@hasna/skills 0.2.0 → 0.3.0

package/bin/mcp.js

@@ -3048,13 +3048,32 @@ var require_data = __commonJS((exports, module) => {
   };
 });
 
-// ../../node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS((exports, module) => {
   var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
   var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+  var isPort = RegExp.prototype.test.bind(/^\d*$/u);
   var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
   var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
-  var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
+  var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
+  var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u);
+  var isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u);
+  var BYTE_HEX = new Array(256);
+  {
+    const HEX_DIGITS = "0123456789ABCDEF";
+    for (let i = 0;i < 256; i++) {
+      BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
+    }
+  }
+  function percentEncodeNonAscii(cp) {
+    if (cp < 2048) {
+      return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
+    }
+    if (cp < 65536) {
+      return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+    }
+    return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+  }
   function stringArrayToHexStripped(input) {
     let acc = "";
     let code = 0;
@@ -3079,91 +3098,122 @@ var require_utils = __commonJS((exports, module) => {
     }
     return acc;
   }
+  var isHextet = RegExp.prototype.test.bind(/^[\dA-Fa-f]{1,4}$/);
+  var isIPvFuture = RegExp.prototype.test.bind(/^[vV][\dA-Fa-f]+\.[A-Za-z\d\-._~!$&'()*+,;=:]+$/);
+  var isZoneCharacter = RegExp.prototype.test.bind(/^[A-Za-z\d\-._~]$/);
   var nonSimpleDomain = RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);
-  function consumeIsZone(buffer) {
-    buffer.length = 0;
-    return true;
-  }
-  function consumeHextets(buffer, address, output) {
-    if (buffer.length) {
-      const hex = stringArrayToHexStripped(buffer);
-      if (hex !== "") {
-        address.push(hex);
-      } else {
-        output.error = true;
-        return false;
+  function isZoneIdentifier(zone) {
+    if (zone.length === 0)
+      return false;
+    for (let i = 0;i < zone.length; i++) {
+      if (isZoneCharacter(zone[i]))
+        continue;
+      if (zone[i] === "%" && i + 2 < zone.length && isHexPair(zone.slice(i + 1, i + 3))) {
+        i += 2;
+        continue;
       }
-      buffer.length = 0;
+      return false;
     }
     return true;
   }
-  function getIPV6(input) {
-    let tokenCount = 0;
-    const output = { error: false, address: "", zone: "" };
-    const address = [];
-    const buffer = [];
-    let endipv6Encountered = false;
-    let endIpv6 = false;
-    let consume = consumeHextets;
-    for (let i = 0;i < input.length; i++) {
-      const cursor = input[i];
-      if (cursor === "[" || cursor === "]") {
-        continue;
-      }
-      if (cursor === ":") {
-        if (endipv6Encountered === true) {
-          endIpv6 = true;
-        }
-        if (!consume(buffer, address, output)) {
-          break;
-        }
-        if (++tokenCount > 7) {
-          output.error = true;
-          break;
-        }
-        if (i > 0 && input[i - 1] === ":") {
-          endipv6Encountered = true;
-        }
-        address.push(":");
-        continue;
-      } else if (cursor === "%") {
-        if (!consume(buffer, address, output)) {
-          break;
+  function compressIPv6ZeroRun(hextets) {
+    let bestStart = -1;
+    let bestLength = 0;
+    let runStart = -1;
+    let runLength = 0;
+    for (let i = 0;i < hextets.length; i++) {
+      if (hextets[i] === "0") {
+        if (runStart === -1)
+          runStart = i;
+        runLength++;
+        if (runLength > bestLength) {
+          bestLength = runLength;
+          bestStart = runStart;
