@floomhq/skills 0.2.0 → 0.2.1

package/dist/index.js

@@ -1,99 +1,3650 @@
 #!/usr/bin/env node
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// ../../node_modules/.pnpm/bcryptjs@2.4.3/node_modules/bcryptjs/dist/bcrypt.js
+var require_bcrypt = __commonJS({
+  "../../node_modules/.pnpm/bcryptjs@2.4.3/node_modules/bcryptjs/dist/bcrypt.js"(exports, module) {
+    (function(global, factory) {
+      if (typeof define === "function" && define["amd"])
+        define([], factory);
+      else if (typeof __require === "function" && typeof module === "object" && module && module["exports"])
+        module["exports"] = factory();
+      else
+        (global["dcodeIO"] = global["dcodeIO"] || {})["bcrypt"] = factory();
+    })(exports, function() {
+      "use strict";
+      var bcrypt2 = {};
+      var randomFallback = null;
+      function random(len) {
+        if (typeof module !== "undefined" && module && module["exports"])
+          try {
+            return __require("crypto")["randomBytes"](len);
+          } catch (e) {
+          }
+        try {
+          var a;
+          (self["crypto"] || self["msCrypto"])["getRandomValues"](a = new Uint32Array(len));
+          return Array.prototype.slice.call(a);
+        } catch (e) {
+        }
+        if (!randomFallback)
+          throw Error("Neither WebCryptoAPI nor a crypto module is available. Use bcrypt.setRandomFallback to set an alternative");
+        return randomFallback(len);
+      }
+      var randomAvailable = false;
+      try {
+        random(1);
+        randomAvailable = true;
+      } catch (e) {
+      }
+      randomFallback = null;
+      bcrypt2.setRandomFallback = function(random2) {
+        randomFallback = random2;
+      };
+      bcrypt2.genSaltSync = function(rounds, seed_length) {
+        rounds = rounds || GENSALT_DEFAULT_LOG2_ROUNDS;
+        if (typeof rounds !== "number")
+          throw Error("Illegal arguments: " + typeof rounds + ", " + typeof seed_length);
+        if (rounds < 4)
+          rounds = 4;
+        else if (rounds > 31)
+          rounds = 31;
+        var salt = [];
+        salt.push("$2a$");
+        if (rounds < 10)
+          salt.push("0");
+        salt.push(rounds.toString());
+        salt.push("$");
+        salt.push(base64_encode(random(BCRYPT_SALT_LEN), BCRYPT_SALT_LEN));
+        return salt.join("");
+      };
+      bcrypt2.genSalt = function(rounds, seed_length, callback) {
+        if (typeof seed_length === "function")
+          callback = seed_length, seed_length = void 0;
+        if (typeof rounds === "function")
+          callback = rounds, rounds = void 0;
+        if (typeof rounds === "undefined")
+          rounds = GENSALT_DEFAULT_LOG2_ROUNDS;
+        else if (typeof rounds !== "number")
+          throw Error("illegal arguments: " + typeof rounds);
+        function _async(callback2) {
+          nextTick(function() {
+            try {
+              callback2(null, bcrypt2.genSaltSync(rounds));
+            } catch (err) {
+              callback2(err);
+            }
+          });
+        }
+        if (callback) {
+          if (typeof callback !== "function")
+            throw Error("Illegal callback: " + typeof callback);
+          _async(callback);
+        } else
+          return new Promise(function(resolve3, reject) {
+            _async(function(err, res) {
+              if (err) {
+                reject(err);
+                return;
+              }
+              resolve3(res);
+            });
+          });
+      };
+      bcrypt2.hashSync = function(s, salt) {
+        if (typeof salt === "undefined")
+          salt = GENSALT_DEFAULT_LOG2_ROUNDS;
+        if (typeof salt === "number")
+          salt = bcrypt2.genSaltSync(salt);
+        if (typeof s !== "string" || typeof salt !== "string")
+          throw Error("Illegal arguments: " + typeof s + ", " + typeof salt);
+        return _hash(s, salt);
+      };
+      bcrypt2.hash = function(s, salt, callback, progressCallback) {
+        function _async(callback2) {
+          if (typeof s === "string" && typeof salt === "number")
+            bcrypt2.genSalt(salt, function(err, salt2) {
+              _hash(s, salt2, callback2, progressCallback);
+            });
+          else if (typeof s === "string" && typeof salt === "string")
+            _hash(s, salt, callback2, progressCallback);
+          else
+            nextTick(callback2.bind(this, Error("Illegal arguments: " + typeof s + ", " + typeof salt)));
+        }
+        if (callback) {
+          if (typeof callback !== "function")
+            throw Error("Illegal callback: " + typeof callback);
+          _async(callback);
+        } else
+          return new Promise(function(resolve3, reject) {
+            _async(function(err, res) {
+              if (err) {
+                reject(err);
+                return;
+              }
+              resolve3(res);
+            });
+          });
+      };
+      function safeStringCompare(known, unknown) {
+        var right = 0, wrong = 0;
+        for (var i = 0, k = known.length; i < k; ++i) {
+          if (known.charCodeAt(i) === unknown.charCodeAt(i))
+            ++right;
+          else
+            ++wrong;
+        }
+        if (right < 0)
+          return false;
+        return wrong === 0;
+      }
+      bcrypt2.compareSync = function(s, hash) {
+        if (typeof s !== "string" || typeof hash !== "string")
+          throw Error("Illegal arguments: " + typeof s + ", " + typeof hash);
+        if (hash.length !== 60)
+          return false;
+        return safeStringCompare(bcrypt2.hashSync(s, hash.substr(0, hash.length - 31)), hash);
+      };
+      bcrypt2.compare = function(s, hash, callback, progressCallback) {
+        function _async(callback2) {
+          if (typeof s !== "string" || typeof hash !== "string") {
+            nextTick(callback2.bind(this, Error("Illegal arguments: " + typeof s + ", " + typeof hash)));
+            return;
+          }
+          if (hash.length !== 60) {
+            nextTick(callback2.bind(this, null, false));
+            return;
+          }
+          bcrypt2.hash(s, hash.substr(0, 29), function(err, comp) {
+            if (err)
+              callback2(err);
+            else
+              callback2(null, safeStringCompare(comp, hash));
+          }, progressCallback);
+        }
+        if (callback) {
+          if (typeof callback !== "function")
+            throw Error("Illegal callback: " + typeof callback);
+          _async(callback);
+        } else
+          return new Promise(function(resolve3, reject) {
+            _async(function(err, res) {
+              if (err) {
+                reject(err);
+                return;
+              }
+              resolve3(res);
+            });
+          });
+      };
+      bcrypt2.getRounds = function(hash) {
+        if (typeof hash !== "string")
+          throw Error("Illegal arguments: " + typeof hash);
+        return parseInt(hash.split("$")[2], 10);
+      };
+      bcrypt2.getSalt = function(hash) {
+        if (typeof hash !== "string")
+          throw Error("Illegal arguments: " + typeof hash);
+        if (hash.length !== 60)
+          throw Error("Illegal hash length: " + hash.length + " != 60");
+        return hash.substring(0, 29);
+      };
+      var nextTick = typeof process !== "undefined" && process && typeof process.nextTick === "function" ? typeof setImmediate === "function" ? setImmediate : process.nextTick : setTimeout;
+      function stringToBytes(str) {
+        var out = [], i = 0;
+        utfx.encodeUTF16toUTF8(function() {
+          if (i >= str.length) return null;
+          return str.charCodeAt(i++);
+        }, function(b) {
+          out.push(b);
+        });
+        return out;
+      }
+      var BASE64_CODE = "./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789".split("");
+      var BASE64_INDEX = [
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        0,
+        1,
+        54,
+        55,
+        56,
+        57,
+        58,
+        59,
+        60,
+        61,
+        62,
+        63,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        2,
+        3,
+        4,
+        5,
+        6,
+        7,
+        8,
+        9,
+        10,
+        11,
+        12,
+        13,
+        14,
+        15,
+        16,
+        17,
+        18,
+        19,
+        20,
+        21,
+        22,
+        23,
+        24,
+        25,
+        26,
+        27,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1,
+        28,
+        29,
+        30,
+        31,
+        32,
+        33,
+        34,
+        35,
+        36,
+        37,
+        38,
+        39,
+        40,
+        41,
+        42,
+        43,
+        44,
+        45,
+        46,
+        47,
+        48,
+        49,
+        50,
+        51,
+        52,
+        53,
+        -1,
+        -1,
+        -1,
+        -1,
+        -1
+      ];
+      var stringFromCharCode = String.fromCharCode;
+      function base64_encode(b, len) {
+        var off = 0, rs = [], c1, c2;
+        if (len <= 0 || len > b.length)
+          throw Error("Illegal len: " + len);
+        while (off < len) {
+          c1 = b[off++] & 255;
+          rs.push(BASE64_CODE[c1 >> 2 & 63]);
+          c1 = (c1 & 3) << 4;
+          if (off >= len) {
+            rs.push(BASE64_CODE[c1 & 63]);
+            break;
+          }
+          c2 = b[off++] & 255;
+          c1 |= c2 >> 4 & 15;
+          rs.push(BASE64_CODE[c1 & 63]);
+          c1 = (c2 & 15) << 2;
+          if (off >= len) {
+            rs.push(BASE64_CODE[c1 & 63]);
+            break;
+          }
+          c2 = b[off++] & 255;
+          c1 |= c2 >> 6 & 3;
+          rs.push(BASE64_CODE[c1 & 63]);
+          rs.push(BASE64_CODE[c2 & 63]);
+        }
+        return rs.join("");
+      }
+      function base64_decode(s, len) {
+        var off = 0, slen = s.length, olen = 0, rs = [], c1, c2, c3, c4, o, code;
+        if (len <= 0)
+          throw Error("Illegal len: " + len);
+        while (off < slen - 1 && olen < len) {
+          code = s.charCodeAt(off++);
+          c1 = code < BASE64_INDEX.length ? BASE64_INDEX[code] : -1;
+          code = s.charCodeAt(off++);
+          c2 = code < BASE64_INDEX.length ? BASE64_INDEX[code] : -1;
+          if (c1 == -1 || c2 == -1)
+            break;
+          o = c1 << 2 >>> 0;
+          o |= (c2 & 48) >> 4;
+          rs.push(stringFromCharCode(o));
+          if (++olen >= len || off >= slen)
+            break;
+          code = s.charCodeAt(off++);
+          c3 = code < BASE64_INDEX.length ? BASE64_INDEX[code] : -1;
+          if (c3 == -1)
+            break;
+          o = (c2 & 15) << 4 >>> 0;
+          o |= (c3 & 60) >> 2;
+          rs.push(stringFromCharCode(o));
+          if (++olen >= len || off >= slen)
+            break;
+          code = s.charCodeAt(off++);
+          c4 = code < BASE64_INDEX.length ? BASE64_INDEX[code] : -1;
+          o = (c3 & 3) << 6 >>> 0;
+          o |= c4;
+          rs.push(stringFromCharCode(o));
+          ++olen;
+        }
+        var res = [];
+        for (off = 0; off < olen; off++)
+          res.push(rs[off].charCodeAt(0));
+        return res;
+      }
+      var utfx = (function() {
+        "use strict";
+        var utfx2 = {};
+        utfx2.MAX_CODEPOINT = 1114111;
+        utfx2.encodeUTF8 = function(src, dst) {
+          var cp = null;
+          if (typeof src === "number")
+            cp = src, src = function() {
+              return null;
+            };
+          while (cp !== null || (cp = src()) !== null) {
+            if (cp < 128)
+              dst(cp & 127);
+            else if (cp < 2048)
+              dst(cp >> 6 & 31 | 192), dst(cp & 63 | 128);
+            else if (cp < 65536)
+              dst(cp >> 12 & 15 | 224), dst(cp >> 6 & 63 | 128), dst(cp & 63 | 128);
+            else
+              dst(cp >> 18 & 7 | 240), dst(cp >> 12 & 63 | 128), dst(cp >> 6 & 63 | 128), dst(cp & 63 | 128);
+            cp = null;
+          }
+        };
+        utfx2.decodeUTF8 = function(src, dst) {
+          var a, b, c, d, fail2 = function(b2) {
+            b2 = b2.slice(0, b2.indexOf(null));
+            var err = Error(b2.toString());
+            err.name = "TruncatedError";
+            err["bytes"] = b2;
+            throw err;
+          };
+          while ((a = src()) !== null) {
+            if ((a & 128) === 0)
+              dst(a);
+            else if ((a & 224) === 192)
+              (b = src()) === null && fail2([a, b]), dst((a & 31) << 6 | b & 63);
+            else if ((a & 240) === 224)
+              ((b = src()) === null || (c = src()) === null) && fail2([a, b, c]), dst((a & 15) << 12 | (b & 63) << 6 | c & 63);
+            else if ((a & 248) === 240)
+              ((b = src()) === null || (c = src()) === null || (d = src()) === null) && fail2([a, b, c, d]), dst((a & 7) << 18 | (b & 63) << 12 | (c & 63) << 6 | d & 63);
+            else throw RangeError("Illegal starting byte: " + a);
+          }
+        };
+        utfx2.UTF16toUTF8 = function(src, dst) {
+          var c1, c2 = null;
+          while (true) {
+            if ((c1 = c2 !== null ? c2 : src()) === null)
+              break;
+            if (c1 >= 55296 && c1 <= 57343) {
+              if ((c2 = src()) !== null) {
+                if (c2 >= 56320 && c2 <= 57343) {
+                  dst((c1 - 55296) * 1024 + c2 - 56320 + 65536);
+                  c2 = null;
+                  continue;
+                }
+              }
+            }
+            dst(c1);
+          }
+          if (c2 !== null) dst(c2);
+        };
+        utfx2.UTF8toUTF16 = function(src, dst) {
+          var cp = null;
+          if (typeof src === "number")
+            cp = src, src = function() {
+              return null;
+            };
+          while (cp !== null || (cp = src()) !== null) {
+            if (cp <= 65535)
+              dst(cp);
+            else
+              cp -= 65536, dst((cp >> 10) + 55296), dst(cp % 1024 + 56320);
+            cp = null;
+          }
+        };
+        utfx2.encodeUTF16toUTF8 = function(src, dst) {
+          utfx2.UTF16toUTF8(src, function(cp) {
+            utfx2.encodeUTF8(cp, dst);
+          });
+        };
+        utfx2.decodeUTF8toUTF16 = function(src, dst) {
+          utfx2.decodeUTF8(src, function(cp) {
+            utfx2.UTF8toUTF16(cp, dst);
+          });
+        };
+        utfx2.calculateCodePoint = function(cp) {
+          return cp < 128 ? 1 : cp < 2048 ? 2 : cp < 65536 ? 3 : 4;
+        };
+        utfx2.calculateUTF8 = function(src) {
+          var cp, l = 0;
+          while ((cp = src()) !== null)
+            l += utfx2.calculateCodePoint(cp);
+          return l;
+        };
+        utfx2.calculateUTF16asUTF8 = function(src) {
+          var n = 0, l = 0;
+          utfx2.UTF16toUTF8(src, function(cp) {
+            ++n;
+            l += utfx2.calculateCodePoint(cp);
+          });
+          return [n, l];
+        };
+        return utfx2;
+      })();
+      Date.now = Date.now || function() {
+        return +/* @__PURE__ */ new Date();
+      };
+      var BCRYPT_SALT_LEN = 16;
+      var GENSALT_DEFAULT_LOG2_ROUNDS = 10;
+      var BLOWFISH_NUM_ROUNDS = 16;
+      var MAX_EXECUTION_TIME = 100;
+      var P_ORIG = [
+        608135816,
+        2242054355,
