+        1774776394,
+        2652871518,
+        566650946,
+        4142492826,
+        1728879713,
+        2882767088,
+        1783734482,
+        3629395816,
+        2517608232,
+        2874225571,
+        1861159788,
+        326777828,
+        3124490320,
+        2130389656,
+        2716951837,
+        967770486,
+        1724537150,
+        2185432712,
+        2364442137,
+        1164943284,
+        2105845187,
+        998989502,
+        3765401048,
+        2244026483,
+        1075463327,
+        1455516326,
+        1322494562,
+        910128902,
+        469688178,
+        1117454909,
+        936433444,
+        3490320968,
+        3675253459,
+        1240580251,
+        122909385,
+        2157517691,
+        634681816,
+        4142456567,
+        3825094682,
+        3061402683,
+        2540495037,
+        79693498,
+        3249098678,
+        1084186820,
+        1583128258,
+        426386531,
+        1761308591,
+        1047286709,
+        322548459,
+        995290223,
+        1845252383,
+        2603652396,
+        3431023940,
+        2942221577,
+        3202600964,
+        3727903485,
+        1712269319,
+        422464435,
+        3234572375,
+        1170764815,
+        3523960633,
+        3117677531,
+        1434042557,
+        442511882,
+        3600875718,
+        1076654713,
+        1738483198,
+        4213154764,
+        2393238008,
+        3677496056,
+        1014306527,
+        4251020053,
+        793779912,
+        2902807211,
+        842905082,
+        4246964064,
+        1395751752,
+        1040244610,
+        2656851899,
+        3396308128,
+        445077038,
+        3742853595,
+        3577915638,
+        679411651,
+        2892444358,
+        2354009459,
+        1767581616,
+        3150600392,
+        3791627101,
+        3102740896,
+        284835224,
+        4246832056,
+        1258075500,
+        768725851,
+        2589189241,
+        3069724005,
+        3532540348,
+        1274779536,
+        3789419226,
+        2764799539,
+        1660621633,
+        3471099624,
+        4011903706,
+        913787905,
+        3497959166,
+        737222580,
+        2514213453,
+        2928710040,
+        3937242737,
+        1804850592,
+        3499020752,
+        2949064160,
+        2386320175,
+        2390070455,
+        2415321851,
+        4061277028,
+        2290661394,
+        2416832540,
+        1336762016,
+        1754252060,
+        3520065937,
+        3014181293,
+        791618072,
+        3188594551,
+        3933548030,
+        2332172193,
+        3852520463,
+        3043980520,
+        413987798,
+        3465142937,
+        3030929376,
+        4245938359,
+        2093235073,
+        3534596313,
+        375366246,
+        2157278981,
+        2479649556,
+        555357303,
+        3870105701,
+        2008414854,
+        3344188149,
+        4221384143,
+        3956125452,
+        2067696032,
+        3594591187,
+        2921233993,
+        2428461,
+        544322398,
+        577241275,
+        1471733935,
+        610547355,
+        4027169054,
+        1432588573,
+        1507829418,
+        2025931657,
+        3646575487,
+        545086370,
+        48609733,
+        2200306550,
+        1653985193,
+        298326376,
+        1316178497,
+        3007786442,
+        2064951626,
+        458293330,
+        2589141269,
+        3591329599,
+        3164325604,
+        727753846,
+        2179363840,
+        146436021,
+        1461446943,
+        4069977195,
+        705550613,
+        3059967265,
+        3887724982,
+        4281599278,
+        3313849956,
+        1404054877,
+        2845806497,
+        146425753,
+        1854211946,
+        1266315497,
+        3048417604,
+        3681880366,
+        3289982499,
+        290971e4,
+        1235738493,
+        2632868024,
+        2414719590,
+        3970600049,
+        1771706367,
+        1449415276,
+        3266420449,
+        422970021,
+        1963543593,
+        2690192192,
+        3826793022,
+        1062508698,
+        1531092325,
+        1804592342,
+        2583117782,
+        2714934279,
+        4024971509,
+        1294809318,
+        4028980673,
+        1289560198,
+        2221992742,
+        1669523910,
+        35572830,
+        157838143,
+        1052438473,
+        1016535060,
+        1802137761,
+        1753167236,
+        1386275462,
+        3080475397,
+        2857371447,
+        1040679964,
+        2145300060,
+        2390574316,
+        1461121720,
+        2956646967,
+        4031777805,
+        4028374788,
+        33600511,
+        2920084762,
+        1018524850,
+        629373528,
+        3691585981,
+        3515945977,
+        2091462646,
+        2486323059,
+        586499841,
+        988145025,
+        935516892,
+        3367335476,
+        2599673255,
+        2839830854,
+        265290510,
+        3972581182,
+        2759138881,
+        3795373465,
+        1005194799,
+        847297441,
+        406762289,
+        1314163512,
+        1332590856,
+        1866599683,
+        4127851711,
+        750260880,
+        613907577,
+        1450815602,
+        3165620655,
+        3734664991,
+        3650291728,
+        3012275730,
+        3704569646,
+        1427272223,
+        778793252,
+        1343938022,
+        2676280711,
+        2052605720,
+        1946737175,
+        3164576444,
+        3914038668,
+        3967478842,
+        3682934266,
+        1661551462,
+        3294938066,
+        4011595847,
+        840292616,
+        3712170807,
+        616741398,
+        312560963,
+        711312465,
+        1351876610,
+        322626781,
+        1910503582,
+        271666773,
+        2175563734,
+        1594956187,
+        70604529,
+        3617834859,
+        1007753275,
+        1495573769,
+        4069517037,
+        2549218298,
+        2663038764,
+        504708206,
+        2263041392,
+        3941167025,
+        2249088522,
+        1514023603,
+        1998579484,
+        1312622330,
+        694541497,
+        2582060303,
+        2151582166,
+        1382467621,
+        776784248,
+        2618340202,
+        3323268794,
+        2497899128,
+        2784771155,
+        503983604,
+        4076293799,
+        907881277,
+        423175695,
+        432175456,
+        1378068232,
+        4145222326,
+        3954048622,
+        3938656102,
+        3820766613,
+        2793130115,
+        2977904593,
+        26017576,
+        3274890735,
+        3194772133,
+        1700274565,
+        1756076034,
+        4006520079,
+        3677328699,
+        720338349,
+        1533947780,
+        354530856,
+        688349552,
+        3973924725,
+        1637815568,
+        332179504,
+        3949051286,
+        53804574,
+        2852348879,
+        3044236432,
+        1282449977,
+        3583942155,
+        3416972820,
+        4006381244,
+        1617046695,
+        2628476075,
+        3002303598,
+        1686838959,
+        431878346,
+        2686675385,
+        1700445008,
+        1080580658,
+        1009431731,
+        832498133,
+        3223435511,
+        2605976345,
+        2271191193,
+        2516031870,
+        1648197032,
+        4164389018,
+        2548247927,
+        300782431,
+        375919233,
+        238389289,
+        3353747414,
+        2531188641,
+        2019080857,
+        1475708069,
+        455242339,
+        2609103871,
+        448939670,
+        3451063019,
+        1395535956,
+        2413381860,
+        1841049896,
+        1491858159,
+        885456874,
+        4264095073,
+        4001119347,
+        1565136089,
+        3898914787,
+        1108368660,
+        540939232,
+        1173283510,
+        2745871338,
+        3681308437,
+        4207628240,
+        3343053890,
+        4016749493,
+        1699691293,
+        1103962373,
+        3625875870,
+        2256883143,
+        3830138730,
+        1031889488,
+        3479347698,
+        1535977030,
+        4236805024,
+        3251091107,
+        2132092099,
+        1774941330,
+        1199868427,
+        1452454533,
+        157007616,
+        2904115357,
+        342012276,
+        595725824,
+        1480756522,
+        206960106,
+        497939518,
+        591360097,
+        863170706,
+        2375253569,
+        3596610801,
+        1814182875,
+        2094937945,
+        3421402208,
+        1082520231,
+        3463918190,
+        2785509508,
+        435703966,
+        3908032597,
+        1641649973,
+        2842273706,
+        3305899714,
+        1510255612,
+        2148256476,
+        2655287854,
+        3276092548,
+        4258621189,
+        236887753,
+        3681803219,
+        274041037,
+        1734335097,
+        3815195456,
+        3317970021,
+        1899903192,
+        1026095262,
+        4050517792,
+        356393447,
+        2410691914,
+        3873677099,
+        3682840055,
+        3913112168,
+        2491498743,
+        4132185628,
+        2489919796,
+        1091903735,
+        1979897079,
+        3170134830,
+        3567386728,
+        3557303409,
+        857797738,
+        1136121015,
+        1342202287,
+        507115054,
+        2535736646,
+        337727348,
+        3213592640,
+        1301675037,
+        2528481711,
+        1895095763,
+        1721773893,
+        3216771564,
+        62756741,
+        2142006736,
+        835421444,
+        2531993523,
+        1442658625,
+        3659876326,
+        2882144922,
+        676362277,
+        1392781812,
+        170690266,
+        3921047035,
+        1759253602,
+        3611846912,
+        1745797284,
+        664899054,
+        1329594018,
+        3901205900,
+        3045908486,
+        2062866102,
+        2865634940,
+        3543621612,
+        3464012697,
+        1080764994,
+        553557557,
+        3656615353,
+        3996768171,
+        991055499,
+        499776247,
+        1265440854,
+        648242737,
+        3940784050,
+        980351604,
+        3713745714,
+        1749149687,
+        3396870395,
+        4211799374,
+        3640570775,
+        1161844396,
+        3125318951,
+        1431517754,
+        545492359,
+        4268468663,
+        3499529547,
+        1437099964,
+        2702547544,
+        3433638243,
+        2581715763,
+        2787789398,
+        1060185593,
+        1593081372,
+        2418618748,
+        4260947970,
+        69676912,
+        2159744348,
+        86519011,
+        2512459080,
+        3838209314,
+        1220612927,
+        3339683548,
+        133810670,
+        1090789135,
+        1078426020,
+        1569222167,
+        845107691,
+        3583754449,
+        4072456591,
+        1091646820,
+        628848692,
+        1613405280,
+        3757631651,
+        526609435,
+        236106946,
+        48312990,
+        2942717905,
+        3402727701,
+        1797494240,
+        859738849,
+        992217954,
+        4005476642,
+        2243076622,
+        3870952857,
+        3732016268,
