@hasna/skills 0.2.0 → 0.3.0

package/bin/index.js

@@ -36860,12 +36860,13 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.2.0",
+    version: "0.3.0",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
       skills: "bin/index.js",
       "skills-mcp": "bin/mcp.js",
+      "skills-serve": "bin/server.js",
       "skills-server": "bin/server.js",
       "skills-worker": "bin/worker.js",
       "skills-migrate": "bin/migrate.js"
@@ -36951,6 +36952,7 @@ var init_package = __esm(() => {
     dependencies: {
       "@aws-sdk/client-ecs": "^3.1079.0",
       "@aws-sdk/client-s3": "^3.1079.0",
+      "@hasna/contracts": "1.0.1",
       "@hasna/events": "0.1.16",
       "@modelcontextprotocol/sdk": "^1.26.0",
       chalk: "^5.3.0",
@@ -37897,14 +37899,19 @@ function assertNoRetiredConfigKeys(config, source) {
   for (const [key, replacement] of Object.entries(RETIRED_CONFIG_KEYS)) {
     if (!(key in config))
       continue;
-    throw new RetiredSettingError(key, `${source}: "${key}" is no longer a configuration key. ` + "Deployment modes were removed: a Skills client either has an API origin " + "configured or it does not, and that is the whole of it. " + `Use "${replacement}" instead (skills config set ${replacement} <origin>), and ` + `remove the old key with: skills config unset ${key}. ` + "Refused rather than ignored, because silently dropping it would leave an " + "operator believing they had pointed this install at a server.");
+    throw new RetiredSettingError(key, `${source}: "${key}" is no longer a configuration key. ` + `${RETIRED_CONFIG_KEY_REASONS[key] ?? ""} ` + `Use ${replacement} instead, and remove the old key with: skills config unset ${key}. ` + "Refused rather than ignored, because silently dropping it would leave an " + "operator believing they had pointed this install at a server.");
   }
 }
-var RETIRED_ENV_SUFFIXES, RETIRED_CONFIG_KEYS, RetiredSettingError;
+var RETIRED_ENV_SUFFIXES, RETIRED_CONFIG_KEYS, RETIRED_CONFIG_KEY_REASONS, RetiredSettingError;
 var init_retired_settings = __esm(() => {
   RETIRED_ENV_SUFFIXES = ["_STORAGE_MODE", "_DEPLOYMENT_MODE", "_CLOUD_MODE"];
   RETIRED_CONFIG_KEYS = {
-    mode: "apiUrl"
+    mode: "a configured API origin",
+    apiUrl: "skills setup --api-url <origin>"
+  };
+  RETIRED_CONFIG_KEY_REASONS = {
+    mode: "Deployment modes were removed: a Skills client either resolves a credential " + "or it does not, and that is the whole of it.",
+    apiUrl: "The service address is no longer kept in this app's config file: it is read from " + "HASNA_SKILLS_API_URL, then the macOS Keychain item hasna.credentials.skills.api-url, " + "then ~/.hasna/skills/config/credentials, then the fleet gateway."
   };
   RetiredSettingError = class RetiredSettingError extends Error {
     code = "RETIRED_SETTING";
@@ -38036,7 +38043,6 @@ var init_app_home = __esm(() => {
 // src/lib/config.ts
 import { existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
 import { join as join4, dirname } from "path";
-import { homedir as homedir3 } from "os";
 function validKeys() {
   return [...Object.keys(ENUM_KEYS), ...STRING_KEYS];
 }
@@ -38067,16 +38073,6 @@ function normalizeConfigValue(key, value) {
   const allowed = allowedValues(key);
   if (allowed)
     return allowed.includes(value) ? value : undefined;
-  if (key === "apiUrl") {
-    try {
-      const url = new URL(value);
-      if (url.protocol !== "http:" && url.protocol !== "https:")
-        return;
-      return value.replace(/\/+$/, "");
-    } catch {
-      return;
-    }
-  }
   if (key === "extensionsDir")
     return value.trim() ? value : undefined;
   return;
@@ -38107,27 +38103,6 @@ function getDataDir() {
 function getDataDirReadOnly() {
   return getDataRoot();
 }
-function getConfigPathReadOnly(scope) {
-  if (scope === "global")
-    return join4(getDataDirReadOnly(), "config.json");
-  return join4(process.cwd(), "skills.config.json");
-}
-function loadConfigReadOnly() {
-  const canonicalConfigPath = getConfigPathReadOnly("global");
-  let globalConfig;
-  if (existsSync4(canonicalConfigPath)) {
-    globalConfig = readConfigFile(canonicalConfigPath);
-  } else if (hasOperatorOverride()) {
-    globalConfig = {};
-  } else {
-    globalConfig = readConfigFile(legacyConfigFilePath());
-  }
-  const projectConfig = readConfigFile(getConfigPathReadOnly("project"));
-  return { ...globalConfig, ...projectConfig };
-}
-function legacyConfigFilePath() {
-  return join4(process.env["HOME"] || process.env["USERPROFILE"] || homedir3(), ".skillsrc");
-}
 function getConfigPath(scope) {
   if (scope === "global") {
     return join4(getDataDir(), "config.json");
@@ -38167,7 +38142,7 @@ function saveConfig(key, value, scope = "project") {
   const normalized = normalizeConfigValue(key, value);
   if (normalized === undefined) {
     const allowed = allowedValues(key);
-    throw new Error(allowed ? `Invalid value '${value}' for ${key}. Allowed: ${allowed.join(", ")}` : `Invalid value '${value}' for ${key}. Expected ${key === "apiUrl" ? "an http(s) URL" : "a non-empty path"}`);
+    throw new Error(allowed ? `Invalid value '${value}' for ${key}. Allowed: ${allowed.join(", ")}` : `Invalid value '${value}' for ${key}. Expected a non-empty path`);
   }
   const filePath = getConfigPath(scope);
   let existing = {};
@@ -38224,7 +38199,7 @@ var init_config = __esm(() => {
     defaultScope: ["global", "project"],
     format: ["compact", "json", "csv"]
   };
-  STRING_KEYS = ["apiUrl", "extensionsDir"];
+  STRING_KEYS = ["extensionsDir"];
 });
 
 // src/lib/registry-data/development-tools.ts
@@ -39729,7 +39704,7 @@ function readPortableSkillManifest(skillPath, fallbackName = basename(skillPath)
   const pkg = existsSync8(pkgPath) ? readJsonObject(pkgPath) : undefined;
   const name = normalizePortableSkillName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
   const description = stringField(jsonManifest, "description") ?? frontmatter?.description ?? stringValue(pkg?.description) ?? `${name} skill`;
-  const version = stringField(jsonManifest, "version") ?? frontmatter?.version ?? stringValue(pkg?.version) ?? PORTABLE_SKILL_DEFAULT_VERSION;
+  const version = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
   const kind = parseSkillKind(stringField(jsonManifest, "kind") ?? frontmatter?.kind);
   const commands = parseManifestCommands(jsonManifest) ?? (kind === "instruction" ? [] : inferPackageCommands(pkg, name)) ?? [];
   return {
@@ -39753,6 +39728,15 @@ function parseSkillKind(value) {
     return value;
   return;
 }
+function readDeclaredSkillVersion(skillPath) {
+  const skillJsonPath = join8(skillPath, "skill.json");
+  const skillMdPath = join8(skillPath, "SKILL.md");
+  const pkgPath = join8(skillPath, "package.json");
+  const jsonManifest = existsSync8(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
+  const frontmatter = existsSync8(skillMdPath) ? parseSkillFrontmatter(readFileSync6(skillMdPath, "utf-8")) ?? undefined : undefined;
+  const pkg = existsSync8(pkgPath) ? readJsonObject(pkgPath) : undefined;
+  return stringField(jsonManifest, "version") ?? frontmatter?.version ?? stringValue(pkg?.version);
+}
 function createInstructionManifest(name, options) {
   return {
     $schema: PORTABLE_SKILL_SCHEMA,
@@ -42858,7 +42842,7 @@ import {
   statSync as statSync8,
   writeFileSync as writeFileSync5
 } from "fs";
-import { homedir as homedir4 } from "os";
+import { homedir as homedir3 } from "os";
 import { basename as basename3, dirname as dirname4, join as join12 } from "path";
 function isSyncAgent(value) {
   return SYNC_AGENTS.includes(value);
@@ -42871,7 +42855,7 @@ function resolveSyncAgents(arg) {
   }
   return [arg];
 }
-function agentGlobalSkillsDir(agent, homeDir = homedir4()) {
+function agentGlobalSkillsDir(agent, homeDir = homedir3()) {
   switch (agent) {
     case "opencode":
       return join12(homeDir, ".config", "opencode", "skills");
@@ -42966,7 +42950,7 @@ function isDirectory(path) {
 function syncSkillsToAgents(options = {}) {
   const requested = normalizeRequested(options.names);
   const agents = options.agents?.length ? options.agents : [...SYNC_AGENTS];
-  const homeDir = options.homeDir ?? homedir4();
+  const homeDir = options.homeDir ?? homedir3();
   const { roots, source } = resolveSyncCorpus(options);
   const corpus = listPortableSkillsAcrossRoots(roots);
   const byName = new Map(corpus.map((skill) => [skill.name, skill]));
@@ -43021,7 +43005,7 @@ function syncSkillsToAgents(options = {}) {
   return { actions };
 }
 function writeManagedAgentSkill(params) {
-  const homeDir = params.homeDir ?? homedir4();
+  const homeDir = params.homeDir ?? homedir3();
   const dir = join12(agentGlobalSkillsDir(params.agent, homeDir), params.skill);
   const result2 = writeManagedSkillDir(dir, params.skillMd, {
     skill: params.skill,
@@ -43339,7 +43323,7 @@ __export(exports_installer, {
 });
 import { existsSync as existsSync14, readFileSync as readFileSync10, rmSync as rmSync4 } from "fs";
 import { dirname as dirname5, join as join14 } from "path";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir4 } from "os";
 import { fileURLToPath } from "url";
 function findSkillsDir() {
   let dir = __dirname2;
@@ -43530,11 +43514,11 @@ function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const base2 = projectDir || process.cwd();
   switch (agent) {
     case "pi":
-      return scope === "project" ? join14(base2, ".pi", "skills") : join14(homedir5(), ".pi", "agent", "skills");
+      return scope === "project" ? join14(base2, ".pi", "skills") : join14(homedir4(), ".pi", "agent", "skills");
     case "opencode":
-      return scope === "project" ? join14(base2, ".opencode", "skills") : join14(homedir5(), ".config", "opencode", "skills");
+      return scope === "project" ? join14(base2, ".opencode", "skills") : join14(homedir4(), ".config", "opencode", "skills");
     default:
-      return scope === "project" ? join14(base2, `.${agent}`, "skills") : join14(homedir5(), `.${agent}`, "skills");
+      return scope === "project" ? join14(base2, `.${agent}`, "skills") : join14(homedir4(), `.${agent}`, "skills");
   }
 }
 function getAgentSkillPath(name, agent, scope = "global", projectDir) {
@@ -47719,116 +47703,811 @@ var init_zod = __esm(() => {
   init_external();
 });
 