+        320440878,
+        57701188,
+        2752067618,
+        698298832,
+        137296536,
+        3964562569,
+        1160258022,
+        953160567,
+        3193202383,
+        887688300,
+        3232508343,
+        3380367581,
+        1065670069,
+        3041331479,
+        2450970073,
+        2306472731
+      ];
+      var S_ORIG = [
+        3509652390,
+        2564797868,
+        805139163,
+        3491422135,
+        3101798381,
+        1780907670,
+        3128725573,
+        4046225305,
+        614570311,
+        3012652279,
+        134345442,
+        2240740374,
+        1667834072,
+        1901547113,
+        2757295779,
+        4103290238,
+        227898511,
+        1921955416,
+        1904987480,
+        2182433518,
+        2069144605,
+        3260701109,
+        2620446009,
+        720527379,
+        3318853667,
+        677414384,
+        3393288472,
+        3101374703,
+        2390351024,
+        1614419982,
+        1822297739,
+        2954791486,
+        3608508353,
+        3174124327,
+        2024746970,
+        1432378464,
+        3864339955,
+        2857741204,
+        1464375394,
+        1676153920,
+        1439316330,
+        715854006,
+        3033291828,
+        289532110,
+        2706671279,
+        2087905683,
+        3018724369,
+        1668267050,
+        732546397,
+        1947742710,
+        3462151702,
+        2609353502,
+        2950085171,
+        1814351708,
+        2050118529,
+        680887927,
+        999245976,
+        1800124847,
+        3300911131,
+        1713906067,
+        1641548236,
+        4213287313,
+        1216130144,
+        1575780402,
+        4018429277,
+        3917837745,
+        3693486850,
+        3949271944,
+        596196993,
+        3549867205,
+        258830323,
+        2213823033,
+        772490370,
+        2760122372,
+        1774776394,
+        2652871518,
+        566650946,
+        4142492826,
+        1728879713,
+        2882767088,
+        1783734482,
+        3629395816,
+        2517608232,
+        2874225571,
+        1861159788,
+        326777828,
+        3124490320,
+        2130389656,
+        2716951837,
+        967770486,
+        1724537150,
+        2185432712,
+        2364442137,
+        1164943284,
+        2105845187,
+        998989502,
+        3765401048,
+        2244026483,
+        1075463327,
+        1455516326,
+        1322494562,
+        910128902,
+        469688178,
+        1117454909,
+        936433444,
+        3490320968,
+        3675253459,
+        1240580251,
+        122909385,
+        2157517691,
+        634681816,
+        4142456567,
+        3825094682,
+        3061402683,
+        2540495037,
+        79693498,
+        3249098678,
+        1084186820,
+        1583128258,
+        426386531,
+        1761308591,
+        1047286709,
+        322548459,
+        995290223,
+        1845252383,
+        2603652396,
+        3431023940,
+        2942221577,
+        3202600964,
+        3727903485,
+        1712269319,
+        422464435,
+        3234572375,
+        1170764815,
+        3523960633,
+        3117677531,
+        1434042557,
+        442511882,
+        3600875718,
+        1076654713,
+        1738483198,
+        4213154764,
+        2393238008,
+        3677496056,
+        1014306527,
+        4251020053,
+        793779912,
+        2902807211,
+        842905082,
+        4246964064,
+        1395751752,
+        1040244610,
+        2656851899,
+        3396308128,
+        445077038,
+        3742853595,
+        3577915638,
+        679411651,
+        2892444358,
+        2354009459,
+        1767581616,
+        3150600392,
+        3791627101,
+        3102740896,
+        284835224,
+        4246832056,
+        1258075500,
+        768725851,
+        2589189241,
+        3069724005,
+        3532540348,
+        1274779536,
+        3789419226,
+        2764799539,
+        1660621633,
+        3471099624,
+        4011903706,
+        913787905,
+        3497959166,
+        737222580,
+        2514213453,
+        2928710040,
+        3937242737,
+        1804850592,
+        3499020752,
+        2949064160,
+        2386320175,
+        2390070455,
+        2415321851,
+        4061277028,
+        2290661394,
+        2416832540,
+        1336762016,
+        1754252060,
+        3520065937,
+        3014181293,
+        791618072,
+        3188594551,
+        3933548030,
+        2332172193,
+        3852520463,
+        3043980520,
+        413987798,
+        3465142937,
+        3030929376,
+        4245938359,
+        2093235073,
+        3534596313,
+        375366246,
+        2157278981,
+        2479649556,
+        555357303,
+        3870105701,
+        2008414854,
+        3344188149,
+        4221384143,
+        3956125452,
+        2067696032,
+        3594591187,
+        2921233993,
+        2428461,
+        544322398,
+        577241275,
+        1471733935,
+        610547355,
+        4027169054,
+        1432588573,
+        1507829418,
+        2025931657,
+        3646575487,
+        545086370,
+        48609733,
+        2200306550,
+        1653985193,
+        298326376,
+        1316178497,
+        3007786442,
+        2064951626,
+        458293330,
+        2589141269,
+        3591329599,
+        3164325604,
+        727753846,
+        2179363840,
+        146436021,
+        1461446943,
+        4069977195,
+        705550613,
+        3059967265,
+        3887724982,
+        4281599278,
+        3313849956,
+        1404054877,
+        2845806497,
+        146425753,
+        1854211946,
+        1266315497,
+        3048417604,
+        3681880366,
+        3289982499,
+        290971e4,
+        1235738493,
+        2632868024,
+        2414719590,
+        3970600049,
+        1771706367,
+        1449415276,
+        3266420449,
+        422970021,
+        1963543593,
+        2690192192,
+        3826793022,
+        1062508698,
+        1531092325,
+        1804592342,
+        2583117782,
+        2714934279,
+        4024971509,
+        1294809318,
+        4028980673,
+        1289560198,
+        2221992742,
+        1669523910,
+        35572830,
+        157838143,
+        1052438473,
+        1016535060,
+        1802137761,
+        1753167236,
+        1386275462,
+        3080475397,
+        2857371447,
+        1040679964,
+        2145300060,
+        2390574316,
+        1461121720,
+        2956646967,
+        4031777805,
+        4028374788,
+        33600511,
+        2920084762,
+        1018524850,
+        629373528,
+        3691585981,
+        3515945977,
+        2091462646,
+        2486323059,
+        586499841,
+        988145025,
+        935516892,
+        3367335476,
+        2599673255,
+        2839830854,
+        265290510,
+        3972581182,
+        2759138881,
+        3795373465,
+        1005194799,
+        847297441,
+        406762289,
+        1314163512,
+        1332590856,
+        1866599683,
+        4127851711,
+        750260880,
+        613907577,
+        1450815602,
+        3165620655,
+        3734664991,
+        3650291728,
+        3012275730,
+        3704569646,
+        1427272223,
+        778793252,
+        1343938022,
+        2676280711,
+        2052605720,
+        1946737175,
+        3164576444,
+        3914038668,
+        3967478842,
+        3682934266,
+        1661551462,
+        3294938066,
+        4011595847,
+        840292616,
+        3712170807,
+        616741398,
+        312560963,
+        711312465,
+        1351876610,
+        322626781,
+        1910503582,
+        271666773,
+        2175563734,
+        1594956187,
+        70604529,
+        3617834859,
+        1007753275,
+        1495573769,
+        4069517037,
+        2549218298,
+        2663038764,
+        504708206,
+        2263041392,
+        3941167025,
+        2249088522,
+        1514023603,
+        1998579484,
+        1312622330,
+        694541497,
+        2582060303,
+        2151582166,
+        1382467621,
+        776784248,
+        2618340202,
+        3323268794,
+        2497899128,
+        2784771155,
+        503983604,
+        4076293799,
+        907881277,
+        423175695,
+        432175456,
+        1378068232,
+        4145222326,
+        3954048622,
+        3938656102,
+        3820766613,
+        2793130115,
+        2977904593,
+        26017576,
+        3274890735,
+        3194772133,
+        1700274565,
+        1756076034,
+        4006520079,
+        3677328699,
+        720338349,
+        1533947780,
+        354530856,
+        688349552,
+        3973924725,
+        1637815568,
+        332179504,
+        3949051286,
+        53804574,
+        2852348879,
+        3044236432,
+        1282449977,
+        3583942155,
+        3416972820,
+        4006381244,
+        1617046695,
+        2628476075,
+        3002303598,
+        1686838959,
+        431878346,
+        2686675385,
+        1700445008,
+        1080580658,
+        1009431731,
+        832498133,
+        3223435511,
+        2605976345,
+        2271191193,
+        2516031870,
+        1648197032,
+        4164389018,
+        2548247927,
+        300782431,
+        375919233,
+        238389289,
+        3353747414,
+        2531188641,
+        2019080857,
+        1475708069,
+        455242339,
+        2609103871,
+        448939670,
+        3451063019,
+        1395535956,
+        2413381860,
+        1841049896,
+        1491858159,
+        885456874,
+        4264095073,
+        4001119347,
+        1565136089,
+        3898914787,
+        1108368660,
+        540939232,
+        1173283510,
+        2745871338,
+        3681308437,
+        4207628240,
+        3343053890,
+        4016749493,
+        1699691293,
+        1103962373,
+        3625875870,
+        2256883143,
+        3830138730,
+        1031889488,
+        3479347698,
+        1535977030,
+        4236805024,
+        3251091107,
+        2132092099,
+        1774941330,
+        1199868427,
+        1452454533,
+        157007616,
+        2904115357,
+        342012276,
+        595725824,
+        1480756522,
+        206960106,
+        497939518,
+        591360097,
+        863170706,
+        2375253569,
+        3596610801,
+        1814182875,
+        2094937945,
+        3421402208,
+        1082520231,
+        3463918190,
+        2785509508,
+        435703966,
+        3908032597,
+        1641649973,
+        2842273706,
+        3305899714,
+        1510255612,
+        2148256476,
+        2655287854,
+        3276092548,
+        4258621189,
+        236887753,
+        3681803219,
+        274041037,
+        1734335097,
+        3815195456,
+        3317970021,
+        1899903192,
+        1026095262,
+        4050517792,
+        356393447,
+        2410691914,
+        3873677099,
+        3682840055,
+        3913112168,
+        2491498743,
+        4132185628,
+        2489919796,
+        1091903735,
+        1979897079,
+        3170134830,
+        3567386728,
+        3557303409,
+        857797738,
+        1136121015,
+        1342202287,
+        507115054,
+        2535736646,
+        337727348,
+        3213592640,
+        1301675037,
+        2528481711,
+        1895095763,
+        1721773893,
+        3216771564,
+        62756741,
+        2142006736,
+        835421444,
+        2531993523,
+        1442658625,
+        3659876326,
+        2882144922,
+        676362277,
+        1392781812,
+        170690266,
+        3921047035,
+        1759253602,
+        3611846912,
+        1745797284,
+        664899054,
+        1329594018,
+        3901205900,
+        3045908486,
+        2062866102,
+        2865634940,
+        3543621612,
+        3464012697,
+        1080764994,
+        553557557,
+        3656615353,
+        3996768171,
+        991055499,
+        499776247,
+        1265440854,
+        648242737,
+        3940784050,
+        980351604,
+        3713745714,
+        1749149687,
+        3396870395,
+        4211799374,
+        3640570775,
+        1161844396,
+        3125318951,
+        1431517754,
+        545492359,
+        4268468663,
+        3499529547,
+        1437099964,
+        2702547544,
+        3433638243,
+        2581715763,
+        2787789398,
+        1060185593,
+        1593081372,
+        2418618748,
+        4260947970,
+        69676912,
+        2159744348,
+        86519011,
+        2512459080,
+        3838209314,
+        1220612927,
+        3339683548,
+        133810670,
+        1090789135,
+        1078426020,
+        1569222167,
+        845107691,
+        3583754449,
+        4072456591,
+        1091646820,
+        628848692,
+        1613405280,
+        3757631651,
+        526609435,
+        236106946,
+        48312990,
+        2942717905,
+        3402727701,
+        1797494240,
+        859738849,
+        992217954,
+        4005476642,
+        2243076622,
+        3870952857,
+        3732016268,
+        765654824,
+        3490871365,
+        2511836413,
+        1685915746,
+        3888969200,
+        1414112111,
+        2273134842,
+        3281911079,
+        4080962846,
+        172450625,
+        2569994100,
+        980381355,
+        4109958455,
+        2819808352,
+        2716589560,
+        2568741196,
+        3681446669,
+        3329971472,
+        1835478071,
+        660984891,
+        3704678404,
+        4045999559,
+        3422617507,
+        3040415634,
+        1762651403,
+        1719377915,
+        3470491036,
+        2693910283,
+        3642056355,
+        3138596744,
+        1364962596,
+        2073328063,
+        1983633131,
+        926494387,
+        3423689081,
+        2150032023,
+        4096667949,
+        1749200295,
+        3328846651,
+        309677260,
+        2016342300,
+        1779581495,
+        3079819751,
+        111262694,
+        1274766160,
+        443224088,
+        298511866,
+        1025883608,
+        3806446537,
+        1145181785,
+        168956806,
+        3641502830,
+        3584813610,
+        1689216846,
+        3666258015,
+        3200248200,
+        1692713982,
+        2646376535,
+        4042768518,
+        1618508792,
+        1610833997,
+        3523052358,
+        4130873264,
+        2001055236,
+        3610705100,
+        2202168115,
+        4028541809,
+        2961195399,
+        1006657119,
+        2006996926,
+        3186142756,
+        1430667929,
+        3210227297,
+        1314452623,
+        4074634658,
+        4101304120,
+        2273951170,
+        1399257539,
+        3367210612,
+        3027628629,
+        1190975929,
+        2062231137,
+        2333990788,
+        2221543033,
+        2438960610,
+        1181637006,
+        548689776,
+        2362791313,
+        3372408396,
+        3104550113,
+        3145860560,
+        296247880,
+        1970579870,
+        3078560182,
+        3769228297,
+        1714227617,
+        3291629107,
+        3898220290,
+        166772364,
+        1251581989,
+        493813264,
+        448347421,
+        195405023,
+        2709975567,
+        677966185,
+        3703036547,
+        1463355134,
+        2715995803,
+        1338867538,
+        1343315457,
+        2802222074,
+        2684532164,