+        765654824,
+        3490871365,
+        2511836413,
+        1685915746,
+        3888969200,
+        1414112111,
+        2273134842,
+        3281911079,
+        4080962846,
+        172450625,
+        2569994100,
+        980381355,
+        4109958455,
+        2819808352,
+        2716589560,
+        2568741196,
+        3681446669,
+        3329971472,
+        1835478071,
+        660984891,
+        3704678404,
+        4045999559,
+        3422617507,
+        3040415634,
+        1762651403,
+        1719377915,
+        3470491036,
+        2693910283,
+        3642056355,
+        3138596744,
+        1364962596,
+        2073328063,
+        1983633131,
+        926494387,
+        3423689081,
+        2150032023,
+        4096667949,
+        1749200295,
+        3328846651,
+        309677260,
+        2016342300,
+        1779581495,
+        3079819751,
+        111262694,
+        1274766160,
+        443224088,
+        298511866,
+        1025883608,
+        3806446537,
+        1145181785,
+        168956806,
+        3641502830,
+        3584813610,
+        1689216846,
+        3666258015,
+        3200248200,
+        1692713982,
+        2646376535,
+        4042768518,
+        1618508792,
+        1610833997,
+        3523052358,
+        4130873264,
+        2001055236,
+        3610705100,
+        2202168115,
+        4028541809,
+        2961195399,
+        1006657119,
+        2006996926,
+        3186142756,
+        1430667929,
+        3210227297,
+        1314452623,
+        4074634658,
+        4101304120,
+        2273951170,
+        1399257539,
+        3367210612,
+        3027628629,
+        1190975929,
+        2062231137,
+        2333990788,
+        2221543033,
+        2438960610,
+        1181637006,
+        548689776,
+        2362791313,
+        3372408396,
+        3104550113,
+        3145860560,
+        296247880,
+        1970579870,
+        3078560182,
+        3769228297,
+        1714227617,
+        3291629107,
+        3898220290,
+        166772364,
+        1251581989,
+        493813264,
+        448347421,
+        195405023,
+        2709975567,
+        677966185,
+        3703036547,
+        1463355134,
+        2715995803,
+        1338867538,
+        1343315457,
+        2802222074,
+        2684532164,
+        233230375,
+        2599980071,
+        2000651841,
+        3277868038,
+        1638401717,
+        4028070440,
+        3237316320,
+        6314154,
+        819756386,
+        300326615,
+        590932579,
+        1405279636,
+        3267499572,
+        3150704214,
+        2428286686,
+        3959192993,
+        3461946742,
+        1862657033,
+        1266418056,
+        963775037,
+        2089974820,
+        2263052895,
+        1917689273,
+        448879540,
+        3550394620,
+        3981727096,
+        150775221,
+        3627908307,
+        1303187396,
+        508620638,
+        2975983352,
+        2726630617,
+        1817252668,
+        1876281319,
+        1457606340,
+        908771278,
+        3720792119,
+        3617206836,
+        2455994898,
+        1729034894,
+        1080033504,
+        976866871,
+        3556439503,
+        2881648439,
+        1522871579,
+        1555064734,
+        1336096578,
+        3548522304,
+        2579274686,
+        3574697629,
+        3205460757,
+        3593280638,
+        3338716283,
+        3079412587,
+        564236357,
+        2993598910,
+        1781952180,
+        1464380207,
+        3163844217,
+        3332601554,
+        1699332808,
+        1393555694,
+        1183702653,
+        3581086237,
+        1288719814,
+        691649499,
+        2847557200,
+        2895455976,
+        3193889540,
+        2717570544,
+        1781354906,
+        1676643554,
+        2592534050,
+        3230253752,
+        1126444790,
+        2770207658,
+        2633158820,
+        2210423226,
+        2615765581,
+        2414155088,
+        3127139286,
+        673620729,
+        2805611233,
+        1269405062,
+        4015350505,
+        3341807571,
+        4149409754,
+        1057255273,
+        2012875353,
+        2162469141,
+        2276492801,
+        2601117357,
+        993977747,
+        3918593370,
+        2654263191,
+        753973209,
+        36408145,
+        2530585658,
+        25011837,
+        3520020182,
+        2088578344,
+        530523599,
+        2918365339,
+        1524020338,
+        1518925132,
+        3760827505,
+        3759777254,
+        1202760957,
+        3985898139,
+        3906192525,
+        674977740,
+        4174734889,
+        2031300136,
+        2019492241,
+        3983892565,
+        4153806404,
+        3822280332,
+        352677332,
+        2297720250,
+        60907813,
+        90501309,
+        3286998549,
+        1016092578,
+        2535922412,
+        2839152426,
+        457141659,
+        509813237,
+        4120667899,
+        652014361,
+        1966332200,
+        2975202805,
+        55981186,
+        2327461051,
+        676427537,
+        3255491064,
+        2882294119,
+        3433927263,
+        1307055953,
+        942726286,
+        933058658,
+        2468411793,
+        3933900994,
+        4215176142,
+        1361170020,
+        2001714738,
+        2830558078,
+        3274259782,
+        1222529897,
+        1679025792,
+        2729314320,
+        3714953764,
+        1770335741,
+        151462246,
+        3013232138,
+        1682292957,
+        1483529935,
+        471910574,
+        1539241949,
+        458788160,
+        3436315007,
+        1807016891,
+        3718408830,
+        978976581,
+        1043663428,
+        3165965781,
+        1927990952,
+        4200891579,
+        2372276910,
+        3208408903,
+        3533431907,
+        1412390302,
+        2931980059,
+        4132332400,
+        1947078029,
+        3881505623,
+        4168226417,
+        2941484381,
+        1077988104,
+        1320477388,
+        886195818,
+        18198404,
+        3786409e3,
+        2509781533,
+        112762804,
+        3463356488,
+        1866414978,
+        891333506,
+        18488651,
+        661792760,
+        1628790961,
+        3885187036,
+        3141171499,
+        876946877,
+        2693282273,
+        1372485963,
+        791857591,
+        2686433993,
+        3759982718,
+        3167212022,
+        3472953795,
+        2716379847,
+        445679433,
+        3561995674,
+        3504004811,
+        3574258232,
+        54117162,
+        3331405415,
+        2381918588,
+        3769707343,
+        4154350007,
+        1140177722,
+        4074052095,
+        668550556,
+        3214352940,
+        367459370,
+        261225585,
+        2610173221,
+        4209349473,
+        3468074219,
+        3265815641,
+        314222801,
+        3066103646,
+        3808782860,
+        282218597,
+        3406013506,
+        3773591054,
+        379116347,
+        1285071038,
+        846784868,
+        2669647154,
+        3771962079,
+        3550491691,
+        2305946142,
+        453669953,
+        1268987020,
+        3317592352,
+        3279303384,
+        3744833421,
+        2610507566,
+        3859509063,
+        266596637,
+        3847019092,
+        517658769,
+        3462560207,
+        3443424879,
+        370717030,
+        4247526661,
+        2224018117,
+        4143653529,
+        4112773975,
+        2788324899,
+        2477274417,
+        1456262402,
+        2901442914,
+        1517677493,
+        1846949527,
+        2295493580,
+        3734397586,
+        2176403920,
+        1280348187,
+        1908823572,
+        3871786941,
+        846861322,
+        1172426758,
+        3287448474,
+        3383383037,
+        1655181056,
+        3139813346,
+        901632758,
+        1897031941,
+        2986607138,
+        3066810236,
+        3447102507,
+        1393639104,
+        373351379,
+        950779232,
+        625454576,
+        3124240540,
+        4148612726,
+        2007998917,
+        544563296,
+        2244738638,
+        2330496472,
+        2058025392,
+        1291430526,
+        424198748,
+        50039436,
+        29584100,
+        3605783033,
+        2429876329,
+        2791104160,
+        1057563949,
+        3255363231,
+        3075367218,
+        3463963227,
+        1469046755,
+        985887462
+      ];
+      var C_ORIG = [
+        1332899944,
+        1700884034,
+        1701343084,
+        1684370003,
+        1668446532,
+        1869963892
+      ];
+      function _encipher(lr, off, P, S) {
+        var n, l = lr[off], r = lr[off + 1];
+        l ^= P[0];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[1];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[2];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[3];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[4];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[5];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[6];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[7];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[8];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[9];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[10];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[11];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[12];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[13];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[14];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[15];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[16];
+        lr[off] = r ^ P[BLOWFISH_NUM_ROUNDS + 1];
+        lr[off + 1] = l;
+        return lr;
+      }
+      function _streamtoword(data, offp) {
+        for (var i = 0, word = 0; i < 4; ++i)
+          word = word << 8 | data[offp] & 255, offp = (offp + 1) % data.length;
+        return { key: word, offp };
+      }
+      function _key(key, P, S) {
+        var offset = 0, lr = [0, 0], plen = P.length, slen = S.length, sw;
+        for (var i = 0; i < plen; i++)
+          sw = _streamtoword(key, offset), offset = sw.offp, P[i] = P[i] ^ sw.key;
+        for (i = 0; i < plen; i += 2)
+          lr = _encipher(lr, 0, P, S), P[i] = lr[0], P[i + 1] = lr[1];
+        for (i = 0; i < slen; i += 2)
+          lr = _encipher(lr, 0, P, S), S[i] = lr[0], S[i + 1] = lr[1];
+      }
+      function _ekskey(data, key, P, S) {
+        var offp = 0, lr = [0, 0], plen = P.length, slen = S.length, sw;
+        for (var i = 0; i < plen; i++)
+          sw = _streamtoword(key, offp), offp = sw.offp, P[i] = P[i] ^ sw.key;
+        offp = 0;
+        for (i = 0; i < plen; i += 2)
+          sw = _streamtoword(data, offp), offp = sw.offp, lr[0] ^= sw.key, sw = _streamtoword(data, offp), offp = sw.offp, lr[1] ^= sw.key, lr = _encipher(lr, 0, P, S), P[i] = lr[0], P[i + 1] = lr[1];
+        for (i = 0; i < slen; i += 2)
+          sw = _streamtoword(data, offp), offp = sw.offp, lr[0] ^= sw.key, sw = _streamtoword(data, offp), offp = sw.offp, lr[1] ^= sw.key, lr = _encipher(lr, 0, P, S), S[i] = lr[0], S[i + 1] = lr[1];