-// src/lib/api-url.ts
-function resolveApiUrl(config = loadConfig(), env3 = process.env) {
-  const raw = env3[API_URL_ENV_VAR] || config[API_URL_CONFIG_KEY];
-  const trimmed = raw?.trim().replace(/\/+$/, "");
-  return trimmed || undefined;
+// ../contracts/dist/client/transport.js
+import { isIP } from "net";
+import { spawnSync } from "child_process";
+import { closeSync, fstatSync, openSync, readFileSync as readFileSync11 } from "fs";
+import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
+import { createRequire } from "module";
+import { hostname as osHostname } from "os";
+import { isAbsolute as isAbsolute3, join as join15 } from "path";
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function clientTransportEnvKeys(name) {
+  const envSegment = envToken(name);
+  return {
+    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
+    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
+  };
 }
-function requireApiUrl(action = "This command", config, env3) {
-  const resolved = resolveApiUrl(config ?? loadConfig(), env3 ?? process.env);
-  if (!resolved)
-    throw new MissingApiUrlError(action);
-  return resolved;
+function credentialOverrideEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
 }
-var API_URL_ENV_VAR = "SKILLS_API_URL", API_URL_CONFIG_KEY = "apiUrl", MISSING_API_URL_HINT, MissingApiUrlError;
-var init_api_url = __esm(() => {
-  init_config();
-  MISSING_API_URL_HINT = `set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
-  MissingApiUrlError = class MissingApiUrlError extends Error {
-    code = "MISSING_API_URL";
-    constructor(action = "This command") {
-      super(`${action} requires a Skills API URL and none is configured \u2014 ${MISSING_API_URL_HINT}`);
-      this.name = "MissingApiUrlError";
+function credentialPointerEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_REF`;
+}
+function homeDir(env3) {
+  const home = env3.HOME?.trim();
+  return home ? home : null;
+}
+function absoluteOverride(env3, key) {
+  const value = env3[key]?.trim();
+  return value && isAbsolute3(value) ? value : null;
+}
+function hasnaHomeDir(env3) {
+  const override = absoluteOverride(env3, HASNA_HOME_ENV_KEY);
+  if (override)
+    return override;
+  const home = homeDir(env3);
+  return home ? join15(home, HASNA_HOME_DIR) : null;
+}
+function appConfigDir(name, env3) {
+  const configRoot = absoluteOverride(env3, HASNA_CONFIG_HOME_ENV_KEY);
+  if (configRoot)
+    return join15(configRoot, name);
+  const root = hasnaHomeDir(env3);
+  return root ? join15(root, name, CONFIG_SUBDIR) : null;
+}
+function credentialDiskSourceList(name, env3, profile = null) {
+  if (!SAFE_APP_SLUG.test(name))
+    return [];
+  const directory = appConfigDir(name, env3);
+  if (!directory)
+    return [];
+  const file = profile ? `${CREDENTIALS_FILE}-${profile}` : CREDENTIALS_FILE;
+  return [{ path: join15(directory, file), tier: "disk" }];
+}
+function credentialDiskSources(name, env3) {
+  return credentialDiskSourceList(name, env3, null).map((s) => s.path);
+}
+function profileDiskSources(name, env3, profile) {
+  return credentialDiskSourceList(name, env3, profile).map((s) => s.path);
+}
+function parseEnvFile(text) {
+  const values2 = new Map;
+  const unusable = new Set;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#"))
+      continue;
+    const withoutExport = line.startsWith("export ") ? line.slice("export ".length).trim() : line;
+    const equals = withoutExport.indexOf("=");
+    if (equals <= 0)
+      continue;
+    const key = withoutExport.slice(0, equals).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+      continue;
+    let value = withoutExport.slice(equals + 1).trim();
+    const quote = value[0];
+    if (quote === '"' || quote === "'") {
+      if (value.length < 2 || !value.endsWith(quote)) {
+        unusable.add(key);
+        continue;
+      }
+      value = value.slice(1, -1);
     }
-  };
-});
-
-// src/lib/auth-store.ts
-var exports_auth_store = {};
-__export(exports_auth_store, {
-  saveAuthConfig: () => saveAuthConfig,
-  normalizeSkillsApiOrigin: () => normalizeSkillsApiOrigin,
-  getAuthFilePathReadOnly: () => getAuthFilePathReadOnly,
-  getAuthFilePath: () => getAuthFilePath,
-  getAuthConfigReadOnly: () => getAuthConfigReadOnly,
-  getAuthConfig: () => getAuthConfig,
-  getApiUrl: () => getApiUrl,
-  getApiKeyReadOnly: () => getApiKeyReadOnly,
-  getApiKey: () => getApiKey,
-  clearAuthConfig: () => clearAuthConfig
-});
-import { existsSync as existsSync15, mkdirSync as mkdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync7, unlinkSync } from "fs";
-import { dirname as dirname6, join as join15 } from "path";
-import { homedir as homedir6 } from "os";
-function getAuthFilePath() {
-  return join15(getDataDir(), "auth.json");
+    if (value.trim().length === 0) {
+      unusable.add(key);
+      continue;
+    }
+    if (values2.has(key) && values2.get(key) !== value)
+      unusable.add(key);
+    values2.set(key, value);
+  }
+  return { values: values2, unusable };
 }
-function getAuthFilePathReadOnly() {
-  return join15(getDataDirReadOnly(), "auth.json");
+function configFileModeAllowed(mode) {
+  const permissions = mode & 4095;
+  return permissions === 256 || permissions === 384;
 }
-function legacyAuthFilePath() {
-  return join15(process.env["HOME"] || process.env["USERPROFILE"] || homedir6(), ".skills", "auth.json");
+function configFileReadsCoherent(before2, after2) {
+  return before2.dev === after2.dev && before2.ino === after2.ino && before2.size === after2.size && before2.mtimeMs === after2.mtimeMs && before2.ctimeMs === after2.ctimeMs;
 }
-function getAuthConfig() {
-  if (cachedConfig !== undefined)
-    return cachedConfig;
+function readAppConfigFile(path) {
+  const unsafe = (reason) => {
+    throw new CredentialFileUnsafeError(path, reason);
+  };
+  let fd = -1;
   try {
-    const file = existsSync15(getAuthFilePath()) ? getAuthFilePath() : legacyAuthFilePath();
-    const raw = readFileSync11(file, "utf-8");
-    const config = JSON.parse(raw);
-    if (!config.apiKey) {
-      cachedConfig = null;
+    fd = openSync(path, O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR")
       return null;
+    if (code === "ELOOP")
+      unsafe("the path is a symlink");
+    unsafe(`the path could not be opened (${code ?? "unknown error"})`);
+  }
+  try {
+    const before2 = fstatSync(fd);
+    if (!before2.isFile())
+      unsafe("the path is not a regular file");
+    if (!configFileModeAllowed(before2.mode)) {
+      unsafe(`permission mode ${(before2.mode & 4095).toString(8).padStart(4, "0")} is not owner-only 0400 or 0600`);
+    }
+    const uid = process.getuid?.() ?? process.geteuid?.();
+    if (uid !== undefined && before2.uid !== uid)
+      unsafe("the file is not owned by the current user");
+    if (before2.size > MAX_CREDENTIAL_FILE_BYTES)
+      unsafe("the file exceeds the size limit");
+    const bytes = readFileSync11(fd);
+    const after2 = fstatSync(fd);
+    if (!configFileReadsCoherent(before2, after2)) {
+      unsafe("the file changed while being read");
+    }
+    return parseEnvFile(bytes.toString("utf8"));
+  } finally {
+    if (fd !== -1)
+      closeSync(fd);
+  }
+}
+function readCredentialFile(path, apiKeyKeys) {
+  const parsed = readAppConfigFile(path);
+  if (!parsed)
+    return null;
+  for (const key of apiKeyKeys) {
+    if (parsed.unusable.has(key)) {
+      throw new CredentialFileUnsafeError(path, `${key} is declared but blank or malformed`);
     }
-    cachedConfig = config;
-    return config;
-  } catch {
-    cachedConfig = null;
+  }
+  const values2 = apiKeyKeys.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+  if (new Set(values2).size > 1) {
+    throw new CredentialFileUnsafeError(path, "credential aliases disagree");
+  }
+  return values2[0] ?? null;
+}
+function appConfigDiskValue(name, env3, keys2) {
+  const wanted = keys2.filter((key) => !CREDENTIAL_SHAPED_KEY.test(key));
+  if (wanted.length === 0)
     return null;
+  for (const path of credentialDiskSources(name, env3)) {
+    const parsed = readAppConfigFile(path);
+    if (!parsed)
+      continue;
+    if (wanted.some((key) => parsed.unusable.has(key))) {
+      return { key: wanted.find((key) => parsed.unusable.has(key)), value: "", path, unusable: true };
+    }
+    const values2 = wanted.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+    if (new Set(values2).size > 1)
+      throw new CredentialFileUnsafeError(path, "configuration aliases disagree");
+    for (const key of wanted) {
+      if (parsed.unusable.has(key))
+        return { key, value: "", path, unusable: true };
+      const value = parsed.values.get(key)?.trim();
+      if (value)
+        return { key, value, path };
+    }
   }
+  return null;
 }
-function saveAuthConfig(config) {
-  const file = getAuthFilePath();
-  mkdirSync7(dirname6(file), { recursive: true, mode: 448 });
-  writeFileSync7(file, JSON.stringify(config, null, 2) + `
-`, { mode: 384 });
-  cachedConfig = config;
+function assertUsableCredential(appName, source, value) {
+  if (VAULT_POINTER_SHAPE.test(value)) {
+    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+  }
+  if (!ILLEGAL_IN_HEADER_VALUE.test(value))
+    return;
+  throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
+}
+function sealCredential(fields) {
+  const { apiKey } = fields;
+  const visible = {
+    tier: fields.tier,
+    source: fields.source,
+    deliberate: fields.deliberate,
+    diskCandidates: Object.freeze([...fields.diskCandidates]),
+    warning: fields.warning
+  };
+  const sealed = { ...visible };
+  Object.defineProperty(sealed, "apiKey", {
+    value: apiKey,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  if (fields.pointerVaultKey !== undefined) {
+    Object.defineProperty(sealed, "pointerVaultKey", {
+      value: fields.pointerVaultKey,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  Object.defineProperty(sealed, INSPECT_CUSTOM, {
+    value: () => ({ ...visible, apiKey: "[redacted]" }),
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(sealed, CREDENTIAL_SEAL, {
+    value: true,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  return Object.freeze(sealed);
+}
+function firstEnvValue(env3, keys2) {
+  for (const key of keys2) {
+    if (!Object.prototype.hasOwnProperty.call(env3, key))
+      continue;
+    const value = env3[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
+}
+function isAmbientEnvironment(env3) {
+  return env3 === process.env || env3[AMBIENT_ENVIRONMENT] === true;
+}
+function defaultKeychainRunner(argv) {
+  const result2 = spawnSync(KEYCHAIN_SECURITY_BIN, [...argv], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: KEYCHAIN_SPAWN_TIMEOUT_MS
+  });
+  return {
+    status: result2.status,
+    stdout: result2.stdout ?? "",
+    stderr: result2.error ? result2.error.message : result2.stderr ?? ""
+  };
 }
-function clearAuthConfig() {
+function keychainTierEnabled(env3, options) {
+  if ((options.platform ?? process.platform) !== "darwin")
+    return false;
+  if (options.enabled !== undefined)
+    return options.enabled;
+  return options.run !== undefined || isAmbientEnvironment(env3);
+}
+function keychainAccount(env3, options) {
+  const station = env3[KEYCHAIN_STATION_ENV_KEY]?.trim();
+  if (station)
+    return station;
+  const host = (options.hostname ?? osHostname)().split(".")[0]?.trim() ?? "";
+  if (host)
+    return host;
+  const user = env3.USER?.trim();
+  return user || null;
+}
+function keychainFailureHint(text) {
+  const line = text.split(/\r?\n/).find((entry) => entry.trim().length > 0)?.trim() ?? "";
+  const clean = line.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 200);
+  return clean ? `: ${clean}` : "";
+}
+function readKeychainItem(name, env3, kind, options) {
+  if (!SAFE_APP_SLUG.test(name) || !keychainTierEnabled(env3, options))
+    return null;
+  const account = keychainAccount(env3, options);
+  if (!account)
+    return null;
+  const service = `${KEYCHAIN_SERVICE_PREFIX}.${name}.${kind}`;
+  const source = `keychain:${service}@${account}`;
+  const run = options.run ?? defaultKeychainRunner;
+  let result2;
   try {
-    unlinkSync(getAuthFilePath());
-  } catch {}
+    result2 = run(["find-generic-password", "-a", account, "-s", service, "-w"]);
+  } catch (error) {
+    const reason = keychainFailureHint(error instanceof Error ? error.message : String(error));
+    throw new CredentialResolutionError(name, `The Keychain lookup for ${source} could not run${reason}. A Keychain failure is never resolved ` + `around: fix the keychain, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  if (result2.status === KEYCHAIN_ITEM_NOT_FOUND_STATUS)
+    return null;
+  if (result2.status !== 0) {
+    throw new CredentialResolutionError(name, `The Keychain lookup for ${source} failed (security exited ` + `${result2.status ?? "without a status"}${keychainFailureHint(result2.stderr)}). A Keychain item that ` + `exists but cannot be read is never resolved around: unlock the keychain, run from a session that ` + `may use it, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  const value = result2.stdout.trim();
+  if (!value) {
+    throw new CredentialResolutionError(name, `${source} exists but holds an empty value; a declared item never falls through to another ` + `identity. Store a value in it or delete the item.`, [source]);
+  }
+  return { value, source };
+}
+function keychainConfigValue(name, env3, options = {}) {
+  return readKeychainItem(name, env3, "api-url", options);
+}
+function snapshotClientEnvironment(name, env3) {
+  const keys2 = clientTransportEnvKeys(name);
+  const ambient = isAmbientEnvironment(env3);
+  const snapshot = Object.create(null);
+  for (const key of [
+    ...keys2.apiUrlKeys,
+    ...keys2.apiKeyKeys,
+    credentialOverrideEnvKey(name),
+    credentialPointerEnvKey(name),
+    CREDENTIAL_PROFILE_ENV_KEY,
+    "HOME",
+    HASNA_HOME_ENV_KEY,
+    HASNA_CONFIG_HOME_ENV_KEY,
+    KEYCHAIN_STATION_ENV_KEY,
+    "USER"
+  ]) {
+    const descriptor = Object.getOwnPropertyDescriptor(env3, key);
+    if (!descriptor)
+      continue;
+    if (!("value" in descriptor)) {
+      throw new CredentialResolutionError(name, `${key} is accessor-backed; client configuration requires own data properties.`, [key]);
+    }
+    if (descriptor.value !== undefined && typeof descriptor.value !== "string") {
+      throw new CredentialResolutionError(name, `${key} must be a string data property.`, [key]);
+    }
+    snapshot[key] = descriptor.value;
+  }
+  if (ambient) {
+    Object.defineProperty(snapshot, AMBIENT_ENVIRONMENT, {
+      value: true,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  return Object.freeze(snapshot);
+}
+function resolveCredential(name, env3, options = {}) {
+  env3 = snapshotClientEnvironment(name, env3);
+  const { apiKeyKeys } = clientTransportEnvKeys(name);
+  const diskPaths = credentialDiskSources(name, env3);
+  if (options.apiKey !== undefined) {
+    const explicitKey = options.apiKey.trim();
+    if (!explicitKey) {
+      throw new CredentialResolutionError(name, "The explicit apiKey argument is blank; an explicit credential never falls through to another identity.", ["explicit apiKey argument"]);
+    }
+    assertUsableCredential(name, "the explicit apiKey argument", explicitKey);
+    return sealCredential({
+      apiKey: explicitKey,
+      tier: "argument",
+      source: "explicit apiKey argument",
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const overrideKeyName = credentialOverrideEnvKey(name);
+  const overrideRaw = Object.prototype.hasOwnProperty.call(env3, overrideKeyName) ? env3[overrideKeyName] : undefined;
+  if (overrideRaw !== undefined) {
+    const override = overrideRaw.trim();
+    if (!override) {
+      throw new CredentialResolutionError(name, `${overrideKeyName} is set but empty. It is a deliberate override, so it is not resolved around: ` + `either give it a real key or unset it to fall back to the credential on disk.`, [overrideKeyName]);
+    }
+    assertUsableCredential(name, overrideKeyName, override);
+    return sealCredential({
+      apiKey: override,
+      tier: "override",
+      source: overrideKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const pointerKeyName = credentialPointerEnvKey(name);
+  const pointerRaw = Object.prototype.hasOwnProperty.call(env3, pointerKeyName) ? env3[pointerKeyName] : undefined;
+  if (pointerRaw !== undefined) {
+    const pointer = pointerRaw.trim();
+    if (!pointer) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
+    }
+    if (!VAULT_POINTER_SHAPE.test(pointer)) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
+    }
+    return sealCredential({
+      apiKey: "",
+      pointerVaultKey: pointer,
+      tier: "pointer",
+      source: pointerKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  if (options.profile !== undefined && !options.profile.trim()) {
+    throw new CredentialResolutionError(name, "The explicit profile argument is blank; an explicit identity selection never falls through.", ["explicit profile argument"]);
+  }
+  const profileRaw = Object.prototype.hasOwnProperty.call(env3, CREDENTIAL_PROFILE_ENV_KEY) ? env3[CREDENTIAL_PROFILE_ENV_KEY] : undefined;
+  if (profileRaw !== undefined && !profileRaw.trim()) {
+    throw new CredentialResolutionError(name, `${CREDENTIAL_PROFILE_ENV_KEY} is set but blank.`, [CREDENTIAL_PROFILE_ENV_KEY]);
+  }
+  const profile = options.profile?.trim() || profileRaw?.trim();
+  if (profile) {
+    const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
+    if (!SAFE_PROFILE.test(profile)) {
+      throw new CredentialResolutionError(name, `Profile name from ${profileSource} is not usable in a path. ` + `Use letters, digits, dot, dash, or underscore.`, [profileSource]);
+    }
+    const paths = profileDiskSources(name, env3, profile);
+    for (const path of paths) {
+      const value = readCredentialFile(path, apiKeyKeys);
+      if (value) {
+        assertUsableCredential(name, path, value);
+        return sealCredential({
+          apiKey: value,
+          tier: "profile",
+          source: path,
+          deliberate: true,
+          diskCandidates: paths,
+          warning: null
+        });
+      }
+    }
+    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
+  }
+  const definedEnvEntries = apiKeyKeys.filter((key) => Object.prototype.hasOwnProperty.call(env3, key) && env3[key] !== undefined).map((key) => ({ key, value: String(env3[key]).trim() }));
+  const blankEnv = definedEnvEntries.find((entry) => entry.value.length === 0);
+  if (blankEnv) {
+    throw new CredentialResolutionError(name, `${blankEnv.key} is set but blank; a declared credential never falls through to another alias or identity.`, [blankEnv.key]);
+  }
+  if (definedEnvEntries.length > 1 && new Set(definedEnvEntries.map((entry) => entry.value)).size > 1) {
+    throw new CredentialResolutionError(name, `${definedEnvEntries.map((entry) => entry.key).join(" and ")} disagree; credential aliases must be identical or only one may be set.`, definedEnvEntries.map((entry) => entry.key));
+  }
+  const envHit = firstEnvValue(env3, apiKeyKeys);
+  const keychainHit = readKeychainItem(name, env3, "api-key", options.keychain ?? {});
+  if (keychainHit) {
+    assertUsableCredential(name, keychainHit.source, keychainHit.value);
+    const warning = envHit && envHit.value !== keychainHit.value ? `Credential sources disagree for '${name}': ${keychainHit.source} and ${envHit.key} hold ` + `different keys. ${keychainHit.source} wins, because the Keychain is re-read on every call while ` + `an environment variable is a snapshot. Reconcile them \u2014 a rotation that updated only one leaves ` + `the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: keychainHit.value,
+      tier: "keychain",
+      source: keychainHit.source,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  const diskSourceList = credentialDiskSourceList(name, env3, null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  if (diskHits.length > 0) {
+    const winner = diskHits[0];
+    assertUsableCredential(name, winner.src.path, winner.value);
+    const divergentSources = [
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
+      ...envHit && envHit.value !== winner.value ? [envHit.key] : []
+    ];
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: winner.value,
+      tier: winner.src.tier,
+      source: winner.src.path,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  if (envHit) {
+    assertUsableCredential(name, envHit.key, envHit.value);
+    return sealCredential({
+      apiKey: envHit.value,
+      tier: "env",
+      source: envHit.key,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  return null;
+}
+async function completePointerCredential(name, pointerResolution, env3 = process.env) {
+  const vaultKey = pointerResolution.pointerVaultKey;
+  const pointerEnvKey = pointerResolution.source;
+  if (!vaultKey) {
+    throw new CredentialResolutionError(name, `Pointer resolution from ${pointerEnvKey} carries no vault item key; this is a defect in the resolver.`, [pointerEnvKey]);
+  }
+  let secretsSdk;
   try {
-    unlinkSync(legacyAuthFilePath());
-  } catch {}
-  cachedConfig = undefined;
+    secretsSdk = requireSecretsSdk(SECRETS_PACKAGE_SPECIFIER);
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
+  }
+  let client;
+  try {
+    client = secretsSdk.createSecretsClientFromEnv(env3);
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets client could not be configured from this ` + `environment (the secrets service URL and key env are missing or invalid). A vault pointer is TERMINAL and ` + `never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  let secret;
+  try {
+    secret = await client.getSecret({ key: vaultKey });
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the vault could not be reached or the item is ` + `unavailable. A vault pointer is TERMINAL and never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  const value = secret.value;
+  if (!value) {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} resolved vault item '${vaultKey}', but it holds no value. A vault pointer is TERMINAL.`, [pointerEnvKey]);
+  }
+  assertUsableCredential(name, `${pointerEnvKey} -> vault:${vaultKey}`, value);
+  return sealCredential({
+    apiKey: value,
+    tier: "pointer",
+    source: `${pointerEnvKey} -> vault:${vaultKey}`,
+    deliberate: true,
+    diskCandidates: pointerResolution.diskCandidates,
+    warning: null
+  });
 }
-function getApiKey() {
-  if (process.env.SKILLS_API_KEY)
-    return process.env.SKILLS_API_KEY;
-  if (process.env.SKILL_API_KEY)
-    return process.env.SKILL_API_KEY;
-  return getAuthConfig()?.apiKey || null;
+function defaultFleetGatewayBaseUrl(name) {
+  return `${DEFAULT_FLEET_GATEWAY_ORIGIN}/${validateAppSlug(name)}`;
 }
-function getAuthConfigReadOnly() {
+function isValidDnsDomain(value) {
+  if (value.length === 0 || value.length > 253 || ASCII_CONTROL_PATTERN.test(value) || /[^\x00-\x7f]/.test(value)) {
+    return false;
+  }
+  return value.split(".").every((label) => label.length <= 63 && !label.startsWith("xn--") && DNS_LABEL_PATTERN.test(label));
+}
+function validateAppSlug(name) {
+  if (name.length > 63 || !DNS_LABEL_PATTERN.test(name)) {
+    throw new Error("App name must be one lowercase DNS label.");
+  }
+  return name;
+}
+function rawAuthority(value) {
+  const match = /^[a-z][a-z0-9+.-]*:\/\//i.exec(value);
+  if (!match)
+    throw new Error("API URL must be absolute.");
+  const afterScheme = value.slice(match[0].length);
+  const boundary = afterScheme.search(/[/?#]/);
+  const authority = boundary === -1 ? afterScheme : afterScheme.slice(0, boundary);
+  if (!authority)
+    throw new Error("API URL must include a hostname.");
+  return authority;
+}
+function assertCanonicalPort(port) {
+  if (!/^[0-9]+$/.test(port) || port.length > 1 && port.startsWith("0")) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
+  }
+  const numericPort = Number(port);
+  if (!Number.isSafeInteger(numericPort) || numericPort < 1 || numericPort > 65535) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
+  }
+}
+function canonicalAuthorityHostname(authority) {
+  let rawHostname;
+  if (authority.startsWith("[")) {
+    const closingBracket = authority.indexOf("]");
+    if (closingBracket === -1) {
+      throw new Error("API URL authority must contain a canonical hostname.");
+    }
+    rawHostname = authority.slice(0, closingBracket + 1);
+    const portSuffix = authority.slice(closingBracket + 1);
+    if (portSuffix) {
+      if (!portSuffix.startsWith(":")) {
+        throw new Error("API URL authority must contain a canonical hostname and port.");
+      }
+      assertCanonicalPort(portSuffix.slice(1));
+    }
+    if (isIP(rawHostname.slice(1, -1)) !== 6) {
+      throw new Error("API URL authority must contain a canonical IPv6 literal.");
+    }
+  } else {
+    const firstColon = authority.indexOf(":");
+    const lastColon = authority.lastIndexOf(":");
+    if (firstColon !== lastColon) {
+      throw new Error("IPv6 API URL authorities must use brackets.");
+    }
+    if (lastColon !== -1) {
+      const port = authority.slice(lastColon + 1);
+      assertCanonicalPort(port);
+      rawHostname = authority.slice(0, lastColon);
+    } else {
+      rawHostname = authority;
+    }
+    const ipVersion = isIP(rawHostname);
+    const numericAddressParts = rawHostname.split(".");
+    const looksLikeNonCanonicalIpv4 = numericAddressParts.every((part) => /^(?:0x[0-9a-f]+|[0-9]+)$/i.test(part));
+    if (ipVersion !== 4 && looksLikeNonCanonicalIpv4 || ipVersion !== 4 && !isValidDnsDomain(rawHostname.toLowerCase())) {
+      throw new Error("API URL authority must contain a canonical ASCII hostname.");
+    }
+  }
+  return rawHostname.toLowerCase();
+}
+function isDeliberateLoopbackHttpAuthority(authority) {
+  return /^(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?$/i.test(authority);
+}
+function toV1BaseUrl(apiUrl) {
+  if (ASCII_CONTROL_PATTERN.test(apiUrl)) {
+    throw new Error("API URL must not contain ASCII control characters.");
+  }
+  const input = apiUrl.trim();
+  const authority = rawAuthority(input);
+  if (authority.includes("@") || authority.includes("\\") || authority.includes("%") || /[^\x00-\x7f]/.test(authority)) {
+    throw new Error("API URL authority must be canonical ASCII without credentials.");
+  }
+  const canonicalHostname = canonicalAuthorityHostname(authority);
+  const url = new URL(input);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("API URL must use http or https.");
+  }
+  if (url.username || url.password) {
+    throw new Error("API URL must not include credentials.");
+  }
+  if (!url.hostname || url.hostname.endsWith(".")) {
+    throw new Error("API URL must include a canonical hostname.");
+  }
+  if (url.hostname.toLowerCase() !== canonicalHostname) {
+    throw new Error("API URL authority must not rely on parser hostname normalization.");
+  }
+  if (url.hostname.split(".").some((label) => label.toLowerCase().startsWith("xn--"))) {
+    throw new Error("API URL must not use IDN or punycode hostnames.");
+  }
+  if (url.protocol === "http:" && !isDeliberateLoopbackHttpAuthority(authority)) {
+    throw new Error("API URL may use http only for an exact loopback authority.");
+  }
+  if (url.search || url.hash) {
+    throw new Error("API URL must not include a query string or fragment.");
+  }
+  let path = url.pathname.replace(/\/+$/, "");
+  if (path.endsWith("/v1"))
+    path = path.slice(0, -"/v1".length);
+  url.pathname = `${path}/v1`;
+  return url.toString().replace(/\/+$/, "");
+}
+function resolveClientTransportSnapshot(name, env3 = process.env, options = {}) {
+  env3 = snapshotClientEnvironment(name, env3);
+  const keys2 = clientTransportEnvKeys(name);
+  const definedUrlEntries = keys2.apiUrlKeys.filter((key) => Object.prototype.hasOwnProperty.call(env3, key) && env3[key] !== undefined).map((key) => ({ key, raw: String(env3[key]) }));
+  const blankUrl = definedUrlEntries.find((entry) => entry.raw.trim().length === 0);
+  if (blankUrl) {
+    throw new ClientTransportConfigurationError(name, `${blankUrl.key} is set but blank; public clients require an explicit HTTPS API URL and never select local storage.`, [blankUrl.key]);
+  }
+  const controlledUrl = definedUrlEntries.find((entry) => ASCII_CONTROL_PATTERN.test(entry.raw));
+  if (controlledUrl) {
+    throw new ClientTransportConfigurationError(name, `${controlledUrl.key} contains ASCII control characters.`, [controlledUrl.key]);
+  }
+  const usableUrlEntries = definedUrlEntries.map((entry) => ({ key: entry.key, value: entry.raw.trim() }));
+  if (usableUrlEntries.length > 1 && new Set(usableUrlEntries.map((entry) => entry.value)).size > 1) {
+    throw new ClientTransportConfigurationError(name, `${usableUrlEntries.map((entry) => entry.key).join(" and ")} disagree; client authority aliases must be identical or only one may be set.`, usableUrlEntries.map((entry) => entry.key));
+  }
+  const envUrlHit = usableUrlEntries[0] ?? null;
+  const keychainUrlHit = keychainConfigValue(name, env3, options.credentials?.keychain);
+  const diskConfigUrlHit = appConfigDiskValue(name, env3, keys2.apiUrlKeys);
+  if (diskConfigUrlHit?.unusable) {
+    throw new ClientTransportConfigurationError(name, `${diskConfigUrlHit.key} in ${diskConfigUrlHit.path} is declared but blank or malformed; public clients require a valid HTTPS service authority.`, [diskConfigUrlHit.path]);
+  }
+  const urlCandidates = [
+    ...envUrlHit ? [envUrlHit] : [],
+    ...keychainUrlHit ? [{ key: keychainUrlHit.source, value: keychainUrlHit.value }] : [],
+    ...diskConfigUrlHit ? [{ key: diskConfigUrlHit.path, value: diskConfigUrlHit.value.trim() }] : []
+  ];
+  const configuredUrl = urlCandidates[0] ?? null;
+  const divergentUrls = urlCandidates.filter((candidate) => candidate.value !== configuredUrl?.value);
+  if (configuredUrl && divergentUrls.length > 0) {
+    throw new ClientTransportConfigurationError(name, `${configuredUrl.key} and ${divergentUrls.map((candidate) => candidate.key).join(" and ")} select different service authorities; refusing to send a credential written for one authority to the other.`, urlCandidates.map((candidate) => candidate.key));
+  }
+  const warnings = [];
+  if (configuredUrl && !envUrlHit) {
+    warnings.push(`No ${keys2.apiUrlKeys[0]} in the environment; the server URL in ${configuredUrl.key} was used, so this client connects to the server. ` + `Keep that entry aligned with the intended service authority.`);
+  }
+  const credential = resolveCredential(name, env3, options.credentials);
+  if (!credential) {
+    const diskHint = credentialDiskSourcesForMessage(name, env3);
+    const lead = configuredUrl ? `${configuredUrl.key} selects the HTTP server for '${name}', but no API key could be resolved` : `${keys2.apiUrlKeys[0]} is not set and no API key could be resolved for '${name}'; a credential is required before the default fleet gateway authority applies`;
+    warnings.push(`${lead}; refusing to create an unauthenticated client \u2014 public clients never fall back to SQLite or another local store. ` + `Looked in the Keychain (macOS only), then for a credential file at ${diskHint}, then for ${keys2.apiKeyKeys[0]} in the environment.`);
+    throw new ClientTransportConfigurationError(name, warnings.join(" "), [configuredUrl?.key ?? keys2.apiUrlKeys[0]]);
+  }
+  if (credential.warning)
+    warnings.push(credential.warning);
+  let urlHit;
+  if (configuredUrl) {
+    urlHit = configuredUrl;
+  } else {
+    try {
+      urlHit = { key: DEFAULT_AUTHORITY_SOURCE, value: defaultFleetGatewayBaseUrl(name) };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new ClientTransportConfigurationError(name, `No ${keys2.apiUrlKeys[0]} is configured and the default fleet gateway authority cannot be composed for '${name}': ${message}`, [keys2.apiUrlKeys[0]]);
+    }
+  }
+  const apiUrlSource = urlHit.key;
+  let baseUrl;
   try {
-    const file = existsSync15(getAuthFilePathReadOnly()) ? getAuthFilePathReadOnly() : legacyAuthFilePath();
-    const raw = readFileSync11(file, "utf-8");
-    const config = JSON.parse(raw);
-    if (!config.apiKey)
-      return null;
-    return config;
-  } catch {
-    return null;
+    baseUrl = toV1BaseUrl(urlHit.value);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new ClientTransportConfigurationError(name, `Invalid API URL from ${apiUrlSource}: ${message}`, [apiUrlSource]);
   }
+  return {
+    resolution: {
+      transport: "http",
+      transportSource: urlHit.key,
+      baseUrl,
+      apiUrlSource,
+      apiKeyPresent: true,
+      apiKeySource: credential.source,
+      apiKeyTier: credential.tier,
+      misconfigured: false,
+      warning: warnings.length > 0 ? warnings.join(" ") : null
+    },
+    credential
+  };
+}
+function resolveClientTransport(name, env3 = process.env, options = {}) {
+  return resolveClientTransportSnapshot(name, env3, options).resolution;
 }
-function getApiKeyReadOnly() {
-  if (process.env.SKILLS_API_KEY)
-    return process.env.SKILLS_API_KEY;
-  if (process.env.SKILL_API_KEY)
-    return process.env.SKILL_API_KEY;
-  return getAuthConfigReadOnly()?.apiKey || null;
+function credentialDiskSourcesForMessage(name, env3) {
+  const paths = credentialDiskSources(name, env3);
+  return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
+}
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM, CREDENTIAL_SEAL, AMBIENT_ENVIRONMENT, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, ClientTransportConfigurationError, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS;
+var init_transport = __esm(() => {
+  CredentialResolutionError = class CredentialResolutionError extends Error {
+    appName;
+    attempted;
+    constructor(appName, message, attempted) {
+      super(message);
+      this.name = "CredentialResolutionError";
+      this.appName = appName;
+      this.attempted = attempted;
+    }
+  };
+  CredentialFileUnsafeError = class CredentialFileUnsafeError extends Error {
+    path;
+    constructor(path, reason) {
+      super(`Refusing unsafe credential/config file ${path}: ${reason}.`);
+      this.name = "CredentialFileUnsafeError";
+      this.path = path;
+    }
+  };
+  MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
+  SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+  SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+  ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+  VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
+  CREDENTIAL_SHAPED_KEY = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
+  INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+  CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
+  AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+  SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+  requireSecretsSdk = createRequire(import.meta.url);
+  ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
+  DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+  ClientTransportConfigurationError = class ClientTransportConfigurationError extends Error {
+    appName;
+    sources;
+    constructor(appName, message, sources = []) {
+      super(message);
+      this.name = "ClientTransportConfigurationError";
+      this.appName = appName;
+      this.sources = Object.freeze([...sources]);
+    }
+  };
+  IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+  AUTHORITY_OVERRIDE_HEADERS = new Set([
+    "host",
+    ":authority",
+    "forwarded",
+    "x-forwarded-host",
+    "x-original-host"
+  ]);
+});
+
+// src/lib/fleet-credentials.ts
+var exports_fleet_credentials = {};
+__export(exports_fleet_credentials, {
+  skillsCredentialOrReason: () => skillsCredentialOrReason,
+  skillsCredentialFiles: () => skillsCredentialFiles,
+  skillsCredentialFilePath: () => skillsCredentialFilePath,
+  resolveSkillsFleet: () => resolveSkillsFleet,
+  resolveSkillsApiOrigin: () => resolveSkillsApiOrigin,
+  resolveSkillsApiKey: () => resolveSkillsApiKey,
+  resetLocalSkillsModeNotice: () => resetLocalSkillsModeNotice,
+  requireSkillsFleet: () => requireSkillsFleet,
+  requireSkillsApiOrigin: () => requireSkillsApiOrigin,
+  requireSkillsApiKey: () => requireSkillsApiKey,
+  noticeLocalSkillsMode: () => noticeLocalSkillsMode,
+  normalizeSkillsApiOrigin: () => normalizeSkillsApiOrigin,
+  configuredSkillsApiUrl: () => configuredSkillsApiUrl,
+  SkillsFleetCredentialError: () => SkillsFleetCredentialError,
+  SKILLS_APP: () => SKILLS_APP,
+  SKILLS_API_URL_ENV_KEYS: () => SKILLS_API_URL_ENV_KEYS,
+  SKILLS_API_URL_ENV: () => SKILLS_API_URL_ENV,
+  SKILLS_API_KEY_ENV_KEYS: () => SKILLS_API_KEY_ENV_KEYS,
+  SKILLS_API_KEY_ENV: () => SKILLS_API_KEY_ENV,
+  MissingSkillsFleetError: () => MissingSkillsFleetError
+});
+function isClientTransportConfigurationError(error) {
+  return error instanceof ClientTransportConfigurationError || typeof error === "object" && error !== null && error.name === "ClientTransportConfigurationError";
+}
+function isCredentialResolutionError(error) {
+  return error instanceof CredentialResolutionError || typeof error === "object" && error !== null && error.name === "CredentialResolutionError";
+}
+function asSkillsFleetCredentialError(error) {
+  if (!isCredentialResolutionError(error))
+    return null;
+  return new SkillsFleetCredentialError(error.message, "MISSING_API_CREDENTIAL");
 }
 function normalizeSkillsApiOrigin(apiUrl) {
   const url = new URL(apiUrl);
@@ -47842,36 +48521,211 @@ function normalizeSkillsApiOrigin(apiUrl) {
   }
   return url.toString().replace(/\/+$/, "");
 }
-function getApiUrl(action) {
-  return normalizeSkillsApiOrigin(requireApiUrl(action));
+function configuredSkillsApiUrl(env3 = process.env, keychain) {
+  for (const key of SKILLS_API_URL_ENV_KEYS) {
+    const value = env3[key]?.trim();
+    if (value)
+      return { value, source: key };
+  }
+  const fromKeychain = keychainConfigValue(SKILLS_APP, env3, keychain);
+  if (fromKeychain)
+    return { value: fromKeychain.value.trim(), source: fromKeychain.source };
+  const fromDisk = appConfigDiskValue(SKILLS_APP, env3, SKILLS_API_URL_ENV_KEYS);
+  if (fromDisk?.unusable) {
+    throw new SkillsFleetCredentialError(`${fromDisk.key} in ${fromDisk.path} is declared but blank or malformed; ` + `a Skills authority must be a valid https URL (or an exact loopback http URL).`, "INVALID_API_URL");
+  }
+  if (fromDisk)
+    return { value: fromDisk.value.trim(), source: fromDisk.path };
+  return null;
 }
-var cachedConfig;
-var init_auth_store = __esm(() => {
-  init_api_url();
-  init_config();
+function skillsCredentialFiles(env3 = process.env) {
+  return credentialDiskSources(SKILLS_APP, env3);
+}
+function skillsCredentialFilePath(env3 = process.env) {
+  const paths = skillsCredentialFiles(env3);
+  const path = paths[0];
+  if (!path) {
+    throw new Error("No home directory is set (HOME or HASNA_HOME), so there is nowhere to store a Skills credential.");
+  }
+  return path;
+}
+function noticeLocalSkillsMode(write = (line) => console.error(line)) {
+  if (localNoticePrinted)
+    return;
+  localNoticePrinted = true;
+  write(`skills: local mode \u2014 no ${SKILLS_API_KEY_ENV} and no ${SKILLS_API_URL_ENV} resolved, ` + `so this runs on this machine against the bundled corpus. ` + `Sign in with: skills auth login`);
+}
+function resetLocalSkillsModeNotice() {
+  localNoticePrinted = false;
+}
+function resolveSkillsFleet(env3 = process.env, options = {}) {
+  try {
+    return resolveSkillsFleetOrThrow(env3, options);
+  } catch (error) {
+    const translated = asSkillsFleetCredentialError(error);
+    if (translated)
+      throw translated;
+    throw error;
+  }
+}
+function resolveSkillsFleetOrThrow(env3, options) {
+  let resolution;
+  try {
+    resolution = resolveClientTransport(SKILLS_APP, env3, { credentials: options.credentials });
+  } catch (error) {
+    if (!isClientTransportConfigurationError(error))
+      throw error;
+    const configured2 = configuredSkillsApiUrl(env3, options.credentials?.keychain);
+    const credential2 = resolveCredential(SKILLS_APP, env3, options.credentials);
+    if (!configured2 && !credential2) {
+      if (env3 === process.env)
+        noticeLocalSkillsMode();
+      return { mode: "local", apiOrigin: null, apiKey: null };
+    }
+    if (configured2 && !credential2) {
+      throw new SkillsFleetCredentialError(`${configured2.source} points this CLI at a Skills service but no API key resolved \u2014 ` + `refusing to run locally instead. Looked in the Keychain item ` + `hasna.credentials.${SKILLS_APP}.api-key, then ${skillsCredentialFiles(env3).join(" or ") || "no credentials file (no HOME)"}, ` + `then ${SKILLS_API_KEY_ENV}. Sign in with: skills auth login`);
+    }
+    throw error;
+  }
+  const configured = configuredSkillsApiUrl(env3, options.credentials?.keychain);
+  const apiOrigin = configured ? normalizeSkillsApiOrigin(configured.value) : stripV1(resolution.baseUrl);
+  const credential = resolveCredential(SKILLS_APP, env3, options.credentials);
+  if (!credential) {
+    throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills auth login`);
+  }
+  const base2 = {
+    mode: "hosted",
+    apiOrigin,
+    apiUrlSource: resolution.apiUrlSource ?? (configured?.source ?? "default"),
+    apiKeySource: resolution.apiKeySource ?? credential.source,
+    apiKeyTier: resolution.apiKeyTier,
+    warning: resolution.warning
+  };
+  if (credential.tier === "pointer") {
+    return { ...base2, apiKey: null, apiKeyPointer: credential };
+  }
+  if (!credential.apiKey.trim()) {
+    throw new SkillsFleetCredentialError(`The Skills API key from ${credential.source} is empty \u2014 refusing to send an unauthenticated request. ` + `Sign in with: skills auth login`);
+  }
+  return { ...base2, apiKey: credential.apiKey, apiKeyPointer: null };
+}
+async function resolveSkillsApiKey(env3 = process.env, options = {}) {
+  const fleet = resolveSkillsFleet(env3, options);
+  if (fleet.mode !== "hosted")
+    return null;
+  if (fleet.apiKey)
+    return fleet.apiKey;
+  const pointer = fleet.apiKeyPointer;
+  if (!pointer) {
+    throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills auth login`);
+  }
+  let completed;
+  try {
+    completed = await completePointerCredential(SKILLS_APP, pointer, env3);
+  } catch (error) {
+    const translated = asSkillsFleetCredentialError(error);
+    if (translated)
+      throw translated;
+    throw error;
+  }
+  if (!completed.apiKey?.trim()) {
+    throw new SkillsFleetCredentialError(`${credentialPointerEnvKey(SKILLS_APP)} names a vault item that produced an empty Skills API key \u2014 ` + `refusing to send an unauthenticated request.`);
+  }
+  return completed.apiKey;
+}
+async function requireSkillsApiKey(action = "This command", env3 = process.env, options = {}) {
+  const apiKey = await resolveSkillsApiKey(env3, options);
+  if (!apiKey)
+    throw new MissingSkillsFleetError(action);
+  return apiKey;
+}
+function stripV1(baseUrl) {
+  return baseUrl.replace(/\/v1$/, "").replace(/\/+$/, "");
+}
+async function skillsCredentialOrReason(env3 = process.env, options = {}) {
+  try {
+    const apiKey = await resolveSkillsApiKey(env3, options);
+    return apiKey ? { apiKey, reason: null } : { apiKey: null, reason: null };
+  } catch (error) {
+    if (error instanceof SkillsFleetCredentialError || error?.name === "SkillsFleetCredentialError") {
+      return { apiKey: null, reason: error.message };
+    }
+    throw error;
+  }
+}
+function resolveSkillsApiOrigin(env3 = process.env, options = {}) {
+  const configured = configuredSkillsApiUrl(env3, options.credentials?.keychain);
+  if (configured) {
+    toV1BaseUrl(configured.value);
+    return { origin: normalizeSkillsApiOrigin(configured.value), source: configured.source };
+  }
+  const fleet = resolveSkillsFleet(env3, options);
+  return fleet.mode === "hosted" ? { origin: fleet.apiOrigin, source: fleet.apiUrlSource } : null;
+}
+function requireSkillsApiOrigin(action = "This command", env3 = process.env, options = {}) {
+  const resolved = resolveSkillsApiOrigin(env3, options);
+  if (!resolved)
+    throw new MissingSkillsFleetError(action);
+  return resolved.origin;
+}
+function requireSkillsFleet(action = "This command", env3 = process.env, options = {}) {
+  const fleet = resolveSkillsFleet(env3, options);
+  if (fleet.mode === "hosted")
+    return fleet;
+  throw new MissingSkillsFleetError(action);
+}
+var SKILLS_APP = "skills", ENV_KEYS, SKILLS_API_URL_ENV_KEYS, SKILLS_API_KEY_ENV_KEYS, SKILLS_API_URL_ENV, SKILLS_API_KEY_ENV, SkillsFleetCredentialError, localNoticePrinted = false, MissingSkillsFleetError;
+var init_fleet_credentials = __esm(() => {
+  init_transport();
+  ENV_KEYS = clientTransportEnvKeys(SKILLS_APP);
+  SKILLS_API_URL_ENV_KEYS = ENV_KEYS.apiUrlKeys;
+  SKILLS_API_KEY_ENV_KEYS = ENV_KEYS.apiKeyKeys;
+  SKILLS_API_URL_ENV = SKILLS_API_URL_ENV_KEYS[0];
+  SKILLS_API_KEY_ENV = SKILLS_API_KEY_ENV_KEYS[0];
+  SkillsFleetCredentialError = class SkillsFleetCredentialError extends Error {
+    code;
+    constructor(message, code = "MISSING_API_CREDENTIAL") {
+      super(message);
+      this.name = "SkillsFleetCredentialError";
+      this.code = code;
+    }
+  };
+  MissingSkillsFleetError = class MissingSkillsFleetError extends Error {
+    code = "MISSING_API_URL";
+    constructor(action = "This command") {
+      super(`${action} requires a Skills API credential and none is configured \u2014 ` + `run: skills auth login, or set ${SKILLS_API_KEY_ENV} ` + `(add the Keychain item hasna.credentials.${SKILLS_APP}.api-key, or write ~/.hasna/skills/config/credentials). ` + `Point at your own instance with ${SKILLS_API_URL_ENV}, or run: skills setup --api-url <your Skills instance origin>`);
+      this.name = "MissingSkillsFleetError";
+    }
+  };
+});
+
+// src/lib/api-url.ts
+function resolveApiUrl(env3 = process.env, options = {}) {
+  const fleet = resolveSkillsFleet(env3, options);
+  return fleet.mode === "hosted" ? fleet.apiOrigin : undefined;
+}
+var API_URL_ENV_VAR, MISSING_API_URL_HINT;
+var init_api_url = __esm(() => {
+  init_fleet_credentials();
+  init_fleet_credentials();
+  API_URL_ENV_VAR = SKILLS_API_URL_ENV;
+  MISSING_API_URL_HINT = `run: skills auth login, or set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
 });
 