+        233230375,
+        2599980071,
+        2000651841,
+        3277868038,
+        1638401717,
+        4028070440,
+        3237316320,
+        6314154,
+        819756386,
+        300326615,
+        590932579,
+        1405279636,
+        3267499572,
+        3150704214,
+        2428286686,
+        3959192993,
+        3461946742,
+        1862657033,
+        1266418056,
+        963775037,
+        2089974820,
+        2263052895,
+        1917689273,
+        448879540,
+        3550394620,
+        3981727096,
+        150775221,
+        3627908307,
+        1303187396,
+        508620638,
+        2975983352,
+        2726630617,
+        1817252668,
+        1876281319,
+        1457606340,
+        908771278,
+        3720792119,
+        3617206836,
+        2455994898,
+        1729034894,
+        1080033504,
+        976866871,
+        3556439503,
+        2881648439,
+        1522871579,
+        1555064734,
+        1336096578,
+        3548522304,
+        2579274686,
+        3574697629,
+        3205460757,
+        3593280638,
+        3338716283,
+        3079412587,
+        564236357,
+        2993598910,
+        1781952180,
+        1464380207,
+        3163844217,
+        3332601554,
+        1699332808,
+        1393555694,
+        1183702653,
+        3581086237,
+        1288719814,
+        691649499,
+        2847557200,
+        2895455976,
+        3193889540,
+        2717570544,
+        1781354906,
+        1676643554,
+        2592534050,
+        3230253752,
+        1126444790,
+        2770207658,
+        2633158820,
+        2210423226,
+        2615765581,
+        2414155088,
+        3127139286,
+        673620729,
+        2805611233,
+        1269405062,
+        4015350505,
+        3341807571,
+        4149409754,
+        1057255273,
+        2012875353,
+        2162469141,
+        2276492801,
+        2601117357,
+        993977747,
+        3918593370,
+        2654263191,
+        753973209,
+        36408145,
+        2530585658,
+        25011837,
+        3520020182,
+        2088578344,
+        530523599,
+        2918365339,
+        1524020338,
+        1518925132,
+        3760827505,
+        3759777254,
+        1202760957,
+        3985898139,
+        3906192525,
+        674977740,
+        4174734889,
+        2031300136,
+        2019492241,
+        3983892565,
+        4153806404,
+        3822280332,
+        352677332,
+        2297720250,
+        60907813,
+        90501309,
+        3286998549,
+        1016092578,
+        2535922412,
+        2839152426,
+        457141659,
+        509813237,
+        4120667899,
+        652014361,
+        1966332200,
+        2975202805,
+        55981186,
+        2327461051,
+        676427537,
+        3255491064,
+        2882294119,
+        3433927263,
+        1307055953,
+        942726286,
+        933058658,
+        2468411793,
+        3933900994,
+        4215176142,
+        1361170020,
+        2001714738,
+        2830558078,
+        3274259782,
+        1222529897,
+        1679025792,
+        2729314320,
+        3714953764,
+        1770335741,
+        151462246,
+        3013232138,
+        1682292957,
+        1483529935,
+        471910574,
+        1539241949,
+        458788160,
+        3436315007,
+        1807016891,
+        3718408830,
+        978976581,
+        1043663428,
+        3165965781,
+        1927990952,
+        4200891579,
+        2372276910,
+        3208408903,
+        3533431907,
+        1412390302,
+        2931980059,
+        4132332400,
+        1947078029,
+        3881505623,
+        4168226417,
+        2941484381,
+        1077988104,
+        1320477388,
+        886195818,
+        18198404,
+        3786409e3,
+        2509781533,
+        112762804,
+        3463356488,
+        1866414978,
+        891333506,
+        18488651,
+        661792760,
+        1628790961,
+        3885187036,
+        3141171499,
+        876946877,
+        2693282273,
+        1372485963,
+        791857591,
+        2686433993,
+        3759982718,
+        3167212022,
+        3472953795,
+        2716379847,
+        445679433,
+        3561995674,
+        3504004811,
+        3574258232,
+        54117162,
+        3331405415,
+        2381918588,
+        3769707343,
+        4154350007,
+        1140177722,
+        4074052095,
+        668550556,
+        3214352940,
+        367459370,
+        261225585,
+        2610173221,
+        4209349473,
+        3468074219,
+        3265815641,
+        314222801,
+        3066103646,
+        3808782860,
+        282218597,
+        3406013506,
+        3773591054,
+        379116347,
+        1285071038,
+        846784868,
+        2669647154,
+        3771962079,
+        3550491691,
+        2305946142,
+        453669953,
+        1268987020,
+        3317592352,
+        3279303384,
+        3744833421,
+        2610507566,
+        3859509063,
+        266596637,
+        3847019092,
+        517658769,
+        3462560207,
+        3443424879,
+        370717030,
+        4247526661,
+        2224018117,
+        4143653529,
+        4112773975,
+        2788324899,
+        2477274417,
+        1456262402,
+        2901442914,
+        1517677493,
+        1846949527,
+        2295493580,
+        3734397586,
+        2176403920,
+        1280348187,
+        1908823572,
+        3871786941,
+        846861322,
+        1172426758,
+        3287448474,
+        3383383037,
+        1655181056,
+        3139813346,
+        901632758,
+        1897031941,
+        2986607138,
+        3066810236,
+        3447102507,
+        1393639104,
+        373351379,
+        950779232,
+        625454576,
+        3124240540,
+        4148612726,
+        2007998917,
+        544563296,
+        2244738638,
+        2330496472,
+        2058025392,
+        1291430526,
+        424198748,
+        50039436,
+        29584100,
+        3605783033,
+        2429876329,
+        2791104160,
+        1057563949,
+        3255363231,
+        3075367218,
+        3463963227,
+        1469046755,
+        985887462
+      ];
+      var C_ORIG = [
+        1332899944,
+        1700884034,
+        1701343084,
+        1684370003,
+        1668446532,
+        1869963892
+      ];
+      function _encipher(lr, off, P, S) {
+        var n, l = lr[off], r = lr[off + 1];
+        l ^= P[0];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[1];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[2];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[3];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[4];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[5];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[6];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[7];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[8];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[9];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[10];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[11];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[12];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[13];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[14];
+        n = S[l >>> 24];
+        n += S[256 | l >> 16 & 255];
+        n ^= S[512 | l >> 8 & 255];
+        n += S[768 | l & 255];
+        r ^= n ^ P[15];
+        n = S[r >>> 24];
+        n += S[256 | r >> 16 & 255];
+        n ^= S[512 | r >> 8 & 255];
+        n += S[768 | r & 255];
+        l ^= n ^ P[16];
+        lr[off] = r ^ P[BLOWFISH_NUM_ROUNDS + 1];
+        lr[off + 1] = l;
+        return lr;
+      }
+      function _streamtoword(data, offp) {
+        for (var i = 0, word = 0; i < 4; ++i)
+          word = word << 8 | data[offp] & 255, offp = (offp + 1) % data.length;
+        return { key: word, offp };
+      }
+      function _key(key, P, S) {
+        var offset = 0, lr = [0, 0], plen = P.length, slen = S.length, sw;
+        for (var i = 0; i < plen; i++)
+          sw = _streamtoword(key, offset), offset = sw.offp, P[i] = P[i] ^ sw.key;
+        for (i = 0; i < plen; i += 2)
+          lr = _encipher(lr, 0, P, S), P[i] = lr[0], P[i + 1] = lr[1];
+        for (i = 0; i < slen; i += 2)
+          lr = _encipher(lr, 0, P, S), S[i] = lr[0], S[i + 1] = lr[1];
+      }
+      function _ekskey(data, key, P, S) {
+        var offp = 0, lr = [0, 0], plen = P.length, slen = S.length, sw;
+        for (var i = 0; i < plen; i++)
+          sw = _streamtoword(key, offp), offp = sw.offp, P[i] = P[i] ^ sw.key;
+        offp = 0;
+        for (i = 0; i < plen; i += 2)
+          sw = _streamtoword(data, offp), offp = sw.offp, lr[0] ^= sw.key, sw = _streamtoword(data, offp), offp = sw.offp, lr[1] ^= sw.key, lr = _encipher(lr, 0, P, S), P[i] = lr[0], P[i + 1] = lr[1];
+        for (i = 0; i < slen; i += 2)
+          sw = _streamtoword(data, offp), offp = sw.offp, lr[0] ^= sw.key, sw = _streamtoword(data, offp), offp = sw.offp, lr[1] ^= sw.key, lr = _encipher(lr, 0, P, S), S[i] = lr[0], S[i + 1] = lr[1];
+      }
+      function _crypt(b, salt, rounds, callback, progressCallback) {
+        var cdata = C_ORIG.slice(), clen = cdata.length, err;
+        if (rounds < 4 || rounds > 31) {
+          err = Error("Illegal number of rounds (4-31): " + rounds);
+          if (callback) {
+            nextTick(callback.bind(this, err));
+            return;
+          } else
+            throw err;
+        }
+        if (salt.length !== BCRYPT_SALT_LEN) {
+          err = Error("Illegal salt length: " + salt.length + " != " + BCRYPT_SALT_LEN);
+          if (callback) {
+            nextTick(callback.bind(this, err));
+            return;
+          } else
+            throw err;
+        }
+        rounds = 1 << rounds >>> 0;
+        var P, S, i = 0, j;
+        if (Int32Array) {
+          P = new Int32Array(P_ORIG);
+          S = new Int32Array(S_ORIG);
+        } else {
+          P = P_ORIG.slice();
+          S = S_ORIG.slice();
+        }
+        _ekskey(salt, b, P, S);
+        function next() {
+          if (progressCallback)
+            progressCallback(i / rounds);
+          if (i < rounds) {
+            var start = Date.now();
+            for (; i < rounds; ) {
+              i = i + 1;
+              _key(b, P, S);
+              _key(salt, P, S);
+              if (Date.now() - start > MAX_EXECUTION_TIME)
+                break;
+            }
+          } else {
+            for (i = 0; i < 64; i++)
+              for (j = 0; j < clen >> 1; j++)
+                _encipher(cdata, j << 1, P, S);
+            var ret = [];
+            for (i = 0; i < clen; i++)
+              ret.push((cdata[i] >> 24 & 255) >>> 0), ret.push((cdata[i] >> 16 & 255) >>> 0), ret.push((cdata[i] >> 8 & 255) >>> 0), ret.push((cdata[i] & 255) >>> 0);
+            if (callback) {
+              callback(null, ret);
+              return;
+            } else
+              return ret;
+          }
+          if (callback)
+            nextTick(next);
+        }
+        if (typeof callback !== "undefined") {
+          next();
+        } else {
+          var res;
+          while (true)
+            if (typeof (res = next()) !== "undefined")
+              return res || [];
+        }
+      }
+      function _hash(s, salt, callback, progressCallback) {
+        var err;
+        if (typeof s !== "string" || typeof salt !== "string") {
+          err = Error("Invalid string / salt: Not a string");
+          if (callback) {
+            nextTick(callback.bind(this, err));
+            return;
+          } else
+            throw err;
+        }
+        var minor, offset;
+        if (salt.charAt(0) !== "$" || salt.charAt(1) !== "2") {
+          err = Error("Invalid salt version: " + salt.substring(0, 2));
+          if (callback) {
+            nextTick(callback.bind(this, err));
+            return;
+          } else
+            throw err;
+        }
+        if (salt.charAt(2) === "$")
+          minor = String.fromCharCode(0), offset = 3;
+        else {
+          minor = salt.charAt(2);
+          if (minor !== "a" && minor !== "b" && minor !== "y" || salt.charAt(3) !== "$") {
+            err = Error("Invalid salt revision: " + salt.substring(2, 4));
+            if (callback) {
+              nextTick(callback.bind(this, err));
+              return;
+            } else
+              throw err;
+          }
+          offset = 4;
+        }
+        if (salt.charAt(offset + 2) > "$") {
+          err = Error("Missing salt rounds");
+          if (callback) {
+            nextTick(callback.bind(this, err));
+            return;
+          } else
+            throw err;
+        }
+        var r1 = parseInt(salt.substring(offset, offset + 1), 10) * 10, r2 = parseInt(salt.substring(offset + 1, offset + 2), 10), rounds = r1 + r2, real_salt = salt.substring(offset + 3, offset + 25);
+        s += minor >= "a" ? "\0" : "";
+        var passwordb = stringToBytes(s), saltb = base64_decode(real_salt, BCRYPT_SALT_LEN);
+        function finish(bytes) {
+          var res = [];
+          res.push("$2");
+          if (minor >= "a")
+            res.push(minor);
+          res.push("$");
+          if (rounds < 10)
+            res.push("0");
+          res.push(rounds.toString());
+          res.push("$");
+          res.push(base64_encode(saltb, saltb.length));
+          res.push(base64_encode(bytes, C_ORIG.length * 4 - 1));
+          return res.join("");
+        }
+        if (typeof callback == "undefined")
+          return finish(_crypt(passwordb, saltb, rounds));
+        else {
+          _crypt(passwordb, saltb, rounds, function(err2, bytes) {
+            if (err2)
+              callback(err2, null);
+            else
+              callback(null, finish(bytes));
+          }, progressCallback);
+        }
+      }
+      bcrypt2.encodeBase64 = base64_encode;
+      bcrypt2.decodeBase64 = base64_decode;
+      return bcrypt2;
+    });
+  }
+});
+
+// ../../node_modules/.pnpm/bcryptjs@2.4.3/node_modules/bcryptjs/index.js
+var require_bcryptjs = __commonJS({
+  "../../node_modules/.pnpm/bcryptjs@2.4.3/node_modules/bcryptjs/index.js"(exports, module) {
+    module.exports = require_bcrypt();
+  }
+});
+
+// src/index.ts
 import { Command } from "commander";
-import { FloomError } from "@floom/shared";
-import { log } from "./lib/output.js";
-import { loginCommand } from "./commands/login.js";
-import { logoutCommand } from "./commands/logout.js";
-import { whoamiCommand } from "./commands/whoami.js";
-import { initCommand } from "./commands/init.js";
-import { validateCommand } from "./commands/validate.js";
-import { publishCommand } from "./commands/publish.js";
-import { installCommand } from "./commands/install.js";
-import { installedCommand } from "./commands/installed.js";
-import { outdatedCommand } from "./commands/outdated.js";
-import { updateCommand } from "./commands/update.js";
-import { listCommand } from "./commands/list.js";
-import { infoCommand } from "./commands/info.js";
-import { shareCommand, unshareCommand } from "./commands/share.js";
-import { libraryCreateCommand, libraryInviteCommand, libraryLeaveCommand, libraryListCommand } from "./commands/library.js";
-import { VERSION } from "./version.js";
-const program = new Command();
-program
-    .name("floom")
-    .description("Floom CLI — publish, install, sync, and share AI agent skills.")