+      }
+      function _crypt(b, salt, rounds, callback, progressCallback) {
+        var cdata = C_ORIG.slice(), clen = cdata.length, err;
+        if (rounds < 4 || rounds > 31) {
+          err = Error("Illegal number of rounds (4-31): " + rounds);
+          if (callback) {
+            nextTick(callback.bind(this, err));
+            return;
+          } else
+            throw err;
+        }
+        if (salt.length !== BCRYPT_SALT_LEN) {
+          err = Error("Illegal salt length: " + salt.length + " != " + BCRYPT_SALT_LEN);
+          if (callback) {
+            nextTick(callback.bind(this, err));
+            return;
+          } else
+            throw err;
+        }
+        rounds = 1 << rounds >>> 0;
+        var P, S, i = 0, j;
+        if (Int32Array) {
+          P = new Int32Array(P_ORIG);
+          S = new Int32Array(S_ORIG);
+        } else {
+          P = P_ORIG.slice();
+          S = S_ORIG.slice();
+        }
+        _ekskey(salt, b, P, S);
+        function next() {
+          if (progressCallback)
+            progressCallback(i / rounds);
+          if (i < rounds) {
+            var start = Date.now();
+            for (; i < rounds; ) {
+              i = i + 1;
+              _key(b, P, S);
+              _key(salt, P, S);
+              if (Date.now() - start > MAX_EXECUTION_TIME)
+                break;
+            }
+          } else {
+            for (i = 0; i < 64; i++)
+              for (j = 0; j < clen >> 1; j++)
+                _encipher(cdata, j << 1, P, S);
+            var ret = [];
+            for (i = 0; i < clen; i++)
+              ret.push((cdata[i] >> 24 & 255) >>> 0), ret.push((cdata[i] >> 16 & 255) >>> 0), ret.push((cdata[i] >> 8 & 255) >>> 0), ret.push((cdata[i] & 255) >>> 0);
+            if (callback) {
+              callback(null, ret);
+              return;
+            } else
+              return ret;
+          }
+          if (callback)
+            nextTick(next);
+        }
+        if (typeof callback !== "undefined") {
+          next();
+        } else {
+          var res;
+          while (true)
+            if (typeof (res = next()) !== "undefined")
+              return res || [];
+        }
+      }
+      function _hash(s, salt, callback, progressCallback) {
+        var err;
+        if (typeof s !== "string" || typeof salt !== "string") {
+          err = Error("Invalid string / salt: Not a string");
+          if (callback) {
+            nextTick(callback.bind(this, err));
+            return;
+          } else
+            throw err;
+        }
+        var minor, offset;
+        if (salt.charAt(0) !== "$" || salt.charAt(1) !== "2") {
+          err = Error("Invalid salt version: " + salt.substring(0, 2));
+          if (callback) {
+            nextTick(callback.bind(this, err));
+            return;
+          } else
+            throw err;
+        }
+        if (salt.charAt(2) === "$")
+          minor = String.fromCharCode(0), offset = 3;
+        else {
+          minor = salt.charAt(2);
+          if (minor !== "a" && minor !== "b" && minor !== "y" || salt.charAt(3) !== "$") {
+            err = Error("Invalid salt revision: " + salt.substring(2, 4));
+            if (callback) {
+              nextTick(callback.bind(this, err));
+              return;
+            } else
+              throw err;
+          }
+          offset = 4;
+        }
+        if (salt.charAt(offset + 2) > "$") {
+          err = Error("Missing salt rounds");
+          if (callback) {
+            nextTick(callback.bind(this, err));
+            return;
+          } else
+            throw err;
+        }
+        var r1 = parseInt(salt.substring(offset, offset + 1), 10) * 10, r2 = parseInt(salt.substring(offset + 1, offset + 2), 10), rounds = r1 + r2, real_salt = salt.substring(offset + 3, offset + 25);
+        s += minor >= "a" ? "\0" : "";
+        var passwordb = stringToBytes(s), saltb = base64_decode(real_salt, BCRYPT_SALT_LEN);
+        function finish(bytes) {
+          var res = [];
+          res.push("$2");
+          if (minor >= "a")
+            res.push(minor);
+          res.push("$");
+          if (rounds < 10)
+            res.push("0");
+          res.push(rounds.toString());
+          res.push("$");
+          res.push(base64_encode(saltb, saltb.length));
+          res.push(base64_encode(bytes, C_ORIG.length * 4 - 1));
+          return res.join("");
+        }
+        if (typeof callback == "undefined")
+          return finish(_crypt(passwordb, saltb, rounds));
+        else {
+          _crypt(passwordb, saltb, rounds, function(err2, bytes) {
+            if (err2)
+              callback(err2, null);
+            else
+              callback(null, finish(bytes));
+          }, progressCallback);
+        }
+      }
+      bcrypt2.encodeBase64 = base64_encode;
+      bcrypt2.decodeBase64 = base64_decode;
+      return bcrypt2;
+    });
+  }
+});
+
+// ../../node_modules/.pnpm/bcryptjs@2.4.3/node_modules/bcryptjs/index.js
+var require_bcryptjs = __commonJS({
+  "../../node_modules/.pnpm/bcryptjs@2.4.3/node_modules/bcryptjs/index.js"(exports, module) {
+    module.exports = require_bcrypt();
+  }
+});
+
+// src/index.ts
+import { homedir as homedir5 } from "node:os";
+import { Command } from "commander";
+
+// ../shared/src/manifest.ts
+import { z } from "zod";
+var slugSchema = z.string().regex(
+  /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/,
+  "name must be lowercase letters/digits/hyphens, 3-64 chars, start+end alphanumeric"
+);
+var semverSchema = z.string().regex(
+  /^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$/,
+  "version must be semver (e.g. 0.1.0 or 1.0.0-beta.1)"
+);
+var skillTargetSchema = z.enum([
+  "claude",
+  "codex",
+  "cursor",
+  "gemini",
+  "opencode",
+  "custom"
+]);
+var authorSchema = z.object({
+  name: z.string().min(1),
+  email: z.string().email().optional()
+});
+var declaredScriptSchema = z.object({
+  path: z.string(),
+  description: z.string().max(280)
+});
+var manifestSchema = z.object({
+  schema_version: z.literal("0.1"),
+  name: slugSchema,
+  title: z.string().min(1).max(120),
+  description: z.string().min(1).max(500),
+  version: semverSchema,
+  entrypoint: z.string().default("SKILL.md"),
+  targets: z.array(skillTargetSchema).default(["codex"]),
+  tags: z.array(z.string().min(1).max(32)).max(10).optional(),
+  authors: z.array(authorSchema).optional(),
+  license: z.string().optional(),
+  homepage: z.string().url().optional(),
+  repository: z.string().url().optional(),
+  source_url: z.string().url().optional(),
+  declared_scripts: z.array(declaredScriptSchema).optional(),
+  min_floom_version: semverSchema.optional()
+}).strict();
+
+// ../shared/src/errors.ts
+var FloomError = class extends Error {
+  code;
+  details;
+  constructor(code, message, details) {
+    super(message);
+    this.name = "FloomError";
+    this.code = code;
+    this.details = details;
+  }
+};
+
+// ../shared/src/api-keys.ts
+var import_bcryptjs = __toESM(require_bcryptjs(), 1);
+import { randomBytes, scrypt as scryptCb, timingSafeEqual, createHash } from "node:crypto";
+import { promisify } from "node:util";
+var scrypt = promisify(scryptCb);
+
+// ../shared/src/install-targets.ts
+import { homedir } from "node:os";
+import { stat } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+var INSTALL_TARGETS = [
+  "claude",
+  "codex",
+  "cursor",
+  "gemini",
+  "opencode"
+];
+function assertInstallTarget(value) {
+  if (INSTALL_TARGETS.includes(value)) {
+    return value;
+  }
+  throw new Error(
+    `Unknown target "${value}". Use one of: ${INSTALL_TARGETS.join(", ")}.`
+  );
+}
+var COMPATIBLE_AGENTS = {
+  claude: ["Claude Code"],
+  codex: ["Codex CLI"],
+  cursor: ["Cursor"],
+  gemini: ["Gemini CLI"],
+  opencode: ["OpenCode"]
+};
+var TARGET_ENV_DIRS = {
+  claude: ["FLOOM_SKILLS_DIR", "CLAUDE_SKILLS_DIR"],
+  codex: ["FLOOM_SKILLS_DIR", "CODEX_SKILLS_DIR"],
+  cursor: ["FLOOM_SKILLS_DIR", "CURSOR_SKILLS_DIR"],
+  gemini: ["FLOOM_SKILLS_DIR", "GEMINI_SKILLS_DIR"],
+  opencode: ["FLOOM_SKILLS_DIR", "OPENCODE_SKILLS_DIR"]
+};
+var TARGET_PARENT_DIRS = {
+  claude: ".claude",
+  codex: ".codex",
+  cursor: ".cursor",
+  gemini: ".gemini",
+  opencode: ".opencode"
+};
+var SYSTEM_ROOTS = /* @__PURE__ */ new Set(["/", "/etc", "/usr", "/bin", "/sbin", "/var", "/sys", "/proc"]);
+function isInsideDir(path, parent) {
+  const rel = relative(parent, path);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+function validateEnvDirPath(envVar, rawValue, homeDir) {
+  const resolved = resolve(rawValue);
+  const resolvedHome = resolve(homeDir);
+  if (SYSTEM_ROOTS.has(resolved) || !isInsideDir(resolved, resolvedHome)) {
+    throw new Error(
+      `${envVar} points outside your home directory (${resolved}). Set it to a path under ${resolvedHome} or use --target without an env override.`
+    );
+  }
+  return resolved;
+}
+function envDirForTarget(target, homeDir) {
+  for (const key of TARGET_ENV_DIRS[target]) {
+    const value = process.env[key]?.trim();
+    if (value) return validateEnvDirPath(key, value, homeDir);
+  }
+  return null;
+}
+function presetDir(target, opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const root = opts.global ? opts.homeDir ?? homedir() : cwd;
+  switch (target) {
+    case "claude":
+      return join(root, ".claude", "skills");
+    case "gemini":
+      return join(root, ".gemini", "skills");
+    case "codex":
+      return join(root, ".codex", "skills");
+    case "cursor":
+      return join(root, ".cursor", "skills");
+    case "opencode":
+      return join(root, ".opencode", "skills");
+  }
+}
+function resolveInstallDir(args) {
+  const target = args.target ?? "codex";
+  const homeDir = args.homeDir ?? homedir();
+  if (args.to) {
+    return {
+      target,
+      dir: args.to,
+      origin: "explicit",
+      compatibleAgents: COMPATIBLE_AGENTS[target]
+    };
+  }
+  const targetEnvDir = envDirForTarget(target, homeDir);
+  if (targetEnvDir) {
+    return {
+      target,
+      dir: targetEnvDir,
+      origin: "env",
+      compatibleAgents: COMPATIBLE_AGENTS[target]
+    };
+  }
+  return {
+    target,
+    dir: presetDir(target, { global: args.global, cwd: args.cwd, homeDir }),
+    origin: "preset",
+    compatibleAgents: COMPATIBLE_AGENTS[target]
+  };
+}
+async function detectInstalledTargets(opts = {}) {
+  const homeDir = opts.homeDir ?? homedir();
+  const detected = [];
+  for (const target of INSTALL_TARGETS) {
+    const parentDir = join(homeDir, TARGET_PARENT_DIRS[target]);
+    try {
+      const parentStat = await stat(parentDir);
+      if (parentStat.isDirectory()) detected.push(target);
+    } catch {
+    }
+  }
+  return detected;
+}
+
+// ../shared/src/security-scan.ts
+import { readFile } from "node:fs/promises";
+
+// ../shared/src/skill-package.ts
+import { readFile as readFile2, readdir, stat as stat2, lstat, mkdir } from "node:fs/promises";
+import { join as join2, relative as relative2, sep as sep2, posix } from "node:path";
+import { createHash as createHash2 } from "node:crypto";
+var LIMITS = {
+  maxBundleBytes: 10 * 1024 * 1024,
+  // 10 MB compressed