 // src/lib/remote-registry.ts
-function getConfiguredApiUrl(config = loadConfig(), env3 = process.env) {
-  return resolveApiUrl(config, env3);
+function getConfiguredApiUrl(env3 = process.env) {
+  return resolveApiUrl(env3);
 }
 function buildSkillsApiUrl(apiUrl, endpoint = "/skills") {
   const url = new URL(apiUrl);
   const cleanEndpoint = endpoint.startsWith("/") ? endpoint : `/${endpoint}`;
   const pathname = url.pathname.replace(/\/+$/, "");
-  if (pathname.endsWith("/skills")) {
-    if (cleanEndpoint === "/skills") {
-      url.pathname = pathname;
-    } else {
-      url.pathname = `${pathname.slice(0, -"/skills".length)}${cleanEndpoint}` || cleanEndpoint;
-    }
+  const apiBase = /\/api(?:\/v1)?\/skills$/.test(pathname) ? pathname.slice(0, -"/skills".length) : pathname;
+  if (/\/api(?:\/v1)?$/.test(apiBase)) {
+    url.pathname = `${apiBase}${cleanEndpoint}`;
     return url.toString();
   }
-  if (pathname.endsWith("/api") || pathname.endsWith("/api/v1")) {
-    url.pathname = `${pathname}${cleanEndpoint}`;
-    return url.toString();
-  }
-  url.pathname = `${pathname}/api/v1${cleanEndpoint}`.replace(/\/{2,}/g, "/");
+  url.pathname = `${apiBase}/api/v1${cleanEndpoint}`.replace(/\/{2,}/g, "/");
   return url.toString();
 }
 function titleize(name) {
@@ -47932,9 +48786,9 @@ function parseRemoteContract(schema, payload, message) {
     throw error;
   }
 }
-function remoteRequestHeaders(options) {
+async function remoteRequestHeaders(options) {
   const headers = new Headers({ Accept: "application/json" });
-  const token = options.authToken !== undefined ? options.authToken : getApiKey();
+  const token = options.authToken !== undefined ? options.authToken : await resolveSkillsApiKey();
   const trimmed = token?.trim();
   if (trimmed)
     headers.set("Authorization", `Bearer ${trimmed}`);
@@ -47942,11 +48796,12 @@ function remoteRequestHeaders(options) {
 }
 async function fetchRemoteJson(url, options) {
   const fetchImpl = options.fetchImpl || fetch;
+  const headers = await remoteRequestHeaders(options);
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 1e4);
   try {
     const response = await fetchImpl(url, {
-      headers: remoteRequestHeaders(options),
+      headers,
       signal: controller.signal
     });
     if (!response.ok) {
@@ -47960,7 +48815,7 @@ async function fetchRemoteJson(url, options) {
 async function loadRemoteRegistry(options = {}) {
   const apiUrl = options.apiUrl || getConfiguredApiUrl();
   if (!apiUrl) {
-    throw new Error("Remote registry requires SKILLS_API_URL or config apiUrl");
+    throw new Error(`Remote registry requires a Skills credential (${SKILLS_API_KEY_ENV}, the Keychain item, or ~/.hasna/skills/config/credentials) and, for your own instance, ${SKILLS_API_URL_ENV}`);
   }
   const url = buildSkillsApiUrl(apiUrl, options.endpoint);
   return parseRemoteRegistryPayload(await fetchRemoteJson(url, options));
@@ -47969,16 +48824,15 @@ async function mergeRemoteRegistry(local, options = {}) {
   const apiUrl = options.apiUrl || getConfiguredApiUrl();
   if (!apiUrl)
     return local;
-  const token = options.authToken !== undefined ? options.authToken : getApiKey();
-  if (!token?.trim())
+  if (options.authToken !== undefined && !options.authToken?.trim())
     return local;
-  const remote = await loadRemoteRegistry({ ...options, apiUrl, authToken: token });
+  const remote = await loadRemoteRegistry({ ...options, apiUrl });
   return mergeSkillRegistryLists(local, remote);
 }
 async function loadRemoteSkill(name, options = {}) {
   const apiUrl = options.apiUrl || getConfiguredApiUrl();
   if (!apiUrl) {
-    throw new Error("Remote registry requires SKILLS_API_URL or config apiUrl");
+    throw new Error(`Remote registry requires a Skills credential (${SKILLS_API_KEY_ENV}, the Keychain item, or ~/.hasna/skills/config/credentials) and, for your own instance, ${SKILLS_API_URL_ENV}`);
   }
   const slug = encodeURIComponent(name);
   const url = buildSkillsApiUrl(apiUrl, options.endpoint ?? `/skills/${slug}`);
@@ -47988,8 +48842,7 @@ var remoteAvailabilitySchema, remoteSkillSchema, secretValuePatterns, remoteSkil
 var init_remote_registry = __esm(() => {
   init_zod();
   init_api_url();
-  init_auth_store();
-  init_config();
+  init_fleet_credentials();
   init_discovery();
   init_registry_merge();
   remoteAvailabilitySchema = exports_external.object({
@@ -48034,6 +48887,162 @@ var init_remote_registry = __esm(() => {
   ]);
 });
 
+// src/lib/auth-store.ts
+import { chmodSync, existsSync as existsSync15, mkdirSync as mkdirSync7, readFileSync as readFileSync12, renameSync as renameSync4, statSync as statSync9, unlinkSync, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname6, join as join16 } from "path";
+function getAuthFilePath(env3 = process.env) {
+  return skillsCredentialFilePath(env3);
+}
+function getIdentityFilePath(env3 = process.env) {
+  return join16(dirname6(skillsCredentialFilePath(env3)), "identity.json");
+}
+function getAuthIdentity(env3 = process.env) {
+  return readIdentity(env3);
+}
+function readIdentity(env3 = process.env) {
+  try {
+    const parsed = JSON.parse(readFileSync12(getIdentityFilePath(env3), "utf-8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      return {};
+    const record = parsed;
+    const identity2 = {};
+    for (const field of ["email", "orgId", "orgSlug", "userId"]) {
+      const value = record[field];
+      if (typeof value === "string" && value.length > 0)
+        identity2[field] = value;
+    }
+    return identity2;
+  } catch {
+    return {};
+  }
+}
+function getAuthConfig(env3 = process.env, options = {}) {
+  const fleet = resolveSkillsFleet(env3, options);
+  if (fleet.mode !== "hosted")
+    return null;
+  return { apiKey: fleet.apiKey, ...readIdentity(env3) };
+}
+function writeCredentialValues(values2, env3 = process.env) {
+  const file = skillsCredentialFilePath(env3);
+  mkdirSync7(dirname6(file), { recursive: true, mode: 448 });
+  const lines = [];
+  const written = new Set;
+  if (existsSync15(file)) {
+    for (const raw of readFileSync12(file, "utf-8").split(/\r?\n/)) {
+      const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(raw);
+      const key = match?.[1];
+      if (key && key in values2) {
+        const next = values2[key];
+        if (next !== null && next !== undefined) {
+          lines.push(`${key}=${next}`);
+          written.add(key);
+        }
+        continue;
+      }
+      lines.push(raw);
+    }
+  }
+  for (const [key, value] of Object.entries(values2)) {
+    if (value === null || value === undefined || written.has(key))
+      continue;
+    lines.push(`${key}=${value}`);
+  }
+  const body = lines.filter((line, index) => !(line.trim() === "" && index === lines.length - 1)).join(`
+`) + `
+`;
+  const temp = `${file}.tmp-${process.pid}`;
+  writeFileSync7(temp, body, { mode: 384 });
+  chmodSync(temp, 384);
+  renameSync4(temp, file);
+  return file;
+}
+function readCredentialValue(key, env3 = process.env) {
+  let file;
+  try {
+    file = skillsCredentialFilePath(env3);
+  } catch {
+    return null;
+  }
+  if (!existsSync15(file))
+    return null;
+  try {
+    for (const raw of readFileSync12(file, "utf-8").split(/\r?\n/)) {
+      const match = new RegExp(`^\\s*(?:export\\s+)?${key}\\s*=\\s*(.*)$`).exec(raw);
+      if (!match)
+        continue;
+      let value = (match[1] ?? "").trim();
+      const quote = value[0];
+      if ((quote === '"' || quote === "'") && value.length >= 2 && value.endsWith(quote)) {
+        value = value.slice(1, -1);
+      }
+      return value || null;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+function saveAuthConfig(config, env3 = process.env) {
+  const apiKey = config.apiKey.trim();
+  if (!apiKey)
+    throw new Error("Refusing to store an empty Skills API key.");
+  if (/[^\t\x20-\x7e]/.test(apiKey)) {
+    throw new Error("Refusing to store a Skills API key containing control characters or non-ASCII bytes.");
+  }
+  const file = writeCredentialValues({ [SKILLS_API_KEY_ENV]: apiKey }, env3);
+  const identity2 = {};
+  for (const field of ["email", "orgId", "orgSlug", "userId"]) {
+    const value = config[field];
+    if (typeof value === "string" && value.length > 0)
+      identity2[field] = value;
+  }
+  const identityFile = getIdentityFilePath(env3);
+  if (Object.keys(identity2).length > 0) {
+    writeFileSync7(identityFile, JSON.stringify(identity2, null, 2) + `
+`, { mode: 384 });
+  } else {
+    try {
+      unlinkSync(identityFile);
+    } catch {}
+  }
+  return file;
+}
+function saveApiUrl(apiUrl, env3 = process.env) {
+  return writeCredentialValues({ [SKILLS_API_URL_ENV]: apiUrl }, env3);
+}
+function readStoredApiUrl(env3 = process.env) {
+  return readCredentialValue(SKILLS_API_URL_ENV, env3);
+}
+function clearAuthConfig(env3 = process.env) {
+  try {
+    writeCredentialValues({ [SKILLS_API_KEY_ENV]: null }, env3);
+  } catch {}
+  try {
+    unlinkSync(getIdentityFilePath(env3));
+  } catch {}
+  let stillResolves;
+  try {
+    stillResolves = resolveSkillsFleet(env3).mode === "hosted";
+  } catch {
+    stillResolves = true;
+  }
+  return { stillResolves };
+}
+function getApiUrl(action, env3 = process.env, options = {}) {
+  return requireSkillsApiOrigin(action, env3, options);
+}
+function credentialFileMode(env3 = process.env) {
+  try {
+    return statSync9(skillsCredentialFilePath(env3)).mode & 511;
+  } catch {
+    return null;
+  }
+}
+var init_auth_store = __esm(() => {
+  init_fleet_credentials();
+  init_fleet_credentials();
+});
+
 // src/lib/remote-run-contract.ts
 function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
   const record = isRecord3(payload) ? payload : {};
@@ -48351,26 +49360,23 @@ function normalizeUpdatedSincePage(payload) {
   }
   return { skills, nextCursor };
 }
-function createRemoteSkillsClient() {
-  const apiKey = getApiKey();
-  if (!apiKey)
+async function createRemoteSkillsClient(env3 = process.env) {
+  const fleet = resolveSkillsFleet(env3);
+  if (fleet.mode !== "hosted")
     return null;
-  return new RemoteSkillsClient(apiKey);
+  const apiKey = await resolveSkillsApiKey(env3);
+  if (!apiKey) {
+    throw new Error("A Skills authority resolved but no API key did. Sign in with: skills auth login");
+  }
+  return new RemoteSkillsClient(apiKey, fleet.apiOrigin);
 }
-function createRemoteSkillsClientReadOnly() {
-  const apiKey = getApiKeyReadOnly();
-  if (!apiKey)
-    return null;
-  const apiUrl = resolveApiUrl(loadConfigReadOnly(), process.env);
-  if (!apiUrl)
-    throw new MissingApiUrlError("the cloud group's sync verb (--dry-run)");
-  return new RemoteSkillsClient(apiKey, apiUrl);
+function createRemoteSkillsClientReadOnly(env3 = process.env) {
+  return createRemoteSkillsClient(env3);
 }
 var RemoteRouteUnsupportedError, RemoteRequestError;
 var init_remote_client = __esm(() => {
   init_auth_store();
-  init_api_url();
-  init_config();
+  init_fleet_credentials();
   RemoteRouteUnsupportedError = class RemoteRouteUnsupportedError extends Error {
     path;
     status;
@@ -48420,8 +49426,8 @@ var init_revision = __esm(() => {
 
 // src/lib/skill-bundle.ts
 import { createHash as createHash3 } from "crypto";
-import { readFileSync as readFileSync12, readdirSync as readdirSync9, statSync as statSync9 } from "fs";
-import { join as join16, relative as relative2 } from "path";
+import { readFileSync as readFileSync13, readdirSync as readdirSync9, statSync as statSync10 } from "fs";
+import { join as join17, relative as relative2 } from "path";
 function isDotenvFile(lower) {
   if (lower === ".env" || lower.startsWith(".env."))
     return true;
@@ -48459,7 +49465,7 @@ function collectSkillBundleEntries(dir) {
 }
 function walk(root, current, out) {
   for (const entry of readdirSync9(current, { withFileTypes: true })) {
-    const absolute = join16(current, entry.name);
+    const absolute = join17(current, entry.name);
     const rel = relative2(root, absolute).split("\\").join("/");
     const isRootLevel = !rel.includes("/");
     if (ANY_SEGMENT_EXCLUDES.has(entry.name.toLowerCase()))
@@ -48480,10 +49486,10 @@ function walk(root, current, out) {
       continue;
     if (isCredentialFile(entry.name))
       continue;
-    const stats = statSync9(absolute);
+    const stats = statSync10(absolute);
     out.push({
       path: rel,
-      bytes: ownBytes(readFileSync12(absolute)),
+      bytes: ownBytes(readFileSync13(absolute)),
       mode: stats.mode & 64 ? 493 : 420
     });
   }
@@ -48778,12 +49784,12 @@ var init_skill_bundles = __esm(() => {
 });
 