-    .version(VERSION);
-program.command("login").description("Log in via browser (device code).").action(loginCommand);
+
+// ../shared/src/manifest.ts
+import { z } from "zod";
+var slugSchema = z.string().regex(
+  /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/,
+  "name must be lowercase letters/digits/hyphens, 3-64 chars, start+end alphanumeric"
+);
+var semverSchema = z.string().regex(
+  /^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$/,
+  "version must be semver (e.g. 0.1.0 or 1.0.0-beta.1)"
+);
+var skillTargetSchema = z.enum([
+  "generic",
+  "claude",
+  "codex",
+  "cursor",
+  "gemini",
+  "opencode",
+  "kimi",
+  "custom"
+]);
+var authorSchema = z.object({
+  name: z.string().min(1),
+  email: z.string().email().optional()
+});
+var declaredScriptSchema = z.object({
+  path: z.string(),
+  description: z.string().max(280)
+});
+var manifestSchema = z.object({
+  schema_version: z.literal("0.1"),
+  name: slugSchema,
+  title: z.string().min(1).max(120),
+  description: z.string().min(1).max(500),
+  version: semverSchema,
+  entrypoint: z.string().default("SKILL.md"),
+  targets: z.array(skillTargetSchema).default(["generic"]),
+  tags: z.array(z.string().min(1).max(32)).max(10).optional(),
+  authors: z.array(authorSchema).optional(),
+  license: z.string().optional(),
+  homepage: z.string().url().optional(),
+  repository: z.string().url().optional(),
+  source_url: z.string().url().optional(),
+  declared_scripts: z.array(declaredScriptSchema).optional(),
+  min_floom_version: semverSchema.optional()
+}).strict();
+function parseManifest(raw) {
+  const result = manifestSchema.safeParse(raw);
+  if (result.success) return { ok: true, manifest: result.data };
+  const issue = result.error.issues[0];
+  return {
+    ok: false,
+    error: `${issue.path.join(".") || "manifest"}: ${issue.message}`
+  };
+}
+async function readManifest(skillDir) {
+  const { readFile: readFile9 } = await import("node:fs/promises");
+  const { join: join12 } = await import("node:path");
+  try {
+    const raw = await readFile9(join12(skillDir, "skill.json"), "utf8");
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (e) {
+      return { ok: false, error: `skill.json is not valid JSON: ${e.message}` };
+    }
+    return parseManifest(parsed);
+  } catch (e) {
+    const err = e;
+    if (err.code === "ENOENT") return { ok: false, error: "skill.json not found" };
+    return { ok: false, error: `failed to read skill.json: ${err.message}` };
+  }
+}
+
+// ../shared/src/slug.ts
+var SLUG_RE = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;
+function isValidSlug(input) {
+  return typeof input === "string" && SLUG_RE.test(input);
+}
+function slugErrorMessage(input) {
+  if (typeof input !== "string") return "must be a string";
+  if (input.length < 3) return "must be at least 3 characters";
+  if (input.length > 64) return "must be at most 64 characters";
+  if (!/^[a-z0-9]/.test(input)) return "must start with a lowercase letter or digit";
+  if (!/[a-z0-9]$/.test(input)) return "must end with a lowercase letter or digit";
+  if (!/^[a-z0-9-]+$/.test(input)) return "may only contain lowercase letters, digits, and hyphens";
+  return null;
+}
+var REF_RE = /^@([a-z0-9][a-z0-9-]{1,30}[a-z0-9])\/([a-z0-9][a-z0-9-]{1,62}[a-z0-9])(?:@([^@/]+))?$/;
+var LIB_REF_RE = /^([a-z0-9][a-z0-9-]{1,62}[a-z0-9])\/([a-z0-9][a-z0-9-]{1,62}[a-z0-9])(?:@([^@/]+))?$/;
+function parseSkillRef(input) {
+  const m = REF_RE.exec(input);
+  if (m) {
+    const [, owner2, slug2, version2] = m;
+    return version2 ? { owner: owner2, slug: slug2, version: version2 } : { owner: owner2, slug: slug2 };
+  }
+  const m2 = LIB_REF_RE.exec(input);
+  if (!m2) return null;
+  const [, owner, slug, version] = m2;
+  return version ? { owner, slug, version, isLibraryRef: true } : { owner, slug, isLibraryRef: true };
+}
+function formatSkillRef(ref) {
+  return ref.version ? `@${ref.owner}/${ref.slug}@${ref.version}` : `@${ref.owner}/${ref.slug}`;
+}
+
+// ../shared/src/errors.ts
+var FloomError = class extends Error {
+  code;
+  details;
+  constructor(code, message, details) {
+    super(message);
+    this.name = "FloomError";
+    this.code = code;
+    this.details = details;
+  }
+};
+
+// ../shared/src/frontmatter.ts
+function parseSkillFrontmatter(input) {
+  const trimmed = input.replace(/^\uFEFF/, "");
+  if (!trimmed.startsWith("---")) {
+    return { meta: { extras: {} }, body: input };
+  }
+  const afterOpen = trimmed.slice(3);
+  const closeMatch = afterOpen.match(/\r?\n---\s*(?:\r?\n|$)/);
+  if (!closeMatch || closeMatch.index === void 0) {
+    return { meta: { extras: {} }, body: input };
+  }
+  const headerBlock = afterOpen.slice(0, closeMatch.index);
+  const body = afterOpen.slice(closeMatch.index + closeMatch[0].length);
+  const meta = { extras: {} };
+  for (const rawLine of headerBlock.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    const colon = line.indexOf(":");
+    if (colon === -1) continue;
+    const key = line.slice(0, colon).trim().toLowerCase();
+    let value = line.slice(colon + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    if (key === "name") meta.name = value;
+    else if (key === "description") meta.description = value;
+    else meta.extras[key] = value;
+  }
+  return { meta, body };
+}
+function validateSkillFrontmatter(meta) {
+  if (!meta.name) return "SKILL.md frontmatter missing required 'name' field";
+  if (!meta.description) return "SKILL.md frontmatter missing required 'description' field";
+  if (meta.description.length > 500) return "SKILL.md description must be at most 500 characters";
+  return null;
+}
+
+// ../shared/src/api-keys.ts
+var import_bcryptjs = __toESM(require_bcryptjs(), 1);
+import { randomBytes, scrypt as scryptCb, timingSafeEqual, createHash } from "node:crypto";
+import { promisify } from "node:util";
+var scrypt = promisify(scryptCb);
+
+// ../shared/src/install-targets.ts
+import { homedir } from "node:os";
+import { join } from "node:path";
+var COMPATIBLE_AGENTS = {
+  generic: ["Claude Code", "Codex CLI", "Cursor", "Gemini CLI", "OpenCode", "Kimi CLI"],
+  all: ["Claude Code", "Codex CLI", "Cursor", "Gemini CLI", "OpenCode", "Kimi CLI"],
+  claude: ["Claude Code", "OpenCode", "Kimi CLI"],
+  codex: ["Codex CLI", "Gemini CLI (via interop alias)", "OpenCode", "Kimi CLI", "Cursor (auto-import)"],
+  cursor: ["Cursor (auto-import)", "Codex CLI", "OpenCode", "Kimi CLI"],
+  gemini: ["Gemini CLI"],
+  opencode: ["OpenCode", "Claude Code", "Codex CLI", "Kimi CLI"],
+  kimi: ["Kimi CLI", "Claude Code", "OpenCode"]
+};
+function presetDir(target, opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const root = opts.global ? homedir() : cwd;
+  switch (target) {
+    case "claude":
+      return join(root, ".claude", "skills");
+    case "gemini":
+      return join(root, ".gemini", "skills");
+    case "codex":
+    case "cursor":
+    case "generic":
+    case "all":
+    case "opencode":
+    case "kimi":
+    default:
+      return join(root, ".agents", "skills");
+  }
+}
+function resolveInstallDir(args) {
+  if (args.to) {
+    return {
+      target: args.target ?? "generic",
+      dir: args.to,
+      origin: "explicit",
+      compatibleAgents: COMPATIBLE_AGENTS[args.target ?? "generic"]
+    };
+  }
+  if (process.env.FLOOM_SKILLS_DIR) {
+    return {
+      target: args.target ?? "generic",
+      dir: process.env.FLOOM_SKILLS_DIR,
+      origin: "env",
+      compatibleAgents: COMPATIBLE_AGENTS[args.target ?? "generic"]
+    };
+  }
+  const target = args.target ?? "generic";
+  return {
+    target,
+    dir: presetDir(target, { global: args.global, cwd: args.cwd }),
+    origin: "preset",
+    compatibleAgents: COMPATIBLE_AGENTS[target]
+  };
+}
+
+// ../shared/src/security-scan.ts
+import { readFile } from "node:fs/promises";
+var PATTERNS = [
+  { label: "OpenAI API key", category: "secret", regex: /\bsk-proj-[A-Za-z0-9_-]{20,}\b/g },
+  { label: "OpenAI API key", category: "secret", regex: /\bsk-[A-Za-z0-9]{32,}\b/g },
+  { label: "Anthropic API key", category: "secret", regex: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
+  { label: "Google API key", category: "secret", regex: /\bAIza[0-9A-Za-z_-]{25,}\b/g },
+  { label: "GitHub token", category: "secret", regex: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{30,}\b/g },
+  { label: "GitHub token", category: "secret", regex: /\bgithub_pat_[A-Za-z0-9_]{40,}\b/g },
+  { label: "Supabase access token", category: "secret", regex: /\bsbp_[A-Za-z0-9]{30,}\b/g },
+  { label: "Stripe secret key", category: "secret", regex: /\bsk_(?:live|test)_[A-Za-z0-9]{20,}\b/g },
+  { label: "Slack token", category: "secret", regex: /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/g },
+  { label: "AWS access key", category: "secret", regex: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g },
+  { label: "Floom API token", category: "secret", regex: /\bflm_v1_[A-Za-z0-9_-]{14}_[A-Za-z0-9_-]{32}\b/g },
+  { label: "Private key", category: "secret", regex: /-----BEGIN (?:RSA |EC |OPENSSH |)PRIVATE KEY-----/g },
+  { label: "Prompt injection instruction", category: "prompt_injection", regex: /\bignore (?:all )?(?:previous|prior|above|earlier) instructions\b/gi },
+  { label: "Prompt injection instruction", category: "prompt_injection", regex: /\bdisregard (?:all )?(?:previous|prior|above|earlier) instructions\b/gi },
+  { label: "Prompt injection instruction", category: "prompt_injection", regex: /\bforget (?:all )?(?:previous|prior|above|earlier) instructions\b/gi },
+  { label: "Prompt injection instruction", category: "prompt_injection", regex: /\boverride (?:the )?(?:system|developer|safety) instructions\b/gi },
+  { label: "System prompt extraction", category: "prompt_injection", regex: /\b(?:reveal|print|show|dump|expose|leak) (?:the )?(?:system prompt|developer message|hidden instructions)\b/gi },
+  { label: "Data exfiltration instruction", category: "data_exfiltration", regex: /\b(?:send|post|upload|exfiltrate|copy) (?:[^.\n]{0,80})\b(?:api keys?|tokens?|secrets?|environment variables|\.env|credentials)\b(?:[^.\n]{0,120})\b(?:to|into) https?:\/\//gi },
+  { label: "Data exfiltration instruction", category: "data_exfiltration", regex: /\b(?:curl|wget|fetch)\b[^\n]{0,160}\b(?:api keys?|tokens?|secrets?|environment variables|\.env|credentials)\b/gi },
+  { label: "Credential harvesting instruction", category: "data_exfiltration", regex: /\b(?:collect|harvest|steal|extract) (?:[^.\n]{0,80})\b(?:api keys?|tokens?|secrets?|environment variables|\.env|credentials)\b/gi },
+  { label: "Possible personal email address", category: "personal_data", severity: "medium", regex: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi },
+  { label: "Possible phone number", category: "personal_data", severity: "medium", regex: /\b(?:\+?\d[\s().-]?){9,}\d\b/g },
+  { label: "Dangerous shell command", category: "data_exfiltration", regex: /\bcurl\b[^\n|]{0,120}\|\s*(?:sh|bash)\b/gi },
+  { label: "Dangerous shell command", category: "data_exfiltration", regex: /\brm\s+-rf\s+(?:\/|\$HOME|~)\b/g }
+];
+var GENERIC_ASSIGNMENT_RE = /\b(?:api[_-]?key|secret|access[_-]?token|auth[_-]?token|bearer[_-]?token)\b\s*[:=]\s*["']?([A-Za-z0-9_./+=-]{24,})["']?/gi;
+var PROVIDER_LIKE_ASSIGNMENT_RE = /\b(?:api[_-]?key|secret|access[_-]?token|auth[_-]?token|bearer[_-]?token)\b\s*[:=]\s*["']?((?:sk|pk|rk)-[A-Za-z0-9_-]{8,}|sbp_[A-Za-z0-9]{12,}|xox[baprs]-[A-Za-z0-9-]{12,})["']?/gi;
+var PLACEHOLDER_RE = /(?:^|[_./+=-])(?:your|example|sample|placeholder|replace|changeme|todo|xxx|test|demo|dummy|fake|mock|staging|dev|local|redacted)(?:$|[_./+=-])/i;
+var EXAMPLE_EMAIL_RE = /@(example\.(?:com|org|net)|example|test|localhost)$/i;
+var TEXT_FILE_RE = /\.(?:md|mdx|txt|json|jsonc|ya?ml|toml|ini|env|example|ts|tsx|js|jsx|mjs|cjs|py|rb|go|rs|java|kt|sh|bash|zsh|fish|ps1|sql|html|css|csv)$/i;
+var FORBIDDEN_FILE_PATTERNS = [
+  { label: "Environment file", severity: "high", regex: /(^|\/)\.env(?:$|\.local$|\.production$|\.development$)/ },
+  { label: "Private key file", severity: "high", regex: /(^|\/)(?:id_rsa|id_ed25519|.*\.(?:pem|key|p12|pfx))$/i },
+  { label: "npm credentials file", severity: "high", regex: /(^|\/)\.npmrc$/ },
+  { label: "Credentials file", severity: "high", regex: /(^|\/)(?:credentials|service-account|service_account)\.json$/i },
+  { label: "Example environment file", severity: "medium", regex: /(^|\/)\.env\.example$/ }
+];
+function redact(value) {
+  if (value.length <= 12) return "[redacted]";
+  return `${value.slice(0, 4)}...${value.slice(-4)}`;
+}
+function lineNumberAt(input, index) {
+  let line = 1;
+  for (let i = 0; i < index; i++) {
+    if (input.charCodeAt(i) === 10) line++;
+  }
+  return line;
+}
+function isProbablyText(buf, path) {
+  if (TEXT_FILE_RE.test(path)) return true;
+  if (buf.includes(0)) return false;
+  const sample = buf.subarray(0, Math.min(buf.length, 4096));
+  let suspicious = 0;
+  for (const byte of sample) {
+    if (byte < 9 || byte > 13 && byte < 32) suspicious++;
+  }
+  return sample.length === 0 || suspicious / sample.length < 0.02;
+}
+function scanSkillText(input, opts = {}) {
+  const findings = [];
+  const seen = /* @__PURE__ */ new Set();
+  const push = (label, category, severity, index, value) => {
+    const key = `${opts.path ?? ""}:${label}:${category}:${index}:${value}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    findings.push({ label, category, path: opts.path, severity, line: lineNumberAt(input, index), preview: redact(value.replace(/\s+/g, " ").trim()) });
+  };
+  for (const pattern of PATTERNS) {
+    pattern.regex.lastIndex = 0;
+    for (const match of input.matchAll(pattern.regex)) {
+      const value = match[0] ?? "";
+      if (pattern.category === "personal_data" && EXAMPLE_EMAIL_RE.test(value)) continue;
+      push(pattern.label, pattern.category, pattern.severity ?? "high", match.index ?? 0, value);
+    }
+  }
+  GENERIC_ASSIGNMENT_RE.lastIndex = 0;
+  for (const match of input.matchAll(GENERIC_ASSIGNMENT_RE)) {
+    const value = match[1] ?? "";
+    if (!value || PLACEHOLDER_RE.test(value)) continue;
+    push("Possible secret assignment", "secret", "high", match.index ?? 0, value);
+  }
+  PROVIDER_LIKE_ASSIGNMENT_RE.lastIndex = 0;
+  for (const match of input.matchAll(PROVIDER_LIKE_ASSIGNMENT_RE)) {
+    const value = match[1] ?? "";
+    if (!value) continue;
+    push("Provider-like secret assignment", "secret", "high", match.index ?? 0, value);
+  }
+  return findings.sort((a, b) => (a.path ?? "").localeCompare(b.path ?? "") || a.line - b.line || a.label.localeCompare(b.label));
+}
+function scanSkillMarkdown(input) {
+  return scanSkillText(input);
+}
+function isBlockingSecurityFinding(finding) {
+  return finding.severity === "high" && (finding.category === "secret" || finding.category === "data_exfiltration" || finding.category === "unsafe_file");
+}
+async function scanSkillBundleEntries(entries) {
+  const findings = [];
+  for (const entry of entries) {
+    for (const rule of FORBIDDEN_FILE_PATTERNS) {
+      if (rule.regex.test(entry.relPath)) {
+        findings.push({ label: rule.label, path: entry.relPath, line: 1, preview: entry.relPath, severity: rule.severity, category: "unsafe_file" });
+      }
+    }
+    if (!isProbablyText(entry.data, entry.relPath)) continue;
+    findings.push(...scanSkillText(entry.data.toString("utf8"), { path: entry.relPath }));
+  }
+  return findings.sort((a, b) => (a.path ?? "").localeCompare(b.path ?? "") || a.line - b.line || a.label.localeCompare(b.label));