+  maxUncompressedBytes: 50 * 1024 * 1024,
+  maxFiles: 100,
+  maxFileBytes: 2 * 1024 * 1024,
+  // 2 MB per file
+  maxPathLength: 200
+};
+var DEFAULT_IGNORE = [
+  ".git",
+  "node_modules",
+  "dist",
+  "build",
+  ".next",
+  ".cache",
+  ".DS_Store",
+  ".env",
+  ".env.local",
+  ".env.development",
+  ".env.production",
+  "*.pem",
+  "*.key",
+  "*.p12",
+  "*.sqlite",
+  "*.db"
+];
+function matchesGlob(name, pat) {
+  if (pat.includes("*")) {
+    const re = new RegExp("^" + pat.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*") + "$");
+    return re.test(name);
+  }
+  return name === pat;
+}
+function isIgnored(relPath, patterns) {
+  const parts = relPath.split(posix.sep);
+  for (const pat of patterns) {
+    const cleanPat = pat.replace(/^\/|\/$/g, "");
+    if (parts.some((p) => matchesGlob(p, cleanPat))) return true;
+  }
+  return false;
+}
+async function loadFloomIgnore(dir) {
+  try {
+    const raw = await readFile2(join2(dir, ".floomignore"), "utf8");
+    return raw.split(/\r?\n/).map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
+  } catch {
+    return [];
+  }
+}
+async function walk(rootDir, ignore, acc, current) {
+  const entries = await readdir(current, { withFileTypes: true });
+  for (const entry of entries) {
+    const abs = join2(current, entry.name);
+    const rel = relative2(rootDir, abs).split(sep2).join(posix.sep);
+    if (entry.isSymbolicLink()) {
+      throw new Error(`Symlinks are not allowed: ${rel}`);
+    }
+    if (isIgnored(rel, ignore)) continue;
+    if (entry.isDirectory()) {
+      await walk(rootDir, ignore, acc, abs);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    const ls = await lstat(abs);
+    if (ls.isSymbolicLink()) throw new Error(`Symlinks are not allowed: ${rel}`);
+    if (rel.length > LIMITS.maxPathLength) {
+      throw new Error(`Path too long (>${LIMITS.maxPathLength} chars): ${rel}`);
+    }
+    if (rel.includes("..")) {
+      throw new Error(`Path traversal detected: ${rel}`);
+    }
+    const buf = await readFile2(abs);
+    if (buf.length > LIMITS.maxFileBytes) {
+      throw new Error(`File too large (${buf.length} > ${LIMITS.maxFileBytes}): ${rel}`);
+    }
+    const sha256 = createHash2("sha256").update(buf).digest("hex");
+    acc.push({ relPath: rel, absPath: abs, size: buf.length, sha256 });
+  }
+}
+async function collectBundle(rootDir) {
+  const st = await stat2(rootDir);
+  if (!st.isDirectory()) throw new Error(`Not a directory: ${rootDir}`);
+  const ignore = [...DEFAULT_IGNORE, ...await loadFloomIgnore(rootDir)];
+  const files = [];
+  await walk(rootDir, ignore, files, rootDir);
+  files.sort((a, b) => a.relPath.localeCompare(b.relPath));
+  if (files.length === 0) throw new Error("No files to bundle (after applying ignores)");
+  if (files.length > LIMITS.maxFiles) {
+    throw new Error(`Too many files (${files.length} > ${LIMITS.maxFiles})`);
+  }
+  const total = files.reduce((n, f) => n + f.size, 0);
+  if (total > LIMITS.maxUncompressedBytes) {
+    throw new Error(`Bundle too large uncompressed (${total} > ${LIMITS.maxUncompressedBytes})`);
+  }
+  const hasScripts = files.some((f) => f.relPath.startsWith("scripts/"));
+  return { rootDir, files, totalUncompressedBytes: total, hasScripts };
+}
+
+// ../shared/src/contract/index.ts
+import { z as z2 } from "zod";
+var CONTRACT_ERROR_CODES = [
+  "UNAUTHENTICATED",
+  "FORBIDDEN",
+  "NOT_FOUND",
+  "VALIDATION_FAILED",
+  "CONFLICT",
+  "RATE_LIMITED",
+  "INTERNAL",
+  "WORKSPACE_REQUIRED",
+  "WORKSPACE_ALREADY_EXISTS",
+  "INVITE_EMAIL_MISMATCH",
+  "INVITE_EXPIRED",
+  "INVITE_REVOKED",
+  "INVITE_ALREADY_ACCEPTED",
+  "DEVICE_DENIED",
+  "DEVICE_EXPIRED",
+  "DEVICE_PENDING",
+  "UNSUPPORTED_TARGET",
+  "DIRTY_LOCAL_STATE",
+  "FILE_TOO_LARGE",
+  "BUNDLE_TOO_LARGE",
+  "UNSAFE_FILE_PATH",
+  "SKILL_MARKDOWN_REQUIRED"
+];
+var ContractErrorCodeSchema = z2.enum(CONTRACT_ERROR_CODES);
+var RequestIdSchema = z2.string().min(1);
+var IsoDateTimeSchema = z2.string().datetime({ offset: true });
+var IdSchema = z2.string().uuid();
+var SlugSchema = z2.string().min(1).max(80).regex(/^(?=.{1,80}$)[a-z0-9]+(?:-[a-z0-9]+)*$/);
+var EmailSchema = z2.string().email().max(320);
+var Sha256Schema = z2.string().regex(/^[a-f0-9]{64}$/);
+var VersionSeqSchema = z2.number().int().positive();
+var UrlSchema = z2.string().url();
+var ErrorDetailSchema = z2.object({
+  code: ContractErrorCodeSchema,
+  message: z2.string().min(1),
+  request_id: RequestIdSchema
+}).catchall(z2.unknown());
+var ErrorEnvelopeSchema = z2.object({
+  error: ErrorDetailSchema
+}).strict();
+var UserSchema = z2.object({
+  id: IdSchema,
+  email: EmailSchema,
+  name: z2.string().min(1),
+  avatar_url: UrlSchema.nullable()
+}).strict();
+var WorkspaceSchema = z2.object({
+  id: IdSchema,
+  slug: SlugSchema,
+  name: z2.string().min(1).max(120)
+}).strict();
+var MeResponseSchema = z2.object({
+  user: UserSchema,
+  workspace: WorkspaceSchema.nullable()
+}).strict();
+var WorkspaceCreateRequestSchema = z2.object({
+  name: z2.string().trim().min(1).max(120)
+}).strict();
+var WorkspaceCreateResponseSchema = z2.object({
+  workspace: WorkspaceSchema
+}).strict();
+var MemberSchema = z2.object({
+  name: z2.string().min(1),
+  email: EmailSchema,
+  joined_at: IsoDateTimeSchema
+}).strict();
+var MembersListResponseSchema = z2.object({
+  workspace: WorkspaceSchema,
+  members: z2.array(MemberSchema),
+  total: z2.number().int().nonnegative()
+}).strict();
+var InviteStatusSchema = z2.enum([
+  "pending",
+  "accepted",
+  "revoked",
+  "expired"
+]);
+var InviteCreateRequestSchema = z2.object({
+  email: EmailSchema
+}).strict();
+var InviteSchema = z2.object({
+  email: EmailSchema,
+  status: InviteStatusSchema,
+  expires_at: IsoDateTimeSchema,
+  created_at: IsoDateTimeSchema
+}).strict();
+var InviteCreateResponseSchema = z2.object({
+  invite: InviteSchema,
+  accept_url: UrlSchema
+}).strict();
+var InvitesListResponseSchema = z2.object({
+  invites: z2.array(InviteSchema),
+  total: z2.number().int().nonnegative()
+}).strict();
+var InviteAcceptResponseSchema = z2.object({
+  invite: InviteSchema.extend({
+    status: z2.literal("accepted"),
+    accepted_at: IsoDateTimeSchema
+  }),
+  workspace: WorkspaceSchema
+}).strict();
+var TargetSchema = z2.enum([
+  "claude",
+  "codex",
+  "cursor",
+  "gemini",
+  "opencode"
+]);
+var VersionRefSchema = z2.object({
+  version_seq: VersionSeqSchema,
+  display: z2.string().regex(/^v[1-9][0-9]*$/)
+}).strict().superRefine((value, context) => {
+  if (value.display !== `v${value.version_seq}`) {
+    context.addIssue({
+      code: z2.ZodIssueCode.custom,
+      message: "display must equal v${version_seq}",
+      path: ["display"]
+    });
+  }
+});
+var PersonNameSchema = z2.object({
+  name: z2.string().min(1)
+}).strict();
+var PersonNameEmailSchema = PersonNameSchema.extend({
+  email: EmailSchema
+}).strict();
+var FileMetadataSchema = z2.object({
+  path: z2.string().min(1).max(512),
+  size_bytes: z2.number().int().nonnegative(),
+  size: z2.number().int().nonnegative(),
+  sha256: Sha256Schema,
+  mime: z2.string().min(1)
+}).strict();
+var FileTreeEntrySchema = z2.object({
+  path: z2.string().min(1).max(512),
+  kind: z2.enum(["directory", "file"]),
+  parent_path: z2.string().max(512).nullable(),
+  depth: z2.number().int().nonnegative(),
+  size_bytes: z2.number().int().nonnegative().nullable()
+}).strict();
+var FileDownloadSchema = z2.object({
+  available: z2.boolean(),
+  url: UrlSchema.nullable(),
+  filename: z2.string().min(1).nullable(),
+  expires_at: IsoDateTimeSchema.nullable()
+}).strict();
+var FileCopySchema = z2.object({
+  available: z2.boolean(),
+  source: z2.enum(["content_text", "safe_extraction", "none"])
+}).strict();
+var FileActionSchema = z2.object({
+  copy: FileCopySchema,
+  download: FileDownloadSchema
+}).strict();
+var TextFileContentSchema = FileMetadataSchema.extend({
+  mode: z2.literal("text"),
+  content_text: z2.string(),
+  safe_extraction: z2.null(),
+  binary: z2.null(),
+  actions: FileActionSchema
+}).strict();
+var SafeExtractionSchema = z2.object({
+  status: z2.enum(["available", "truncated", "unsupported"]),
+  text_preview: z2.string().nullable(),
+  reason: z2.string().min(1).nullable()
+}).strict();
+var BinaryMetadataSchema = z2.object({
+  filename: z2.string().min(1),
+  size_bytes: z2.number().int().nonnegative(),
+  sha256: Sha256Schema,
+  mime: z2.string().min(1),
+  download_url: UrlSchema.nullable()
+}).strict();
+var NonTextFileContentSchema = FileMetadataSchema.extend({
+  mode: z2.literal("non_text"),
+  content_text: z2.null(),
+  safe_extraction: SafeExtractionSchema,
+  binary: BinaryMetadataSchema,
+  actions: FileActionSchema
+}).strict();
+var FileContentSchema = z2.discriminatedUnion("mode", [
+  TextFileContentSchema,
+  NonTextFileContentSchema
+]);
+var SkillsListItemSchema = z2.object({
+  slug: SlugSchema,
+  title: z2.string().min(1),
+  description: z2.string(),
+  icon: z2.string().min(1).nullable().optional(),
+  latest_version: VersionRefSchema,
+  updated_at: IsoDateTimeSchema,
+  updated_by: PersonNameSchema
+}).strict();
+var SkillsListResponseSchema = z2.object({
+  skills: z2.array(SkillsListItemSchema),
+  total: z2.number().int().nonnegative(),
+  order: z2.literal("updated_desc"),
+  search: z2.object({
+    mode: z2.literal("client_side_only"),
+    server_search: z2.literal(false),
+    query_param: z2.null()
+  }).strict(),
+  pagination: z2.null()
+}).strict();
+var VersionHistoryItemSchema = z2.object({
+  version_seq: VersionSeqSchema,
+  display: z2.string().regex(/^v[1-9][0-9]*$/),
+  created_at: IsoDateTimeSchema,
+  created_by: PersonNameSchema,
+  changelog: z2.string().nullable().optional()
+}).strict().superRefine((value, context) => {
+  if (value.display !== `v${value.version_seq}`) {
+    context.addIssue({
+      code: z2.ZodIssueCode.custom,
+      message: "display must equal v${version_seq}",
+      path: ["display"]
+    });
+  }
+});
+var SkillDetailResponseSchema = z2.object({
+  skill: z2.object({
+    slug: SlugSchema,
+    title: z2.string().min(1),
+    description: z2.string(),
+    owner: PersonNameEmailSchema,
+    created_at: IsoDateTimeSchema,
+    license: z2.string().nullable().optional(),
+    min_floom: z2.string().nullable().optional(),
+    latest: VersionRefSchema,
+    works_with: z2.array(TargetSchema),
+    files: z2.array(FileMetadataSchema),
+    versions: z2.array(VersionHistoryItemSchema)
+  }).strict()
+}).strict();
+var SkillVersionReadResponseSchema = z2.object({
+  skill: z2.object({
+    slug: SlugSchema,
+    title: z2.string().min(1),
+    description: z2.string()
+  }).strict(),
+  version: VersionHistoryItemSchema,
+  files: z2.array(FileMetadataSchema),
+  tree: z2.array(FileTreeEntrySchema),
+  selected_file: FileContentSchema.nullable(),
+  file_contents: z2.array(FileContentSchema)
+}).strict();
+var ShareCreateRequestSchema = z2.object({}).strict();
+var ShareCreateResponseSchema = z2.object({
+  url: UrlSchema,
+  token: z2.string().min(32)
+}).strict();
+var PublicShareGetResponseSchema = z2.object({
+  skill: z2.object({
+    title: z2.string().min(1),
+    description: z2.string(),