 // src/lib/pull.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync3, readFileSync as readFileSync13, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname7, join as join17 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync3, readFileSync as readFileSync14, renameSync as renameSync5, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname7, join as join18 } from "path";
 async function pullSkills(options = {}) {
-  const client = options.client !== undefined ? options.client : createRemoteSkillsClient();
+  const client = options.client !== undefined ? options.client : await createRemoteSkillsClient();
   if (!client) {
-    throw new PullSkillError("No API key configured, so there is no instance to pull from.", ["Run `skills login`, or set SKILLS_API_KEY and SKILLS_API_URL for this instance."]);
+    throw new PullSkillError("No API key configured, so there is no instance to pull from.", ["Run `skills auth login`, or set HASNA_SKILLS_API_KEY (and HASNA_SKILLS_API_URL for your own instance)."]);
   }
   const signingKey = options.signingKey ?? resolveSigningKey() ?? undefined;
   const targets = await resolveTargetSlugs(client, options);
@@ -48835,8 +49841,8 @@ async function pullOne(client, rawName, corpusOptions, verify) {
       return reconcileTombstone(slug, corpusOptions);
     }
     if (bundleResponse.status === 404) {
-      const marker = readPullMarker(join17(getPortableSkillsRoot(corpusOptions), slug));
-      if (marker && typeof marker.revisionId === "string" && marker.revisionId) {
+      const marker = readPullMarker(join18(getPortableSkillsRoot(corpusOptions), slug));
+      if (isPublishedInstallMarker(marker)) {
         return { name: slug, success: true, purged: true, removed: false };
       }
     }
@@ -48874,8 +49880,8 @@ async function pullOne(client, rawName, corpusOptions, verify) {
     return { name: slug, success: false, error: `Skill '${slug}' was not found on the configured Skills instance.` };
   }
   if (!meta?.revisionId) {
-    const marker = readPullMarker(join17(getPortableSkillsRoot(corpusOptions), slug));
-    if (marker && typeof marker.revisionId === "string" && marker.revisionId) {
+    const marker = readPullMarker(join18(getPortableSkillsRoot(corpusOptions), slug));
+    if (isPublishedInstallMarker(marker)) {
       return { name: slug, success: true, purged: true, removed: false };
     }
   }
@@ -48931,8 +49937,8 @@ function provenRevision(meta, slug, bundle) {
   return declared;
 }
 function reconcileTombstone(slug, corpusOptions) {
-  const target = join17(getPortableSkillsRoot(corpusOptions), slug);
-  if (!existsSync16(join17(target, PULL_MARKER_FILE))) {
+  const target = join18(getPortableSkillsRoot(corpusOptions), slug);
+  if (!existsSync16(join18(target, PULL_MARKER_FILE))) {
     return { name: slug, success: true, tombstoned: true, removed: false, leftInPlace: true };
   }
   rmSync5(target, { recursive: true, force: true });
@@ -48940,11 +49946,18 @@ function reconcileTombstone(slug, corpusOptions) {
 }
 function readPullMarker(dir) {
   try {
-    return JSON.parse(readFileSync13(join17(dir, PULL_MARKER_FILE), "utf-8"));
+    return JSON.parse(readFileSync14(join18(dir, PULL_MARKER_FILE), "utf-8"));
   } catch {
     return null;
   }
 }
+function isPublishedInstallMarker(marker) {
+  if (!marker)
+    return false;
+  const revisionId = typeof marker.revisionId === "string" ? marker.revisionId : "";
+  const contentHash = typeof marker.contentHash === "string" ? marker.contentHash : "";
+  return revisionId.length > 0 || contentHash.length > 0;
+}
 function installVerifiedBundle(slug, response, meta, corpusOptions, verify, exact) {
   return response.arrayBuffer().then((buffer) => {
     const verified = verifyBundleResponseBytes(buffer, response, verify);
@@ -49068,14 +50081,14 @@ function verifyBundleResponseBytes(buffer, response, verify = {}) {
 function installBundleAtomically(name, entries, options = {}, marker = {}) {
   const root = getPortableSkillsRoot(options);
   mkdirSync8(root, { recursive: true });
-  const target = join17(root, name);
+  const target = join18(root, name);
   const created = !existsSync16(target);
-  const staging = mkdtempSync3(join17(root, `.pull-${name}-`));
+  const staging = mkdtempSync3(join18(root, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
     for (const entry of entries) {
-      const destination = join17(staging, entry.path);
+      const destination = join18(staging, entry.path);
       mkdirSync8(dirname7(destination), { recursive: true });
       writeFileSync8(destination, entry.bytes, { mode: entry.mode });
     }
@@ -49088,18 +50101,18 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
       ...marker.revisionId ? { revisionId: marker.revisionId } : {}
     });
     if (existsSync16(target)) {
-      backup = mkdtempSync3(join17(root, `.pull-backup-${name}-`));
-      renameSync4(target, join17(backup, name));
+      backup = mkdtempSync3(join18(root, `.pull-backup-${name}-`));
+      renameSync5(target, join18(backup, name));
       moved = true;
     }
-    renameSync4(staging, target);
+    renameSync5(staging, target);
     if (moved && backup)
       rmSync5(backup, { recursive: true, force: true });
   } catch (error) {
     rmSync5(staging, { recursive: true, force: true });
-    if (moved && backup && existsSync16(join17(backup, name))) {
+    if (moved && backup && existsSync16(join18(backup, name))) {
       try {
-        renameSync4(join17(backup, name), target);
+        renameSync5(join18(backup, name), target);
       } catch {}
     }
     throw error;
@@ -49118,7 +50131,7 @@ function writePullMarker(dir, record) {
     ...record.revisionId ? { revisionId: record.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
-  writeFileSync8(join17(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
+  writeFileSync8(join18(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
 `);
 }
 async function safeMeta(client, slug) {
@@ -49197,7 +50210,7 @@ __export(exports_install, {
 });
 function registerInstall(parent) {
   parent.command("install").argument("[args...]", "Deprecated. Use 'skills pin <name>' for project skill pins.").option("--json", "Output result as JSON", false).description("Deprecated. Render skills into native agent folders with 'skills render'.").action((args, options) => handleDeprecatedInstall(args, options));
-  parent.command("pin").argument("[skills...]", "Skills to pin").option("-o, --overwrite", "Refresh existing pins", false).option("--json", "Output results as JSON", false).option("--dry-run", "Print what would happen without actually pinning", false).option("--category <category>", "Pin all skills in a category (case-insensitive)").option("--remote", "Pin skills from the remote registry configured by SKILLS_API_URL or config apiUrl", false).description("Pin skills in .skills/project.json without copying source").action((skills, options) => {
+  parent.command("pin").argument("[skills...]", "Skills to pin").option("-o, --overwrite", "Refresh existing pins", false).option("--json", "Output results as JSON", false).option("--dry-run", "Print what would happen without actually pinning", false).option("--category <category>", "Pin all skills in a category (case-insensitive)").option("--remote", "Pin skills from the remote registry (the resolved Skills credential; HASNA_SKILLS_API_URL for your own instance). Implied for name@version pins", false).description("Pin skills in .skills/project.json without copying source").action((skills, options) => {
     handlePin(skills, options).catch(handlePinError);
   });
   parent.command("unpin").argument("<skill>", "Skill to unpin").option("--json", "Output as JSON", false).option("--dry-run", "Print what would happen without actually unpinning", false).description("Remove a skill from project pins").action((skill, options) => handleUnpin(skill, options));
@@ -49280,7 +50293,10 @@ Pinning ${skills.length} skills from "${matchedCategory}"...
     const { name: pinName, version: pinnedVersion } = splitNameVersion(skills[i]);
     if (total > 1 && !options.json)
       process.stdout.write(`[${i + 1}/${total}] Pinning ${skills[i]}...`);
-    const result2 = pinnedVersion ? await pinExactVersion(pinName, pinnedVersion, { useRemote, overwrite: options.overwrite }) : useRemote ? pinRemoteSkill(pinName, remoteByName, options.overwrite) : installSkill(pinName, { overwrite: options.overwrite });
+    const result2 = pinnedVersion ? await pinExactVersion(pinName, pinnedVersion, {
+      useRemote: true,
+      overwrite: options.overwrite
+    }) : useRemote ? pinRemoteSkill(pinName, remoteByName, options.overwrite) : installSkill(pinName, { overwrite: options.overwrite });
     results.push(result2);
     if (total > 1 && !options.json)
       console.log(result2.success ? " done" : ` ${source_default.red("failed")}`);
@@ -49389,7 +50405,12 @@ Pinned skills (${pins.length}):
 }
 async function pinExactVersion(name, version, options) {
   if (!options.useRemote) {
-    return { skill: name, success: false, error: `Pinning '${name}@${version}' needs a configured Skills instance to fetch that version from (skills login / SKILLS_API_URL).`, mode: "pin" };
+    return {
+      skill: name,
+      success: false,
+      error: `Pinning '${name}@${version}' needs a configured Skills instance: an exact version only exists on an instance, so the fetch is implied for name@version pins (skills auth login, or HASNA_SKILLS_API_URL for your own instance).`,
+      mode: "pin"
+    };
   }
   const pull2 = options.pull ?? (async (spec) => (await pullSkills({ names: [spec] })).results[0] ?? { success: false, error: "pull returned no result" });
   const pulled = await pull2(`${name}@${version}`);
@@ -49507,16 +50528,16 @@ __export(exports_list, {
   registerBrowse: () => registerBrowse
 });
 function registerBrowse(parent) {
-  parent.command("list").alias("ls").option("-c, --category <category>", "Filter by category").option("-p, --pinned", "Show only pinned skills", false).option("-t, --tags <tags>", "Filter by comma-separated tags (OR logic, case-insensitive)").option("--tag <tags>", "Filter by comma-separated tags (alias for --tags)").option("--all", "Show the full skill registry instead of the default basic set", false).option("--remote", "Use remote registry from SKILLS_API_URL or config apiUrl", false).option("--json", "Output as JSON", false).option("--brief", "One line per skill: name \u2014 description [category]", false).option("--format <format>", "Output format: compact (names only) or csv (name,category,price,description)").option("--limit <n>", "Maximum rows to print for human output (default: 30, use 0 or all for every row)").option("--cursor <n>", "Numeric offset for human-output pagination", "0").option("--verbose", "Show longer descriptions and tags in human output", false).action((options) => {
+  parent.command("list").alias("ls").option("-c, --category <category>", "Filter by category").option("-p, --pinned", "Show only pinned skills", false).option("-t, --tags <tags>", "Filter by comma-separated tags (OR logic, case-insensitive)").option("--tag <tags>", "Filter by comma-separated tags (alias for --tags)").option("--all", "Show the full skill registry instead of the default basic set", false).option("--remote", "Use the remote registry (the resolved Skills credential; HASNA_SKILLS_API_URL for your own instance)", false).option("--json", "Output as JSON", false).option("--brief", "One line per skill: name \u2014 description [category]", false).option("--format <format>", "Output format: compact (names only) or csv (name,category,price,description)").option("--limit <n>", "Maximum rows to print for human output (default: 30, use 0 or all for every row)").option("--cursor <n>", "Numeric offset for human-output pagination", "0").option("--verbose", "Show longer descriptions and tags in human output", false).action((options) => {
     return handleList(options).catch(handleBrowseError);
   });
-  parent.command("search").alias("s").argument("<query>", "Search term").option("--json", "Output as JSON", false).option("--brief", "One line per skill: name \u2014 description [category]", false).option("--format <format>", "Output format: compact (names only) or csv (name,category,price,description)").option("-c, --category <category>", "Filter results by category").option("-t, --tags <tags>", "Filter results by comma-separated tags (OR logic, case-insensitive)").option("--all", "Search the full skill registry instead of the default basic set", false).option("--remote", "Use remote registry from SKILLS_API_URL or config apiUrl", false).option("--limit <n>", "Maximum rows to print for human output (default: 20, use 0 or all for every row)").option("--cursor <n>", "Numeric offset for human-output pagination", "0").option("--verbose", "Show longer descriptions and tags in human output", false).description("Search for skills").action((query, options) => {
+  parent.command("search").alias("s").argument("<query>", "Search term").option("--json", "Output as JSON", false).option("--brief", "One line per skill: name \u2014 description [category]", false).option("--format <format>", "Output format: compact (names only) or csv (name,category,price,description)").option("-c, --category <category>", "Filter results by category").option("-t, --tags <tags>", "Filter results by comma-separated tags (OR logic, case-insensitive)").option("--all", "Search the full skill registry instead of the default basic set", false).option("--remote", "Use the remote registry (the resolved Skills credential; HASNA_SKILLS_API_URL for your own instance)", false).option("--limit <n>", "Maximum rows to print for human output (default: 20, use 0 or all for every row)").option("--cursor <n>", "Numeric offset for human-output pagination", "0").option("--verbose", "Show longer descriptions and tags in human output", false).description("Search for skills").action((query, options) => {
     return handleSearch(query, options).catch(handleBrowseError);
   });
-  parent.command("categories").option("--json", "Output as JSON", false).option("--remote", "Use remote registry from SKILLS_API_URL or config apiUrl", false).description("List all categories").action((options) => {
+  parent.command("categories").option("--json", "Output as JSON", false).option("--remote", "Use the remote registry (the resolved Skills credential; HASNA_SKILLS_API_URL for your own instance)", false).description("List all categories").action((options) => {
     return handleCategories(options).catch(handleBrowseError);
   });
-  parent.command("tags").option("--json", "Output as JSON", false).option("--remote", "Use remote registry from SKILLS_API_URL or config apiUrl", false).option("--limit <n>", "Maximum rows to print for human output (default: 80, use 0 or all for every row)").option("--cursor <n>", "Numeric offset for human-output pagination", "0").description("List all unique tags with counts").action((options) => {
+  parent.command("tags").option("--json", "Output as JSON", false).option("--remote", "Use the remote registry (the resolved Skills credential; HASNA_SKILLS_API_URL for your own instance)", false).option("--limit <n>", "Maximum rows to print for human output (default: 80, use 0 or all for every row)").option("--cursor <n>", "Numeric offset for human-output pagination", "0").description("List all unique tags with counts").action((options) => {
     return handleTags(options).catch(handleBrowseError);
   });
 }
@@ -49883,16 +50904,16 @@ __export(exports_skillinfo, {
   generateEnvExample: () => generateEnvExample,
   detectProjectSkills: () => detectProjectSkills
 });
-import { existsSync as existsSync17, readFileSync as readFileSync14 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
+import { join as join19 } from "path";
 function isInstructionSkillDir(skillPath, meta) {
   if (meta?.kind === "instruction")
     return true;
-  const skillMdPath = join18(skillPath, "SKILL.md");
+  const skillMdPath = join19(skillPath, "SKILL.md");
   if (!existsSync17(skillMdPath))
     return false;
   try {
-    return parseSkillFrontmatter(readFileSync14(skillMdPath, "utf-8"))?.kind === "instruction";
+    return parseSkillFrontmatter(readFileSync15(skillMdPath, "utf-8"))?.kind === "instruction";
   } catch {
     return false;
   }
@@ -49902,9 +50923,9 @@ function getSkillDocs(name) {
   if (!existsSync17(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join18(skillPath, "SKILL.md")),
-    readme: readIfExists(join18(skillPath, "README.md")),
-    claudeMd: readIfExists(join18(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join19(skillPath, "SKILL.md")),
+    readme: readIfExists(join19(skillPath, "README.md")),
+    claudeMd: readIfExists(join19(skillPath, "CLAUDE.md"))
   };
 }
 function getSkillBestDoc(name) {
@@ -49919,7 +50940,7 @@ function getSkillRequirements(name) {
     return null;
   const texts = [];
   for (const file of ["SKILL.md", "README.md", "CLAUDE.md", ".env.example", ".env.local.example"]) {
-    const content = readIfExists(join18(skillPath, file));
+    const content = readIfExists(join19(skillPath, file));
     if (content)
       texts.push(content);
   }
@@ -49935,7 +50956,8 @@ function getSkillRequirements(name) {
       }
     }
     envVars.delete("SKILL_API_KEY");
-    envVars.add("SKILLS_API_KEY");
+    envVars.delete("SKILLS_API_KEY");
+    envVars.add("HASNA_SKILLS_API_KEY");
   }
   const systemDeps = new Set;
   const depPatterns = [
@@ -49958,10 +50980,10 @@ function getSkillRequirements(name) {
   const skillName = normalizeSkillName(name);
   let cliCommand = `skills run ${skillName}`;
   let dependencies = {};
-  const pkgPath = join18(skillPath, "package.json");
+  const pkgPath = join19(skillPath, "package.json");
   if (existsSync17(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
+      const pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
       dependencies = pkg.dependencies || {};
     } catch {}
   }
@@ -49978,9 +51000,9 @@ function isHostedPremiumSkill(skillName, meta) {
 function isPackageResolvable(pkgName, fromDir) {
   let dir = fromDir;
   while (true) {
-    if (existsSync17(join18(dir, "node_modules", pkgName, "package.json")))
+    if (existsSync17(join19(dir, "node_modules", pkgName, "package.json")))
       return true;
-    const parent = join18(dir, "..");
+    const parent = join19(dir, "..");
     if (parent === dir)
       return false;
     dir = parent;
@@ -50009,13 +51031,13 @@ async function runSkill(name, args, options = {}) {
       error: `Skill '${name}' is an instruction skill (kind: instruction) and is not runnable. Instruction skills are consumed by coding agents via SKILL.md, not executed with 'skills run'.`
     };
   }
-  const pkgPath = join18(skillPath, "package.json");
+  const pkgPath = join19(skillPath, "package.json");
   if (!existsSync17(pkgPath)) {
     return { exitCode: 1, error: `No package.json in skill '${name}'` };
   }
   let entryPoint;
   try {
-    const pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
     if (pkg.bin) {
       const binValues = Object.values(pkg.bin);
       entryPoint = binValues[0];
@@ -50029,11 +51051,11 @@ async function runSkill(name, args, options = {}) {
   } catch {
     return { exitCode: 1, error: `Failed to parse package.json for skill '${name}'` };
   }
-  const entryPath = join18(skillPath, entryPoint);
+  const entryPath = join19(skillPath, entryPoint);
   if (!existsSync17(entryPath)) {
     return { exitCode: 1, error: `Entry point '${entryPoint}' not found in skill '${name}'` };
   }
-  const nodeModules = join18(skillPath, "node_modules");
+  const nodeModules = join19(skillPath, "node_modules");
   if (!existsSync17(nodeModules)) {
     const install = Bun.spawn(["bun", "install", "--no-save"], {
       cwd: skillPath,
@@ -50061,7 +51083,7 @@ async function runSkill(name, args, options = {}) {
   return { exitCode };
 }
 function detectProjectSkills(cwd2 = process.cwd()) {
-  const pkgPath = join18(cwd2, "package.json");
+  const pkgPath = join19(cwd2, "package.json");
   if (!existsSync17(pkgPath)) {
     const alwaysRecommend = ["market-research-report", "repo-onboarding-report", "blog-article"];
     const recommended2 = alwaysRecommend.map((name) => loadRegistry().find((s) => s.name === name)).filter((s) => s !== undefined);
@@ -50069,7 +51091,7 @@ function detectProjectSkills(cwd2 = process.cwd()) {
   }
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
+    pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
   } catch {
     const alwaysRecommend = ["market-research-report", "repo-onboarding-report", "blog-article"];
     const recommended2 = alwaysRecommend.map((name) => loadRegistry().find((s) => s.name === name)).filter((s) => s !== undefined);
@@ -50198,13 +51220,13 @@ function generateSkillMd(name) {
     "---"
   ].join(`
 `);
-  const readme = readIfExists(join18(skillPath, "README.md"));
-  const claudeMd = readIfExists(join18(skillPath, "CLAUDE.md"));
+  const readme = readIfExists(join19(skillPath, "README.md"));
+  const claudeMd = readIfExists(join19(skillPath, "CLAUDE.md"));
   let cliCommand = null;
-  const pkgPath = join18(skillPath, "package.json");
+  const pkgPath = join19(skillPath, "package.json");
   if (existsSync17(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
+      const pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
       if (pkg.bin) {
         const binKeys = Object.keys(pkg.bin);
         if (binKeys.length > 0)
@@ -50278,7 +51300,7 @@ function extractEnvVars(text) {
 function readIfExists(path) {
   try {
     if (existsSync17(path)) {
-      return readFileSync14(path, "utf-8");
+      return readFileSync15(path, "utf-8");
     }
   } catch {}
   return null;
@@ -50313,11 +51335,11 @@ var exports_introspect = {};
 __export(exports_introspect, {
   registerIntrospect: () => registerIntrospect
 });
-import { existsSync as existsSync18, readFileSync as readFileSync15 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
+import { join as join20 } from "path";
 import { execSync } from "child_process";
 function registerIntrospect(parent) {
-  parent.command("info").argument("<skill>", "Skill name").option("--json", "Output as JSON", false).option("--brief", "Single line: name \u2014 description [category] (tags: ...)", false).option("--remote", "Use remote registry from SKILLS_API_URL or config apiUrl", false).description("Show details about a specific skill").action((name, options) => {
+  parent.command("info").argument("<skill>", "Skill name").option("--json", "Output as JSON", false).option("--brief", "Single line: name \u2014 description [category] (tags: ...)", false).option("--remote", "Use the remote registry (the resolved Skills credential; HASNA_SKILLS_API_URL for your own instance)", false).description("Show details about a specific skill").action((name, options) => {
     return handleInfo(name, options).catch(async (error) => {
       const notFound = await resolveRemoteNotFound(name, options.remote, error.message);
       if (options.json)
@@ -50327,7 +51349,7 @@ function registerIntrospect(parent) {
       process.exitCode = 1;
     });
   });
-  parent.command("show").argument("<skill>", "Skill name").option("--json", "Output as JSON", false).option("--brief", "Single line: name \u2014 description [category] (tags: ...)", false).option("--remote", "Use remote registry from SKILLS_API_URL or config apiUrl", false).description("Show details about a specific skill").action((name, options) => {
+  parent.command("show").argument("<skill>", "Skill name").option("--json", "Output as JSON", false).option("--brief", "Single line: name \u2014 description [category] (tags: ...)", false).option("--remote", "Use the remote registry (the resolved Skills credential; HASNA_SKILLS_API_URL for your own instance)", false).description("Show details about a specific skill").action((name, options) => {
     return handleInfo(name, options).catch(async (error) => {
       const notFound = await resolveRemoteNotFound(name, options.remote, error.message);
       if (options.json)
@@ -50535,36 +51557,36 @@ function handleDiff(name, options) {
   const bare = name;
   const normalized = normalizePortableSkillName(bare);
   const sourcePath = getSkillPath(bare);
-  const canonicalDir = join19(resolveCorpusRoot(), normalized);
-  const canonicalSkillMd = join19(canonicalDir, "SKILL.md");
+  const canonicalDir = join20(resolveCorpusRoot(), normalized);
+  const canonicalSkillMd = join20(canonicalDir, "SKILL.md");
   const canonical = {
     present: existsSync18(canonicalSkillMd),
     path: canonicalDir,
     ...existsSync18(canonicalSkillMd) ? { hash: hashSkillMarkdownFile(canonicalSkillMd) } : {},
-    ...existsSync18(canonicalSkillMd) ? { stub: isPointerSkillMd(readFileSync15(canonicalSkillMd, "utf-8")) } : {}
+    ...existsSync18(canonicalSkillMd) ? { stub: isPointerSkillMd(readFileSync16(canonicalSkillMd, "utf-8")) } : {}
   };
   const pinned = getInstalledSkills().includes(bare);
   const installMeta = getInstallMeta();
   const installedVersion = installMeta.skills[bare]?.version ?? "unknown";
-  const registryPkgPath = join19(sourcePath, "package.json");
+  const registryPkgPath = join20(sourcePath, "package.json");
   let registryVersion = "unknown";
   if (existsSync18(registryPkgPath)) {
     try {
-      registryVersion = JSON.parse(readFileSync15(registryPkgPath, "utf-8")).version || "unknown";
+      registryVersion = JSON.parse(readFileSync16(registryPkgPath, "utf-8")).version || "unknown";
     } catch {}
   }
   const upToDate = installedVersion === registryVersion;
   const homes = [];
   for (const agent of SYNC_AGENTS) {
-    const dir = join19(agentGlobalSkillsDir(agent), normalized);
+    const dir = join20(agentGlobalSkillsDir(agent), normalized);
     const present = existsSync18(dir);
-    const managed = existsSync18(join19(dir, SYNC_MARKER_FILE));
-    const skillMdPath = join19(dir, "SKILL.md");
+    const managed = existsSync18(join20(dir, SYNC_MARKER_FILE));
+    const skillMdPath = join20(dir, "SKILL.md");
     const hash = present && existsSync18(skillMdPath) ? hashSkillMarkdownFile(skillMdPath) : undefined;
     let stub;
     if (present && existsSync18(skillMdPath)) {
       try {
-        stub = isPointerSkillMd(readFileSync15(skillMdPath, "utf-8"));
+        stub = isPointerSkillMd(readFileSync16(skillMdPath, "utf-8"));
       } catch {
         stub = undefined;
       }
@@ -50816,7 +51838,7 @@ var init_tool_primitives = __esm(() => {
       cliCommands: ["skills tools deps <skill>", "skills run <skill>"],
       mcpTools: ["get_skill_tool_dependencies", "run_skill"],
       apiSurfaces: ["runSkill", "SkillRunRecord", "RemoteSkillRunContract"],
-      envVars: ["SKILLS_API_KEY"],
+      envVars: ["HASNA_SKILLS_API_KEY"],
       outputTypes: ["text", "json", "markdown", "artifact"],
       capabilities: ["completion", "reasoning", "tool-calling", "vision-input", "structured-output"]
     },
@@ -50872,7 +51894,7 @@ var init_tool_primitives = __esm(() => {
       cliCommands: ["skills tools deps <skill>", "skills run <skill>"],
       mcpTools: ["get_skill_tool_dependencies", "run_skill"],
       apiSurfaces: ["runSkill", "RemoteSkillRunContract"],
-      envVars: ["SKILLS_API_KEY"],
+      envVars: ["HASNA_SKILLS_API_KEY"],
       outputTypes: ["png", "jpeg", "webp", "svg", "zip"],
       capabilities: ["image-generation", "image-analysis", "image-editing", "asset-packaging"]
     },
@@ -50886,7 +51908,7 @@ var init_tool_primitives = __esm(() => {
       cliCommands: ["skills tools deps <skill>", "skills run <skill>"],
       mcpTools: ["get_skill_tool_dependencies", "run_skill"],
       apiSurfaces: ["runSkill", "RemoteSkillRunContract"],
-      envVars: ["SKILLS_API_KEY"],
+      envVars: ["HASNA_SKILLS_API_KEY"],
       outputTypes: ["mp3", "wav", "txt", "srt", "json", "zip"],
       capabilities: ["transcription", "audio-generation", "voiceover", "audio-cleanup"]
     },
@@ -50900,7 +51922,7 @@ var init_tool_primitives = __esm(() => {
       cliCommands: ["skills tools deps <skill>", "skills run <skill>"],
       mcpTools: ["get_skill_tool_dependencies", "run_skill"],
       apiSurfaces: ["runSkill", "RemoteSkillRunContract"],
-      envVars: ["SKILLS_API_KEY"],
+      envVars: ["HASNA_SKILLS_API_KEY"],
       outputTypes: ["mp4", "mov", "srt", "png", "json", "zip"],
       capabilities: ["video-generation", "video-analysis", "captioning", "highlight-extraction"]
     },
@@ -50928,7 +51950,7 @@ var init_tool_primitives = __esm(() => {
       cliCommands: ["skills tools deps <skill>", "skills run <skill>"],
       mcpTools: ["get_skill_tool_dependencies", "run_skill"],
       apiSurfaces: ["SkillRunContext", "RemoteSkillRunContract"],
-      envVars: ["SKILLS_API_KEY"],
+      envVars: ["HASNA_SKILLS_API_KEY"],
       outputTypes: ["json", "artifact"],
       capabilities: ["approval", "external-api", "account-scoped-execution"]
     },
@@ -50970,7 +51992,7 @@ var init_tool_primitives = __esm(() => {
       cliCommands: ["skills auth login", "skills run <skill>"],
       mcpTools: ["run_skill"],
       apiSurfaces: ["RemoteSkillsClient", "RemoteSkillRunContract"],
-      envVars: ["SKILLS_API_KEY"],
+      envVars: ["HASNA_SKILLS_API_KEY"],
       outputTypes: ["json"],
       capabilities: ["account-auth", "remote-run-submit"]
     }
@@ -51097,8 +52119,8 @@ var exports_init = {};
 __export(exports_init, {
   registerSetup: () => registerSetup
 });
-import { existsSync as existsSync19, readFileSync as readFileSync16, writeFileSync as writeFileSync9, appendFileSync } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync17, writeFileSync as writeFileSync9, appendFileSync } from "fs";
+import { join as join21 } from "path";
 function registerSetup(parent) {
   parent.command("init").option("--json", "Output as JSON", false).option("--for <agent>", "Detect project type and show MCP registration guidance for agent").option("--scope <scope>", "Deprecated; agent skill-folder installs are disabled", "global").description("Initialize project for pinned skills (.env.example, .gitignore)").action((options) => handleInit(options));
   parent.command("export").option("--json", "Output as JSON (default behavior)", false).description("Export pinned skills to JSON for sharing or backup").action((_options) => handleExport());
@@ -51182,7 +52204,7 @@ Use: skills render`));
       lines.push(`# Used by: ${skills.join(", ")}`);
       lines.push(`${envVar}=`);
     }
-    writeFileSync9(join20(cwd2, ".env.example"), lines.join(`
+    writeFileSync9(join21(cwd2, ".env.example"), lines.join(`
 `) + `
 `);
     envVarCount = envMap.size;
@@ -51190,9 +52212,9 @@ Use: skills render`));
       console.log(source_default.green(`\u2713 Generated .env.example (${envVarCount} variables from ${installed.length} skills)`));
   } else if (!options.json)
     console.log(source_default.dim("  No environment variables detected across pinned skills"));
-  const gitignorePath = join20(cwd2, ".gitignore");
+  const gitignorePath = join21(cwd2, ".gitignore");
   const gitignoreEntries = [".skills/runs/", ".skills/exports/", ".skills/tmp/"];
-  let gitignoreContent = existsSync19(gitignorePath) ? readFileSync16(gitignorePath, "utf-8") : "";
+  let gitignoreContent = existsSync19(gitignorePath) ? readFileSync17(gitignorePath, "utf-8") : "";
   let gitignoreUpdated = false;
   const missingEntries = gitignoreEntries.filter((entry) => !gitignoreContent.includes(entry));
   if (missingEntries.length > 0) {
@@ -51247,7 +52269,7 @@ async function handleImport(file, options) {
         process.exitCode = 1;
         return;
       }
-      raw = readFileSync16(file, "utf-8");
+      raw = readFileSync17(file, "utf-8");
     }
   } catch (err) {
     const error = `Failed to read file: ${err.message}`;
@@ -51344,9 +52366,9 @@ var init_init = __esm(() => {
 });
 