+}
+async function scanSkillBundleFiles(files) {
+  const entries = [];
+  for (const file of files) {
+    const buf = await readFile(file.absPath);
+    entries.push({ relPath: file.relPath, data: buf });
+  }
+  return scanSkillBundleEntries(entries);
+}
+
+// ../shared/src/skill-package.ts
+import { readFile as readFile2, readdir, stat, lstat, mkdir } from "node:fs/promises";
+import { join as join2, relative, sep, posix } from "node:path";
+import { createHash as createHash2 } from "node:crypto";
+var LIMITS = {
+  maxBundleBytes: 10 * 1024 * 1024,
+  // 10 MB compressed
+  maxUncompressedBytes: 50 * 1024 * 1024,
+  maxFiles: 100,
+  maxFileBytes: 2 * 1024 * 1024,
+  // 2 MB per file
+  maxPathLength: 200
+};
+var DEFAULT_IGNORE = [
+  ".git",
+  "node_modules",
+  "dist",
+  "build",
+  ".next",
+  ".cache",
+  ".DS_Store",
+  ".env",
+  ".env.local",
+  ".env.development",
+  ".env.production",
+  "*.pem",
+  "*.key",
+  "*.p12",
+  "*.sqlite",
+  "*.db"
+];
+function matchesGlob(name, pat) {
+  if (pat.includes("*")) {
+    const re = new RegExp("^" + pat.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*") + "$");
+    return re.test(name);
+  }
+  return name === pat;
+}
+function isIgnored(relPath, patterns) {
+  const parts = relPath.split(posix.sep);
+  for (const pat of patterns) {
+    const cleanPat = pat.replace(/^\/|\/$/g, "");
+    if (parts.some((p) => matchesGlob(p, cleanPat))) return true;
+  }
+  return false;
+}
+async function loadFloomIgnore(dir) {
+  try {
+    const raw = await readFile2(join2(dir, ".floomignore"), "utf8");
+    return raw.split(/\r?\n/).map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
+  } catch {
+    return [];
+  }
+}
+async function walk(rootDir, ignore, acc, current) {
+  const entries = await readdir(current, { withFileTypes: true });
+  for (const entry of entries) {
+    const abs = join2(current, entry.name);
+    const rel = relative(rootDir, abs).split(sep).join(posix.sep);
+    if (entry.isSymbolicLink()) {
+      throw new Error(`Symlinks are not allowed: ${rel}`);
+    }
+    if (isIgnored(rel, ignore)) continue;
+    if (entry.isDirectory()) {
+      await walk(rootDir, ignore, acc, abs);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    const ls = await lstat(abs);
+    if (ls.isSymbolicLink()) throw new Error(`Symlinks are not allowed: ${rel}`);
+    if (rel.length > LIMITS.maxPathLength) {
+      throw new Error(`Path too long (>${LIMITS.maxPathLength} chars): ${rel}`);
+    }
+    if (rel.includes("..")) {
+      throw new Error(`Path traversal detected: ${rel}`);
+    }
+    const buf = await readFile2(abs);
+    if (buf.length > LIMITS.maxFileBytes) {
+      throw new Error(`File too large (${buf.length} > ${LIMITS.maxFileBytes}): ${rel}`);
+    }
+    const sha256 = createHash2("sha256").update(buf).digest("hex");
+    acc.push({ relPath: rel, absPath: abs, size: buf.length, sha256 });
+  }
+}
+async function collectBundle(rootDir) {
+  const st = await stat(rootDir);
+  if (!st.isDirectory()) throw new Error(`Not a directory: ${rootDir}`);
+  const ignore = [...DEFAULT_IGNORE, ...await loadFloomIgnore(rootDir)];
+  const files = [];
+  await walk(rootDir, ignore, files, rootDir);
+  files.sort((a, b) => a.relPath.localeCompare(b.relPath));
+  if (files.length === 0) throw new Error("No files to bundle (after applying ignores)");
+  if (files.length > LIMITS.maxFiles) {
+    throw new Error(`Too many files (${files.length} > ${LIMITS.maxFiles})`);
+  }
+  const total = files.reduce((n, f) => n + f.size, 0);
+  if (total > LIMITS.maxUncompressedBytes) {
+    throw new Error(`Bundle too large uncompressed (${total} > ${LIMITS.maxUncompressedBytes})`);
+  }
+  const hasScripts = files.some((f) => f.relPath.startsWith("scripts/"));
+  return { rootDir, files, totalUncompressedBytes: total, hasScripts };
+}
+async function packBundle(bundle) {
+  const tar = await import("tar");
+  const stream = tar.create(
+    {
+      gzip: { level: 9 },
+      cwd: bundle.rootDir,
+      portable: true,
+      noMtime: true
+    },
+    bundle.files.map((f) => f.relPath)
+  );
+  const chunks = [];
+  for await (const chunk of stream) {
+    chunks.push(Buffer.from(chunk));
+  }
+  const buf = Buffer.concat(chunks);
+  if (buf.length > LIMITS.maxBundleBytes) {
+    throw new Error(`Compressed bundle too large (${buf.length} > ${LIMITS.maxBundleBytes})`);
+  }
+  return { bytes: buf, sha256: createHash2("sha256").update(buf).digest("hex") };
+}
+async function extractBundle(buf, destDir) {
+  const tar = await import("tar");
+  const { Readable } = await import("node:stream");
+  await mkdir(destDir, { recursive: true });
+  await new Promise((resolve3, reject) => {
+    const extractStream = tar.extract({
+      cwd: destDir,
+      strict: true,
+      preserveOwner: false,
+      filter: (path) => {
+        if (path.startsWith("/") || path.includes("..")) return false;
+        if (path.length > LIMITS.maxPathLength) return false;
+        return true;
+      },
+      onwarn: (_code, msg) => {
+        if (msg.toLowerCase().includes("symlink")) reject(new Error("Bundle contains symlinks"));
+      }
+    });
+    Readable.from(buf).pipe(extractStream).on("finish", () => resolve3()).on("error", reject);
+  });
+}
+function verifyBundleHash(buf, expected) {
+  const actual = createHash2("sha256").update(buf).digest("hex");
+  return actual === expected;
+}
+
+// src/lib/output.ts
+import chalk from "chalk";
+var log = {
+  info: (msg) => console.log(msg),
+  ok: (msg) => console.log(chalk.green("\u2713 ") + msg),
+  warn: (msg) => console.log(chalk.yellow("! ") + msg),
+  err: (msg) => console.error(chalk.red("\u2717 ") + msg),
+  step: (msg) => console.log(chalk.dim("\xB7 ") + msg),
+  heading: (msg) => console.log("\n" + chalk.bold(msg)),
+  kv: (key, value) => console.log(`  ${chalk.dim(key.padEnd(16))}${value}`),
+  blank: () => console.log("")
+};
+
+// src/commands/login.ts
+import { exec } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+
+// src/config.ts
+import { homedir as homedir2 } from "node:os";
+import { join as join3 } from "node:path";
+import { mkdir as mkdir2, readFile as readFile3, writeFile, chmod } from "node:fs/promises";
+var CONFIG_DIR = join3(homedir2(), ".floom");
+var AUTH_FILE = join3(CONFIG_DIR, "auth.json");
+var DEFAULT_APP_URL = "https://floom.dev";
+var DEFAULT_API_URL = "https://floom-v0.vercel.app/api/v1";
+async function ensureDir() {
+  await mkdir2(CONFIG_DIR, { recursive: true, mode: 448 });
+}
+async function readAuth() {
+  try {
+    const raw = await readFile3(AUTH_FILE, "utf8");
+    return JSON.parse(raw);
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  }
+}
+async function writeAuth(state) {
+  await ensureDir();
+  await writeFile(AUTH_FILE, JSON.stringify(state, null, 2), { mode: 384 });
+  try {
+    await chmod(AUTH_FILE, 384);
+  } catch {
+  }
+}
+async function clearAuth() {
+  const { unlink } = await import("node:fs/promises");
+  try {
+    await unlink(AUTH_FILE);
+  } catch {
+  }
+}
+function getApiUrl() {
+  if (process.env.FLOOM_API_URL) return process.env.FLOOM_API_URL;
+  if (process.env.FLOOM_APP_URL) return `${getAppUrl().replace(/\/$/, "")}/api/v1`;
+  return DEFAULT_API_URL;
+}
+function getAppUrl() {
+  return process.env.FLOOM_APP_URL ?? DEFAULT_APP_URL;
+}
+function getApiBaseUrls(preferred) {
+  const explicitApiUrl = process.env.FLOOM_API_URL?.trim();
+  if (explicitApiUrl) return [explicitApiUrl.replace(/\/$/, "")];
+  const primary = (preferred ?? getApiUrl()).replace(/\/$/, "");
+  const bases = [primary];
+  if (preferred && !process.env.FLOOM_APP_URL) bases.push(DEFAULT_API_URL);
+  return Array.from(new Set(bases));
+}
+
+// src/version.ts
+var VERSION = "0.2.1";
+
+// src/api-client.ts
+var DEFAULT_TIMEOUT_MS = 2e4;
+function timeoutMs() {
+  const raw = Number(process.env.FLOOM_API_TIMEOUT_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_TIMEOUT_MS;
+}
+async function fetchWithTimeout(url, init = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs());
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } catch (e) {
+    if (e.name === "AbortError") {
+      throw new Error(`Request timed out after ${timeoutMs()}ms`);
+    }
+    throw e;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function api(path, opts = {}) {
+  const auth = await readAuth();
+  if (opts.authRequired && !auth) {
+    throw new FloomError("AUTH_REQUIRED", "Not logged in. Run: floom login");
+  }
+  let lastError = null;
+  const bases = getApiBaseUrls(auth?.apiUrl);
+  for (const base of bases) {
+    const url = new URL(base + path);
+    if (opts.query) {
+      for (const [k, v] of Object.entries(opts.query)) {
+        if (v !== void 0) url.searchParams.set(k, String(v));
+      }
+    }
+    const headers = {
+      "Content-Type": "application/json",
+      "User-Agent": `floom-cli/${VERSION}`,
+      "x-floom-cli-version": VERSION
+    };
+    if (auth) headers.Authorization = `Bearer ${auth.token}`;
+    let res;
+    try {
+      res = await fetchWithTimeout(url.toString(), {
+        method: opts.method ?? "GET",
+        headers,
+        body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0
+      });
+    } catch (e) {
+      lastError = new FloomError(
+        "INTERNAL_ERROR",
+        `Unable to reach Floom API at ${base}: ${e.message}`,
+        { apiUrl: base }
+      );
+      continue;
+    }
+    const text = await res.text();
+    let json = null;
+    try {
+      json = text ? JSON.parse(text) : null;
+    } catch {
+    }
+    if (res.ok) return json;
+    const err = json?.error ?? {};
+    lastError = new FloomError(
+      err.code ?? "INTERNAL_ERROR",
+      err.message ?? `HTTP ${res.status} ${res.statusText}`,
+      { status: res.status, requestId: err.request_id, apiUrl: base }
+    );
+    if (res.status !== 404 || json?.error) break;
+  }
+  throw lastError ?? new FloomError("INTERNAL_ERROR", "API request failed");
+}
+async function rawPut(url, body, contentType = "application/octet-stream") {
+  const u8 = body instanceof Buffer ? new Uint8Array(body) : body;
+  let res;
+  try {
+    res = await fetchWithTimeout(url, {
+      method: "PUT",
+      headers: { "Content-Type": contentType },
+      body: u8
+    });
+  } catch (e) {
+    throw new FloomError("UPLOAD_FAILED", `Upload failed: ${e.message}`);
+  }
+  if (!res.ok) {
+    throw new FloomError(
+      "UPLOAD_FAILED",
+      `Upload failed: HTTP ${res.status} ${res.statusText}`
+    );
+  }
+}
+async function rawGet(url) {
+  let res;
+  try {
+    res = await fetchWithTimeout(url);
+  } catch (e) {
+    throw new FloomError("DOWNLOAD_FAILED", `Download failed: ${e.message}`);
+  }
+  if (!res.ok) {
+    throw new FloomError(
+      "DOWNLOAD_FAILED",
+      `Download failed: HTTP ${res.status} ${res.statusText}`
+    );
+  }
+  const ab = await res.arrayBuffer();
+  return Buffer.from(ab);
+}
+
+// src/commands/login.ts
+var sh = promisify2(exec);
+async function openInBrowser(url) {
+  const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  try {
+    await sh(`${opener} ${JSON.stringify(url)}`);
+  } catch {
+  }
+}
+async function loginCommand() {
+  log.heading("Starting CLI login...");
+  const session = await api("/cli/sessions", {
+    method: "POST",
+    body: { client: "floom-cli", version: VERSION }
+  });
+  log.info("");
+  log.info(`Open this URL in your browser:`);
+  log.info(`  ${session.verification_uri}`);
+  log.info("");
+  log.info(`Your code: ${session.user_code}`);
+  log.info("");
+  log.info("Waiting for approval in the browser. Press Ctrl+C to cancel.");
+  openInBrowser(session.verification_uri).catch(() => {
+  });
+  const deadline = new Date(session.expires_at).getTime();
+  const interval = Math.max(2, session.poll_interval_seconds) * 1e3;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, interval));
+    const pollPath = `/cli/sessions/${session.session_id}?device_code=${encodeURIComponent(session.device_code)}`;
+    const poll = await api(pollPath);
+    if (poll.status === "approved" && poll.token && poll.handle && poll.email) {
+      await writeAuth({
+        token: poll.token,
+        handle: poll.handle,
+        email: poll.email,
+        apiUrl: getApiUrl()
+      });
+      log.ok(`Logged in as @${poll.handle} (${poll.email})`);
+      log.info("");
+      log.info("Next:");
+      log.info("  floom init");
+      log.info("  floom publish");
+      log.info(`  floom install @${poll.handle}/your-skill --for codex`);
+      return;
+    }
+    if (poll.status === "denied") {
+      log.err("Login denied.");
+      process.exit(1);
+    }
+    if (poll.status === "expired") {
+      log.err("Login session expired. Run `floom login` again.");
+      process.exit(1);
+    }
+    process.stdout.write(".");
+  }
+  log.err("Login timed out.");
+  process.exit(1);
+}
+
+// src/commands/logout.ts
+async function logoutCommand() {
+  const auth = await readAuth();
+  if (!auth) {
+    log.info("Not logged in.");
+    return;
+  }
+  try {
+    await api("/cli/sessions/revoke", { method: "POST", authRequired: true });
+  } catch {
+  }
+  await clearAuth();
+  log.ok("Logged out.");
+}
+
+// src/commands/whoami.ts
+async function whoamiCommand() {
+  const auth = await readAuth();
+  if (!auth) {
+    log.info("Not logged in. Run: floom login");
+    return;
+  }
+  log.heading("Logged in as:");
+  log.kv("handle", `@${auth.handle}`);
+  log.kv("email", auth.email);
+  log.kv("api url", auth.apiUrl);
+}
+
+// src/commands/init.ts
+import { writeFile as writeFile2, stat as stat2 } from "node:fs/promises";
+import { join as join4, basename } from "node:path";
+import prompts from "prompts";
+async function pathExists(p) {
+  try {
+    await stat2(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function initCommand() {
+  const cwd = process.cwd();
+  const folderName = basename(cwd);
+  if (await pathExists(join4(cwd, "skill.json"))) {
+    log.err("skill.json already exists in this folder. Edit it directly or run from a fresh directory.");
+    process.exit(1);
+  }
+  const defaultName = folderName.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  const answers = await prompts([
+    {
+      type: "text",
+      name: "name",
+      message: "Skill name (lowercase, hyphens):",
+      initial: isValidSlug(defaultName) ? defaultName : "",
+      validate: (v) => slugErrorMessage(v) ?? true
+    },
+    {
+      type: "text",
+      name: "title",
+      message: "Title (human-readable):",
+      initial: (prev) => prev.split("-").map((w) => w[0]?.toUpperCase() + w.slice(1)).join(" "),
+      validate: (v) => v.trim().length > 0 ? true : "title required"
+    },
+    {
+      type: "text",
+      name: "description",
+      message: "One-line description:",
+      validate: (v) => v.trim().length > 0 ? true : "description required"
+    },
+    {
+      type: "text",
+      name: "version",
+      message: "Version:",
+      initial: "0.1.0"
+    }
+  ]);
+  if (!answers.name) {
+    log.err("Init cancelled.");
+    process.exit(1);
+  }
+  const manifest = {
+    schema_version: "0.1",
+    name: answers.name,
+    title: answers.title,
+    description: answers.description,
+    version: answers.version,
+    entrypoint: "SKILL.md",
+    targets: ["generic"]
+  };
+  const skillMd = `---
+name: ${answers.name}
+description: ${answers.description}
+---
+
+# ${answers.title}
+
+## Purpose
+
+${answers.description}
+
+## When to use
+
+(Describe when this skill should be activated.)