+    owner: PersonNameSchema,
+    version: VersionRefSchema
+  }).strict(),
+  files: z2.array(FileMetadataSchema),
+  tree: z2.array(FileTreeEntrySchema),
+  selected_file: FileContentSchema.nullable(),
+  file_contents: z2.array(FileContentSchema),
+  license: z2.string().nullable().optional()
+}).strict();
+var DeviceSessionStateSchema = z2.enum([
+  "pending",
+  "approved",
+  "denied",
+  "expired"
+]);
+var DeviceSessionResponseSchema = z2.object({
+  state: DeviceSessionStateSchema,
+  device: z2.object({
+    label: z2.string().min(1),
+    location: z2.string().min(1).nullable().optional(),
+    client: z2.string().min(1),
+    first_seen: IsoDateTimeSchema
+  }).strict()
+}).strict();
+var DeviceSessionActionResponseSchema = z2.object({
+  state: DeviceSessionStateSchema
+}).strict();
+var CliLibraryStateSchema = z2.enum([
+  "active",
+  "stale",
+  "missing",
+  "dirty",
+  "conflict",
+  "unsupported_target"
+]);
+var CliLibraryTargetQuerySchema = z2.object({
+  target: TargetSchema
+}).strict();
+var CliLibrarySkillSchema = z2.object({
+  slug: SlugSchema,
+  title: z2.string().min(1),
+  description: z2.string(),
+  version: VersionRefSchema,
+  hash: Sha256Schema,
+  state: CliLibraryStateSchema,
+  files: z2.array(FileContentSchema)
+}).strict();
+var CliLibraryResponseSchema = z2.object({
+  workspace: WorkspaceSchema,
+  target: TargetSchema,
+  generated_at: IsoDateTimeSchema,
+  manifest_schema_version: z2.literal(1),
+  hash_basis: z2.literal("workspace_slug:skill_slug:version_seq:file_sha256"),
+  full_hash: Sha256Schema,
+  states: z2.array(CliLibraryStateSchema),
+  skills: z2.array(CliLibrarySkillSchema)
+}).strict();
+var LocalManifestSkillSchema = z2.object({
+  slug: SlugSchema,
+  version_seq: VersionSeqSchema,
+  hash: Sha256Schema,
+  state: CliLibraryStateSchema,
+  installed_paths: z2.array(z2.string().min(1))
+}).strict();
+var LocalManifestSchema = z2.object({
+  manifest_schema_version: z2.literal(1),
+  target: TargetSchema,
+  workspace_slug: SlugSchema,
+  full_hash: Sha256Schema,
+  hash_basis: z2.literal("workspace_slug:skill_slug:version_seq:file_sha256"),
+  installed_at: IsoDateTimeSchema,
+  backup_path: z2.string().min(1).nullable(),
+  skills: z2.array(LocalManifestSkillSchema)
+}).strict();
+var ContractDecisionChecklistItemSchema = z2.object({
+  id: z2.string().min(1),
+  title: z2.string().min(1),
+  locked: z2.literal(true)
+}).strict();
+
+// src/lib/output.ts
+import chalk from "chalk";
+var log = {
+  info: (msg) => console.log(msg),
+  ok: (msg) => console.log(chalk.green("\u2713 ") + msg),
+  warn: (msg) => console.log(chalk.yellow("! ") + msg),
+  err: (msg) => console.error(chalk.red("\u2717 ") + msg),
+  step: (msg) => console.log(chalk.dim("\xB7 ") + msg),
+  heading: (msg) => console.log("\n" + chalk.bold(msg)),
+  kv: (key, value) => console.log(`  ${chalk.dim(key.padEnd(18))}${value}`),
+  blank: () => console.log("")
+};
+
+// src/config.ts
+import { homedir as homedir2 } from "node:os";
+import { join as join3 } from "node:path";
+import { mkdir as mkdir2, readFile as readFile3, writeFile, chmod } from "node:fs/promises";
+var CONFIG_DIR = join3(homedir2(), ".floom");
+var AUTH_FILE = join3(CONFIG_DIR, "auth.json");
+var DEFAULT_APP_URL = "https://floom.dev";
+var DEFAULT_API_URL = "https://floom.dev/api/v1";
+var TRUSTED_API_HOSTS = /* @__PURE__ */ new Set(["floom.dev", "try.floom.dev"]);
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1"]);
+function devModeEnabled() {
+  const v = process.env.FLOOM_DEV;
+  return v === "1" || v === "true";
+}
+function isTrustedApiUrl(apiUrl) {
+  if (!apiUrl) return false;
+  try {
+    const url = new URL(apiUrl);
+    if (TRUSTED_API_HOSTS.has(url.hostname)) {
+      return url.protocol === "https:";
+    }
+    if (LOOPBACK_HOSTS.has(url.hostname) && devModeEnabled()) {
+      return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+function trustedApiUrlOrDefault(apiUrl) {
+  if (!apiUrl) return DEFAULT_API_URL;
+  const trimmed = apiUrl.replace(/\/$/, "");
+  if (!isTrustedApiUrl(trimmed)) return DEFAULT_API_URL;
+  try {
+    if (TRUSTED_API_HOSTS.has(new URL(trimmed).hostname)) return DEFAULT_API_URL;
+  } catch {
+    return DEFAULT_API_URL;
+  }
+  return trimmed;
+}
+async function ensureDir() {
+  await mkdir2(CONFIG_DIR, { recursive: true, mode: 448 });
+}
+async function readAuth() {
+  const parsed = await readRawAuth();
+  return parsed ? { ...parsed, apiUrl: normalizeApiUrl(parsed.apiUrl) } : null;
+}
+async function readRawAuth() {
+  let raw;
+  try {
+    raw = await readFile3(AUTH_FILE, "utf8");
+  } catch (e) {
+    const code = e.code;
+    if (code === "ENOENT") return null;
+    if (code === "EACCES" || code === "EPERM") {
+      throw new Error("Cannot read your Floom auth file (permission denied). Fix its permissions or run: floom login");
+    }
+    throw new Error("Cannot read your Floom auth file. Run: floom login");
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error("Your Floom auth file is unreadable. Run: floom login");
+  }
+}
+async function writeAuth(state) {
+  await ensureDir();
+  await writeFile(AUTH_FILE, JSON.stringify({ ...state, apiUrl: normalizeApiUrl(state.apiUrl) }, null, 2), { mode: 384 });
+  try {
+    await chmod(AUTH_FILE, 384);
+  } catch {
+  }
+}
+async function clearAuth() {
+  const { unlink } = await import("node:fs/promises");
+  try {
+    await unlink(AUTH_FILE);
+  } catch {
+  }
+}
+function getApiUrl() {
+  if (process.env.FLOOM_API_URL) {
+    return trustedApiUrlOrDefault(process.env.FLOOM_API_URL);
+  }
+  if (process.env.FLOOM_APP_URL) {
+    return trustedApiUrlOrDefault(`${getAppUrl().replace(/\/$/, "")}/api/v1`);
+  }
+  return DEFAULT_API_URL;
+}
+function getAppUrl() {
+  return process.env.FLOOM_APP_URL ?? DEFAULT_APP_URL;
+}
+function getApiBaseUrls(preferred) {
+  const explicitApiUrl = process.env.FLOOM_API_URL?.trim();
+  if (explicitApiUrl) return [trustedApiUrlOrDefault(explicitApiUrl)];
+  return [normalizeApiUrl(preferred ?? getApiUrl())];
+}
+function normalizeApiUrl(apiUrl) {
+  return trustedApiUrlOrDefault(apiUrl);
+}
+
+// src/lib/machine.ts
+import { hostname, platform, type, release } from "node:os";
+import { join as join4 } from "node:path";
+import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+var CONFIG_DIR2 = join4(homedir3(), ".floom");
+var MACHINE_FILE = join4(CONFIG_DIR2, "machine.json");
+async function tryCommand(cmd, args) {
+  return new Promise((resolve3) => {
+    let child;
+    try {
+      child = spawn(cmd, args, { stdio: ["ignore", "pipe", "ignore"] });
+    } catch {
+      resolve3(null);
+      return;
+    }
+    let out = "";
+    child.stdout?.on("data", (d) => {
+      out += d.toString();
+    });
+    child.on("close", (code) => resolve3(code === 0 ? out.trim() : null));
+    child.on("error", () => resolve3(null));
+    const timer = setTimeout(() => {
+      try {
+        child.kill();
+      } catch {
+      }
+      resolve3(null);
+    }, 800);
+    child.on("close", () => clearTimeout(timer));
+  });
+}
+async function nativeDeviceName() {
+  const p = platform();
+  if (p === "darwin") {
+    return tryCommand("scutil", ["--get", "ComputerName"]);
+  }
+  if (p === "win32") {
+    return process.env.COMPUTERNAME ?? null;
+  }
+  return null;
+}
+async function defaultLabel() {
+  const native = await nativeDeviceName();
+  const host = (hostname() || "").trim();
+  const base = native || host || `${type()}`.slice(0, 40);
+  const p = platform();
+  const os = p === "darwin" ? "macOS" : p === "linux" ? "Linux" : p === "win32" ? "Windows" : type();
+  const label = base.toLowerCase().includes(os.toLowerCase()) ? base : `${base} \xB7 ${os}`;
+  return label.slice(0, 80);
+}
+function defaultLabelSync() {
+  const host = (hostname() || "").trim();
+  if (host) return host.slice(0, 80);
+  return `${type()} ${release()}`.slice(0, 80);
+}
+async function getMachineIdentity() {
+  try {
+    const raw = await readFile4(MACHINE_FILE, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed?.id === "string" && /^[0-9a-f-]{36}$/i.test(parsed.id)) {
+      const label2 = parsed.label || await defaultLabel();
+      return { id: parsed.id, label: label2.slice(0, 80) };
+    }
+  } catch {
+  }
+  const label = await defaultLabel().catch(() => defaultLabelSync());
+  const identity = { id: randomUUID(), label };
+  try {
+    await mkdir3(CONFIG_DIR2, { recursive: true, mode: 448 });
+    await writeFile2(
+      MACHINE_FILE,
+      JSON.stringify({ id: identity.id, label: identity.label, created_at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2),
+      { mode: 384 }
+    );
+  } catch {
+  }
+  return identity;
+}
+
+// src/version.ts
+var VERSION = "0.2.21";
+
+// src/api-client.ts
+var DEFAULT_TIMEOUT_MS = 2e4;
+var MAX_ERROR_BODY_BYTES = 64 * 1024;
+function timeoutMs() {
+  const raw = Number(process.env.FLOOM_API_TIMEOUT_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_TIMEOUT_MS;
+}
+async function fetchWithTimeout(url, init = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs());
+  try {
+    return await fetch(url, { ...init, redirect: "manual", signal: controller.signal });
+  } catch (e) {
+    if (e.name === "AbortError") {
+      throw new Error(`Request timed out after ${timeoutMs()}ms`);
+    }
+    throw e;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function readLimitedText(res, limitBytes = MAX_ERROR_BODY_BYTES) {
+  if (!res.body) return res.text();
+  const reader = res.body.getReader();
+  const chunks = [];
+  let total = 0;
+  let truncated = false;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    const chunk = value ?? new Uint8Array();
+    if (total + chunk.byteLength > limitBytes) {
+      const remaining = Math.max(limitBytes - total, 0);
+      if (remaining > 0) chunks.push(chunk.slice(0, remaining));
+      truncated = true;
+      await reader.cancel();
+      break;
+    }
+    chunks.push(chunk);
+    total += chunk.byteLength;
+  }
+  const text = new TextDecoder().decode(Buffer.concat(chunks));
+  return truncated ? `${text}
+[truncated]` : text;
+}
+async function api(path, opts = {}) {
+  const auth = await readAuth();
+  const token = process.env.FLOOM_API_TOKEN?.trim() || auth?.token;
+  if (opts.authRequired && !token) {
+    throw new FloomError("AUTH_REQUIRED", "Not logged in. Run: floom login");
+  }
+  let lastError = null;
+  const bases = getApiBaseUrls(auth?.apiUrl);
+  for (const base of bases) {
+    const url = new URL(base + path);
+    if (opts.query) {
+      for (const [k, v] of Object.entries(opts.query)) {
+        if (v !== void 0) url.searchParams.set(k, String(v));
+      }
+    }
+    const headers = {
+      "Content-Type": "application/json",
+      "User-Agent": `floom-cli/${VERSION}`,
+      "x-floom-cli-version": VERSION
+    };
+    if (token && opts.authRequired) headers.Authorization = `Bearer ${token}`;
+    try {
+      const mach = await getMachineIdentity();
+      headers["x-floom-machine-id"] = mach.id;
+      headers["x-floom-machine-label"] = encodeURIComponent(mach.label);
+    } catch {
+    }
+    let res;
+    try {