 // src/lib/home-adoption.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync9, readdirSync as readdirSync10, readFileSync as readFileSync17, rmSync as rmSync6, statSync as statSync10, writeFileSync as writeFileSync10 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join21 } from "path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync9, readdirSync as readdirSync10, readFileSync as readFileSync18, rmSync as rmSync6, statSync as statSync11, writeFileSync as writeFileSync10 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join22 } from "path";
 function indexCanonicalCorpus(corpusRoot) {
   const byName = new Map;
   if (!existsSync20(corpusRoot))
@@ -51360,7 +52382,7 @@ function indexCanonicalCorpus(corpusRoot) {
   for (const entry of entries.sort()) {
     if (entry.startsWith("."))
       continue;
-    const skillMd = join21(corpusRoot, entry, "SKILL.md");
+    const skillMd = join22(corpusRoot, entry, "SKILL.md");
     if (!existsSync20(skillMd))
       continue;
     try {
@@ -51370,13 +52392,13 @@ function indexCanonicalCorpus(corpusRoot) {
   return byName;
 }
 function scanUnmarkedHomes(options = {}) {
-  const homeDir = options.homeDir ?? homedir7();
+  const homeDir2 = options.homeDir ?? homedir5();
   const corpusRoot = resolveCorpusRoot(options);
   const index = indexCanonicalCorpus(corpusRoot);
   const agents = options.agents?.length ? options.agents : [...SYNC_AGENTS];
   const scan = { adoptable: [], conflicts: [], unknown: [], managed: 0 };
   for (const agent of agents) {
-    const home = agentGlobalSkillsDir(agent, homeDir);
+    const home = agentGlobalSkillsDir(agent, homeDir2);
     if (!existsSync20(home))
       continue;
     let entries = [];
@@ -51388,22 +52410,22 @@ function scanUnmarkedHomes(options = {}) {
     for (const skill of entries.sort()) {
       if (skill.startsWith("."))
         continue;
-      const dir = join21(home, skill);
+      const dir = join22(home, skill);
       try {
-        if (!statSync10(dir).isDirectory())
+        if (!statSync11(dir).isDirectory())
           continue;
       } catch {
         continue;
       }
-      if (existsSync20(join21(dir, SYNC_MARKER_FILE))) {
+      if (existsSync20(join22(dir, SYNC_MARKER_FILE))) {
         scan.managed += 1;
         continue;
       }
-      const skillMdPath = join21(dir, "SKILL.md");
+      const skillMdPath = join22(dir, "SKILL.md");
       if (!existsSync20(skillMdPath))
         continue;
       const hash = hashSkillMarkdownFile(skillMdPath);
-      const mtime = statSync10(skillMdPath).mtime.toISOString();
+      const mtime = statSync11(skillMdPath).mtime.toISOString();
       const entry = { agent, skill, home, path: dir, hash, mtime };
       const canonicalHash = index.get(skill);
       if (canonicalHash === undefined) {
@@ -51420,11 +52442,11 @@ function scanUnmarkedHomes(options = {}) {
 function appendConflictsLedger(appDir, conflicts) {
   if (conflicts.length === 0)
     return;
-  const ledgerPath = join21(appDir, CONFLICTS_LEDGER_FILE);
+  const ledgerPath = join22(appDir, CONFLICTS_LEDGER_FILE);
   let ledger = { version: 1, entries: [] };
   if (existsSync20(ledgerPath)) {
     try {
-      const parsed = JSON.parse(readFileSync17(ledgerPath, "utf-8"));
+      const parsed = JSON.parse(readFileSync18(ledgerPath, "utf-8"));
       if (parsed && typeof parsed === "object" && Array.isArray(parsed.entries)) {
         ledger = parsed;
       }
@@ -51440,9 +52462,9 @@ function appendConflictsLedger(appDir, conflicts) {
 `);
 }
 function writeRollbackRecord(mode, entries, appDir = getDataDir()) {
-  const dir = join21(appDir, ROLLBACK_DIRNAME);
+  const dir = join22(appDir, ROLLBACK_DIRNAME);
   mkdirSync9(dir, { recursive: true });
-  const file = join21(dir, `${mode}-${Date.now()}.json`);
+  const file = join22(dir, `${mode}-${Date.now()}.json`);
   const record = { version: 1, mode, timestamp: new Date().toISOString(), entries };
   writeFileSync10(file, `${JSON.stringify(record, null, 2)}
 `);
@@ -51453,7 +52475,7 @@ function adoptUnmarkedHomes(options = {}) {
   if (!options.apply) {
     return { ...scan, applied: false };
   }
-  const appDir = options.homeDir ? join21(options.homeDir, ".hasna", "skills") : getDataDir();
+  const appDir = options.homeDir ? join22(options.homeDir, ".hasna", "skills") : getDataDir();
   const markers = scan.adoptable.map((entry) => {
     const marker = {
       managedBy: SYNC_MARKER_MANAGED_BY,
@@ -51461,7 +52483,7 @@ function adoptUnmarkedHomes(options = {}) {
       source: "adopted",
       syncedAt: new Date().toISOString()
     };
-    writeFileSync10(join21(entry.path, SYNC_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
+    writeFileSync10(join22(entry.path, SYNC_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
 `);
     return { agent: entry.agent, skill: entry.skill, path: entry.path, hash: entry.hash, marker };
   });
@@ -51473,13 +52495,13 @@ function adoptUnmarkedHomes(options = {}) {
   return { ...scan, applied: true, rollbackFile };
 }
 function pruneStrayHomes(options = {}) {
-  const homeDir = options.homeDir ?? homedir7();
+  const homeDir2 = options.homeDir ?? homedir5();
   const corpusRoot = resolveCorpusRoot(options);
   const index = indexCanonicalCorpus(corpusRoot);
   const agents = options.agents?.length ? options.agents : [...SYNC_AGENTS];
   const candidates = [];
   for (const agent of agents) {
-    const home = agentGlobalSkillsDir(agent, homeDir);
+    const home = agentGlobalSkillsDir(agent, homeDir2);
     if (!existsSync20(home))
       continue;
     let entries = [];
@@ -51491,28 +52513,28 @@ function pruneStrayHomes(options = {}) {
     for (const skill of entries.sort()) {
       if (skill.startsWith("."))
         continue;
-      const dir = join21(home, skill);
+      const dir = join22(home, skill);
       try {
-        if (!statSync10(dir).isDirectory())
+        if (!statSync11(dir).isDirectory())
           continue;
       } catch {
         continue;
       }
-      const markerPath = join21(dir, SYNC_MARKER_FILE);
+      const markerPath = join22(dir, SYNC_MARKER_FILE);
       if (!existsSync20(markerPath))
         continue;
       if (index.has(skill))
         continue;
       let marker;
       try {
-        const parsed = JSON.parse(readFileSync17(markerPath, "utf-8"));
+        const parsed = JSON.parse(readFileSync18(markerPath, "utf-8"));
         if (!parsed || typeof parsed !== "object" || typeof parsed.managedBy !== "string")
           continue;
         marker = parsed;
       } catch {
         continue;
       }
-      const skillMdPath = join21(dir, "SKILL.md");
+      const skillMdPath = join22(dir, "SKILL.md");
       const hash = existsSync20(skillMdPath) ? hashSkillMarkdownFile(skillMdPath) : "";
       candidates.push({ agent, skill, home, path: dir, hash, marker });
     }
@@ -51520,7 +52542,7 @@ function pruneStrayHomes(options = {}) {
   if (!options.apply) {
     return { candidates, pruned: 0, dryRun: true };
   }
-  const appDir = options.homeDir ? join21(options.homeDir, ".hasna", "skills") : getDataDir();
+  const appDir = options.homeDir ? join22(options.homeDir, ".hasna", "skills") : getDataDir();
   const rollbackFile = writeRollbackRecord("prune", candidates.map(({ agent, skill, path, hash, marker }) => ({ agent, skill, path, hash, marker })), appDir);
   for (const candidate of candidates) {
     rmSync6(candidate.path, { recursive: true, force: true });
@@ -51536,9 +52558,9 @@ var init_home_adoption = __esm(() => {
 });
 
 // src/lib/home-census.ts
-import { existsSync as existsSync21, readFileSync as readFileSync18, readdirSync as readdirSync11, statSync as statSync11 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join22 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync19, readdirSync as readdirSync11, statSync as statSync12 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join23 } from "path";
 function sortEntries(entries) {
   return entries.sort((a, b) => {
     const left = `${a.agent}/${a.skill}/${a.kind}`;
@@ -51547,7 +52569,7 @@ function sortEntries(entries) {
   });
 }
 function censusHomeDrift(options = {}) {
-  const homeDir = options.homeDir ?? homedir8();
+  const homeDir2 = options.homeDir ?? homedir6();
   const corpusRoot = resolveCorpusRoot(options);
   const index = indexCanonicalCorpus(corpusRoot);
   const agents = options.agents?.length ? options.agents : [...SYNC_AGENTS];
@@ -51556,7 +52578,7 @@ function censusHomeDrift(options = {}) {
   let managed = 0;
   let homesChecked = 0;
   for (const agent of agents) {
-    const home = agentGlobalSkillsDir(agent, homeDir);
+    const home = agentGlobalSkillsDir(agent, homeDir2);
     if (!existsSync21(home))
       continue;
     homesChecked += 1;
@@ -51570,15 +52592,15 @@ function censusHomeDrift(options = {}) {
     for (const skill of dirEntries.sort()) {
       if (skill.startsWith("."))
         continue;
-      const dir = join22(home, skill);
+      const dir = join23(home, skill);
       try {
-        if (!statSync11(dir).isDirectory())
+        if (!statSync12(dir).isDirectory())
           continue;
       } catch {
         continue;
       }
       present.add(skill);
-      const markerPath = join22(dir, SYNC_MARKER_FILE);
+      const markerPath = join23(dir, SYNC_MARKER_FILE);
       if (!existsSync21(markerPath)) {
         unmarked += 1;
         continue;
@@ -51589,7 +52611,7 @@ function censusHomeDrift(options = {}) {
         entries.push({ agent, skill, kind: "stray-in-home", path: dir });
         continue;
       }
-      const skillMdPath = join22(dir, "SKILL.md");
+      const skillMdPath = join23(dir, "SKILL.md");
       if (!existsSync21(skillMdPath)) {
         entries.push({ agent, skill, kind: "diverged", path: dir, canonicalHash });
         continue;
@@ -51598,14 +52620,14 @@ function censusHomeDrift(options = {}) {
       if (homeHash !== canonicalHash) {
         let homeStub;
         try {
-          homeStub = isPointerSkillMd(readFileSync18(skillMdPath, "utf-8"));
+          homeStub = isPointerSkillMd(readFileSync19(skillMdPath, "utf-8"));
         } catch {
           homeStub = undefined;
         }
         let canonicalStub;
-        const canonicalSkillMd = join22(corpusRoot, skill, "SKILL.md");
+        const canonicalSkillMd = join23(corpusRoot, skill, "SKILL.md");
         try {
-          canonicalStub = isPointerSkillMd(readFileSync18(canonicalSkillMd, "utf-8"));
+          canonicalStub = isPointerSkillMd(readFileSync19(canonicalSkillMd, "utf-8"));
         } catch {
           canonicalStub = undefined;
         }
@@ -51618,7 +52640,7 @@ function censusHomeDrift(options = {}) {
           agent,
           skill: name,
           kind: "missing-from-home",
-          path: join22(home, name),
+          path: join23(home, name),
           canonicalHash
         });
       }
@@ -51644,8 +52666,8 @@ var exports_diagnostic = {};
 __export(exports_diagnostic, {
   registerDiagnostic: () => registerDiagnostic
 });
-import { existsSync as existsSync22, readFileSync as readFileSync19, readdirSync as readdirSync12, statSync as statSync12, writeFileSync as writeFileSync11 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync20, readdirSync as readdirSync12, statSync as statSync13, writeFileSync as writeFileSync11 } from "fs";
+import { join as join24 } from "path";
 import { execSync as execSync2 } from "child_process";
 function registerDiagnostic(parent) {
   parent.command("doctor").option("--json", "Output as JSON", false).description("Check env vars, system deps, and readiness for pinned skills").action((options) => handleDoctor(options));
@@ -51761,7 +52783,7 @@ Skills Test (${results.length} skill${results.length === 1 ? "" : "s"}):
 }
 function handleAuth(name, options) {
   const cwd2 = process.cwd();
-  const envFilePath = join23(cwd2, ".env");
+  const envFilePath = join24(cwd2, ".env");
   if (options.set) {
     const eqIdx = options.set.indexOf("=");
     if (eqIdx === -1) {
@@ -51783,7 +52805,7 @@ function handleAuth(name, options) {
       process.exitCode = 1;
       return;
     }
-    let existing = existsSync22(envFilePath) ? readFileSync19(envFilePath, "utf-8") : "";
+    let existing = existsSync22(envFilePath) ? readFileSync20(envFilePath, "utf-8") : "";
     const keyPattern = new RegExp(`^${key}=.*$`, "m");
     const updated = keyPattern.test(existing) ? existing.replace(keyPattern, `${key}=${value}`) : existing.endsWith(`
 `) || existing === "" ? existing + `${key}=${value}
@@ -51853,13 +52875,14 @@ function handleWhoami(options) {
     let skillCount = 0;
     if (exists)
       try {
-        skillCount = readdirSync12(agentSkillsPath).filter((f) => !f.startsWith(".") && statSync12(join23(agentSkillsPath, f)).isDirectory()).length;
+        skillCount = readdirSync12(agentSkillsPath).filter((f) => !f.startsWith(".") && statSync13(join24(agentSkillsPath, f)).isDirectory()).length;
       } catch {}
     agentConfigs.push({ agent, label: AGENT_LABELS[agent], path: agentSkillsPath, exists, skillCount });
   }
   const skillsDir = resolveCorpusRoot();
+  const credential = describeCredentialState();
   if (options.json) {
-    console.log(JSON.stringify({ version: package_default.version, installedCount: installed.length, installed, agents: agentConfigs, skillsDir, cwd: process.cwd() }, null, 2));
+    console.log(JSON.stringify({ version: package_default.version, installedCount: installed.length, installed, agents: agentConfigs, skillsDir, cwd: process.cwd(), credential }, null, 2));
     return;
   }
   console.log(source_default.bold(`
@@ -51867,6 +52890,13 @@ skills v${package_default.version}
 `));
   console.log(`${source_default.dim("Working directory:")} ${process.cwd()}`);
   console.log(`${source_default.dim("Corpus directory:")}  ${skillsDir}`);
+  console.log(`${source_default.dim("Mode:")}             ${credential.mode}`);
+  if (credential.apiUrl)
+    console.log(`${source_default.dim("API:")}              ${credential.apiUrl} (${credential.apiUrlSource})`);
+  if (credential.apiKeySource)
+    console.log(`${source_default.dim("Credential:")}       ${credential.apiKeySource}`);
+  if (credential.error)
+    console.log(source_default.red(`${source_default.dim("Credential:")}       ${credential.error}`));
   console.log();
   if (!installed.length)
     console.log(source_default.dim("No pinned skills in current project"));
@@ -51880,6 +52910,51 @@ skills v${package_default.version}
   for (const cfg of agentConfigs)
     console.log(cfg.exists ? `  ${source_default.green("\u2713")} ${cfg.agent} \u2014 ${cfg.skillCount} skill(s) at ${cfg.path}` : `  ${source_default.dim("\u2717")} ${cfg.agent} \u2014 not configured`);
 }
+function describeCredentialState() {
+  let credentialsFile = null;
+  let mode = null;
+  try {
+    credentialsFile = getAuthFilePath();
+    const bits = credentialFileMode();
+    mode = bits === null ? null : `0${bits.toString(8).padStart(3, "0")}`;
+  } catch {}
+  try {
+    const fleet = resolveSkillsFleet();
+    if (fleet.mode === "hosted") {
+      return {
+        mode: "hosted",
+        apiUrl: fleet.apiOrigin,
+        apiUrlSource: fleet.apiUrlSource,
+        apiKeySource: fleet.apiKeySource,
+        apiKeyTier: fleet.apiKeyTier,
+        credentialsFile,
+        credentialsFileMode: mode,
+        error: null
+      };
+    }
+    return {
+      mode: "local",
+      apiUrl: null,
+      apiUrlSource: null,
+      apiKeySource: null,
+      apiKeyTier: null,
+      credentialsFile,
+      credentialsFileMode: mode,
+      error: null
+    };
+  } catch (error) {
+    return {
+      mode: "misconfigured",
+      apiUrl: null,
+      apiUrlSource: null,
+      apiKeySource: null,
+      apiKeyTier: null,
+      credentialsFile,
+      credentialsFileMode: mode,
+      error: error.message
+    };
+  }
+}
 function handleOutdated(options) {
   const installed = getInstalledSkills();
   const pins = [];
@@ -51887,11 +52962,11 @@ function handleOutdated(options) {
   for (const name of installed) {
     const installedVersion = meta.skills[name]?.version ?? "unknown";
     const registryPath = getSkillPath(name);
-    const registryPkgPath = join23(registryPath, "package.json");
+    const registryPkgPath = join24(registryPath, "package.json");
     let registryVersion = "unknown";
     if (existsSync22(registryPkgPath))
       try {
-        registryVersion = JSON.parse(readFileSync19(registryPkgPath, "utf-8")).version || "unknown";
+        registryVersion = JSON.parse(readFileSync20(registryPkgPath, "utf-8")).version || "unknown";
       } catch {}
     if (installedVersion !== registryVersion)
       pins.push({ skill: name, installedVersion, registryVersion });
@@ -51940,6 +53015,8 @@ var init_diagnostic = __esm(() => {
   init_installer();
   init_home_census();
   init_home_migration();
+  init_auth_store();
+  init_fleet_credentials();
 });
 
 // src/lib/blog-article.ts
@@ -52112,20 +53189,20 @@ var init_runs = __esm(() => {
 
 // src/lib/run-state.ts
 import { createHash as createHash4, randomBytes } from "crypto";
-import { existsSync as existsSync23, mkdirSync as mkdirSync10, readFileSync as readFileSync20, readdirSync as readdirSync13, statSync as statSync13, writeFileSync as writeFileSync12 } from "fs";
-import { extname, join as join24, relative as relative3 } from "path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync10, readFileSync as readFileSync21, readdirSync as readdirSync13, statSync as statSync14, writeFileSync as writeFileSync12 } from "fs";
+import { extname, join as join25, relative as relative3 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now3 = new Date;
   const id = createRunId(now3);
   const day = now3.toISOString().slice(0, 10);
   const skillName = normalizeSkillName(params.skill);
   const root = getProjectStateDir(targetDir);
-  const runDir = join24(root, "runs", day, id);
-  const logsDir = join24(runDir, "logs");
-  const exportDir = join24(root, "exports", skillName, id);
+  const runDir = join25(root, "runs", day, id);
+  const logsDir = join25(runDir, "logs");
+  const exportDir = join25(root, "exports", skillName, id);
   mkdirSync10(logsDir, { recursive: true });
   mkdirSync10(exportDir, { recursive: true });
-  mkdirSync10(join24(root, "tmp"), { recursive: true });
+  mkdirSync10(join25(root, "tmp"), { recursive: true });
   const record = {
     id,
     skill: skillName,
@@ -52176,27 +53253,27 @@ function updateSkillRun(context, patch) {
   return context.record;
 }
 function writeRunLogs(context, stdout = "", stderr = "") {
-  writeFileSync12(join24(context.logsDir, "stdout.log"), stdout);
-  writeFileSync12(join24(context.logsDir, "stderr.log"), stderr);
+  writeFileSync12(join25(context.logsDir, "stdout.log"), stdout);
+  writeFileSync12(join25(context.logsDir, "stderr.log"), stderr);
 }
 function appendRunEvent(context, event, data = {}) {
   const line = JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + `
 `;
-  const path = join24(context.runDir, "events.ndjson");
-  const previous = existsSync23(path) ? readFileSync20(path, "utf-8") : "";
+  const path = join25(context.runDir, "events.ndjson");
+  const previous = existsSync23(path) ? readFileSync21(path, "utf-8") : "";
   writeFileSync12(path, previous + line);
 }
 function listSkillRuns(targetDir = process.cwd(), limit = 50) {
-  const runsRoot = join24(getProjectStateDir(targetDir), "runs");
+  const runsRoot = join25(getProjectStateDir(targetDir), "runs");
   if (!existsSync23(runsRoot))
     return [];
   const records = [];
   for (const day of readdirSync13(runsRoot).sort().reverse()) {
-    const dayDir = join24(runsRoot, day);
-    if (!statSync13(dayDir).isDirectory())
+    const dayDir = join25(runsRoot, day);
+    if (!statSync14(dayDir).isDirectory())
       continue;
     for (const runId of readdirSync13(dayDir).sort().reverse()) {
-      const record = readRunRecord(join24(dayDir, runId));
+      const record = readRunRecord(join25(dayDir, runId));
       if (record)
         records.push(record);
       if (records.length >= limit)
@@ -52206,11 +53283,11 @@ function listSkillRuns(targetDir = process.cwd(), limit = 50) {
   return records;
 }
 function findSkillRun(runId, targetDir = process.cwd()) {
-  const runsRoot = join24(getProjectStateDir(targetDir), "runs");
+  const runsRoot = join25(getProjectStateDir(targetDir), "runs");
   if (!existsSync23(runsRoot))
     return null;
   for (const day of readdirSync13(runsRoot)) {
-    const record = readRunRecord(join24(runsRoot, day, runId));
+    const record = readRunRecord(join25(runsRoot, day, runId));
     if (record)
       return record;
   }
@@ -52227,14 +53304,14 @@ function skillRunEnv(context) {
   };
 }
 function getRunExportDir(runId, skill, targetDir = process.cwd()) {
-  return join24(getProjectStateDir(targetDir), "exports", normalizeSkillName(skill), runId);
+  return join25(getProjectStateDir(targetDir), "exports", normalizeSkillName(skill), runId);
 }
 function writeRunRecord(context) {
-  writeFileSync12(join24(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
+  writeFileSync12(join25(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
 `);
 }
 function writeArtifactsManifest(context, artifacts) {
-  writeFileSync12(join24(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
+  writeFileSync12(join25(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
 `);
 }
 function collectRunArtifacts(context) {
@@ -52242,8 +53319,8 @@ function collectRunArtifacts(context) {
     return [];
   const artifacts = [];
   for (const path of walkFiles(context.exportDir)) {
-    const stat = statSync13(path);
-    const bytes = readFileSync20(path);
+    const stat = statSync14(path);
+    const bytes = readFileSync21(path);
     artifacts.push({
       path: toProjectRelative(context.targetDir, path),
       mime: mimeForPath(path),
@@ -52254,11 +53331,11 @@ function collectRunArtifacts(context) {
   return artifacts.sort((a, b) => a.path.localeCompare(b.path));
 }
 function readRunRecord(runDir) {
-  const path = join24(runDir, "run.json");
+  const path = join25(runDir, "run.json");
   if (!existsSync23(path))
     return null;
   try {
-    return JSON.parse(readFileSync20(path, "utf-8"));
+    return JSON.parse(readFileSync21(path, "utf-8"));
   } catch {
     return null;
   }
@@ -52266,8 +53343,8 @@ function readRunRecord(runDir) {
 function walkFiles(dir) {
   const files = [];
   for (const entry of readdirSync13(dir)) {
-    const full = join24(dir, entry);
-    if (statSync13(full).isDirectory())
+    const full = join25(dir, entry);
+    if (statSync14(full).isDirectory())
       files.push(...walkFiles(full));
     else
       files.push(full);
@@ -56901,7 +57978,7 @@ var init_v4 = __esm(() => {
   init_classic();
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 function assertCompleteRequestPrompt(request) {
   if (request.params.ref.type !== "ref/prompt") {
     throw new TypeError(`Expected CompleteRequestPrompt, but got ${request.params.ref.type}`);
@@ -57739,7 +58816,7 @@ var init_types2 = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
 class ReadBuffer {
   constructor(options) {
     this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
@@ -57782,7 +58859,7 @@ var init_stdio = __esm(() => {
   STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 import process14 from "process";
 
 class StdioServerTransport {
@@ -57940,7 +59017,7 @@ var init_v4_mini = __esm(() => {
   init_mini();
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema = s;
   return !!schema._zod;
@@ -58105,7 +59182,7 @@ var init_zod_compat = __esm(() => {
   init_v4_mini();
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 function isTerminal(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
@@ -59509,7 +60586,7 @@ var init_esm2 = __esm(() => {
   init_zodToJsonSchema();
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function mapMiniTarget(t) {
   if (!t)
     return "draft-7";
@@ -59556,7 +60633,7 @@ var init_zod_json_schema_compat = __esm(() => {
   init_esm2();
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 class Protocol {
   constructor(_options) {
     this._options = _options;
@@ -63403,13 +64480,32 @@ var require_data = __commonJS((exports, module) => {
   };
 });
 