+
+## Process
+
+1. (Step one)
+2. (Step two)
+
+## Output
+
+(Describe what the skill produces.)
+`;
+  const floomIgnore = `# Floom CLI ignore patterns
+# One pattern per line, glob-style
+tmp/
+drafts/
+*.log
+`;
+  await writeFile2(join4(cwd, "skill.json"), JSON.stringify(manifest, null, 2) + "\n", "utf8");
+  await writeFile2(join4(cwd, "SKILL.md"), skillMd, "utf8");
+  await writeFile2(join4(cwd, ".floomignore"), floomIgnore, "utf8");
+  log.blank();
+  log.ok("Skill scaffolded.");
+  log.kv("skill.json", "manifest (edit metadata)");
+  log.kv("SKILL.md", "instructions for the agent");
+  log.kv(".floomignore", "patterns to exclude from publish");
+  log.blank();
+  log.info("Next:");
+  log.info("  1. Edit SKILL.md");
+  log.info("  2. floom validate");
+  log.info("  3. floom publish");
+}
+
+// src/commands/validate.ts
+import { readFile as readFile5 } from "node:fs/promises";
+import { join as join5 } from "node:path";
+async function validateSkill(dir) {
+  const report = {
+    ok: true,
+    manifest: { ok: true },
+    skill_md: { ok: true },
+    name_matches: { ok: false, message: "skipped because skill.json and SKILL.md are required" },
+    bundle: { ok: false, message: "skipped because skill.json and SKILL.md are required" },
+    security: { ok: false, message: "skipped because SKILL.md is required", findings: [] }
+  };
+  const m = await readManifest(dir);
+  if (!m.ok) {
+    report.manifest = { ok: false, message: m.error };
+    report.ok = false;
+  }
+  let skillMd;
+  try {
+    skillMd = await readFile5(join5(dir, "SKILL.md"), "utf8");
+  } catch {
+    report.skill_md = { ok: false, message: "SKILL.md not found" };
+    report.ok = false;
+  }
+  if (!skillMd) return report;
+  const { meta } = parseSkillFrontmatter(skillMd);
+  const fmErr = validateSkillFrontmatter(meta);
+  if (fmErr) {
+    report.skill_md = { ok: false, message: fmErr };
+    report.ok = false;
+  }
+  if (m.ok) {
+    report.name_matches = { ok: true };
+    if (meta.name && meta.name !== m.manifest.name) {
+      report.name_matches = {
+        ok: false,
+        message: `skill.json name="${m.manifest.name}" but SKILL.md frontmatter name="${meta.name}"`
+      };
+      report.ok = false;
+    }
+  }
+  report.security = { ok: true, findings: [] };
+  const findings = scanSkillMarkdown(skillMd);
+  if (findings.length > 0) {
+    const blocking = findings.filter(isBlockingSecurityFinding);
+    report.security = { ok: blocking.length === 0, findings };
+    if (blocking.length > 0) report.ok = false;
+  }
+  if (!m.ok) return report;
+  try {
+    const bundle = await collectBundle(dir);
+    const bundleFindings = await scanSkillBundleFiles(bundle.files);
+    const blocking = bundleFindings.filter(isBlockingSecurityFinding);
+    report.security = { ok: blocking.length === 0, findings: bundleFindings };
+    if (blocking.length > 0) report.ok = false;
+    report.bundle = {
+      ok: true,
+      files: bundle.files.length,
+      size: bundle.totalUncompressedBytes,
+      has_scripts: bundle.hasScripts
+    };
+  } catch (e) {
+    report.bundle = { ok: false, message: e.message };
+    report.ok = false;
+  }
+  return report;
+}
+async function validateCommand(opts = {}) {
+  const dir = process.cwd();
+  const r = await validateSkill(dir);
+  if (opts.json) {
+    console.log(JSON.stringify(r, null, 2));
+    process.exit(r.ok ? 0 : 1);
+  }
+  log.heading("Validating skill...");
+  const line = (ok, label, detail) => ok ? log.ok(`${label.padEnd(28)} ${detail ?? ""}`.trim()) : log.err(`${label.padEnd(28)} ${detail ?? ""}`.trim());
+  line(r.manifest.ok, "manifest schema", r.manifest.message);
+  line(r.skill_md.ok, "SKILL.md present", r.skill_md.message);
+  line(r.name_matches.ok, "name fields match", r.name_matches.message);
+  if (r.bundle.ok) {
+    line(true, "files + size limits", `${r.bundle.files} files, ${(r.bundle.size ?? 0) / 1024 | 0} KB`);
+  } else {
+    line(false, "files + size limits", r.bundle.message);
+  }
+  if (r.security.findings.length === 0) {
+    line(r.security.ok, "bundle security scan", r.security.message ?? "clean");
+  } else {
+    const blocking = r.security.findings.filter(isBlockingSecurityFinding).length;
+    const detail = blocking > 0 ? `${r.security.findings.length} finding(s), ${blocking} blocking` : `${r.security.findings.length} warning(s)`;
+    line(r.security.ok, "bundle security scan", detail);
+    for (const f of r.security.findings) {
+      const loc = f.path ? `${f.path}:${f.line}` : `line ${f.line}`;
+      log.warn(`  ${loc} [${f.severity}/${f.category}] ${f.label}: ${f.preview}`);
+    }
+  }
+  if (r.bundle.has_scripts) {
+    log.warn("This skill contains scripts/. Agents may execute these \u2014 review before activating.");
+  }
+  log.blank();
+  if (r.ok) {
+    log.ok("Valid.");
+  } else {
+    log.err("Invalid.");
+    process.exit(1);
+  }
+}
+
+// src/commands/publish.ts
+import { readFile as readFile6 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+async function publishCommand(opts = {}) {
+  const auth = await readAuth();
+  if (!auth && !opts.dryRun) {
+    log.err("Not logged in. Run: floom login");
+    process.exit(1);
+  }
+  const dir = process.cwd();
+  log.heading("Validating skill...");
+  const report = await validateSkill(dir);
+  if (!report.ok) {
+    log.err("Validation failed. Run `floom validate` for details.");
+    process.exit(1);
+  }
+  log.ok("Validation passed.");
+  const m = await readManifest(dir);
+  if (!m.ok) {
+    log.err(m.error);
+    process.exit(1);
+  }
+  const manifest = m.manifest;
+  const skillMd = await readFile6(join6(dir, "SKILL.md"), "utf8");
+  const { meta } = parseSkillFrontmatter(skillMd);
+  const refRoot = opts.workspace ?? opts.library ?? auth?.handle ?? "<your-handle>";
+  log.heading(`${opts.dryRun ? "Dry-running" : "Publishing"} ${refRoot}/${manifest.name}@${manifest.version}`);
+  log.step("Packing bundle...");
+  const bundle = await collectBundle(dir);
+  const packed = await packBundle(bundle);
+  log.kv("files", String(bundle.files.length));
+  log.kv("size", `${packed.bytes.length} bytes (${(packed.bytes.length / 1024).toFixed(1)} KB)`);
+  log.kv("sha256", packed.sha256);
+  if (opts.dryRun) {
+    log.blank();
+    log.ok("Dry run passed. No upload was requested.");
+    return;
+  }
+  const activeAuth = auth;
+  if (!activeAuth) {
+    log.err("Not logged in. Run: floom login");
+    process.exit(1);
+  }
+  log.step("Requesting upload URL...");
+  let initResp;
+  try {
+    initResp = await api(`/skills/${refRoot}/${manifest.name}/versions`, {
+      method: "POST",
+      authRequired: true,
+      body: {
+        manifest,
+        skill_md: skillMd,
+        bundle: {
+          sha256: packed.sha256,
+          size_bytes: packed.bytes.length
+        },
+        files: bundle.files.map((f) => ({
+          path: f.relPath,
+          sha256: f.sha256,
+          size_bytes: f.size
+        })),
+        has_scripts: bundle.hasScripts
+      }
+    });
+  } catch (e) {
+    if (e instanceof FloomError && e.code === "VERSION_ALREADY_EXISTS") {
+      log.err(`Version ${manifest.version} already exists for @${activeAuth.handle}/${manifest.name}.`);
+      log.info("Bump the version in skill.json (e.g. 0.1.1) and try again.");
+      process.exit(1);
+    }
+    throw e;
+  }
+  log.step("Uploading bundle...");
+  await rawPut(initResp.upload.url, packed.bytes, "application/gzip");
+  log.step("Finalizing...");
+  const complete = await api(`/versions/${initResp.version_id}/complete`, {
+    method: "POST",
+    authRequired: true,
+    body: { bundle_sha256: packed.sha256 }
+  });
+  log.blank();
+  log.ok(`Published ${complete.ref}`);
+  log.blank();
+  log.info("View:");
+  log.kv("", `${activeAuth.apiUrl.replace("/api/v1", "")}/@${activeAuth.handle}/${manifest.name}`);
+  log.info("Install:");
+  log.kv("", complete.install_command);
+}
+
+// src/commands/install.ts
+import { mkdir as mkdir4, readdir as readdir3, rm, rename } from "node:fs/promises";
+import { join as join8 } from "node:path";
+import { tmpdir } from "node:os";
+
+// src/lib/floom-lock.ts
+import { readFile as readFile7, writeFile as writeFile3, stat as stat3, readdir as readdir2 } from "node:fs/promises";
+import { join as join7, relative as relative2, sep as sep2, posix as posix2 } from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+var EMPTY = { schema_version: "0.1", skills: {} };
+async function readLock(projectDir) {
+  try {
+    const raw = await readFile7(join7(projectDir, "floom.lock"), "utf8");
+    const parsed = JSON.parse(raw);
+    return parsed.schema_version === "0.1" ? parsed : { ...EMPTY };
+  } catch (e) {
+    if (e.code === "ENOENT") return { ...EMPTY };
+    throw e;
+  }
+}
+async function writeLock(projectDir, lock) {
+  await writeFile3(join7(projectDir, "floom.lock"), JSON.stringify(lock, null, 2) + "\n", "utf8");
+}
+function setLockEntry(lock, ref, entry) {
+  return { ...lock, skills: { ...lock.skills, [ref]: entry } };
+}
+async function hashInstalledFolder(folderAbs) {
+  const out = [];
+  async function walk2(dir) {
+    let entries;
+    try {
+      entries = await readdir2(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const abs = join7(dir, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        await walk2(abs);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const buf = await readFile7(abs);
+      const rel = relative2(folderAbs, abs).split(sep2).join(posix2.sep);
+      out.push({
+        relPath: rel,
+        sha256: createHash3("sha256").update(buf).digest("hex"),
+        size: buf.length
+      });
+    }
+  }
+  try {
+    await stat3(folderAbs);
+  } catch {
+    return out;
+  }
+  await walk2(folderAbs);
+  out.sort((a, b) => a.relPath.localeCompare(b.relPath));
+  return out;
+}
+
+// src/commands/install.ts
+var CLI_VERSION = VERSION;
+function semverGte(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] ?? 0) > (pb[i] ?? 0)) return true;
+    if ((pa[i] ?? 0) < (pb[i] ?? 0)) return false;
+  }
+  return true;
+}
+async function installCommand(refStr, opts = {}) {
+  const ref = parseSkillRef(refStr);
+  if (!ref) {
+    log.err(`Invalid skill ref: ${refStr}`);
+    log.info("Expected: @owner/slug, workspace-slug/slug, or with @version suffix");
+    process.exit(1);
+  }
+  let info;
+  try {
+    info = await api(`/skills/${ref.owner}/${ref.slug}`);
+  } catch (e) {
+    if (e instanceof FloomError && e.code === "SKILL_ACCESS_DENIED") {
+      const auth = await readAuth();
+      if (!auth) {
+        log.err(`Cannot access ${formatSkillRef(ref)}.`);
+        log.info("Run `floom login` to install private or unlisted skills.");
+        process.exit(1);
+      }
+      log.err(`You do not have access to ${formatSkillRef(ref)}.`);
+      log.info(`Ask the owner to share it with: ${auth.email}`);
+      process.exit(1);
+    }
+    throw e;
+  }
+  if (info.min_floom_version && !semverGte(CLI_VERSION, info.min_floom_version)) {
+    log.err(`This skill requires Floom CLI >= ${info.min_floom_version} (you have ${CLI_VERSION}).`);
+    log.info("Upgrade:");
+    log.info("  npm install -g @floomhq/skills@latest");
+    process.exit(1);
+  }
+  const target = resolveInstallDir({
+    target: opts.for ?? "generic",
+    to: opts.to,
+    global: opts.global
+  });
+  const projectDir = opts.global ? process.cwd() : process.cwd();
+  const destFolder = join8(target.dir, ref.slug);
+  const lock = await readLock(projectDir);
+  const refKey = formatSkillRef({ owner: ref.owner, slug: ref.slug });
+  const existing = lock.skills[refKey];
+  let folderExists = false;
+  try {
+    const entries = await readdir3(destFolder);
+    folderExists = entries.length > 0;
+  } catch {
+  }
+  if (folderExists) {
+    if (existing && existing.path === destFolder.replace(projectDir + "/", "")) {
+      const current = await hashInstalledFolder(destFolder);
+      if (!opts.force) {
+        log.warn(`Folder already exists at ${destFolder} and may contain local edits.`);
+        log.info(`Re-run with --force to overwrite, or remove the folder manually.`);
+        process.exit(1);
+      }
+    } else if (!opts.force) {
+      log.err(`Folder already exists at ${destFolder} (not tracked by floom.lock).`);
+      log.info("Re-run with --force to overwrite, or remove the folder manually.");
+      process.exit(1);
+    }
+  }
+  log.step("Fetching skill metadata...");
+  const dl = await api(`/skills/${ref.owner}/${ref.slug}/download`, {
+    query: { version: ref.version }
+  });
+  log.step("Downloading bundle...");
+  const buf = await rawGet(dl.download.url);
+  if (!verifyBundleHash(buf, dl.bundle_sha256)) {
+    log.err("Bundle hash mismatch \u2014 refusing to extract.");
+    process.exit(1);
+  }
+  log.ok(`Bundle verified (${(buf.length / 1024).toFixed(1)} KB).`);
+  const tmp = await import("node:fs/promises").then(
+    (m) => m.mkdtemp(join8(tmpdir(), `floom-install-${ref.slug}-`))
+  );
+  try {
+    await extractBundle(buf, tmp);
+    await mkdir4(target.dir, { recursive: true });
+    if (folderExists) {
+      await rm(destFolder, { recursive: true, force: true });
+    }
+    await rename(tmp, destFolder);
+  } catch (e) {
+    await rm(tmp, { recursive: true, force: true }).catch(() => {
+    });
+    throw e;
+  }
+  const next = setLockEntry(lock, refKey, {
+    version: dl.version,
+    resolved: `${getAppUrl().replace(/\/$/, "")}/${refKey}`,
+    bundle_sha256: dl.bundle_sha256,
+    installed_at: (/* @__PURE__ */ new Date()).toISOString(),
+    path: destFolder.replace(projectDir + "/", ""),
+    preset: opts.for
+  });
+  await writeLock(projectDir, next);
+  log.blank();
+  log.ok(`Installed ${refKey}@${dl.version}`);
+  log.kv("Path", destFolder);
+  log.kv("Target", target.target);
+  log.kv("Compatible with", target.compatibleAgents.join(", "));
+  if (dl.has_scripts) {
+    log.blank();
+    log.warn("This skill contains executable scripts. Floom does not run them; your agent may.");
+    log.warn("Review the scripts/ folder before activating.");
+  }
+}
+
+// src/commands/installed.ts