+      res = await fetchWithTimeout(url.toString(), {
+        method: opts.method ?? "GET",
+        headers,
+        body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0
+      });
+    } catch (e) {
+      lastError = new FloomError(
+        "INTERNAL_ERROR",
+        `Unable to reach Floom API at ${base}: ${e.message}`,
+        { apiUrl: base }
+      );
+      continue;
+    }
+    if (res.type === "opaqueredirect" || res.status >= 300 && res.status < 400) {
+      throw new FloomError(
+        "INTERNAL_ERROR",
+        "Refusing to follow an HTTP redirect from the Floom API.",
+        { apiUrl: base }
+      );
+    }
+    const text = res.ok ? await res.text() : await readLimitedText(res);
+    let json = null;
+    try {
+      json = text ? JSON.parse(text) : null;
+    } catch {
+    }
+    const envelopeError = json?.error;
+    if (envelopeError && typeof envelopeError === "object" && envelopeError.code) {
+      throw new FloomError(
+        envelopeError.code,
+        typeof envelopeError.message === "string" ? envelopeError.message : String(envelopeError.code),
+        { status: res.status, requestId: envelopeError.request_id, apiUrl: base }
+      );
+    }
+    if (res.ok) return json;
+    const err = envelopeError ?? {};
+    lastError = new FloomError(
+      err.code ?? "INTERNAL_ERROR",
+      err.message ?? `HTTP ${res.status} ${res.statusText}`,
+      { status: res.status, requestId: err.request_id, apiUrl: base }
+    );
+    if (res.status !== 404 || json?.error) break;
+  }
+  throw lastError ?? new FloomError("INTERNAL_ERROR", "API request failed");
+}
+
+// src/commands/login.ts
+function sleep(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+async function loginCommand() {
+  const session = await api("/cli/device/start", {
+    method: "POST",
+    body: {
+      label: process.env.FLOOM_DEVICE_LABEL ?? "CLI device",
+      client: `floom-cli/${VERSION}`
+    }
+  });
+  log.heading("CLI login");
+  log.info(`Open: ${session.verification_uri}`);
+  log.info(`Code: ${session.user_code}`);
+  log.info("Waiting for browser approval. Press Ctrl+C to cancel.");
+  const deadline = new Date(session.expires_at).getTime();
+  const interval = Math.max(2, session.poll_interval_seconds) * 1e3;
+  while (Date.now() < deadline) {
+    try {
+      const token = await api("/cli/device/token", {
+        method: "POST",
+        body: { device_code: session.device_code }
+      });
+      if (typeof token.token !== "string" || token.token.trim() === "") {
+        process.stdout.write(".");
+      } else {
+        await writeAuth({
+          token: token.token,
+          handle: token.workspace?.slug ?? "workspace",
+          email: token.user?.email ?? "unknown@example.com",
+          apiUrl: getApiUrl()
+        });
+        log.ok(`Logged in to ${token.workspace?.name ?? "Floom"}.`);
+        return;
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (error instanceof FloomError && String(error.code) === "DEVICE_PENDING" || message.toLowerCase().includes("pending")) {
+        process.stdout.write(".");
+      } else {
+        throw error;
+      }
+    }
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) break;
+    await sleep(Math.min(interval, remaining));
+  }
+  throw new Error("Login timed out.");
+}
+
+// src/commands/mcp.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/commands/sync.ts
+import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
+import { cp, lstat as lstat2, mkdir as mkdir4, readdir as readdir2, readFile as readFile5, rename, rm, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname, join as join5, sep as sep3 } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { ZodError } from "zod";
+
+// src/lib/signals.ts
+import { rmSync } from "node:fs";
+function installCancellationHandler() {
+  const cleanupDirs = /* @__PURE__ */ new Set();
+  const handlers = /* @__PURE__ */ new Map();
+  const cleanupAndExit = (signal) => {
+    log.warn("Cancelling\u2026");
+    for (const dir of cleanupDirs) {
+      try {
+        rmSync(dir, { recursive: true, force: true });
+      } catch (error) {
+        log.warn(`Failed to remove temp dir ${dir}: ${error.message}`);
+      }
+    }
+    process.exit(signal === "SIGINT" ? 130 : 143);
+  };
+  for (const signal of ["SIGINT", "SIGTERM"]) {
+    const handler = () => cleanupAndExit(signal);
+    handlers.set(signal, handler);
+    process.once(signal, handler);
+  }
+  return {
+    trackDir(path) {
+      cleanupDirs.add(path);
+    },
+    dispose() {
+      for (const [signal, handler] of handlers) {
+        process.off(signal, handler);
+      }
+      cleanupDirs.clear();
+    }
+  };
+}
+
+// src/commands/sync.ts
+var BACKUP_RETENTION_LIMIT = 10;
+var MAX_DECODED_FILE_BYTES = 2 * 1024 * 1024;
+var SAFE_SLUG_RE = /^(?=.{1,80}$)[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function nowStamp() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+}
+function backupStamp() {
+  return `${nowStamp()}-${randomUUID2().slice(0, 8)}`;
+}
+function hashBytes(bytes) {
+  return createHash3("sha256").update(bytes).digest("hex");
+}
+function manifestPath(root) {
+  return join5(root, ".floom", "manifest.json");
+}
+async function readManifest(root) {
+  try {
+    const raw = await readFile5(manifestPath(root), "utf8");
+    return LocalManifestSchema.parse(JSON.parse(raw));
+  } catch (error) {
+    const err = error;
+    if (err.code === "ENOENT") return null;
+    if (error instanceof SyntaxError || error instanceof ZodError) {
+      throw new Error(
+        `Corrupted manifest at ${manifestPath(root)}. Remove that file or run floom pull after backing up local edits.`
+      );
+    }
+    throw error;
+  }
+}
+function decodedBase64ByteLength(encoded) {
+  const compact = encoded.replace(/\s/g, "");
+  const padding = compact.endsWith("==") ? 2 : compact.endsWith("=") ? 1 : 0;
+  return Math.floor(compact.length * 3 / 4) - padding;
+}
+function bytesForFile(file) {
+  if (file.mode === "text") {
+    if (Buffer.byteLength(file.content_text, "utf8") > MAX_DECODED_FILE_BYTES) {
+      throw new Error(`Remote file ${file.path} exceeds the 2 MiB decoded file limit.`);
+    }
+    const bytes2 = Buffer.from(file.content_text, "utf8");
+    const actualHash2 = hashBytes(bytes2);
+    if (actualHash2 !== file.sha256) {
+      throw new Error(`INTEGRITY_FAIL: sha256 mismatch on ${file.path}: expected ${file.sha256}, got ${actualHash2}`);
+    }
+    return bytes2;
+  }
+  const url = file.binary.download_url;
+  if (!url?.startsWith("data:")) return Buffer.alloc(0);
+  const [, encoded] = url.split(",", 2);
+  const base64 = encoded ?? "";
+  if (decodedBase64ByteLength(base64) > MAX_DECODED_FILE_BYTES) {
+    throw new Error(`Remote file ${file.path} exceeds the 2 MiB decoded file limit.`);
+  }
+  const bytes = Buffer.from(base64, "base64");
+  if (bytes.byteLength > MAX_DECODED_FILE_BYTES) {
+    throw new Error(`Remote file ${file.path} exceeds the 2 MiB decoded file limit.`);
+  }
+  const actualHash = hashBytes(bytes);
+  if (actualHash !== file.sha256) {
+    throw new Error(`INTEGRITY_FAIL: sha256 mismatch on ${file.path}: expected ${file.sha256}, got ${actualHash}`);
+  }
+  return bytes;
+}
+function safeSkillSlug(slug) {
+  if (!slug) throw new Error("Remote skill slug is empty.");
+  if (slug.length > 80) throw new Error(`Remote skill slug "${slug.slice(0, 80)}\u2026" exceeds 80 characters.`);
+  if (!SAFE_SLUG_RE.test(slug)) throw new Error(`Unsafe remote skill slug: ${slug}`);
+  return slug;
+}
+function safeRemotePath(path) {
+  const normalized = path.replace(/\\/g, "/");
+  if (!normalized || /[\x00-\x1f\x7f]/.test(normalized) || normalized.startsWith("/") || normalized.split("/").some((part) => part === "" || part === "." || part === "..")) {
+    throw new Error(`Unsafe remote file path: ${path}`);
+  }
+  return normalized;
+}
+async function fileExists(path) {
+  try {
+    await stat3(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function liveSkillHash(root, workspaceSlug, skill) {
+  const slug = safeSkillSlug(skill.slug);
+  const fileHashes = [];
+  for (const file of skill.files) {
+    const path = join5(root, slug, ...safeRemotePath(file.path).split("/"));
+    if (!await fileExists(path)) return null;
+    const bytes = await readFile5(path);
+    fileHashes.push(hashBytes(bytes));
+  }
+  return hashBytes([
+    workspaceSlug,
+    slug,
+    String(skill.version.version_seq),
+    ...fileHashes.sort()
+  ].join(":"));
+}
+async function liveManifestSkillHash(root, workspaceSlug, skill) {
+  const fileHashes = [];
+  for (const installedPath of skill.installed_paths) {
+    const path = join5(root, installedPath);
+    if (!await fileExists(path)) return null;
+    const bytes = await readFile5(path);
+    fileHashes.push(hashBytes(bytes));
+  }
+  return hashBytes([
+    workspaceSlug,
+    skill.slug,
+    String(skill.version_seq),
+    ...fileHashes.sort()
+  ].join(":"));
+}
+function computeSyncState(input) {
+  if (input.unsupportedTarget) return "unsupported_target";
+  if (input.deletedRemote) return "stale";
+  if (!input.previousHash || !input.remoteHash || input.liveHash === null) return "missing";
+  const dirty = input.liveHash !== input.previousHash;
+  const stale = input.previousHash !== input.remoteHash;
+  if (dirty && stale) return "conflict";
+  if (dirty) return "dirty";
+  if (stale) return "stale";
+  return "active";
+}
+async function writeSkillAtomically(root, skill) {
+  const slug = safeSkillSlug(skill.slug);
+  const tempDir = join5(root, ".floom", "tmp", `${slug}-${nowStamp()}`);
+  const finalDir = join5(root, slug);
+  const replacedDir = join5(root, ".floom", "tmp", `${slug}-previous-${backupStamp()}`);
+  await rm(tempDir, { recursive: true, force: true });
+  await rm(replacedDir, { recursive: true, force: true });
+  await mkdir4(tempDir, { recursive: true });
+  const installed = [];
+  for (const file of skill.files) {
+    const safePath = safeRemotePath(file.path);
+    const dest = join5(tempDir, ...safePath.split("/"));
+    await mkdir4(dirname(dest), { recursive: true });
+    await writeFile3(dest, bytesForFile(file));
+    installed.push([slug, ...safePath.split("/")].join(sep3));
+  }
+  let movedExisting = false;
+  try {
+    await mkdir4(dirname(finalDir), { recursive: true });
+    if (await fileExists(finalDir)) {
+      try {
+        await rename(finalDir, replacedDir);
+      } catch (error) {
+        throw new Error(`Failed to prepare install for ${slug}; existing install remains at ${finalDir}: ${error.message}`);
+      }
+      movedExisting = true;
+    }
+    try {
+      await rename(tempDir, finalDir);
+    } catch (error) {
+      if (movedExisting) {
+        try {
+          await rename(replacedDir, finalDir);
+        } catch (restoreError) {
+          throw new Error(
+            `Failed to install ${slug} and could not restore the previous install from ${replacedDir} to ${finalDir}: ${restoreError.message}. Original error: ${error.message}`
+          );
+        }
+      }
+      throw new Error(`Failed to install ${slug}; previous install ${movedExisting ? "was restored" : "remains"} at ${finalDir}: ${error.message}`);