-// ../../node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS((exports, module) => {
   var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
   var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+  var isPort = RegExp.prototype.test.bind(/^\d*$/u);
   var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
   var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
-  var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
+  var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
+  var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u);
+  var isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u);
+  var BYTE_HEX = new Array(256);
+  {
+    const HEX_DIGITS = "0123456789ABCDEF";
+    for (let i = 0;i < 256; i++) {
+      BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
+    }
+  }
+  function percentEncodeNonAscii(cp) {
+    if (cp < 2048) {
+      return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
+    }
+    if (cp < 65536) {
+      return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+    }
+    return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+  }
   function stringArrayToHexStripped(input) {
     let acc = "";
     let code = 0;
@@ -63434,91 +64530,122 @@ var require_utils = __commonJS((exports, module) => {
     }
     return acc;
   }
+  var isHextet = RegExp.prototype.test.bind(/^[\dA-Fa-f]{1,4}$/);
+  var isIPvFuture = RegExp.prototype.test.bind(/^[vV][\dA-Fa-f]+\.[A-Za-z\d\-._~!$&'()*+,;=:]+$/);
+  var isZoneCharacter = RegExp.prototype.test.bind(/^[A-Za-z\d\-._~]$/);
   var nonSimpleDomain = RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);
-  function consumeIsZone(buffer) {
-    buffer.length = 0;
-    return true;
-  }
-  function consumeHextets(buffer, address, output) {
-    if (buffer.length) {
-      const hex = stringArrayToHexStripped(buffer);
-      if (hex !== "") {
-        address.push(hex);
-      } else {
-        output.error = true;
-        return false;
+  function isZoneIdentifier(zone) {
+    if (zone.length === 0)
+      return false;
+    for (let i = 0;i < zone.length; i++) {
+      if (isZoneCharacter(zone[i]))
+        continue;
+      if (zone[i] === "%" && i + 2 < zone.length && isHexPair(zone.slice(i + 1, i + 3))) {
+        i += 2;
+        continue;
       }
-      buffer.length = 0;
+      return false;
     }
     return true;
   }
-  function getIPV6(input) {
-    let tokenCount = 0;
-    const output = { error: false, address: "", zone: "" };
-    const address = [];
-    const buffer = [];
-    let endipv6Encountered = false;
-    let endIpv6 = false;
-    let consume = consumeHextets;
-    for (let i = 0;i < input.length; i++) {
-      const cursor = input[i];
-      if (cursor === "[" || cursor === "]") {
-        continue;
-      }
-      if (cursor === ":") {
-        if (endipv6Encountered === true) {
-          endIpv6 = true;
-        }
-        if (!consume(buffer, address, output)) {
-          break;
-        }
-        if (++tokenCount > 7) {
-          output.error = true;
-          break;
-        }
-        if (i > 0 && input[i - 1] === ":") {
-          endipv6Encountered = true;
-        }
-        address.push(":");
-        continue;
-      } else if (cursor === "%") {
-        if (!consume(buffer, address, output)) {
-          break;
+  function compressIPv6ZeroRun(hextets) {
+    let bestStart = -1;
+    let bestLength = 0;
+    let runStart = -1;
+    let runLength = 0;
+    for (let i = 0;i < hextets.length; i++) {
+      if (hextets[i] === "0") {
+        if (runStart === -1)
+          runStart = i;
+        runLength++;
+        if (runLength > bestLength) {
+          bestLength = runLength;
+          bestStart = runStart;
         }
-        consume = consumeIsZone;
       } else {
-        buffer.push(cursor);
-        continue;
+        runStart = -1;
+        runLength = 0;
       }
     }
-    if (buffer.length) {
-      if (consume === consumeIsZone) {
-        output.zone = buffer.join("");
-      } else if (endIpv6) {
-        address.push(buffer.join(""));
-      } else {
-        address.push(stringArrayToHexStripped(buffer));
+    if (bestLength < 2)
+      return hextets.join(":");
+    const head2 = hextets.slice(0, bestStart).join(":");
+    const tail2 = hextets.slice(bestStart + bestLength).join(":");
+    return head2 + "::" + tail2;
+  }
+  function normalizeIPv6Address(input) {
+    const compression = input.indexOf("::");
+    if (compression !== -1 && input.indexOf("::", compression + 1) !== -1)
+      return;
+    const left = compression === -1 ? input.split(":") : input.slice(0, compression).split(":");
+    const right = compression === -1 ? [] : input.slice(compression + 2).split(":");
+    if (compression !== -1) {
+      if (left.length === 1 && left[0] === "")
+        left.length = 0;
+      if (right.length === 1 && right[0] === "")
+        right.length = 0;
+    }
+    const parts = left.concat(right);
+    let hextetCount = 0;
+    for (let i = 0;i < parts.length; i++) {
+      const part = parts[i];
+      if (part === "")
+        return;
+      if (part.indexOf(".") !== -1) {
+        if (i !== parts.length - 1 || compression !== -1 && right.length === 0 || !isIPv4(part))
+          return;
+        hextetCount += 2;
+        continue;
       }
+      if (!isHextet(part))
+        return;
+      parts[i] = parseInt(part, 16).toString(16);
+      hextetCount++;
     }
-    output.address = address.join("");
-    return output;
+    if (compression === -1) {
+      if (hextetCount !== 8)
+        return;
+      return compressIPv6ZeroRun(parts);
+    }
+    if (hextetCount >= 8)
+      return;
+    const expanded = parts.slice(0, left.length);
+    for (let i = hextetCount;i < 8; i++)
+      expanded.push("0");
+    for (let i = left.length;i < parts.length; i++)
+      expanded.push(parts[i]);
+    return compressIPv6ZeroRun(expanded);
   }
   function normalizeIPv6(host) {
-    if (findToken(host, ":") < 2) {
-      return { host, isIPV6: false };
-    }
-    const ipv62 = getIPV6(host);
-    if (!ipv62.error) {
-      let newHost = ipv62.address;
-      let escapedHost = ipv62.address;
-      if (ipv62.zone) {
-        newHost += "%" + ipv62.zone;
-        escapedHost += "%25" + ipv62.zone;
-      }
-      return { host: newHost, isIPV6: true, escapedHost };
-    } else {
-      return { host, isIPV6: false };
-    }
+    const bracketed = host[0] === "[" && host[host.length - 1] === "]";
+    const hasBracket = host[0] === "[" || host[host.length - 1] === "]";
+    if (hasBracket && !bracketed)
+      return { host, isIPV6: false, error: true };
+    let input = bracketed ? host.slice(1, -1) : host;
+    if (bracketed && isIPvFuture(input)) {
+      input = input.toLowerCase();
+      return { host: `[${input}]`, escapedHost: input, isIPV6: false, isIPVFuture: true };
+    }
+    if (findToken(input, ":") < 2) {
+      return { host, isIPV6: false, error: bracketed };
+    }
+    let zoneIdentifier = "";
+    const zoneSeparator = input.indexOf("%");
+    if (zoneSeparator !== -1) {
+      const separatorLength = input.slice(zoneSeparator, zoneSeparator + 3).toLowerCase() === "%25" ? 3 : 1;
+      zoneIdentifier = input.slice(zoneSeparator + separatorLength);
+      if (!isZoneIdentifier(zoneIdentifier))
+        return { host, isIPV6: false, error: true };
+      input = input.slice(0, zoneSeparator);
+    }
+    const address = normalizeIPv6Address(input);
+    if (address === undefined)
+      return { host, isIPV6: false, error: true };
+    return {
+      host: address + (zoneIdentifier ? "%" + zoneIdentifier : ""),
+      escapedHost: address + (zoneIdentifier ? "%25" + zoneIdentifier : ""),
+      isIPV6: true
+    };
   }
   function findToken(str2, token) {
     let ind = 0;
@@ -63606,8 +64733,8 @@ var require_utils = __commonJS((exports, module) => {
   var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
   var HOST_DELIM_RE = /[@/?#:]/g;
   var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
-  function reescapeHostDelimiters(host, isIP) {
-    const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+  function reescapeHostDelimiters(host, isIP2) {
+    const re = isIP2 ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
     re.lastIndex = 0;
     return host.replace(re, (ch) => HOST_DELIMS[ch]);
   }
@@ -63638,7 +64765,8 @@ var require_utils = __commonJS((exports, module) => {
   function normalizePathEncoding(input) {
     let output = "";
     for (let i = 0;i < input.length; i++) {
-      if (input[i] === "%" && i + 2 < input.length) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
         const hex = input.slice(i + 1, i + 3);
         if (isHexPair(hex)) {
           const normalizedHex = hex.toUpperCase();
@@ -63652,10 +64780,152 @@ var require_utils = __commonJS((exports, module) => {
           continue;
         }
       }
-      if (isPathCharacter(input[i])) {
-        output += input[i];
+      if (isPathCharacter(ch)) {
+        output += ch;
       } else {
-        output += escape(input[i]);
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
+      }
+    }
+    return output;
+  }
+  function serializePathEncoding(input, pathNoScheme = false) {
+    let output = "";
+    let firstSegment = pathNoScheme && input[0] !== "/";
+    for (let i = 0;i < input.length; i++) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
+        const hex = input.slice(i + 1, i + 3);
+        if (isHexPair(hex)) {
+          output += "%" + hex.toUpperCase();
+          i += 2;
+          continue;
+        }
+      }
+      if (ch === "/") {
+        firstSegment = false;
+      }
+      if (isPathCharacter(ch) && (ch !== ":" || !firstSegment)) {
+        output += ch;
+      } else {
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
+      }
+    }
+    return output;
+  }
+  function encodeComponent(input, isAllowed) {
+    let output = "";
+    for (let i = 0;i < input.length; i++) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
+        const hex = input.slice(i + 1, i + 3);
+        if (isHexPair(hex)) {
+          output += "%" + hex.toUpperCase();
+          i += 2;
+          continue;
+        }
+      }
+      if (isAllowed(ch)) {
+        output += ch;
+      } else {
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
+      }
+    }
+    return output;
+  }
+  function encodeUserinfo(input) {
+    return encodeComponent(input, isUserinfoCharacter);
+  }
+  function encodeQuery(input) {
+    return encodeComponent(input, isQueryFragmentCharacter);
+  }
+  function encodeFragment(input) {
+    return encodeComponent(input, isQueryFragmentCharacter);
+  }
+  function isEscapeSafe(cp) {
+    return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
+  }
+  function normalizeQueryFragmentEncoding(input) {
+    let output = "";
+    for (let i = 0;i < input.length; i++) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
+        const hex = input.slice(i + 1, i + 3);
+        if (isHexPair(hex)) {
+          const normalizedHex = hex.toUpperCase();
+          const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+          if (isUnreserved(decoded)) {
+            output += decoded;
+          } else {
+            output += "%" + normalizedHex;
+          }
+          i += 2;
+          continue;
+        }
+      }
+      if (isQueryFragmentCharacter(ch)) {
+        output += ch;
+      } else {
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
       }
     }
     return output;
@@ -63678,14 +64948,18 @@ var require_utils = __commonJS((exports, module) => {
   function recomposeAuthority(component) {
     const uriTokens = [];
     if (component.userinfo !== undefined) {
-      uriTokens.push(component.userinfo);
+      uriTokens.push(encodeUserinfo(component.userinfo));
       uriTokens.push("@");
     }
     if (component.host !== undefined) {
-      let host = unescape(component.host);
+      let host = component.host;
       if (!isIPv4(host)) {
-        const ipV6res = normalizeIPv6(host);
-        if (ipV6res.isIPV6 === true) {
+        let ipV6res = normalizeIPv6(host);
+        if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
+          host = normalizePercentEncoding(host, true);
+          ipV6res = normalizeIPv6(host);
+        }
+        if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
           host = `[${ipV6res.escapedHost}]`;
         } else {
           host = reescapeHostDelimiters(host, false);
@@ -63694,8 +64968,12 @@ var require_utils = __commonJS((exports, module) => {
       uriTokens.push(host);
     }
     if (typeof component.port === "number" || typeof component.port === "string") {
+      const port = String(component.port);
+      if (!isPort(port)) {
+        throw new TypeError("URI port is malformed.");
+      }
       uriTokens.push(":");
-      uriTokens.push(String(component.port));
+      uriTokens.push(port);
     }
     return uriTokens.length ? uriTokens.join("") : undefined;
   }
@@ -63705,6 +64983,11 @@ var require_utils = __commonJS((exports, module) => {
     reescapeHostDelimiters,
     normalizePercentEncoding,
     normalizePathEncoding,
+    serializePathEncoding,
+    normalizeQueryFragmentEncoding,
+    encodeUserinfo,
+    encodeQuery,
+    encodeFragment,
     escapePreservingEscapes,
     removeDotSegments,
     isIPv4,
@@ -63714,10 +64997,10 @@ var require_utils = __commonJS((exports, module) => {
   };
 });
 
-// ../../node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS((exports, module) => {
   var { isUUID } = require_utils();
-  var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
+  var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
   var supportedSchemeNames = [
     "http",
     "https",
@@ -63772,9 +65055,10 @@ var require_schemes = __commonJS((exports, module) => {
       wsComponent.secure = undefined;
     }
     if (wsComponent.resourceName) {
-      const [path, query] = wsComponent.resourceName.split("?");
+      const queryIndex = wsComponent.resourceName.indexOf("?");
+      const path = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
       wsComponent.path = path && path !== "/" ? path : undefined;
-      wsComponent.query = query;
+      wsComponent.query = queryIndex === -1 ? undefined : wsComponent.resourceName.slice(queryIndex + 1);
       wsComponent.resourceName = undefined;
     }
     wsComponent.fragment = undefined;
@@ -63786,7 +65070,7 @@ var require_schemes = __commonJS((exports, module) => {
       return urnComponent;
     }
     const matches2 = urnComponent.path.match(URN_REG);
-    if (matches2) {
+    if (matches2 && matches2[0] === urnComponent.path) {
       const scheme = options.scheme || urnComponent.scheme || "urn";
       urnComponent.nid = matches2[1].toLowerCase();
       urnComponent.nss = matches2[2];
@@ -63888,10 +65172,19 @@ var require_schemes = __commonJS((exports, module) => {
   };
 });
 
-// ../../node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/index.js
+// ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS((exports, module) => {
-  var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+  var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
   var { SCHEMES, getSchemeHandler } = require_schemes();
+  var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
+  var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
+  function decodeValidScheme(scheme) {
+    const decodedScheme = unescape(String(scheme));
+    if (!VALID_SCHEME.test(decodedScheme)) {
+      throw new TypeError(MALFORMED_SCHEME_ERROR);
+    }
+    return decodedScheme;
+  }
   function normalize3(uri, options) {
     if (typeof uri === "string") {
       uri = normalizeString(uri, options);
@@ -63902,12 +65195,34 @@ var require_fast_uri = __commonJS((exports, module) => {
   }
   function resolve2(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-    const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
-    const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
-    if (baseMalformed || relativeMalformed) {
+    const {
+      parsed: baseParsed,
+      malformedAuthorityOrPort: baseMalformed,
+      malformedPercentEncoding: baseMalformedPercentEncoding,
+      malformedSchemeSpecific: baseMalformedSchemeSpecific,
+      malformedHost: baseMalformedHost,
+      malformedScheme: baseMalformedScheme
+    } = parseWithStatus(baseURI, schemelessOptions);
+    const {
+      parsed: relativeParsed,
+      malformedAuthorityOrPort: relativeMalformed,
+      malformedPercentEncoding: relativeMalformedPercentEncoding,
+      malformedSchemeSpecific: relativeMalformedSchemeSpecific,
+      malformedHost: relativeMalformedHost,
+      malformedScheme: relativeMalformedScheme
+    } = parseWithStatus(relativeURI, schemelessOptions);
+    if (baseMalformed || relativeMalformed || baseMalformedPercentEncoding || relativeMalformedPercentEncoding || baseMalformedSchemeSpecific || relativeMalformedSchemeSpecific || baseMalformedHost || relativeMalformedHost || baseMalformedScheme || relativeMalformedScheme) {
       throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
     }
     const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
+    const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
+    const resolvedHost = resolved.host;
+    const resolvedHostIsIP = resolvedHost !== undefined && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+    canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
+    const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !/\P{ASCII}/u.test(resolvedHost);
+    if (resolved.error && !encodedASCIIHost) {
+      throw new Error(resolved.error);
+    }
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
@@ -63967,7 +65282,7 @@ var require_fast_uri = __commonJS((exports, module) => {
   function equal(uriA, uriB, options) {
     const normalizedA = normalizeComparableURI(uriA, options);
     const normalizedB = normalizeComparableURI(uriB, options);
-    return normalizedA !== undefined && normalizedB !== undefined && normalizedA.toLowerCase() === normalizedB.toLowerCase();
+    return normalizedA !== undefined && normalizedB !== undefined && normalizedA === normalizedB;
   }
   function serialize(cmpts, opts) {
     const component = {
@@ -63988,20 +65303,23 @@ var require_fast_uri = __commonJS((exports, module) => {
     };
     const options = Object.assign({}, opts);
     const uriTokens = [];
+    if (component.scheme) {
+      component.scheme = decodeValidScheme(component.scheme);
+    }
     const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
     if (schemeHandler && schemeHandler.serialize)
       schemeHandler.serialize(component, options);
+    const hasAuthority = component.userinfo !== undefined || component.host !== undefined || component.port !== undefined;
+    const pathNoScheme = !options.skipEscape && component.scheme === undefined && !hasAuthority;
     if (component.path !== undefined) {
       if (!options.skipEscape) {
-        component.path = escapePreservingEscapes(component.path);
-        if (component.scheme !== undefined) {
-          component.path = component.path.split("%3A").join(":");
-        }
+        component.path = serializePathEncoding(component.path, pathNoScheme);
       } else {
         component.path = normalizePercentEncoding(component.path);
       }
     }
     if (options.reference !== "suffix" && component.scheme) {
+      component.scheme = decodeValidScheme(component.scheme);
       uriTokens.push(component.scheme, ":");
     }
     const authority = recomposeAuthority(component);
@@ -64019,16 +65337,19 @@ var require_fast_uri = __commonJS((exports, module) => {
       if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
         s = removeDotSegments(s);
       }
+      if (pathNoScheme) {
+        s = serializePathEncoding(s, true);
+      }
       if (authority === undefined && s[0] === "/" && s[1] === "/") {
         s = "/%2F" + s.slice(2);
       }
       uriTokens.push(s);
     }
     if (component.query !== undefined) {
-      uriTokens.push("?", component.query);
+      uriTokens.push("?", encodeQuery(component.query));
     }
     if (component.fragment !== undefined) {
-      uriTokens.push("#", component.fragment);
+      uriTokens.push("#", encodeFragment(component.fragment));
     }
     return uriTokens.join("");
   }
@@ -64044,6 +65365,36 @@ var require_fast_uri = __commonJS((exports, module) => {
     }
     return;
   }
+  function hasMalformedPercentEncoding(component) {
+    if (component === undefined)
+      return false;
+    let percent = component.indexOf("%");
+    while (percent !== -1) {
+      if (percent + 2 >= component.length || !/^[\da-f]{2}$/iu.test(component.slice(percent + 1, percent + 3))) {
+        return true;
+      }
+      percent = component.indexOf("%", percent + 3);
+    }
+    return false;
+  }
+  function isIPLiteral(host) {
+    return host[0] === "[" && host[host.length - 1] === "]";
+  }
+  function hasMalformedComponentPercentEncoding(matches2) {
+    const host = matches2[4];
+    return hasMalformedPercentEncoding(matches2[3]) || host !== undefined && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches2[6]) || hasMalformedPercentEncoding(matches2[7]) || hasMalformedPercentEncoding(matches2[8]);
+  }
+  function canonicalizeHost(parsed, options, schemeHandler, isIP2) {
+    if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP2 === false && nonSimpleDomain(parsed.host)) {
+      try {
+        parsed.host = new URL("http://" + parsed.host).hostname;
+      } catch (e) {
+        parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+        return true;
+      }
+    }
+    return false;
+  }
   function parseWithStatus(uri, opts) {
     const options = Object.assign({}, opts);
     const parsed = {
@@ -64056,7 +65407,12 @@ var require_fast_uri = __commonJS((exports, module) => {
       fragment: undefined
     };
     let malformedAuthorityOrPort = false;
-    let isIP = false;
+    let malformedPercentEncoding = false;
+    let malformedSchemeSpecific = false;
+    let malformedHost = false;
+    let malformedIPLiteral = false;
+    let malformedScheme = false;
+    let isIP2 = false;
     if (options.reference === "suffix") {
       if (options.scheme) {
         uri = options.scheme + ":" + uri;
@@ -64092,6 +65448,19 @@ var require_fast_uri = __commonJS((exports, module) => {
       parsed.path = matches2[6] || "";
       parsed.query = matches2[7];
       parsed.fragment = matches2[8];
+      if (parsed.scheme !== undefined) {
+        const decodedScheme = unescape(parsed.scheme);
+        if (VALID_SCHEME.test(decodedScheme)) {
+          parsed.scheme = decodedScheme.toLowerCase();
+        } else {
+          parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
+          malformedScheme = true;
+        }
+      }
+      malformedPercentEncoding = hasMalformedComponentPercentEncoding(matches2);
+      if (malformedPercentEncoding) {
+        parsed.error = parsed.error || "URI contains malformed percent-encoding.";
+      }
       if (isNaN(parsed.port)) {
         parsed.port = matches2[5];
       }
@@ -64103,11 +65472,18 @@ var require_fast_uri = __commonJS((exports, module) => {
       if (parsed.host) {
         const ipv4result = isIPv4(parsed.host);
         if (ipv4result === false) {
+          const bracketedIPLiteral = isIPLiteral(parsed.host);
+          const hasIPLiteralBracket = parsed.host.indexOf("[") !== -1 || parsed.host.indexOf("]") !== -1;
           const ipv6result = normalizeIPv6(parsed.host);
-          parsed.host = ipv6result.host.toLowerCase();
-          isIP = ipv6result.isIPV6;
+          isIP2 = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
+          malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
+          parsed.host = isIP2 ? ipv6result.host : ipv6result.host.toLowerCase();
+          if (malformedIPLiteral) {
+            parsed.error = parsed.error || "URI host is malformed.";
+            malformedAuthorityOrPort = true;
+          }
         } else {
-          isIP = true;
+          isIP2 = true;
         }
       }
       if (parsed.scheme === undefined && parsed.userinfo === undefined && parsed.host === undefined && parsed.port === undefined && parsed.query === undefined && !parsed.path) {
@@ -64123,42 +65499,36 @@ var require_fast_uri = __commonJS((exports, module) => {
         parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
       }
       const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
-      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-        if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
-          try {
-            parsed.host = new URL("http://" + parsed.host).hostname;
-          } catch (e) {
-            parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
-          }
-        }
+      if (!malformedIPLiteral) {
+        malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP2);
       }
       if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
         if (uri.indexOf("%") !== -1) {
-          if (parsed.scheme !== undefined) {
-            parsed.scheme = unescape(parsed.scheme);
-          }
-          if (parsed.host !== undefined) {
-            parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
+          if (parsed.host !== undefined && !malformedIPLiteral) {
+            const host = isIP2 ? parsed.host : normalizePercentEncoding(parsed.host, true);
+            parsed.host = reescapeHostDelimiters(host, isIP2);
           }
         }
         if (parsed.path) {
           parsed.path = normalizePathEncoding(parsed.path);
         }
+        if (parsed.query) {
+          parsed.query = normalizeQueryFragmentEncoding(parsed.query);
+        }
         if (parsed.fragment) {
-          try {
-            parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
-          } catch {
-            parsed.error = parsed.error || "URI malformed";
-          }
+          parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
         }
       }
       if (schemeHandler && schemeHandler.parse) {
         schemeHandler.parse(parsed, options);
+        if (schemeHandler === SCHEMES.urn && parsed.nid === undefined) {
+          malformedSchemeSpecific = true;
+        }
       }
     } else {
       parsed.error = parsed.error || "URI can not be parsed.";
     }
-    return { parsed, malformedAuthorityOrPort };
+    return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
   }
   function parse6(uri, opts) {
     return parseWithStatus(uri, opts).parsed;
@@ -64167,20 +65537,28 @@ var require_fast_uri = __commonJS((exports, module) => {
     return normalizeStringWithStatus(uri, opts).normalized;
   }
   function normalizeStringWithStatus(uri, opts) {
-    const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+    const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
     return {
-      normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
-      malformedAuthorityOrPort
+      normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
+      malformedAuthorityOrPort,
+      malformedPercentEncoding,
+      malformedSchemeSpecific,
+      malformedHost,
+      malformedScheme
     };
   }
   function normalizeComparableURI(uri, opts) {
-    if (typeof uri === "string") {
-      const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
-      return malformedAuthorityOrPort ? undefined : normalized;
+    if (typeof uri !== "string" && typeof uri !== "object") {
+      return;
     }
-    if (typeof uri === "object") {
-      return serialize(uri, opts);
+    let value;
+    try {
+      value = typeof uri === "string" ? uri : serialize(uri, opts);
+    } catch {
+      return;
     }
+    const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
+    return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? undefined : normalized;
   }
   var fastUri = {
     SCHEMES,
@@ -66986,7 +68364,7 @@ var require_dist = __commonJS((exports, module) => {
   exports.default = formatsPlugin;
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 function createDefaultAjvInstance() {
   const ajv = new import_ajv.default({
     strict: false,
@@ -67029,7 +68407,7 @@ var init_ajv_provider = __esm(() => {
   import_ajv_formats = __toESM(require_dist(), 1);
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 class ExperimentalServerTasks {
   constructor(_server) {
     this._server = _server;
@@ -67110,7 +68488,7 @@ var init_server = __esm(() => {
   init_types2();
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 function assertToolsCallTaskCapability(requests, method2, entityName) {
   if (!requests) {
     throw new Error(`${entityName} does not support task creation (required for ${method2})`);
@@ -67145,7 +68523,7 @@ function assertClientRequestTaskCapability(requests, method2, entityName) {
   }
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
 var Server;
 var init_server2 = __esm(() => {
   init_protocol();
@@ -67477,7 +68855,7 @@ var init_server2 = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
 }
@@ -67493,7 +68871,7 @@ var init_completable = __esm(() => {
   })(McpZodTypeKind || (McpZodTypeKind = {}));
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/uriTemplate.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/uriTemplate.js
 class UriTemplate {
   static isTemplate(str2) {
     return /\{[^}\s]+\}/.test(str2);
@@ -67707,7 +69085,7 @@ class UriTemplate {
 }
 var MAX_TEMPLATE_LENGTH = 1e6, MAX_VARIABLE_LENGTH = 1e6, MAX_TEMPLATE_EXPRESSIONS = 1e4, MAX_REGEX_LENGTH = 1e6;
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
 function validateToolName(name) {
   const warnings = [];
   if (name.length === 0) {
@@ -67768,7 +69146,7 @@ var init_toolNameValidation = __esm(() => {
   TOOL_NAME_REGEX = /^[A-Za-z0-9._-]{1,128}$/;
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
 class ExperimentalMcpServerTasks {
   constructor(_mcpServer) {
     this._mcpServer = _mcpServer;
@@ -67783,7 +69161,7 @@ class ExperimentalMcpServerTasks {
   }
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
 class McpServer {
   constructor(serverInfo, options) {
     this._registeredResources = {};
@@ -69597,7 +70975,7 @@ function resolveRunRouting(skill, apiKey, apiUrl) {
     return {
       route: "error",
       code: "REMOTE_REQUIRES_ORIGIN",
-      error: `${skill.name} is a server-owned skill. Point the CLI at a Skills API: ` + `skills setup --api-url <url> (or export SKILLS_API_URL)`
+      error: `${skill.name} is a server-owned skill. Point the CLI at a Skills API: ` + `skills setup --api-url <url> (or export HASNA_SKILLS_API_URL)`
     };
   }
   if (!apiKey) {
@@ -69609,17 +70987,31 @@ function resolveRunRouting(skill, apiKey, apiUrl) {
   }
   return { route: "remote", apiKey };
 }
-function resolveConfiguredRunRouting(skill) {
-  return resolveRunRouting(skill, getApiKey(), resolveApiUrl());
+async function resolveConfiguredRunRouting(skill, env3 = process.env) {
+  let fleet;
+  let apiKey;
+  try {
+    fleet = resolveSkillsFleet(env3);
+    apiKey = fleet.mode === "hosted" ? await resolveSkillsApiKey(env3) : null;
+  } catch (error2) {
+    const isMissingCredential = (error2 instanceof SkillsFleetCredentialError || error2?.name === "SkillsFleetCredentialError") && error2.code === "MISSING_API_CREDENTIAL";
+    if (!isMissingCredential)
+      throw error2;
+    return {
+      route: "error",
+      code: "REMOTE_REQUIRES_CREDENTIAL",
+      error: `${skill.name} is a server-owned skill. ${error2.message}`
+    };
+  }
+  return resolveRunRouting(skill, apiKey, fleet.apiOrigin ?? undefined);
 }
 var init_run_routing = __esm(() => {
-  init_api_url();
-  init_auth_store();
+  init_fleet_credentials();
 });
 
 // src/mcp/operation-tools.ts
-import { existsSync as existsSync24, readdirSync as readdirSync14, statSync as statSync14 } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync24, readdirSync as readdirSync14, statSync as statSync15 } from "fs";
+import { join as join26 } from "path";
 function registerOperationTools(server) {
   server.registerTool("scaffold_skill", {
     title: "Scaffold Skill",
@@ -69840,7 +71232,7 @@ function registerOperationTools(server) {
         return mcpError("INVALID_BLOG_ARTICLE_OPTIONS", validation.errors.join(" "));
       }
     }
-    const routing = resolveConfiguredRunRouting(skill);
+    const routing = await resolveConfiguredRunRouting(skill);
     const runContext = createSkillRun({
       skill: skillName,
       args: runArgs,
@@ -69919,10 +71311,10 @@ function registerOperationTools(server) {
       detail: exports_external.boolean().optional()
     }
   }, async ({ run_id, detail }) => {
-    const { getApiKey: getApiKey2 } = await Promise.resolve().then(() => (init_auth_store(), exports_auth_store));
-    const apiKey = getApiKey2();
+    const { skillsCredentialOrReason: skillsCredentialOrReason2 } = await Promise.resolve().then(() => (init_fleet_credentials(), exports_fleet_credentials));
+    const { apiKey, reason } = await skillsCredentialOrReason2();
     if (!apiKey) {
-      return mcpError("AUTH_REQUIRED", "Remote run status requires API access. Run: skills auth login", ["skills auth login"]);
+      return mcpError("AUTH_REQUIRED", reason ?? "Remote run status requires API access. Run: skills auth login", ["skills auth login"]);
     }
     const localRun = findSkillRun(run_id);
     const remoteRunId = localRun?.remoteRunId || run_id;
@@ -70021,8 +71413,8 @@ function registerOperationTools(server) {
       if (exists) {
         try {
           skillCount = readdirSync14(agentSkillsPath).filter((f) => {
-            const full = join25(agentSkillsPath, f);
-            return !f.startsWith(".") && statSync14(full).isDirectory();
+            const full = join26(agentSkillsPath, f);
+            return !f.startsWith(".") && statSync15(full).isDirectory();
           }).length;
         } catch {}
       }
@@ -70079,10 +71471,10 @@ var init_operation_tools = __esm(() => {
 
 // src/lib/feedback.ts
 import { appendFileSync as appendFileSync2, existsSync as existsSync25, mkdirSync as mkdirSync11 } from "fs";
-import { dirname as dirname8, join as join26 } from "path";
+import { dirname as dirname8, join as join27 } from "path";
 import { Database } from "bun:sqlite";
 function getFeedbackDbPath() {
-  return join26(getDataDir(), "skills.db");
+  return join27(getDataDir(), "skills.db");
 }
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
@@ -70114,7 +71506,7 @@ function saveFeedback(input) {
     throw new Error("Feedback message is required");
   const category = input.category ?? "general";
   if (isApiMode()) {
-    const path = join26(getDataDir(), "feedback.jsonl");
+    const path = join27(getDataDir(), "feedback.jsonl");
     const dir = dirname8(path);
     if (!existsSync25(dir))
       mkdirSync11(dir, { recursive: true });
@@ -70131,12 +71523,10 @@ function saveFeedback(input) {
   return { saved: true, category, path: getFeedbackDbPath() };
 }
 function isApiMode(env3 = process.env) {
-  if (env3.HASNA_SKILLS_API_URL?.trim())
-    return true;
   try {
-    return Boolean(resolveApiUrl(undefined, env3));
+    return Boolean(resolveApiUrl(env3));
   } catch {
-    return Boolean(env3.SKILLS_API_URL?.trim());
+    return true;
   }
 }
 var init_feedback = __esm(() => {
@@ -70280,23 +71670,23 @@ var init_resource_meta_tools = __esm(() => {
 });
 