+async function installedCommand(opts = {}) {
+  const lock = await readLock(process.cwd());
+  const entries = Object.entries(lock.skills);
+  if (opts.json) {
+    console.log(JSON.stringify(lock, null, 2));
+    return;
+  }
+  if (entries.length === 0) {
+    log.info("No skills installed in this project.");
+    log.info("Get one: floom install @owner/slug");
+    return;
+  }
+  log.heading("Installed skills in this project");
+  for (const [ref, e] of entries) {
+    console.log(`  ${ref.padEnd(40)} ${e.version.padEnd(8)} ${(e.preset ?? "-").padEnd(8)} ${e.path}`);
+  }
+  log.blank();
+  log.info(`${entries.length} skill${entries.length === 1 ? "" : "s"} installed.`);
+}
+
+// src/commands/outdated.ts
+function cmpSemver(a, b) {
+  const pa = a.split(".").map((p) => parseInt(p, 10));
+  const pb = b.split(".").map((p) => parseInt(p, 10));
+  for (let i = 0; i < 3; i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return d;
+  }
+  return 0;
+}
+async function outdatedCommand() {
+  const lock = await readLock(process.cwd());
+  const entries = Object.entries(lock.skills);
+  if (entries.length === 0) {
+    log.info("No skills installed.");
+    return;
+  }
+  log.heading("Checking for updates...");
+  const outdated = [];
+  for (const [ref, e] of entries) {
+    const [, owner, slug] = /^@([^/]+)\/([^@]+)/.exec(ref) ?? [];
+    if (!owner || !slug) continue;
+    try {
+      const info = await api(`/skills/${owner}/${slug}`);
+      if (cmpSemver(info.latest_version, e.version) > 0) {
+        outdated.push({ ref, current: e.version, latest: info.latest_version });
+      }
+    } catch (err) {
+      log.warn(`Could not check ${ref}: ${err.message}`);
+    }
+  }
+  log.blank();
+  if (outdated.length === 0) {
+    log.ok("All installed skills are up to date.");
+    return;
+  }
+  log.heading("Outdated skills");
+  for (const o of outdated) {
+    console.log(`  ${o.ref.padEnd(40)} ${o.current.padEnd(10)} -> ${o.latest.padEnd(10)}  floom update ${o.ref}`);
+  }
+  log.blank();
+  log.info(`${outdated.length} skill${outdated.length === 1 ? "" : "s"} can be updated.`);
+  process.exit(1);
+}
+
+// src/commands/update.ts
+import { rm as rm2, rename as rename2, mkdir as mkdir5 } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join9, resolve as resolve2 } from "node:path";
+function cmpSemver2(a, b) {
+  const pa = a.split(".").map((p) => parseInt(p, 10));
+  const pb = b.split(".").map((p) => parseInt(p, 10));
+  for (let i = 0; i < 3; i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return d;
+  }
+  return 0;
+}
+async function updateCommand(refStr, opts = {}) {
+  const projectDir = process.cwd();
+  const lock = await readLock(projectDir);
+  const all = Object.entries(lock.skills);
+  if (all.length === 0) {
+    log.info("No installed skills.");
+    return;
+  }
+  const targets = refStr ? all.filter(([r]) => r === refStr) : all;
+  if (refStr && targets.length === 0) {
+    log.err(`Not installed: ${refStr}`);
+    process.exit(1);
+  }
+  let updated = 0, skipped = 0;
+  for (const [ref, entry] of targets) {
+    const [, owner, slug] = /^@([^/]+)\/([^@]+)/.exec(ref) ?? [];
+    if (!owner || !slug) continue;
+    let info;
+    try {
+      info = await api(`/skills/${owner}/${slug}`);
+    } catch (e) {
+      log.warn(`Skip ${ref}: ${e.message}`);
+      skipped++;
+      continue;
+    }
+    if (cmpSemver2(info.latest_version, entry.version) <= 0) {
+      log.step(`${ref} is already at latest (${entry.version}).`);
+      continue;
+    }
+    const installDir = resolve2(projectDir, entry.path);
+    if (!opts.force) {
+      const current = await hashInstalledFolder(installDir);
+      log.step(`Updating ${ref}: ${entry.version} -> ${info.latest_version}`);
+    }
+    const dl = await api(`/skills/${owner}/${slug}/download`);
+    const buf = await rawGet(dl.download.url);
+    if (!verifyBundleHash(buf, dl.bundle_sha256)) {
+      log.err(`Bundle hash mismatch for ${ref} \u2014 skipping.`);
+      skipped++;
+      continue;
+    }
+    const tmp = await import("node:fs/promises").then(
+      (m) => m.mkdtemp(join9(tmpdir2(), `floom-update-${slug}-`))
+    );
+    try {
+      await extractBundle(buf, tmp);
+      await rm2(installDir, { recursive: true, force: true });
+      await mkdir5(installDir.replace(/\/[^/]+$/, ""), { recursive: true });
+      await rename2(tmp, installDir);
+    } catch (e) {
+      await rm2(tmp, { recursive: true, force: true }).catch(() => {
+      });
+      throw e;
+    }
+    const next = setLockEntry(lock, ref, {
+      ...entry,
+      version: dl.version,
+      bundle_sha256: dl.bundle_sha256,
+      installed_at: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    await writeLock(projectDir, next);
+    log.ok(`Updated ${ref}: ${entry.version} -> ${dl.version}`);
+    updated++;
+  }
+  log.blank();
+  log.info(`${updated} updated, ${skipped} skipped.`);
+}
+
+// src/commands/list.ts
+async function listCommand(opts = {}) {
+  const resp = await api("/skills", {
+    authRequired: true,
+    query: { q: opts.query, library: opts.workspace ?? opts.library, folder: opts.folder }
+  });
+  if (resp.skills.length === 0) {
+    log.info("No skills.");
+    return;
+  }
+  if (opts.flat) {
+    for (const s of resp.skills) {
+      console.log(`${s.library.slug}/${s.slug}`);
+    }
+    return;
+  }
+  const groups = /* @__PURE__ */ new Map();
+  for (const skill of resp.skills) {
+    const k = `${skill.library.slug} (${skill.library.name})`;
+    const arr = groups.get(k) ?? [];
+    arr.push(skill);
+    groups.set(k, arr);
+  }
+  for (const [library, rows] of groups.entries()) {
+    log.heading(library);
+    for (const s of rows) {
+      console.log(`  ${`${s.library.slug}/${s.slug}`.padEnd(40)} ${s.visibility.padEnd(10)} ${s.title}`);
+    }
+  }
+}
+
+// src/commands/info.ts
+async function infoCommand(refStr) {
+  const ref = parseSkillRef(refStr);
+  if (!ref) {
+    log.err(`Invalid skill ref: ${refStr}`);
+    process.exit(1);
+  }
+  const r = await api(`/skills/${ref.owner}/${ref.slug}`);
+  log.heading(r.ref);
+  log.kv("Title", r.title);
+  log.kv("Description", r.description);
+  log.kv("Latest", r.latest_version);
+  log.kv("Visibility", r.visibility);
+  log.kv("Owner", `@${r.owner.handle}${r.owner.display_name ? ` (${r.owner.display_name})` : ""}`);
+  if (r.has_scripts) {
+    log.kv("Scripts", "yes (review before activating)");
+  }
+  log.blank();
+  log.info("Install:");
+  log.info(`  floom install ${r.ref}`);
+}
+
+// src/commands/share.ts
+async function shareCommand(refStr, email, opts = {}) {
+  const ref = parseSkillRef(refStr);
+  if (!ref) {
+    log.err(`Invalid skill ref: ${refStr}`);
+    process.exit(1);
+  }
+  const role = opts.role ?? "viewer";
+  const r = await api(`/skills/${ref.owner}/${ref.slug}/grants`, {
+    method: "POST",
+    authRequired: true,
+    body: { email, role }
+  });
+  log.ok(`Shared ${refStr} with ${r.grant.email} as ${r.grant.role}.`);
+  log.info("No email is sent in V0. They will see the skill under 'Shared with Me' on next login.");
+}
+async function unshareCommand(refStr, email) {
+  const ref = parseSkillRef(refStr);
+  if (!ref) {
+    log.err(`Invalid skill ref: ${refStr}`);
+    process.exit(1);
+  }
+  const list = await api(`/skills/${ref.owner}/${ref.slug}/grants`, { authRequired: true });
+  const grant = list.grants.find((g) => (g.email ?? "").toLowerCase() === email.toLowerCase());
+  if (!grant) {
+    log.err(`No active grant for ${email} on ${refStr}.`);
+    process.exit(1);
+  }
+  await api(`/skills/${ref.owner}/${ref.slug}/grants/${grant.id}`, { method: "DELETE", authRequired: true });
+  log.ok(`Removed ${email}'s access to ${refStr}.`);
+}
+
+// src/commands/library.ts
+async function libraryListCommand() {
+  const resp = await api("/libraries", { authRequired: true });
+  if (!resp.libraries.length) {
+    log.info("No workspaces.");
+    return;
+  }
+  for (const l of resp.libraries) {
+    console.log(`${l.slug.padEnd(24)} ${l.type.padEnd(8)} ${l.role.padEnd(6)} ${l.name}`);
+  }
+}
+async function libraryCreateCommand(slug, name) {
+  const resp = await api("/libraries", { method: "POST", authRequired: true, body: { slug, name } });
+  log.ok(`Created workspace ${resp.slug}`);
+}
+async function libraryInviteCommand(librarySlug, email, role = "viewer") {
+  await api(`/libraries/${librarySlug}/pending-invites`, {
+    method: "POST",
+    authRequired: true,
+    body: { email, role }
+  });
+  log.ok(`Invited ${email} to ${librarySlug} as ${role}`);
+}
+async function libraryLeaveCommand(librarySlug) {
+  await api(`/libraries/${librarySlug}/members/me`, { method: "DELETE", authRequired: true });
+  log.ok(`Left workspace ${librarySlug}`);
+}
+
+// src/commands/mcp.ts
+import { mkdtemp, mkdir as mkdir6, readdir as readdir4, readFile as readFile8, rename as rename3, rm as rm3, writeFile as writeFile4 } from "node:fs/promises";
+import { join as join10 } from "node:path";
+import { homedir as homedir3, tmpdir as tmpdir3 } from "node:os";
+import { z as z2 } from "zod";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+var API_TIMEOUT_MS = 2e4;
+async function fetchWithTimeout2(url, init = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } catch (e) {
+    if (e.name === "AbortError") throw new Error(`Request timed out after ${API_TIMEOUT_MS}ms`);
+    throw e;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function resolveToken() {
+  const fromEnv = process.env.FLOOM_API_TOKEN?.trim();
+  if (fromEnv) return fromEnv;
+  const auth = await readAuth();
+  if (auth?.token) return auth.token;
+  const authPath = join10(homedir3(), ".floom", "auth.json");
+  const raw = await readFile8(authPath, "utf8");
+  const parsed = JSON.parse(raw);
+  if (!parsed.token) throw new Error("Missing token in ~/.floom/auth.json");
+  return parsed.token;
+}
+async function apiWithToken(token, path, query) {
+  const auth = await readAuth();
+  let lastError = null;
+  for (const base of getApiBaseUrls(auth?.apiUrl)) {
+    const url = new URL(base + path);
+    if (query) {
+      for (const [k, v] of Object.entries(query)) url.searchParams.set(k, v);
+    }
+    let res;
+    try {
+      res = await fetchWithTimeout2(url, {
+        headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" }
+      });
+    } catch (e) {
+      lastError = new Error(`Unable to reach Floom API at ${base}: ${e.message}`);
+      continue;
+    }
+    const body = await res.text();
+    let json = null;
+    try {
+      json = body ? JSON.parse(body) : null;
+    } catch {
+      json = { raw: body };
+    }
+    if (res.ok) return json;
+    lastError = new Error(json?.error?.message ?? `HTTP ${res.status}`);
+    if (res.status !== 404 || json?.error) break;
+  }
+  throw lastError ?? new Error("API request failed");
+}
+async function installViaApi(token, refText, target) {
+  const parsed = parseSkillRef(refText);
+  if (!parsed) throw new Error(`Invalid ref: ${refText}`);
+  const info = await apiWithToken(token, `/skills/${parsed.owner}/${parsed.slug}`);
+  const dl = await apiWithToken(token, `/skills/${parsed.owner}/${parsed.slug}/download`, parsed.version ? { version: parsed.version } : void 0);
+  const bundle = await rawGet(dl.download.url);
+  if (!verifyBundleHash(bundle, dl.bundle_sha256)) throw new Error("Bundle hash mismatch");
+  const install = resolveInstallDir({ target });
+  await mkdir6(install.dir, { recursive: true });
+  const dest = join10(install.dir, parsed.slug);
+  const exists = await readdir4(dest).then(() => true).catch(() => false);
+  if (exists) await rm3(dest, { recursive: true, force: true });
+  const temp = await mkdtemp(join10(tmpdir3(), `floom-mcp-${parsed.slug}-`));
+  try {
+    await extractBundle(bundle, temp);
+    await rename3(temp, dest);
+  } catch (e) {
+    await rm3(temp, { recursive: true, force: true }).catch(() => {
+    });
+    throw e;
+  }
+  const lock = await readLock(process.cwd());
+  const ref = formatSkillRef({ owner: parsed.owner, slug: parsed.slug });
+  const next = setLockEntry(lock, ref, {
+    version: dl.version,
+    resolved: `${getAppUrl().replace(/\/$/, "")}/${ref}`,
+    bundle_sha256: dl.bundle_sha256,
+    installed_at: (/* @__PURE__ */ new Date()).toISOString(),
+    path: dest.replace(process.cwd() + "/", ""),
+    preset: target
+  });
+  await writeLock(process.cwd(), next);
+  return { path: dest, version: dl.version, ref: info.ref ?? ref };
+}
+async function parseSkillBundle(bundle) {
+  const tmp = await mkdtemp(join10(tmpdir3(), "floom-mcp-read-"));
+  try {
+    await extractBundle(bundle, tmp);
+    const files = [];
+    const walk2 = async (dir, rel = "") => {
+      const entries = await readdir4(dir, { withFileTypes: true });
+      for (const entry of entries) {
+        const nextRel = rel ? `${rel}/${entry.name}` : entry.name;
+        const full = join10(dir, entry.name);
+        if (entry.isDirectory()) await walk2(full, nextRel);
+        else files.push(nextRel);
+      }
+    };
+    await walk2(tmp);
+    const skillMdPath = files.find((f) => f.toUpperCase() === "SKILL.MD");
+    const skillMd = skillMdPath ? await readFile8(join10(tmp, skillMdPath), "utf8") : "";
+    const skillJsonPath = files.find((f) => f.toLowerCase() === "skill.json");
+    const skillJson = skillJsonPath ? JSON.parse(await readFile8(join10(tmp, skillJsonPath), "utf8")) : null;
+    return { files, skill_md: skillMd, skill_json: skillJson };
+  } finally {
+    await rm3(tmp, { recursive: true, force: true });
+  }
+}
+async function mcpCommand() {
+  const token = await resolveToken();
+  const server = new McpServer({ name: "floom", version: VERSION });
+  server.tool("search_skills", { query: z2.string().min(1), workspace: z2.string().optional(), library: z2.string().optional() }, async ({ query, workspace, library }) => {
+    const workspaceSlug = workspace ?? library;
+    const result = await apiWithToken(token, "/skills", { q: query, ...workspaceSlug ? { library: workspaceSlug } : {} });
+    return { content: [{ type: "text", text: JSON.stringify(result) }] };