+    }
+    if (movedExisting) await rm(replacedDir, { recursive: true, force: true });
+  } catch (error) {
+    throw error;
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+    if (!movedExisting) await rm(replacedDir, { recursive: true, force: true });
+  }
+  return installed.sort();
+}
+async function backupSkill(root, backupRoot, slug) {
+  slug = safeSkillSlug(slug);
+  const from = join5(root, slug);
+  if (!await fileExists(from)) return false;
+  const to = join5(backupRoot, slug);
+  await rm(to, { recursive: true, force: true });
+  await mkdir4(dirname(to), { recursive: true });
+  await cp(from, to, { recursive: true });
+  return true;
+}
+async function pruneBackups(root, keep = BACKUP_RETENTION_LIMIT) {
+  const backupsDir = join5(root, ".floom", "backups");
+  let entries;
+  try {
+    entries = await readdir2(backupsDir);
+  } catch {
+    return;
+  }
+  const sorted = entries.sort().reverse();
+  for (const stale of sorted.slice(keep)) {
+    if (stale === "." || stale === ".." || stale.includes("/") || stale.includes("\\") || /[\x00-\x1f\x7f]/.test(stale)) {
+      log.warn(`Skipping malformed backup entry: ${stale}`);
+      continue;
+    }
+    const candidate = join5(backupsDir, stale);
+    try {
+      const info = await lstat2(candidate);
+      if (info.isSymbolicLink()) {
+        log.warn(`Skipping symlink in backups dir: ${stale}`);
+        continue;
+      }
+    } catch {
+      continue;
+    }
+    await rm(candidate, { recursive: true, force: true });
+  }
+}
+async function fetchLibrary(target, operation) {
+  const response = await api("/cli/library", {
+    authRequired: true,
+    query: { target, operation }
+  });
+  return CliLibraryResponseSchema.parse(response);
+}
+async function confirmPullAll(count) {
+  if (!process.stdin.isTTY) return true;
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await rl.question(`Pull the whole library into all ${count}? [Y/n] `)).trim().toLowerCase();
+    return answer === "" || answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}
+function printDetectedTargets(targets) {
+  log.info("Detected agents on this machine:");
+  for (const target of targets) log.info(`- ${target}`);
+}
+function printNoDetectedTargets() {
+  log.warn(`No installed agents detected. Checked: ${INSTALL_TARGETS.join(", ")}.`);
+  log.info(`Use --target <${INSTALL_TARGETS.join("|")}> to choose one target explicitly.`);
+}
+async function statusCommand(options) {
+  if (!options.target) {
+    const targets = await detectInstalledTargets();
+    if (targets.length === 0) {
+      printNoDetectedTargets();
+      process.exitCode = 1;
+      return;
+    }
+    printDetectedTargets(targets);
+    const results = [];
+    for (const target2 of targets) {
+      try {
+        results.push({ target: target2, ok: true, status: await statusLibrary(target2) });
+      } catch (error) {
+        results.push({ target: target2, ok: false, error });
+      }
+    }
+    for (const result of results) {
+      if (!result.ok) {
+        log.err(`${result.target}  ${result.error.message}`);
+        continue;
+      }
+      log.heading(`${result.status.workspaceName} (${result.target})`);
+      for (const line of result.status.skills) log.info(`${line.slug}  ${line.state}  ${line.version}`);
+    }
+    if (results.some((result) => !result.ok)) process.exitCode = 1;
+    return;
+  }
+  const target = assertInstallTarget(options.target);
+  const status = await statusLibrary(target);
+  log.heading(`${status.workspaceName} (${target})`);
+  for (const line of status.skills) log.info(`${line.slug}  ${line.state}  ${line.version}`);
+}
+async function statusLibrary(target, deps = {}) {
+  const resolved = resolveInstallDir({ target, global: true });
+  const remote = await (deps.fetchLibrary ?? fetchLibrary)(target, "status");
+  const manifest = await readManifest(resolved.dir);
+  if (!manifest) {
+    return {
+      workspaceName: remote.workspace.name,
+      skills: remote.skills.map((skill) => ({ slug: skill.slug, state: "missing", version: skill.version.display }))
+    };
+  }
+  const manifestMatchesTarget = manifest.target === target && manifest.workspace_slug === remote.workspace.slug;
+  const remoteBySlug = new Map(remote.skills.map((skill) => [skill.slug, skill]));
+  const skills = [];
+  for (const skill of remote.skills) {
+    const previous = manifestMatchesTarget ? manifest.skills.find((entry) => entry.slug === skill.slug) : null;
+    const liveHash = await liveSkillHash(resolved.dir, remote.workspace.slug, skill);
+    const state = computeSyncState({
+      previousHash: previous?.hash ?? null,
+      remoteHash: skill.hash,
+      liveHash
+    });
+    skills.push({ slug: skill.slug, state, version: skill.version.display });
+  }
+  for (const previous of manifest.skills) {
+    if (manifestMatchesTarget && remoteBySlug.has(previous.slug)) continue;
+    skills.push({
+      slug: previous.slug,
+      state: computeSyncState({
+        previousHash: previous.hash,
+        remoteHash: null,
+        liveHash: await liveManifestSkillHash(resolved.dir, manifest.workspace_slug, previous),
+        unsupportedTarget: !manifestMatchesTarget,
+        deletedRemote: manifestMatchesTarget
+      }),
+      version: `v${previous.version_seq}`
+    });
+  }
+  return { workspaceName: remote.workspace.name, skills };
+}
+async function pullCommand(options) {
+  const cleanup = installCancellationHandler();
+  try {
+    if (!options.target) {
+      const targets = await detectInstalledTargets();
+      if (targets.length === 0) {
+        printNoDetectedTargets();
+        process.exitCode = 1;
+        return;
+      }
+      printDetectedTargets(targets);
+      if (!await confirmPullAll(targets.length)) {
+        log.info("Cancelled.");
+        return;
+      }
+      for (const target2 of targets) {
+        const resolved2 = resolveInstallDir({ target: target2, global: true });
+        cleanup.trackDir(join5(resolved2.dir, ".floom", "tmp"));
+      }
+      const results = [];
+      for (const target2 of targets) {
+        try {
+          const result2 = await pullLibrary(target2);
+          results.push({ target: target2, ok: true, ...result2 });
+        } catch (error) {
+          results.push({ target: target2, ok: false, error });
+        }
+      }
+      log.heading("Pull summary:");
+      for (const result2 of results) {
+        if (result2.ok) log.ok(`${result2.target}  ${result2.skillCount} skills  ${result2.dir}`);
+        else log.err(`${result2.target}  ${result2.error.message}`);
+      }
+      if (results.some((result2) => !result2.ok)) process.exitCode = 1;
+      return;
+    }
+    const target = assertInstallTarget(options.target);
+    const resolved = resolveInstallDir({ target, global: true });
+    cleanup.trackDir(join5(resolved.dir, ".floom", "tmp"));
+    const result = await pullLibrary(target);
+    log.ok(`Pulled ${result.skillCount} skills into ${target} (${result.dir}).`);
+    log.info(`This syncs ${target} only. For another agent: floom pull --target <claude|codex|cursor|gemini|opencode>`);
+  } finally {
+    cleanup.dispose();
+  }
+}
+async function pullLibrary(target, deps = {}) {
+  const resolved = resolveInstallDir({ target, global: true });
+  const remote = await (deps.fetchLibrary ?? fetchLibrary)(target, "pull");
+  for (const skill of remote.skills) safeSkillSlug(skill.slug);
+  const manifest = await readManifest(resolved.dir);
+  const backupRoot = join5(resolved.dir, ".floom", "backups", backupStamp());
+  let wroteBackup = false;
+  const installedSkills = [];
+  await mkdir4(resolved.dir, { recursive: true });
+  const manifestMatchesTarget = Boolean(manifest && manifest.target === target && manifest.workspace_slug === remote.workspace.slug);
+  if (manifestMatchesTarget && manifest?.full_hash === remote.full_hash) {
+    let dirty = false;
+    for (const previous of manifest.skills) {
+      const liveHash = await liveManifestSkillHash(resolved.dir, remote.workspace.slug, previous);
+      if (liveHash !== previous.hash) {
+        dirty = true;
+        break;
+      }
+    }
+    if (!dirty) {
+      return { skillCount: remote.skills.length, dir: resolved.dir };
+    }
+  }
+  const remoteBySlug = new Map(remote.skills.map((skill) => [skill.slug, skill]));
+  if (manifest) {
+    for (const previous of manifest.skills) {
+      if (manifestMatchesTarget && remoteBySlug.has(previous.slug)) continue;
+      wroteBackup = await backupSkill(resolved.dir, backupRoot, previous.slug) || wroteBackup;
+      await rm(join5(resolved.dir, previous.slug), { recursive: true, force: true });
+    }
+  }
+  for (const skill of remote.skills) {
+    const previous = manifestMatchesTarget ? manifest?.skills.find((entry) => entry.slug === skill.slug) ?? null : null;
+    const liveHash = await liveSkillHash(resolved.dir, remote.workspace.slug, skill);
+    const state = computeSyncState({
+      previousHash: previous?.hash ?? null,
+      remoteHash: skill.hash,
+      liveHash
+    });
+    if (state === "active" && previous) {
+      installedSkills.push({
+        slug: skill.slug,
+        version_seq: skill.version.version_seq,
+        hash: skill.hash,
+        state: "active",
+        installed_paths: previous.installed_paths
+      });
+      continue;
+    }
+    if (state === "dirty" || state === "conflict") {
+      wroteBackup = await backupSkill(resolved.dir, backupRoot, skill.slug) || wroteBackup;
+    }
+    if (state === "missing" && await fileExists(join5(resolved.dir, skill.slug))) {
+      wroteBackup = await backupSkill(resolved.dir, backupRoot, skill.slug) || wroteBackup;
+    }
+    const installedPaths = await writeSkillAtomically(resolved.dir, skill);
+    installedSkills.push({
+      slug: skill.slug,
+      version_seq: skill.version.version_seq,
+      hash: skill.hash,
+      state: "active",
+      installed_paths: installedPaths
+    });
+  }
+  const nextManifest = LocalManifestSchema.parse({
+    manifest_schema_version: 1,
+    target,
+    workspace_slug: remote.workspace.slug,
+    full_hash: remote.full_hash,
+    hash_basis: remote.hash_basis,
+    installed_at: (/* @__PURE__ */ new Date()).toISOString(),
+    backup_path: wroteBackup ? backupRoot : null,
+    skills: installedSkills
+  });
+  await mkdir4(dirname(manifestPath(resolved.dir)), { recursive: true });
+  await writeFile3(manifestPath(resolved.dir), JSON.stringify(nextManifest, null, 2));
+  if (wroteBackup) await pruneBackups(resolved.dir);
+  return { skillCount: remote.skills.length, dir: resolved.dir };
+}
+
+// src/commands/mcp.ts
+var targetSchema = TargetSchema;
+var SESSION_START_ADVISORY = "On session start, pull the workspace library when skills are missing or stale.";
+function jsonResult(value) {
+  return {
+    content: [
+      {
+        type: "text",
+        text: JSON.stringify(value)
+      }
+    ]
+  };
+}
+function createMcpServer(deps = {}) {
+  const pullLibrary2 = deps.pullLibrary ?? pullLibrary;
+  const statusLibrary2 = deps.statusLibrary ?? statusLibrary;
+  const server = new McpServer(
+    { name: "floom", version: VERSION },