 // src/lib/scheduler.ts
-import { existsSync as existsSync26, readFileSync as readFileSync21, writeFileSync as writeFileSync13, mkdirSync as mkdirSync12 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync22, writeFileSync as writeFileSync13, mkdirSync as mkdirSync12 } from "fs";
+import { join as join28 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
-  return join27(targetDir, ".skills", "schedules.json");
+  return join28(targetDir, ".skills", "schedules.json");
 }
 function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
   if (existsSync26(path)) {
     try {
-      return JSON.parse(readFileSync21(path, "utf-8"));
+      return JSON.parse(readFileSync22(path, "utf-8"));
     } catch {}
   }
   return { version: 1, schedules: [] };
 }
 function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  const dir = join27(targetDir, ".skills");
+  const dir = join28(targetDir, ".skills");
   if (!existsSync26(dir))
     mkdirSync12(dir, { recursive: true });
   writeFileSync13(path, JSON.stringify(data, null, 2));
@@ -70599,12 +71989,12 @@ import { createHash as createHash5, createHmac as createHmac3 } from "crypto";
 import {
   existsSync as existsSync27,
   mkdirSync as mkdirSync13,
-  readFileSync as readFileSync22,
+  readFileSync as readFileSync23,
   readdirSync as readdirSync15,
-  statSync as statSync15,
+  statSync as statSync16,
   writeFileSync as writeFileSync14
 } from "fs";
-import { dirname as dirname9, join as join28, normalize as normalize3, relative as relative4, sep as sep2 } from "path";
+import { dirname as dirname9, join as join29, normalize as normalize3, relative as relative4, sep as sep2 } from "path";
 function resolveSkillsNativeStorageConfig(env3 = process.env) {
   assertNoRetiredModeEnvVars(env3, {
     app: SKILLS_ENV_NAMESPACE,
@@ -70645,7 +72035,7 @@ function getSkillsNativeStorageStatus(options = {}) {
     local: {
       dataDir: getDataDir(),
       projectStateDir: getProjectStateDir(targetDir),
-      feedbackDbPath: join28(getDataDir(), "skills.db")
+      feedbackDbPath: join29(getDataDir(), "skills.db")
     },
     remote: {
       databaseConfigured: Boolean(config2.databaseUrl),
@@ -70667,7 +72057,7 @@ function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
   const files = [];
   if (existsSync27(projectStateDir)) {
     for (const filePath of walkFiles2(projectStateDir)) {
-      const bytes = readFileSync22(filePath);
+      const bytes = readFileSync23(filePath);
       const relativePath = toPosix(relative4(targetDir, filePath));
       files.push({
         path: relativePath,
@@ -70726,8 +72116,8 @@ function parsePositiveInteger(value) {
 function walkFiles2(dir) {
   const files = [];
   for (const entry of readdirSync15(dir)) {
-    const full = join28(dir, entry);
-    const stats = statSync15(full);
+    const full = join29(dir, entry);
+    const stats = statSync16(full);
     if (stats.isDirectory())
       files.push(...walkFiles2(full));
     else
@@ -71203,26 +72593,26 @@ var require_content_type = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
 var import_content_type;
 var init_mediaType = __esm(() => {
   import_content_type = __toESM(require_content_type(), 1);
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/sseKeepAlive.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/sseKeepAlive.js
 var MAX_TIMER_DELAY_MS;
 var init_sseKeepAlive = __esm(() => {
   MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
 var init_webStandardStreamableHttp = __esm(() => {
   init_mediaType();
   init_sseKeepAlive();
   init_types2();
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/streamableHttp.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/streamableHttp.js
 var init_streamableHttp = __esm(() => {
   init_dist();
   init_webStandardStreamableHttp();
@@ -71275,9 +72665,9 @@ var init_mcp2 = __esm(() => {
 });
 
 // src/cli/commands/runtime-mcp.ts
-import { existsSync as existsSync28, mkdirSync as mkdirSync14, readFileSync as readFileSync23, writeFileSync as writeFileSync15 } from "fs";
-import { homedir as homedir9 } from "os";
-import { dirname as dirname10, join as join29 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync14, readFileSync as readFileSync24, writeFileSync as writeFileSync15 } from "fs";
+import { homedir as homedir7 } from "os";
+import { dirname as dirname10, join as join30 } from "path";
 async function handleMcp(options) {
   if (options.register) {
     let agents;
@@ -71320,24 +72710,24 @@ async function registerMcpForAgent(agent, command) {
     case "codex":
       return registerCodexMcp(command);
     case "gemini":
-      return registerJsonMcpServer(agent, join29(homedir9(), ".gemini", "settings.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join30(homedir7(), ".gemini", "settings.json"), "mcpServers", {
         command,
         args: []
       });
     case "pi":
-      return registerJsonMcpServer(agent, join29(homedir9(), ".pi", "agent", "mcp.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join30(homedir7(), ".pi", "agent", "mcp.json"), "mcpServers", {
         command,
         args: []
       });
     case "opencode":
       return registerOpenCodeMcp(command);
     case "cursor":
-      return registerJsonMcpServer(agent, join29(homedir9(), ".cursor", "mcp.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join30(homedir7(), ".cursor", "mcp.json"), "mcpServers", {
         command,
         args: []
       });
     case "windsurf":
-      return registerJsonMcpServer(agent, join29(homedir9(), ".windsurf", "mcp.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join30(homedir7(), ".windsurf", "mcp.json"), "mcpServers", {
         command,
         args: []
       });
@@ -71360,7 +72750,7 @@ async function registerClaudeMcp(command) {
     if (exitCode === 0) {
       return { agent: "claude", success: true, command: cliCommand };
     }
-    const fallback = registerJsonMcpServer("claude", join29(homedir9(), ".claude", ".mcp.json"), "mcpServers", {
+    const fallback = registerJsonMcpServer("claude", join30(homedir7(), ".claude", ".mcp.json"), "mcpServers", {
       command,
       args: []
     });
@@ -71370,7 +72760,7 @@ async function registerClaudeMcp(command) {
       error: fallback.success ? undefined : `claude exited with ${exitCode}: ${(stderr || stdout).trim()}`
     };
   } catch (err) {
-    const fallback = registerJsonMcpServer("claude", join29(homedir9(), ".claude", ".mcp.json"), "mcpServers", {
+    const fallback = registerJsonMcpServer("claude", join30(homedir7(), ".claude", ".mcp.json"), "mcpServers", {
       command,
       args: []
     });
@@ -71382,11 +72772,11 @@ async function registerClaudeMcp(command) {
   }
 }
 function registerCodexMcp(command) {
-  const path = join29(homedir9(), ".codex", "config.toml");
+  const path = join30(homedir7(), ".codex", "config.toml");
   const config2 = `[mcp_servers.${MCP_SERVER_NAME}]
 command = ${JSON.stringify(command)}`;
   try {
-    const current = existsSync28(path) ? readFileSync23(path, "utf-8") : "";
+    const current = existsSync28(path) ? readFileSync24(path, "utf-8") : "";
     writeTextFile(path, upsertTomlSection(current, `[mcp_servers.${MCP_SERVER_NAME}]`, `command = ${JSON.stringify(command)}`));
     return { agent: "codex", success: true, path, config: config2 };
   } catch (err) {
@@ -71394,7 +72784,7 @@ command = ${JSON.stringify(command)}`;
   }
 }
 function registerOpenCodeMcp(command) {
-  const path = join29(homedir9(), ".config", "opencode", "opencode.json");
+  const path = join30(homedir7(), ".config", "opencode", "opencode.json");
   const config2 = JSON.stringify({
     $schema: "https://opencode.ai/config.json",
     mcp: {
@@ -71438,7 +72828,7 @@ function registerJsonMcpServer(agent, path, containerKey, server2) {
 function readJsonObject2(path) {
   if (!existsSync28(path))
     return {};
-  const raw = readFileSync23(path, "utf-8").trim();
+  const raw = readFileSync24(path, "utf-8").trim();
   if (!raw)
     return {};
   const parsed = JSON.parse(raw);
@@ -71482,7 +72872,7 @@ function findCommandOnPath(command) {
   for (const dir of pathValue.split(":")) {
     if (!dir)
       continue;
-    const candidate = join29(dir, command);
+    const candidate = join30(dir, command);
     if (existsSync28(candidate))
       return candidate;
   }
@@ -71503,7 +72893,7 @@ __export(exports_runtime, {
   registerRuntime: () => registerRuntime
 });
 import { mkdirSync as mkdirSync15, writeFileSync as writeFileSync16 } from "fs";
-import { dirname as dirname11, join as join30 } from "path";
+import { dirname as dirname11, join as join31 } from "path";
 import { createInterface } from "readline";
 function registerRuntime(parent) {
   parent.command("run").argument("<skill>", "Skill name").argument("[args...]", "Arguments to pass to the skill").allowUnknownOption(true).passThroughOptions(true).option("--json", "Output result as JSON", false).option("--wait", "Poll remote runs until a terminal status", false).option("--poll-interval-ms <ms>", "Remote polling interval in milliseconds", "1000").option("--poll-timeout-ms <ms>", "Maximum time to wait for a remote run", "300000").description("Run a skill directly").action(async (name, args2, options) => handleRun(name, args2, options));
@@ -71522,7 +72912,7 @@ function registerRuntime(parent) {
     }
     await handleMcp(options);
   });
-  const setup = parent.command("setup").description("Point this CLI at a Skills API server, or register agent integrations").option("--api-url <url>", "Skills API origin to send remote work to").option("--global", "Save the API origin globally instead of in this project", false).option("--json", "Output setup result as JSON", false).action(async (options) => handleSetup(options));
+  const setup = parent.command("setup").description("Point this CLI at a Skills API server, or register agent integrations").option("--api-url <url>", "Skills API origin to send remote work to").option("--global", "Accepted for compatibility; the API origin is always per-user", false).option("--json", "Output setup result as JSON", false).action(async (options) => handleSetup(options));
   setup.command("agents").option("--json", "Output registration result as JSON", false).description("Register the Skills MCP server with all supported agents").action(async (options) => handleMcp({ register: "all", json: options.json }));
   parent.command("self-update").description("Update @hasna/skills to the latest version").option("--json", "Output result as JSON", false).action(async (options) => {
     if (process.env.SKILLS_TEST_MODE === "1") {
@@ -71568,13 +72958,12 @@ Updating ${name}...
   });
 }
 async function handleSetup(options) {
-  const scope = options.global ? "global" : "project";
   if (options.apiUrl !== undefined && !options.apiUrl.trim()) {
-    const error2 = "Invalid value '' for --api-url. Expected an http(s) URL";
+    const error3 = "Invalid value '' for --api-url. Expected an http(s) URL";
     if (options.json)
-      console.log(JSON.stringify({ saved: null, scope, error: error2 }, null, 2));
+      console.log(JSON.stringify({ saved: null, error: error3 }, null, 2));
     else
-      console.error(source_default.red(error2));
+      console.error(source_default.red(error3));
     process.exitCode = 1;
     return;
   }
@@ -71583,49 +72972,89 @@ async function handleSetup(options) {
     requested = (await promptLine("Skills API URL (blank to leave unchanged): ")).trim();
   }
   let saved = null;
+  let credentialsFile = null;
   if (requested) {
     try {
-      saveConfig("apiUrl", requested, scope);
-      saved = loadConfig().apiUrl ?? requested;
+      const normalized = normalizeSkillsApiOrigin(requireHttpUrl(requested));
+      credentialsFile = saveApiUrl(normalized);
+      saved = normalized;
     } catch (err) {
-      const error2 = err.message;
+      const error3 = err.message;
       if (options.json)
-        console.log(JSON.stringify({ saved: null, requested, scope, error: error2 }, null, 2));
+        console.log(JSON.stringify({ saved: null, requested, error: error3 }, null, 2));
       else
-        console.error(source_default.red(error2));
+        console.error(source_default.red(error3));
       process.exitCode = 1;
       return;
     }
   }
-  const config2 = loadConfig();
-  const configured = config2.apiUrl ?? null;
-  const next = configured ? ["skills auth login", "skills list --remote"] : ["skills list", "skills run <skill>"];
+  let configured = null;
+  let source = null;
+  let authenticated = false;
+  let error2 = null;
+  try {
+    const fleet = resolveSkillsFleet();
+    if (fleet.mode === "hosted") {
+      configured = fleet.apiOrigin;
+      source = fleet.apiUrlSource;
+      authenticated = true;
+    }
+  } catch (err) {
+    error2 = err.message;
+    configured = saved;
+  }
+  const next = error2 ? ["skills auth login"] : configured ? ["skills auth login", "skills list --remote"] : ["skills list", "skills run <skill>"];
   const payload = {
     apiUrl: configured,
+    source,
     saved,
-    scope,
-    config: config2,
+    credentialsFile,
+    authenticated,
+    ...error2 ? { error: error2 } : {},
+    config: loadConfig(),
     next
   };
   if (options.json) {
     console.log(JSON.stringify(payload, null, 2));
+    if (error2)
+      process.exitCode = 1;
+    return;
+  }
+  if (error2) {
+    if (saved)
+      console.log(source_default.green(`Skills API set to ${saved}`));
+    console.error(source_default.red(error2));
+    process.exitCode = 1;
     return;
   }
   if (saved) {
     console.log(source_default.green(`Skills API set to ${saved}`));
-    console.log(source_default.dim(`  Scope: ${scope}`));
+    if (credentialsFile)
+      console.log(source_default.dim(`  Saved in: ${credentialsFile}`));
     console.log(source_default.dim("  Next: skills auth login"));
   } else if (configured) {
     console.log(source_default.green(`Skills API already configured: ${configured}`));
+    console.log(source_default.dim(`  Source: ${source}`));
     console.log(source_default.dim("  Change it with: skills setup --api-url <url>"));
-    console.log(source_default.dim("  Clear it with:  skills config unset apiUrl"));
-    console.log(source_default.dim("  Next: skills auth login"));
+    console.log(source_default.dim(`  Clear it with:  skills config unset apiUrl (or unset ${SKILLS_API_URL_ENV})`));
   } else {
     console.log(source_default.green("No Skills API configured; skills run on this machine."));
     console.log(source_default.dim("  Point at a server with: skills setup --api-url <url>"));
     console.log(source_default.dim("  Next: skills list"));
   }
 }
+function requireHttpUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`Invalid value '${value}' for --api-url. Expected an http(s) URL`);
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error(`Invalid value '${value}' for --api-url. Expected an http(s) URL`);
+  }
+  return value.replace(/\/+$/, "");
+}
 function promptLine(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((resolve2) => {
@@ -71657,7 +73086,7 @@ async function handleRun(name, args2, options) {
       return;
     }
   }
-  const routing = resolveConfiguredRunRouting(skill);
+  const routing = await resolveConfiguredRunRouting(skill);
   const runContext = createSkillRun({
     skill: skill.name,
     args: args2,
@@ -71853,10 +73282,10 @@ ${run.id}
   }
 }
 async function handleRunsStatus(runId, options) {
-  const { getApiKey: getApiKey2 } = await Promise.resolve().then(() => (init_auth_store(), exports_auth_store));
-  const apiKey = getApiKey2();
+  const { skillsCredentialOrReason: skillsCredentialOrReason2 } = await Promise.resolve().then(() => (init_fleet_credentials(), exports_fleet_credentials));
+  const { apiKey, reason } = await skillsCredentialOrReason2();
   if (!apiKey) {
-    const error2 = "Remote run status requires API access. Run: skills auth login";
+    const error2 = reason ?? "Remote run status requires API access. Run: skills auth login";
     if (options.json)
       console.log(JSON.stringify({ contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION, error: error2 }, null, 2));
     else
@@ -71954,10 +73383,10 @@ async function handleExportsOpen(runId, options) {
   } catch {}
 }
 async function handleExportsDownload(runId, options) {
-  const { getApiKey: getApiKey2 } = await Promise.resolve().then(() => (init_auth_store(), exports_auth_store));
-  const apiKey = getApiKey2();
+  const { skillsCredentialOrReason: skillsCredentialOrReason2 } = await Promise.resolve().then(() => (init_fleet_credentials(), exports_fleet_credentials));
+  const { apiKey, reason } = await skillsCredentialOrReason2();
   if (!apiKey) {
-    const error2 = "Remote artifact downloads require API access. Run: skills auth login";
+    const error2 = reason ?? "Remote artifact downloads require API access. Run: skills auth login";
     if (options.json)
       console.log(JSON.stringify({ error: error2 }, null, 2));
     else
@@ -71992,7 +73421,7 @@ async function handleExportsDownload(runId, options) {
       if (!response.ok)
         throw new Error(`download failed for artifact ${artifactId}: ${response.status}`);
       const relativePath = safeArtifactRelativePath(typeof artifact.relativePath === "string" ? artifact.relativePath : artifact.fileName, String(artifact.fileName || artifactId));
-      const outputPath = join30(exportDir, relativePath);
+      const outputPath = join31(exportDir, relativePath);
       mkdirSync15(dirname11(outputPath), { recursive: true });
       const bytes = new Uint8Array(await response.arrayBuffer());
       writeFileSync16(outputPath, bytes);
@@ -72208,6 +73637,8 @@ var init_runtime = __esm(() => {
   init_skillinfo();
   init_blog_article();
   init_config();
+  init_auth_store();
+  init_fleet_credentials();
   init_runs();
   init_run_state();
   init_runtime_mcp();
@@ -72354,9 +73785,9 @@ var init_completion = __esm(() => {
 });
 