+  });
+  server.tool("get_skill", { ref: z2.string().min(3) }, async ({ ref }) => {
+    const parsed = parseSkillRef(ref);
+    if (!parsed) throw new Error("Invalid ref. Expected @owner/slug or workspace/slug");
+    const meta = await apiWithToken(token, `/skills/${parsed.owner}/${parsed.slug}`);
+    const dl = await apiWithToken(token, `/skills/${parsed.owner}/${parsed.slug}/download`);
+    const buf = await rawGet(dl.download.url);
+    const parsedBundle = await parseSkillBundle(buf);
+    return { content: [{ type: "text", text: JSON.stringify({ ref, meta, ...parsedBundle }) }] };
+  });
+  async function listWorkspaces() {
+    const result = await apiWithToken(token, "/libraries");
+    return { content: [{ type: "text", text: JSON.stringify(result) }] };
+  }
+  server.tool("list_workspaces", {}, listWorkspaces);
+  server.tool("list_libraries", {}, listWorkspaces);
+  server.tool("install_skill", { ref: z2.string().min(3), target: z2.enum(["claude", "codex", "cursor", "kimi", "opencode", "gemini"]) }, async ({ ref, target }) => {
+    const installed = await installViaApi(token, ref, target);
+    return { content: [{ type: "text", text: JSON.stringify(installed) }] };
+  });
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+
+// src/commands/doctor.ts
+import { mkdtemp as mkdtemp2, readdir as readdir5, rm as rm4 } from "node:fs/promises";
+import { tmpdir as tmpdir4 } from "node:os";
+import { join as join11 } from "node:path";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+function textOf(result) {
+  return String(result?.content?.[0]?.text ?? "");
+}
+function pass(name, detail) {
+  return { name, ok: true, detail };
+}
+function fail(name, detail) {
+  return { name, ok: false, detail };
+}
+async function doctorCommand(opts = {}) {
+  if (!opts.freshAgent) {
+    const auth2 = await readAuth();
+    const checks2 = [pass("cli_version", VERSION), auth2?.token ? pass("auth", `@${auth2.handle}`) : fail("auth", "not logged in")];
+    emitDoctor(checks2, opts.json);
+    if (checks2.some((check) => !check.ok)) process.exit(1);
+    return;
+  }
+  const checks = [];
+  const auth = await readAuth();
+  const token = process.env.FLOOM_API_TOKEN?.trim() || auth?.token;
+  if (!token) {
+    checks.push(fail("fresh_agent_token", "missing FLOOM_API_TOKEN and ~/.floom/auth.json"));
+    emitDoctor(checks, opts.json);
+    process.exit(1);
+  }
+  const cliPath = process.argv[1];
+  if (!cliPath) {
+    checks.push(fail("fresh_agent_cli_path", "process.argv[1] is empty"));
+    emitDoctor(checks, opts.json);
+    process.exit(1);
+  }
+  const tmpHome = await mkdtemp2(join11(tmpdir4(), "floom-doctor-home-"));
+  const tmpSkills = await mkdtemp2(join11(tmpdir4(), "floom-doctor-skills-"));
+  const tmpProject = await mkdtemp2(join11(tmpdir4(), "floom-doctor-project-"));
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [cliPath, "mcp"],
+    cwd: tmpProject,
+    env: {
+      ...process.env,
+      HOME: tmpHome,
+      FLOOM_API_TOKEN: token,
+      FLOOM_SKILLS_DIR: tmpSkills,
+      ...auth?.apiUrl ? { FLOOM_API_URL: auth.apiUrl } : {}
+    },
+    stderr: "pipe"
+  });
+  const client = new Client({ name: "floom-doctor", version: VERSION });
+  try {
+    await client.connect(transport);
+    const tools = await client.listTools();
+    const toolNames = tools.tools.map((tool) => tool.name).sort();
+    const expected = ["get_skill", "install_skill", "list_workspaces", "search_skills"];
+    const missing = expected.filter((name) => !toolNames.includes(name));
+    checks.push(missing.length === 0 ? pass("mcp_tools", toolNames.join(", ")) : fail("mcp_tools", `missing ${missing.join(", ")}`));
+    const workspaces = await client.callTool({ name: "list_workspaces", arguments: {} });
+    checks.push(textOf(workspaces).length > 0 ? pass("mcp_list_workspaces", `${textOf(workspaces).length} chars`) : fail("mcp_list_workspaces", "empty response"));
+    const search = await client.callTool({ name: "search_skills", arguments: { query: opts.query ?? "pdf" } });
+    checks.push(textOf(search).length > 0 ? pass("mcp_search_skills", `${textOf(search).length} chars`) : fail("mcp_search_skills", "empty response"));
+    if (opts.ref) {
+      const skill = await client.callTool({ name: "get_skill", arguments: { ref: opts.ref } });
+      checks.push(/SKILL\.md/.test(textOf(skill)) ? pass("mcp_get_skill", opts.ref) : fail("mcp_get_skill", "bundle did not include SKILL.md"));
+      const installed = await client.callTool({ name: "install_skill", arguments: { ref: opts.ref, target: opts.target ?? "codex" } });
+      const entries = await readdir5(tmpSkills);
+      checks.push(entries.length > 0 ? pass("mcp_install_skill", textOf(installed)) : fail("mcp_install_skill", "target directory is empty"));
+    }
+  } catch (e) {
+    checks.push(fail("fresh_agent_mcp", e.message));
+  } finally {
+    await client.close().catch(() => {
+    });
+    await rm4(tmpHome, { recursive: true, force: true });
+    await rm4(tmpSkills, { recursive: true, force: true });
+    await rm4(tmpProject, { recursive: true, force: true });
+  }
+  emitDoctor(checks, opts.json);
+  if (checks.some((check) => !check.ok)) process.exit(1);
+}
+function emitDoctor(checks, json) {
+  if (json) {
+    console.log(JSON.stringify({ ok: checks.every((check) => check.ok), checks }, null, 2));
+    return;
+  }
+  log.heading("Floom doctor");
+  for (const check of checks) {
+    const detail = check.detail ? ` ${check.detail}` : "";
+    if (check.ok) log.ok(`${check.name}${detail}`);
+    else log.err(`${check.name}${detail}`);
+  }
+}
+
+// src/index.ts
+var program = new Command();
+program.name("floom").description("Floom CLI \u2014 publish, install, sync, and share AI agent skills.").version(VERSION);
+program.command("login").description("Log in via browser (device code).").addHelpText("after", "\nExample:\n  $ floom login").action(loginCommand);
 program.command("logout").description("Log out and revoke local token.").action(logoutCommand);
 program.command("whoami").description("Show the logged-in user.").action(whoamiCommand);
 program.command("init").description("Scaffold a new skill in the current directory.").action(initCommand);
-program
-    .command("validate")
-    .description("Validate the skill in the current directory.")
-    .option("--json", "Emit machine-readable JSON")
-    .action((opts) => validateCommand(opts));
-program
-    .command("publish")
-    .description("Publish the skill in the current directory.")
-    .option("--library <slug>", "Publish into a shared library slug (default: personal)")
-    .action((opts) => publishCommand(opts));
-program.command("push").description("Alias for `publish`.").option("--library <slug>").action((opts) => publishCommand(opts));
-program
-    .command("install <ref>")
-    .description("Install a skill (default: .agents/skills/<slug>/).")
-    .option("--for <target>", "Tool preset: claude | codex | cursor | gemini | opencode | kimi | all")
-    .option("--to <path>", "Explicit install directory")
-    .option("--global", "Install to user-level folder instead of project-local")
-    .option("--force", "Overwrite existing folder")
-    .action((ref, opts) => installCommand(ref, opts));
+program.command("validate").description("Validate the skill in the current directory.").option("--json", "Emit machine-readable JSON").action((opts) => validateCommand(opts));
+program.command("publish").description("Publish the skill in the current directory.").option("--dry-run", "Validate and pack locally without uploading.").option("--workspace <slug>", "Publish into a shared workspace slug (default: personal)").option("--library <slug>", "Legacy alias for --workspace").addHelpText("after", "\nExamples:\n  $ floom publish\n  $ floom publish --workspace team-workspace").action((opts) => publishCommand(opts));
+program.command("push").description("Alias for `publish`.").option("--dry-run", "Validate and pack locally without uploading.").option("--workspace <slug>", "Publish into a shared workspace slug").option("--library <slug>", "Legacy alias for --workspace").addHelpText("after", "\nExample:\n  $ floom push --workspace team-workspace").action((opts) => publishCommand(opts));
+program.command("install <ref>").description("Install a skill (default: .agents/skills/<slug>/).").option("--for <target>", "Tool preset: claude | codex | cursor | gemini | opencode | kimi | all").option("--to <path>", "Explicit install directory").option("--global", "Install to user-level folder instead of project-local").option("--force", "Overwrite existing folder").addHelpText("after", "\nExamples:\n  $ floom install @alice/research-brief\n  $ floom install @alice/research-brief --for codex\n  $ floom install @alice/research-brief --to .agents/skills").action((ref, opts) => installCommand(ref, opts));
 program.command("installed").description("List installed skills in this project.").option("--json").action(installedCommand);
 program.command("outdated").description("Show installed skills with newer versions available.").action(outdatedCommand);
-program
-    .command("update [ref]")
-    .description("Update installed skills to latest.")
-    .option("--force", "Overwrite local edits")
-    .action((ref, opts) => updateCommand(ref, opts));
-program
-    .command("list")
-    .description("List remote skills.")
-    .option("--mine", "Only your own skills (default)")
-    .option("--library <slug>", "Filter by library slug")
-    .option("--folder <uuid>", "Filter by folder id")
-    .option("--flat", "Print one ref per line")
-    .option("--query <q>", "Filter by query")
-    .action(listCommand);
+program.command("update [ref]").description("Update installed skills to latest.").option("--force", "Overwrite local edits").action((ref, opts) => updateCommand(ref, opts));
+program.command("list").description("List remote skills.").option("--mine", "Only your own skills (default)").option("--workspace <slug>", "Filter by workspace slug").option("--library <slug>", "Legacy alias for --workspace").option("--folder <uuid>", "Filter by folder id").option("--flat", "Print one ref per line").option("--query <q>", "Filter by query").action(listCommand);
 program.command("info <ref>").description("Show details for a remote skill.").action(infoCommand);
-program
-    .command("share <ref> <email>")
-    .description("Invite someone to a skill by email.")
-    .option("--role <role>", "viewer (default) or editor")
-    .action((ref, email, opts) => shareCommand(ref, email, opts));
-program
-    .command("unshare <ref> <email>")
-    .description("Revoke someone's access.")
-    .action((ref, email) => unshareCommand(ref, email));
-const lib = program.command("library").description("Manage libraries");
-lib.command("list").action(libraryListCommand);
-lib.command("create <slug> <name>").action((slug, name) => libraryCreateCommand(slug, name));
-lib.command("invite <librarySlug> <email>").option("--role <role>", "viewer|editor|admin", "viewer").action((librarySlug, email, opts) => libraryInviteCommand(librarySlug, email, opts.role));
-lib.command("leave <librarySlug>").action((librarySlug) => libraryLeaveCommand(librarySlug));
-// Global error handler
+program.command("share <ref> <email>").description("Invite someone to a skill by email.").option("--role <role>", "viewer (default) or editor").action((ref, email, opts) => shareCommand(ref, email, opts));
+program.command("unshare <ref> <email>").description("Revoke someone's access.").action((ref, email) => unshareCommand(ref, email));
+function addWorkspaceCommands(cmd) {
+  cmd.command("list").action(libraryListCommand);
+  cmd.command("create <slug> <name>").action((slug, name) => libraryCreateCommand(slug, name));
+  cmd.command("invite <workspaceSlug> <email>").option("--role <role>", "viewer|editor|admin", "viewer").action((workspaceSlug, email, opts) => libraryInviteCommand(workspaceSlug, email, opts.role));
+  cmd.command("leave <workspaceSlug>").action((workspaceSlug) => libraryLeaveCommand(workspaceSlug));
+}
+addWorkspaceCommands(program.command("workspace").description("Manage workspaces"));
+addWorkspaceCommands(program.command("library").description("Manage workspaces (legacy alias)"));
+program.command("doctor").description("Check local Floom CLI, auth, and fresh-agent MCP installability.").option("--fresh-agent", "Run MCP checks with a clean HOME and temp skills directory").option("--ref <ref>", "Skill ref to install during --fresh-agent, e.g. @depontefede/pdf").option("--target <target>", "Install target for --fresh-agent", "codex").option("--query <query>", "Search query for --fresh-agent", "pdf").option("--json", "Emit machine-readable JSON").action((opts) => doctorCommand(opts));
+program.command("mcp").description("Run local MCP server over stdio.").action(mcpCommand);
 async function main() {
-    try {
-        await program.parseAsync(process.argv);
-    }
-    catch (e) {
-        if (e instanceof FloomError) {
-            log.err(e.message);
-            if (e.code === "AUTH_REQUIRED" || e.code === "TOKEN_EXPIRED") {
-                log.info("Run: floom login");
-            }
-            process.exit(1);
-        }
-        log.err(e.message ?? "Unknown error");
-        if (process.env.FLOOM_DEBUG)
-            console.error(e);
-        process.exit(1);
+  try {
+    await program.parseAsync(process.argv);
+  } catch (e) {
+    if (e instanceof FloomError) {
+      log.err(e.message);
+      if (e.code === "AUTH_REQUIRED" || e.code === "TOKEN_EXPIRED") {
+        log.info("Run: floom login");
+      }
+      process.exit(1);
     }
+    log.err(e.message ?? "Unknown error");
+    if (process.env.FLOOM_DEBUG) console.error(e);
+    process.exit(1);
+  }
 }
 main();
-//# sourceMappingURL=index.js.map
+/*! Bundled license information:
+
+bcryptjs/dist/bcrypt.js:
+  (**
+   * @license bcrypt.js (c) 2013 Daniel Wirtz <dcode@dcode.io>
+   * Released under the Apache License, Version 2.0
+   * see: https://github.com/dcodeIO/bcrypt.js for details
+   *)
+*/
+//# sourceMappingURL=index.js.map