+    { instructions: SESSION_START_ADVISORY }
+  );
+  server.registerTool(
+    "workspace_status",
+    {
+      title: "Workspace Status",
+      description: "Read the authenticated CLI session workspace sync status for one install target.",
+      inputSchema: { target: targetSchema.default("codex") },
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: true
+      }
+    },
+    async ({ target }) => {
+      const status = await statusLibrary2(target);
+      return jsonResult({
+        tool: "workspace_status",
+        target,
+        status: "ok",
+        workspace: status.workspaceName,
+        skills: status.skills,
+        advisory: SESSION_START_ADVISORY
+      });
+    }
+  );
+  server.registerTool(
+    "pull_workspace_library",
+    {
+      title: "Pull Workspace Library",
+      description: "Use the authenticated CLI session to pull the whole workspace library into one target skill directory.",
+      inputSchema: { target: targetSchema.default("codex") },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: true
+      }
+    },
+    async ({ target }) => {
+      const result = await pullLibrary2(target);
+      return jsonResult({
+        tool: "pull_workspace_library",
+        target,
+        status: "ok",
+        skill_count: result.skillCount,
+        install_dir: result.dir
+      });
+    }
+  );
+  return server;
+}
+async function mcpCommand() {
+  const server = createMcpServer();
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+
+// src/commands/push.ts
+import { basename, join as join6, resolve as resolve2 } from "node:path";
+import { readdir as readdir3, readFile as readFile6, stat as stat4 } from "node:fs/promises";
+function parseConcurrency(value) {
+  const raw = value ?? 6;
+  const parsed = typeof raw === "number" ? raw : Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed < 1 || parsed > 16) {
+    throw new Error("--concurrency must be an integer from 1 to 16.");
+  }
+  return parsed;
+}
+async function hasSkillMarkdown(dir) {
+  try {
+    const skillMd = await stat4(join6(dir, "SKILL.md"));
+    return skillMd.isFile();
+  } catch {
+    return false;
+  }
+}
+async function findImmediateSkillDirs(root) {
+  const entries = await readdir3(root, { withFileTypes: true });
+  const dirs = entries.filter((entry) => entry.isDirectory()).map((entry) => join6(root, entry.name)).sort();
+  const checks = await Promise.all(dirs.map(async (dir) => await hasSkillMarkdown(dir) ? dir : null));
+  return checks.filter((dir) => Boolean(dir));
+}
+async function pushOneSkill(root, pushApi) {
+  const dirStat = await stat4(root).catch(() => null);
+  if (!dirStat || !dirStat.isDirectory()) {
+    throw new Error(`Directory not found: ${root}`);
+  }
+  const bundle = await collectBundle(root);
+  const skillMd = bundle.files.find((file) => file.relPath === "SKILL.md");
+  if (!skillMd) throw new Error("SKILL.md is required.");
+  const files = await Promise.all(bundle.files.map(async (file) => ({
+    path: file.relPath,
+    content_base64: (await readFile6(file.absPath)).toString("base64")
+  })));
+  return pushApi("/skills/push", {
+    method: "POST",
+    authRequired: true,
+    body: {
+      folder_name: basename(root),
+      files
+    }
+  });
+}
+async function runBounded(items, concurrency, worker) {
+  let next = 0;
+  const workers = Array.from({ length: Math.min(concurrency, items.length) }, async () => {
+    while (next < items.length) {
+      const item = items[next];
+      next += 1;
+      await worker(item);
+    }
+  });
+  await Promise.all(workers);
+}
+async function pushCommand(dir = ".", options = {}, deps = {}) {
+  const cleanup = installCancellationHandler();
+  try {
+    const root = resolve2(dir);
+    const dirStat = await stat4(root).catch(() => null);
+    if (!dirStat || !dirStat.isDirectory()) {
+      throw new Error(`Directory not found: ${dir}`);
+    }
+    const pushApi = deps.pushApi ?? api;
+    if (await hasSkillMarkdown(root)) {
+      const result = await pushOneSkill(root, pushApi);
+      log.ok(`Pushed ${result.skill.slug} ${result.skill.latest.display}.`);
+      return;
+    }
+    const skillDirs = await findImmediateSkillDirs(root);
+    if (skillDirs.length === 0) throw new Error("SKILL.md is required.");
+    const concurrency = parseConcurrency(options.concurrency);
+    const startedAt = Date.now();
+    const errors = [];
+    let pushed = 0;
+    await runBounded(skillDirs, concurrency, async (skillDir) => {
+      const slug = basename(skillDir);
+      try {
+        const result = await pushOneSkill(skillDir, pushApi);
+        pushed += 1;
+        log.info(`\u2713 ${result.skill.slug}  ${result.skill.latest.display}`);
+      } catch (error) {
+        errors.push({ slug, message: error.message });
+      }
+    });
+    const elapsed = ((Date.now() - startedAt) / 1e3).toFixed(1).replace(/\.0$/, "");
+    log.info(`Pushed ${pushed}/${skillDirs.length} skills in ${elapsed}s.`);
+    if (errors.length > 0) {
+      log.err("Push errors:");
+      for (const error of errors) log.err(`- ${error.slug}: ${error.message}`);
+      process.exitCode = 1;
+    }
+  } finally {
+    cleanup.dispose();
+  }
+}
+
+// src/commands/delete.ts
+var defaultDeps = { api, log, readAuth };
+async function deleteCommand(slug, opts = {}, deps = defaultDeps) {
+  if (!opts.yes) {
+    const auth = await deps.readAuth();
+    deps.log.info(`About to delete "${slug}" from ${auth?.handle ?? "your workspace"}. Re-run with --yes to confirm.`);
+    process.exitCode = 1;
+    return;
+  }
+  await deps.api(`/skills/${encodeURIComponent(slug)}`, {
+    method: "DELETE",
+    authRequired: true
+  });
+  deps.log.ok(`Deleted ${slug}.`);
+}
+
+// src/commands/list.ts
+async function listCommand() {
+  const result = await api("/skills", { authRequired: true });
+  if (result.total === 0) {
+    log.info("No skills in this workspace.");
+    return;
+  }
+  for (const skill of result.skills) {
+    log.info(`${skill.slug}  ${skill.latest_version.display}  ${skill.title}`);
+  }
+}
+
+// src/commands/rename-machine.ts
+import { readFile as readFile7, writeFile as writeFile4 } from "node:fs/promises";
+import { join as join7 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+var MACHINE_FILE2 = join7(homedir4(), ".floom", "machine.json");
+async function renameMachineCommand(newLabel, _opts) {
+  const trimmed = newLabel.trim().slice(0, 80);
+  if (!trimmed) {
+    log.err('Label cannot be empty. Use: floom rename-machine "Office Server"');
+    process.exitCode = 1;
+    return;
+  }
+  const raw = await readFile7(MACHINE_FILE2, "utf8").catch(() => null);
+  if (!raw) {
+    log.err("No machine.json found. Run a `floom pull` first.");
+    process.exitCode = 1;
+    return;
+  }
+  let stored;
+  try {
+    stored = JSON.parse(raw);
+  } catch {
+    log.err("machine.json is malformed. Run a `floom pull` to reset it.");
+    process.exitCode = 1;
+    return;
+  }
+  stored["label"] = trimmed;
+  await writeFile4(MACHINE_FILE2, JSON.stringify(stored, null, 2), { mode: 384 });
+  log.ok(`Local machine label set to "${trimmed}".`);
+  try {
+    await api("/pull-state", {
+      method: "PATCH",
+      authRequired: true,
+      body: { machine_id: stored["id"], machine_label: trimmed }
+    });
+    log.ok("Synced to your workspace.");
+  } catch (e) {
+    log.warn(`Couldn't push the rename to the server right now: ${e.message}`);
+    log.warn("It will sync on your next pull.");
+  }
+}
+
+// src/index.ts
+async function logoutCommand() {
+  const auth = await readAuth();
+  if (auth) {
+    try {
+      await api("/cli/session/revoke", { method: "POST", authRequired: true });
+    } catch (error) {
+      log.warn(`Remote session revoke failed: ${error.message}`);
+    }
+  }
+  await clearAuth();
+  log.ok("Logged out.");
+}
+async function whoamiCommand() {
+  const auth = await readAuth();
+  if (!auth) {
+    log.info("Not logged in. Run: npx -y @floomhq/skills-mvp login");
+    process.exitCode = 1;
+    return;
+  }
+  const rawAuth = await readRawAuth();
+  if (rawAuth && !isTrustedApiUrl(rawAuth.apiUrl)) {
+    log.warn(
+      `Your CLI auth.json points at ${rawAuth.apiUrl}, which is not a trusted Floom API. Run 'npx -y @floomhq/skills-mvp login' to re-auth on try.floom.dev.`
+    );
+  }
+  try {
+    const me = await api("/me", { authRequired: true });
+    log.heading("Logged in as:");
+    log.kv("email", me.user.email ?? auth.email);
+    if (me.workspace) {
+      log.kv("workspace", `${me.workspace.name} (${me.workspace.slug})`);
+    }
+    log.kv("api url", auth.apiUrl);
+  } catch (error) {
+    if (error instanceof FloomError) {
+      log.err(`${error.code}: ${error.message}`);
+    } else {
+      log.err(error.message);
+    }
+    log.warn("Local auth file exists but the server rejected this session. Run: npx -y @floomhq/skills-mvp login");
+    process.exitCode = 1;
+  }
+}
+var program = new Command();
+program.name("floom").description("Floom CLI \u2014 one shared skill library, pulled into the AI agent you choose.").version(VERSION);
+program.command("login").description("Log in via browser device flow.").action(loginCommand);
+program.command("logout").description("Clear local Floom auth.").action(logoutCommand);
+program.command("whoami").description("Show local auth state.").action(whoamiCommand);
+program.command("push [dir]").description("Push a skill folder.").option("--concurrency <n>", "Bulk push concurrency, 1-16", "6").action(pushCommand);
+program.command("delete <slug>").description("Delete a workspace skill.").option("--yes", "Skip confirmation").action((slug, opts) => deleteCommand(slug, opts));
+program.command("pull").description("Pull the whole workspace library.").option("--target <target>", "claude | codex | cursor | gemini | opencode").action(pullCommand);
+program.command("list").description("List workspace skills.").action(listCommand);
+program.command("status").description("Show local workspace sync status.").option("--target <target>", "claude | codex | cursor | gemini | opencode").action(statusCommand);
+program.command("mcp").description("Run the local MCP server over stdio.").action(mcpCommand);
+program.command("rename-machine <label>").description('Set the friendly name for THIS machine (e.g. "Office Server", "Travel Mac").').action(renameMachineCommand);
+async function main() {
+  try {
+    await program.parseAsync(process.argv);
+  } catch (e) {
+    if (e instanceof FloomError) {
+      log.err(`${e.code}: ${e.message}`);
+      process.exit(1);
+    }
+    log.err(e.message ?? "Unknown error");
+    if (process.env.FLOOM_DEBUG) {
+      const raw = e?.stack ?? String(e);
+      const home = homedir5();
+      const sanitized = raw.split(process.cwd()).join(".").split(home && home.length > 1 ? home : "\0").join("~");
+      console.error(sanitized);
+    }
+    process.exit(1);
+  }
+}
+main();
+/*! Bundled license information:
+
+bcryptjs/dist/bcrypt.js:
+  (**
+   * @license bcrypt.js (c) 2013 Daniel Wirtz <dcode@dcode.io>
+   * Released under the Apache License, Version 2.0
+   * see: https://github.com/dcodeIO/bcrypt.js for details
+   *)
+*/