 // src/lib/portable-snapshot-filter.ts
-import { readdirSync as readdirSync16, statSync as statSync16 } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join31, sep as sep3 } from "path";
+import { readdirSync as readdirSync16, statSync as statSync17 } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join32, sep as sep3 } from "path";
 function isExcludedSkillFileName(fileName) {
   if (EXCLUDE_FILE_NAMES.has(fileName)) {
     return true;
@@ -72377,18 +73808,18 @@ function isPortableWithinSkill(relativeParts) {
   return PORTABLE_SUBDIRS.has(second);
 }
 function homePathFor(definition, homesRoot) {
-  const home = homesRoot ?? homedir10();
+  const home = homesRoot ?? homedir8();
   if (definition.subClass === "skills" || definition.subClass === "custom") {
-    return join31(skillsDataRootForHome(home), definition.name);
+    return join32(skillsDataRootForHome(home), definition.name);
   }
   if (definition.agent === "opencode") {
-    return join31(home, ".config", "opencode", "skills");
+    return join32(home, ".config", "opencode", "skills");
   }
-  return join31(home, `.${definition.agent}`, "skills");
+  return join32(home, `.${definition.agent}`, "skills");
 }
 function destinationFor(definition, stationId, relativePath) {
-  const category = definition.subClass === "agent-homes" ? join31("agent-homes", definition.agent ?? "") : definition.name;
-  return join31("resources", stationId, "skills", category, ...relativePath.split(sep3));
+  const category = definition.subClass === "agent-homes" ? join32("agent-homes", definition.agent ?? "") : definition.name;
+  return join32("resources", stationId, "skills", category, ...relativePath.split(sep3));
 }
 function walkEntries(absoluteRoot) {
   let entries;
@@ -72399,7 +73830,7 @@ function walkEntries(absoluteRoot) {
   }
   const output = [];
   for (const entry of entries) {
-    const childFull = join31(absoluteRoot, entry.name);
+    const childFull = join32(absoluteRoot, entry.name);
     if (entry.isSymbolicLink()) {
       output.push({ kind: "symlink", relativePath: entry.name, fullPath: childFull });
       continue;
@@ -72410,7 +73841,7 @@ function walkEntries(absoluteRoot) {
       }
       const nested = walkEntries(childFull);
       for (const item of nested) {
-        output.push({ ...item, relativePath: join31(entry.name, item.relativePath) });
+        output.push({ ...item, relativePath: join32(entry.name, item.relativePath) });
       }
       continue;
     }
@@ -72422,7 +73853,7 @@ function walkEntries(absoluteRoot) {
 }
 function isRegularFile(filePath) {
   try {
-    return statSync16(filePath).isFile();
+    return statSync17(filePath).isFile();
   } catch {
     return false;
   }
@@ -72507,18 +73938,18 @@ import { createHash as createHash6 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
   mkdirSync as mkdirSync16,
-  readFileSync as readFileSync24,
-  statSync as statSync17,
+  readFileSync as readFileSync25,
+  statSync as statSync18,
   writeFileSync as writeFileSync17
 } from "fs";
-import { dirname as dirname12, isAbsolute as isAbsolute3, relative as relative5, resolve as resolve2, sep as sep4 } from "path";
+import { dirname as dirname12, isAbsolute as isAbsolute4, relative as relative5, resolve as resolve2, sep as sep4 } from "path";
 function validateStationId(stationId) {
   if (!/^[a-z0-9-]+$/.test(stationId)) {
     throw new StationSnapshotError("INVALID_STATION", `station id must be a slug, got: ${stationId}`);
   }
 }
 function sha256File(filePath) {
-  return createHash6("sha256").update(readFileSync24(filePath)).digest("hex");
+  return createHash6("sha256").update(readFileSync25(filePath)).digest("hex");
 }
 function scanHome(definition, homesRoot) {
   const homePath = homePathFor(definition, homesRoot);
@@ -72548,7 +73979,7 @@ function scanHome(definition, homesRoot) {
       skipped.push({ relativePath: entry.relativePath, reason: "not-regular-file" });
       continue;
     }
-    const info = statSync17(entry.fullPath);
+    const info = statSync18(entry.fullPath);
     portable.push({
       relativePath: entry.relativePath,
       fullPath: entry.fullPath,
@@ -72617,7 +74048,7 @@ function writeStationSnapshot(options) {
   for (const plan of plans) {
     const destination = resolve2(repoRoot, plan.destination);
     const destinationRelative = relative5(repoRoot, destination);
-    if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep4) || isAbsolute3(destinationRelative)) {
+    if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep4) || isAbsolute4(destinationRelative)) {
       throw new StationSnapshotError("DESTINATION_ESCAPE", `destination escapes repo root: ${plan.destination}`);
     }
     let existingDigest = null;
@@ -72691,7 +74122,7 @@ __export(exports_create_sync_config, {
   registerCreateSync: () => registerCreateSync
 });
 import { existsSync as existsSync29, writeFileSync as writeFileSync18, mkdirSync as mkdirSync17 } from "fs";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 function registerCreateSync(parent) {
   const configCmd = parent.command("config").description("Manage skills configuration");
   configCmd.command("show", { isDefault: true }).option("--json", "Output as JSON", false).description("Show current merged configuration").action((options) => {
@@ -72728,6 +74159,20 @@ function registerCreateSync(parent) {
   configCmd.command("unset <key>").option("--global", "Remove from the global config instead of the project config", false).option("--json", "Output as JSON", false).description("Remove a configuration value").action((key, options) => {
     const scope = options.global ? "global" : "project";
     try {
+      if (key === "apiUrl") {
+        const hadStored = Boolean(readStoredApiUrl());
+        if (hadStored)
+          saveApiUrl(null);
+        const removedStaleKey = unsetConfig(key, scope);
+        const removed2 = hadStored || removedStaleKey;
+        if (options.json)
+          console.log(JSON.stringify({ key, removed: removed2, scope, path: getConfigPath(scope) }));
+        else if (removed2)
+          console.log(source_default.green(`Unset ${key}`));
+        else
+          console.log(source_default.dim(`${key} was not set`));
+        return;
+      }
       const removed = unsetConfig(key, scope);
       if (options.json)
         console.log(JSON.stringify({ key, removed, scope, path: getConfigPath(scope) }));
@@ -72772,7 +74217,7 @@ function handleCreate(name, options) {
   const bare = name.trim();
   const dirName = bare;
   const baseDir = getPortableSkillsRoot();
-  const skillDir = join32(baseDir, dirName);
+  const skillDir = join33(baseDir, dirName);
   if (existsSync29(skillDir)) {
     console.log(options.json ? JSON.stringify({ error: `Skill '${bare}' already exists at ${skillDir}` }) : source_default.red(`Skill '${bare}' already exists at ${skillDir}`));
     process.exitCode = 1;
@@ -72781,8 +74226,8 @@ function handleCreate(name, options) {
   const description = options.description || `${bare} skill`;
   const tags = options.tags ? options.tags.split(",").map((t) => t.trim()).filter(Boolean) : [bare];
   const displayName2 = bare.replace(/-/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
-  mkdirSync17(join32(skillDir, "src"), { recursive: true });
-  writeFileSync18(join32(skillDir, "SKILL.md"), [
+  mkdirSync17(join33(skillDir, "src"), { recursive: true });
+  writeFileSync18(join33(skillDir, "SKILL.md"), [
     "---",
     `name: ${bare}`,
     `description: ${description}`,
@@ -72802,11 +74247,11 @@ function handleCreate(name, options) {
     ""
   ].join(`
 `));
-  writeFileSync18(join32(skillDir, "src", "index.ts"), [`#!/usr/bin/env bun`, `/**`, ` * ${displayName2} \u2014 ${description}`, ` */`, "", `console.log("${displayName2}");`, ""].join(`
+  writeFileSync18(join33(skillDir, "src", "index.ts"), [`#!/usr/bin/env bun`, `/**`, ` * ${displayName2} \u2014 ${description}`, ` */`, "", `console.log("${displayName2}");`, ""].join(`
 `));
-  writeFileSync18(join32(skillDir, "package.json"), JSON.stringify({ name: bare, version: "0.1.0", description, bin: { [bare]: "./src/index.ts" }, scripts: { dev: `bun src/index.ts` }, dependencies: {} }, null, 2) + `
+  writeFileSync18(join33(skillDir, "package.json"), JSON.stringify({ name: bare, version: "0.1.0", description, bin: { [bare]: "./src/index.ts" }, scripts: { dev: `bun src/index.ts` }, dependencies: {} }, null, 2) + `
 `);
-  writeFileSync18(join32(skillDir, "tsconfig.json"), JSON.stringify({ compilerOptions: { target: "ES2022", module: "ESNext", moduleResolution: "bundler", strict: true, outDir: "dist" }, include: ["src/**/*.ts"] }, null, 2) + `
+  writeFileSync18(join33(skillDir, "tsconfig.json"), JSON.stringify({ compilerOptions: { target: "ES2022", module: "ESNext", moduleResolution: "bundler", strict: true, outDir: "dist" }, include: ["src/**/*.ts"] }, null, 2) + `
 `);
   clearRegistryCache();
   if (options.json)
@@ -72815,8 +74260,8 @@ function handleCreate(name, options) {
     console.log(source_default.green(`\u2713 Created custom skill '${bare}' at ${skillDir}`));
     console.log(source_default.dim(`  Category: ${options.category}`));
     console.log(source_default.dim(`  Tags: ${tags.join(", ")}`));
-    console.log(`  ${source_default.cyan("Edit:")} ${join32(skillDir, "src", "index.ts")}`);
-    console.log(`  ${source_default.cyan("Run:")}  bun ${join32(skillDir, "src", "index.ts")}`);
+    console.log(`  ${source_default.cyan("Edit:")} ${join33(skillDir, "src", "index.ts")}`);
+    console.log(`  ${source_default.cyan("Run:")}  bun ${join33(skillDir, "src", "index.ts")}`);
   }
 }
 function handleSync(names, options) {
@@ -73052,6 +74497,7 @@ ${written}/${actions.length} ${dryRun ? "would be written" : "written"}`));
 var init_create_sync_config = __esm(() => {
   init_source();
   init_config();
+  init_auth_store();
   init_portable_skills();
   init_registry();
   init_agent_sync();
@@ -73066,23 +74512,23 @@ import {
   copyFileSync as copyFileSync3,
   mkdirSync as mkdirSync18,
   readdirSync as readdirSync17,
-  readFileSync as readFileSync25,
-  statSync as statSync18,
+  readFileSync as readFileSync26,
+  statSync as statSync19,
   writeFileSync as writeFileSync19
 } from "fs";
-import { dirname as dirname13, join as join33, resolve as resolve3, sep as sep5 } from "path";
+import { dirname as dirname13, join as join34, resolve as resolve3, sep as sep5 } from "path";
 function fail2(code, message, detail = []) {
   throw new StationSnapshotError(code, message, detail);
 }
 function snapshotRootFor(repoRoot, stationId) {
-  return join33(repoRoot, "resources", stationId, "skills");
+  return join34(repoRoot, "resources", stationId, "skills");
 }
 function readSnapshotManifest(repoRoot, stationId) {
   const snapshotRoot = snapshotRootFor(repoRoot, stationId);
-  const manifestPath = join33(snapshotRoot, "sync-manifest.json");
+  const manifestPath = join34(snapshotRoot, "sync-manifest.json");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync25(manifestPath, "utf8"));
+    manifest = JSON.parse(readFileSync26(manifestPath, "utf8"));
   } catch (error2) {
     fail2("MANIFEST_UNREADABLE", `cannot read snapshot manifest: ${manifestPath}: ${error2.message}`);
   }
@@ -73106,7 +74552,7 @@ function planStationHydration(stationId, repoRoot) {
   const hashMismatches = [];
   const skippedByRule = [];
   for (const agent of SYNC_AGENTS) {
-    const agentRoot = join33(snapshotRoot, "agent-homes", agent);
+    const agentRoot = join34(snapshotRoot, "agent-homes", agent);
     let identEntries;
     try {
       identEntries = readdirSync17(agentRoot, { withFileTypes: true });
@@ -73117,7 +74563,7 @@ function planStationHydration(stationId, repoRoot) {
       if (!identEntry.isDirectory() || identEntry.name.startsWith(".")) {
         continue;
       }
-      const identRoot = join33(agentRoot, identEntry.name);
+      const identRoot = join34(agentRoot, identEntry.name);
       const entries = walkEntries(identRoot);
       for (const entry of entries) {
         const relativeParts = [identEntry.name, ...entry.relativePath.split(sep5)];
@@ -73164,7 +74610,7 @@ function planStationHydration(stationId, repoRoot) {
           });
           continue;
         }
-        const info = statSync18(entry.fullPath);
+        const info = statSync19(entry.fullPath);
         const manifestHash = manifestHashes.get(`${agent}${MANIFEST_HASH_KEY_SEP}${homeRelative}`) ?? null;
         let verified = false;
         if (manifestHash !== null) {
@@ -73218,7 +74664,7 @@ function planStationHydration(stationId, repoRoot) {
         for (const copy of copies) {
           let isStub = false;
           try {
-            isStub = isPointerSkillMd(readFileSync25(copy.fullPath, "utf8"));
+            isStub = isPointerSkillMd(readFileSync26(copy.fullPath, "utf8"));
           } catch {
             isStub = false;
           }
@@ -73302,7 +74748,7 @@ function writeStationHydration(options) {
   const toWrite = [];
   for (const skill of plan.winners) {
     for (const file of skill.files) {
-      const destination = join33(cacheRoot, skill.ident, file.withinIdent);
+      const destination = join34(cacheRoot, skill.ident, file.withinIdent);
       const digest = sha256File(file.winner.fullPath);
       let existingDigest = null;
       try {
@@ -73344,7 +74790,7 @@ function writeStationHydration(options) {
     },
     skills: resultSkills
   };
-  const hydrationManifestPath = join33(dirname13(cacheRoot), `hydration-${options.stationId}.json`);
+  const hydrationManifestPath = join34(dirname13(cacheRoot), `hydration-${options.stationId}.json`);
   mkdirSync18(dirname13(hydrationManifestPath), { recursive: true });
   writeFileSync19(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
@@ -73706,7 +75152,7 @@ async function executeScheduledSkill(skillName, args2, options) {
   if (!skill)
     throw new Error(`Skill '${skillName}' not found`);
   const { resolveConfiguredRunRouting: resolveConfiguredRunRouting2 } = await Promise.resolve().then(() => (init_run_routing(), exports_run_routing));
-  const routing = resolveConfiguredRunRouting2(skill);
+  const routing = await resolveConfiguredRunRouting2(skill);
   if (routing.route === "error") {
     throw new Error(`${routing.code}: ${routing.error}`);
   }
@@ -73925,7 +75371,7 @@ ${ok}/${results.length} pulled into ~/.hasna/skills/installed`));
 }
 function registerVersions(parent) {
   parent.command("versions").argument("<name>", "Skill name on the configured instance").option("--json", "Output as JSON", false).description("List the published versions of a skill on the configured instance").action(async (name, options) => {
-    const client = createRemoteSkillsClient();
+    const client = await createRemoteSkillsClient();
     if (!client) {
       const message = "No API key configured, so there is no instance to list versions from.";
       if (options.json)
@@ -73972,6 +75418,7 @@ var init_registry2 = __esm(() => {
 // src/cli/commands/publish.ts
 var exports_publish = {};
 __export(exports_publish, {
+  sanitizeGitRemote: () => sanitizeGitRemote,
   registerPublish: () => registerPublish,
   pushSkill: () => pushSkill,
   bumpPatch: () => bumpPatch,
@@ -73979,9 +75426,9 @@ __export(exports_publish, {
   PushSkillError: () => PushSkillError
 });
 import { execFileSync } from "child_process";
-import { existsSync as existsSync30, readFileSync as readFileSync26 } from "fs";
+import { existsSync as existsSync30, readFileSync as readFileSync27 } from "fs";
 import { hostname as hostname2 } from "os";
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 function registerPublish(parent) {
   parent.command("push").argument("<name>", "Name of a skill in the local corpus (~/.hasna/skills/installed or the migrated ~/.hasna/skills/skills)").option("--version <version>", "Override the version recorded on the instance").option("--force-new-version", "If name@version already exists with different content, publish as the next patch version", false).option("--dry-run", "Pack and validate without uploading", false).option("--json", "Output result as JSON", false).description("Publish a local skill to the configured skills instance").action(async (name, options) => {
     try {
@@ -74022,10 +75469,14 @@ async function pushSkill(name, options = {}) {
     throw new PushSkillError(`Skill '${skill.name}' is not valid and was not published.`, validation.issues.map((issue2) => `${issue2.code}: ${issue2.message}`));
   }
   const manifest = readPortableSkillManifest(skill.path, skill.name);
+  const declaredVersion = options.version ?? readDeclaredSkillVersion(skill.path);
+  if (!declaredVersion) {
+    throw new PushSkillError(`Skill '${skill.name}' declares no version, so it was not published as an invented '0.1.0'.`, ["Declare a version in skill.json (or the SKILL.md frontmatter / package.json), or pass --version <version> to this push."]);
+  }
   const packed = packSkillBundle(skill.path, { maxUnpackedBytes: MAX_UNPACKED_BYTES });
   const versionManifest = buildVersionManifest(skill.path, packed);
-  const skillMdPath = join34(skill.path, "SKILL.md");
-  const skillMd = existsSync30(skillMdPath) ? readFileSync26(skillMdPath, "utf-8") : undefined;
+  const skillMdPath = join35(skill.path, "SKILL.md");
+  const skillMd = existsSync30(skillMdPath) ? readFileSync27(skillMdPath, "utf-8") : undefined;
   const base2 = {
     slug: skill.name,
     path: skill.path,
@@ -74040,13 +75491,13 @@ async function pushSkill(name, options = {}) {
   };
   if (options.dryRun)
     return base2;
-  const client = options.client !== undefined ? options.client : createRemoteSkillsClient();
+  const client = options.client !== undefined ? options.client : await createRemoteSkillsClient();
   if (!client) {
-    throw new PushSkillError("No API key configured, so there is nowhere to publish to.", ["Run `skills login`, or set SKILLS_API_KEY and SKILLS_API_URL for this instance."]);
+    throw new PushSkillError("No API key configured, so there is nowhere to publish to.", ["Run `skills auth login`, or set HASNA_SKILLS_API_KEY (and HASNA_SKILLS_API_URL for your own instance)."]);
   }
   const current = await client.getSkill(skill.name);
   const ifMatch = current && typeof current.revisionId === "string" && current.revisionId ? current.revisionId : undefined;
-  let version2 = options.version ?? manifest.version ?? "0.1.0";
+  let version2 = options.version ?? manifest.version;
   let response = await publishOnce(client, skill, manifest, packed, skillMd, versionManifest, version2, ifMatch);
   let payload = await readBody(response);
   if (response.status === 409 && codeOf(payload) === "SKILL_VERSION_EXISTS") {
@@ -74059,6 +75510,9 @@ async function pushSkill(name, options = {}) {
     version2 = bumpPatch(version2);
     response = await publishOnce(client, skill, manifest, packed, skillMd, versionManifest, version2, ifMatch);
     payload = await readBody(response);
+    if (response.status === 409 && codeOf(payload) === "SKILL_VERSION_EXISTS") {
+      throw new PushSkillError(`Publishing '${skill.name}@${version2}' failed: even the bumped version already exists on the instance with different content.`, ["code: SKILL_VERSION_EXISTS", "Pick an explicit --version <new> that is free, and push again."]);
+    }
   }
   if (!response.ok) {
     const code = codeOf(payload);
@@ -74070,7 +75524,15 @@ async function pushSkill(name, options = {}) {
     }
     throw new PushSkillError(`Publishing '${skill.name}' failed: ${response.status} ${describeError(payload)}`, code ? [`code: ${code}`] : undefined);
   }
-  return { ...base2, published: true, status: response.status, response: payload, version: version2 };
+  const alreadyPublished = isAlreadyPublishedPayload(payload);
+  return {
+    ...base2,
+    published: true,
+    status: response.status,
+    response: payload,
+    version: version2,
+    ...alreadyPublished ? { alreadyPublished: true } : {}
+  };
 }
 async function publishOnce(client, skill, manifest, packed, skillMd, versionManifest, version2, ifMatch) {
   return client.publishSkill({
@@ -74091,6 +75553,9 @@ async function publishOnce(client, skill, manifest, packed, skillMd, versionMani
 function codeOf(payload) {
   return typeof payload === "object" && payload && "code" in payload ? String(payload.code) : undefined;
 }
+function isAlreadyPublishedPayload(payload) {
+  return typeof payload === "object" && payload !== null && payload.alreadyPublished === true;
+}
 function bumpPatch(version2) {
   const match = /^(\d+)\.(\d+)\.(\d+)(.*)$/.exec(version2);
   if (!match)
@@ -74108,12 +75573,28 @@ function buildVersionManifest(skillDir, packed) {
       machine: hostname2(),
       agent: process.env.SKILLS_AGENT_ID ?? process.env.HASNA_AGENT_ID ?? process.env.AGENT_ID ?? null,
       cliVersion: package_default.version,
-      gitRemote: gitValue(skillDir, ["remote", "get-url", "origin"]),
+      gitRemote: sanitizeGitRemote(gitValue(skillDir, ["remote", "get-url", "origin"])),
       gitSha: gitValue(skillDir, ["rev-parse", "HEAD"]),
       packedAt: new Date().toISOString()
     }
   };
 }
+function sanitizeGitRemote(url) {
+  if (!url)
+    return null;
+  try {
+    const parsed = new URL(url);
+    if (!parsed.username && !parsed.password)
+      return url;
+    if (parsed.protocol === "ssh:")
+      return url;
+    parsed.username = "";
+    parsed.password = "";
+    return parsed.toString();
+  } catch {
+    return url;
+  }
+}
 function gitValue(dir, args2) {
   try {
     const out = execFileSync("git", ["-C", dir, ...args2], { stdio: ["ignore", "pipe", "ignore"], encoding: "utf-8" }).trim();
@@ -74126,10 +75607,14 @@ function printHuman(result2) {
   if (!result2.published) {
     console.log(source_default.bold(`
 Dry run: '${result2.slug}' would be published
+`));
+  } else if (result2.alreadyPublished) {
+    console.log(source_default.green(`
+\u2713 '${result2.slug}@${result2.version}' was already published \u2014 no new version created
 `));
   } else {
     console.log(source_default.green(`
-\u2713 Published '${result2.slug}'
+\u2713 Published '${result2.slug}'${result2.version ? ` as ${result2.version}` : ""}
 `));
   }
   console.log(`  ${source_default.dim("source")}    ${result2.path}`);
@@ -74294,14 +75779,17 @@ function writeCommandError(err, fallback, json) {
   if (payload.endpoint)
     console.error(source_default.dim(`Endpoint: ${payload.endpoint}`));
   if (status !== undefined && CONFIG_HINT_STATUSES.has(status)) {
-    console.error(source_default.dim(`Hint: check SKILLS_API_URL (currently ${payload.apiUrl}) or run: skills setup`));
+    console.error(source_default.dim(`Hint: check ${SKILLS_API_URL_ENV} (currently ${payload.apiUrl}) or run: skills setup`));
   }
   process.exitCode = 1;
 }
-function envApiKey() {
-  const key = process.env.SKILLS_API_KEY || process.env.SKILL_API_KEY;
-  const trimmed = key?.trim();
-  return trimmed || null;
+function credentialSource() {
+  try {
+    const fleet = resolveSkillsFleet();
+    return fleet.mode === "hosted" ? fleet.apiKeySource : null;
+  } catch {
+    return null;
+  }
 }
 function stringField2(value) {
   return typeof value === "string" && value.length > 0 ? value : undefined;
@@ -74341,8 +75829,8 @@ function printWhoami(payload) {
     console.log(source_default.bold("Role:   ") + payload.role);
   if (payload.organizationName)
     console.log(source_default.bold("Name:   ") + payload.organizationName);
-  if (payload.authSource === "env")
-    console.log(source_default.dim("Auth:   SKILLS_API_KEY"));
+  if (payload.authSource)
+    console.log(source_default.dim(`Auth:   ${payload.authSource}`));
   if (payload.offline)
     console.log(source_default.dim("(offline \u2014 showing cached info)"));
 }
@@ -74644,35 +76132,46 @@ function registerAuth(parent) {
       console.log(source_default.dim("Not signed in"));
       return;
     }
-    clearAuthConfig();
-    console.log(source_default.green(`\u2713 Signed out (was ${existing.email})`));
+    const { stillResolves } = clearAuthConfig();
+    console.log(source_default.green(`\u2713 Signed out${existing.email ? ` (was ${existing.email})` : ""}`));
+    if (stillResolves) {
+      console.log(source_default.yellow(`A Skills credential still resolves from ${credentialSource() ?? "another source"}; ` + `clear it there to finish signing out.`));
+    }
   });
   auth.command("whoami").description("Show current account info").option("--json", "Output as JSON", false).action(async (options) => {
-    const envKey = envApiKey();
-    const config2 = getAuthConfig();
-    const apiKey = envKey ?? config2?.apiKey;
-    if (!apiKey) {
-      const payload = { status: "unauthenticated", error: "Not signed in. Run: skills auth login" };
+    let fleet;
+    try {
+      fleet = resolveSkillsFleet();
+    } catch (err) {
+      writeCommandError(err, "Failed to resolve the Skills credential", options.json);
+      return;
+    }
+    if (fleet.mode !== "hosted") {
+      const payload = {
+        status: "unauthenticated",
+        error: `Not signed in. Run: skills auth login, or set ${SKILLS_API_KEY_ENV}`
+      };
       if (options.json)
         console.log(JSON.stringify(payload, null, 2));
       else
         console.log(source_default.dim(payload.error));
       return;
     }
-    const authSource = envKey ? "env" : "stored";
+    const cached2 = fleet.apiKeyTier === "disk" ? getAuthIdentity() : null;
+    const authSource = fleet.apiKeySource;
     try {
       const res = await apiRequest("/api/auth/whoami", {
-        headers: { Authorization: `Bearer ${apiKey}` }
+        headers: { Authorization: `Bearer ${fleet.apiKey}` }
       });
-      const payload = authIdentityPayload(authSource, res, envKey ? null : config2);
+      const payload = authIdentityPayload(authSource, res, cached2);
       if (options.json) {
         console.log(JSON.stringify(payload, null, 2));
       } else {
         printWhoami(payload);
       }
     } catch (err) {
-      if (config2 && !envKey) {
-        const payload = authIdentityPayload("stored", {}, config2, true);
+      if (cached2 && Object.keys(cached2).length > 0) {
+        const payload = authIdentityPayload(authSource, {}, cached2, true);
         if (options.json)
           console.log(JSON.stringify(payload, null, 2));
         else
@@ -74687,6 +76186,7 @@ var isTTY, DEFAULT_DEVICE_POLL_TIMEOUT_MS, MAX_ERROR_DETAIL_LENGTH = 200, CONFIG
 var init_auth = __esm(() => {
   init_source();
   init_auth_store();
+  init_fleet_credentials();
   isTTY = process.stdin.isTTY && process.stdout.isTTY;
   DEFAULT_DEVICE_POLL_TIMEOUT_MS = 10 * 60 * 1000;
   CONFIG_HINT_STATUSES = new Set([401, 403, 404, 405, 501]);
@@ -74848,11 +76348,11 @@ var init_storage = __esm(() => {
 });
 
 // src/lib/registry-reconcile.ts
-import { existsSync as existsSync31, readFileSync as readFileSync27, statSync as statSync19, writeFileSync as writeFileSync21 } from "fs";
-import { join as join35 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync28, statSync as statSync20, writeFileSync as writeFileSync21 } from "fs";
+import { join as join36 } from "path";
 function isDirectory2(path) {
   try {
-    return statSync19(path).isDirectory();
+    return statSync20(path).isDirectory();
   } catch {
     return false;
   }
@@ -74860,15 +76360,15 @@ function isDirectory2(path) {
 function migrationNeeded(options) {
   if (options.rootDir)
     return false;
-  const appDir = options.homeDir ? join35(options.homeDir, ".hasna", "skills") : getDataDir();
-  return !(isOwnerLayoutMigrated(appDir) && isDirectory2(join35(appDir, SKILLS_CACHE_DIRNAME)));
+  const appDir = options.homeDir ? join36(options.homeDir, ".hasna", "skills") : getDataDir();
+  return !(isOwnerLayoutMigrated(appDir) && isDirectory2(join36(appDir, SKILLS_CACHE_DIRNAME)));
 }
 function readBaseline(skillDir) {
-  const markerPath = join35(skillDir, PULL_MARKER_FILE);
+  const markerPath = join36(skillDir, PULL_MARKER_FILE);
   if (!existsSync31(markerPath))
     return;
   try {
-    const marker = JSON.parse(readFileSync27(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync28(markerPath, "utf-8"));
     return {
       ...typeof marker.contentHash === "string" && marker.contentHash ? { contentHash: marker.contentHash } : {},
       ...typeof marker.version === "string" && marker.version ? { version: marker.version } : {}
@@ -74878,11 +76378,11 @@ function readBaseline(skillDir) {
   }
 }
 function readCursor(root) {
-  const path = join35(root, SYNC_CURSOR_FILE);
+  const path = join36(root, SYNC_CURSOR_FILE);
   if (!existsSync31(path))
     return { runCount: 0 };
   try {
-    const cursor = JSON.parse(readFileSync27(path, "utf-8"));
+    const cursor = JSON.parse(readFileSync28(path, "utf-8"));
     return { runCount: typeof cursor.runCount === "number" ? cursor.runCount : 0 };
   } catch {
     return { runCount: 0 };
@@ -74891,12 +76391,12 @@ function readCursor(root) {
 function resolveCorpusRootReadOnly(options) {
   if (options.rootDir)
     return { root: options.rootDir, migrationPending: false };
-  const appDir = options.homeDir ? join35(options.homeDir, ".hasna", "skills") : getDataDirReadOnly();
-  const cache3 = join35(appDir, SKILLS_CACHE_DIRNAME);
+  const appDir = options.homeDir ? join36(options.homeDir, ".hasna", "skills") : getDataDirReadOnly();
+  const cache3 = join36(appDir, SKILLS_CACHE_DIRNAME);
   if (isOwnerLayoutMigrated(appDir) && isDirectory2(cache3)) {
     return { root: cache3, migrationPending: false };
   }
-  return { root: join35(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
+  return { root: join36(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
 }
 function remoteRowToSkill(record3) {
   const slug = typeof record3.slug === "string" ? record3.slug : typeof record3.name === "string" ? record3.name : undefined;
@@ -74994,9 +76494,9 @@ async function reconcileRegistry(options = {}) {
   }
   const direction = options.pull && !options.push && !options.all ? "pull" : options.push && !options.pull && !options.all ? "push" : "all";
   const dryRun = options.dryRun ?? false;
-  const client = options.client !== undefined ? options.client : dryRun ? createRemoteSkillsClientReadOnly() : createRemoteSkillsClient();
+  const client = options.client !== undefined ? options.client : dryRun ? await createRemoteSkillsClientReadOnly() : await createRemoteSkillsClient();
   if (!client) {
-    throw new ReconcileRegistryError("No API key configured, so there is nowhere to sync to.", ["Run `skills login`, or set SKILLS_API_KEY and SKILLS_API_URL for this instance."]);
+    throw new ReconcileRegistryError("No API key configured, so there is nowhere to sync to.", ["Run `skills auth login`, or set HASNA_SKILLS_API_KEY (and HASNA_SKILLS_API_URL for your own instance)."]);
   }
   const { root, migrationPending } = dryRun ? resolveCorpusRootReadOnly(options) : { root: resolveCorpusRoot(options), migrationPending: migrationNeeded(options) };
   const localSkills = listPortableSkillMetas({ rootDir: root });
@@ -75013,7 +76513,7 @@ async function reconcileRegistry(options = {}) {
   const remoteRowsPayload = await client.listSkills();
   if (!Array.isArray(remoteRowsPayload)) {
     const shape = remoteRowsPayload && typeof remoteRowsPayload === "object" ? `object with keys [${Object.keys(remoteRowsPayload).join(", ")}]` : typeof remoteRowsPayload;
-    throw new ReconcileRegistryError(`Registry listing failed: expected an array of skills, got ${shape}.`, ["Check SKILLS_API_URL and the stored credential; a failed listing must not be read as an empty registry."]);
+    throw new ReconcileRegistryError(`Registry listing failed: expected an array of skills, got ${shape}.`, ["Check HASNA_SKILLS_API_URL and the resolved credential; a failed listing must not be read as an empty registry."]);
   }
   const remotes = new Map;
   for (const row of remoteRowsPayload) {
@@ -75028,7 +76528,7 @@ async function reconcileRegistry(options = {}) {
   for (const slug of allSlugs) {
     const local = locals.get(slug);
     const remote = remotes.get(slug);
-    const baseline = local ? readBaseline(join35(root, slug)) : undefined;
+    const baseline = local ? readBaseline(join36(root, slug)) : undefined;
     const { state, reason } = classifySkill(local, remote, baseline);
     let { action, reason: actionReason } = resolveAction(state, direction, conflict);
     if (state === "remote-only" && isDigestless(remote)) {
@@ -75087,7 +76587,7 @@ async function reconcileRegistry(options = {}) {
       try {
         await pushSkill(slug, { rootDir: root, client });
         const pushed = locals.get(slug);
-        writePullMarker(join35(root, slug), {
+        writePullMarker(join36(root, slug), {
           skill: slug,
           ...pushed?.version ? { version: pushed.version } : {},
           ...pushed?.sha256 ? { contentHash: pushed.sha256 } : {},
@@ -75159,7 +76659,7 @@ async function reconcileRegistry(options = {}) {
         runCount: readCursor(root).runCount + 1,
         summary
       };
-      writeFileSync21(join35(root, SYNC_CURSOR_FILE), `${JSON.stringify(cursor, null, 2)}
+      writeFileSync21(join36(root, SYNC_CURSOR_FILE), `${JSON.stringify(cursor, null, 2)}
 `);
       return {
         corpusRoot: root,
@@ -75276,7 +76776,7 @@ import process12 from "process";
 // ../../node_modules/.bun/ink@5.2.1+6e93904c7bfe2418/node_modules/ink/build/ink.js
 var import_react10 = __toESM(require_react(), 1);
 import process11 from "process";
-// ../../node_modules/.bun/es-toolkit@1.51.0/node_modules/es-toolkit/dist/function/debounce.mjs
+// ../../node_modules/.bun/es-toolkit@1.52.0/node_modules/es-toolkit/dist/function/debounce.mjs
 function debounce(func, debounceMs, { signal, edges } = {}) {
   let pendingThis = undefined;
   let pendingArgs = null;
@@ -75334,7 +76834,7 @@ function debounce(func, debounceMs, { signal, edges } = {}) {
   return debounced;
 }
 
-// ../../node_modules/.bun/es-toolkit@1.51.0/node_modules/es-toolkit/dist/compat/function/debounce.mjs
+// ../../node_modules/.bun/es-toolkit@1.52.0/node_modules/es-toolkit/dist/compat/function/debounce.mjs
 function debounce2(func, debounceMs = 0, options = {}) {
   if (typeof options !== "object")
     options = {};
@@ -75355,7 +76855,8 @@ function debounce2(func, debounceMs = 0, options = {}) {
       if (pendingAt === null)
         pendingAt = Date.now();
       if (Date.now() - pendingAt >= maxWait) {
-        result = func.apply(this, args);
+        if (leading || trailing)
+          result = func.apply(this, args);
         pendingAt = Date.now();
         _debounced.cancel();
         _debounced.schedule();
@@ -75374,7 +76875,7 @@ function debounce2(func, debounceMs = 0, options = {}) {
   return debounced;
 }
 
-// ../../node_modules/.bun/es-toolkit@1.51.0/node_modules/es-toolkit/dist/compat/function/throttle.mjs
+// ../../node_modules/.bun/es-toolkit@1.52.0/node_modules/es-toolkit/dist/compat/function/throttle.mjs
 function throttle(func, throttleMs = 0, options = {}) {
   const { leading = true, trailing = true } = options;
   return debounce2(func, throttleMs, {