         }
-        consume = consumeIsZone;
       } else {
-        buffer.push(cursor);
-        continue;
+        runStart = -1;
+        runLength = 0;
       }
     }
-    if (buffer.length) {
-      if (consume === consumeIsZone) {
-        output.zone = buffer.join("");
-      } else if (endIpv6) {
-        address.push(buffer.join(""));
-      } else {
-        address.push(stringArrayToHexStripped(buffer));
+    if (bestLength < 2)
+      return hextets.join(":");
+    const head = hextets.slice(0, bestStart).join(":");
+    const tail = hextets.slice(bestStart + bestLength).join(":");
+    return head + "::" + tail;
+  }
+  function normalizeIPv6Address(input) {
+    const compression = input.indexOf("::");
+    if (compression !== -1 && input.indexOf("::", compression + 1) !== -1)
+      return;
+    const left = compression === -1 ? input.split(":") : input.slice(0, compression).split(":");
+    const right = compression === -1 ? [] : input.slice(compression + 2).split(":");
+    if (compression !== -1) {
+      if (left.length === 1 && left[0] === "")
+        left.length = 0;
+      if (right.length === 1 && right[0] === "")
+        right.length = 0;
+    }
+    const parts = left.concat(right);
+    let hextetCount = 0;
+    for (let i = 0;i < parts.length; i++) {
+      const part = parts[i];
+      if (part === "")
+        return;
+      if (part.indexOf(".") !== -1) {
+        if (i !== parts.length - 1 || compression !== -1 && right.length === 0 || !isIPv4(part))
+          return;
+        hextetCount += 2;
+        continue;
       }
+      if (!isHextet(part))
+        return;
+      parts[i] = parseInt(part, 16).toString(16);
+      hextetCount++;
     }
-    output.address = address.join("");
-    return output;
+    if (compression === -1) {
+      if (hextetCount !== 8)
+        return;
+      return compressIPv6ZeroRun(parts);
+    }
+    if (hextetCount >= 8)
+      return;
+    const expanded = parts.slice(0, left.length);
+    for (let i = hextetCount;i < 8; i++)
+      expanded.push("0");
+    for (let i = left.length;i < parts.length; i++)
+      expanded.push(parts[i]);
+    return compressIPv6ZeroRun(expanded);
   }
   function normalizeIPv6(host) {
-    if (findToken(host, ":") < 2) {
-      return { host, isIPV6: false };
-    }
-    const ipv62 = getIPV6(host);
-    if (!ipv62.error) {
-      let newHost = ipv62.address;
-      let escapedHost = ipv62.address;
-      if (ipv62.zone) {
-        newHost += "%" + ipv62.zone;
-        escapedHost += "%25" + ipv62.zone;
-      }
-      return { host: newHost, isIPV6: true, escapedHost };
-    } else {
-      return { host, isIPV6: false };
-    }
+    const bracketed = host[0] === "[" && host[host.length - 1] === "]";
+    const hasBracket = host[0] === "[" || host[host.length - 1] === "]";
+    if (hasBracket && !bracketed)
+      return { host, isIPV6: false, error: true };
+    let input = bracketed ? host.slice(1, -1) : host;
+    if (bracketed && isIPvFuture(input)) {
+      input = input.toLowerCase();
+      return { host: `[${input}]`, escapedHost: input, isIPV6: false, isIPVFuture: true };
+    }
+    if (findToken(input, ":") < 2) {
+      return { host, isIPV6: false, error: bracketed };
+    }
+    let zoneIdentifier = "";
+    const zoneSeparator = input.indexOf("%");
+    if (zoneSeparator !== -1) {
+      const separatorLength = input.slice(zoneSeparator, zoneSeparator + 3).toLowerCase() === "%25" ? 3 : 1;
+      zoneIdentifier = input.slice(zoneSeparator + separatorLength);
+      if (!isZoneIdentifier(zoneIdentifier))
+        return { host, isIPV6: false, error: true };
+      input = input.slice(0, zoneSeparator);
+    }
+    const address = normalizeIPv6Address(input);
+    if (address === undefined)
+      return { host, isIPV6: false, error: true };
+    return {
+      host: address + (zoneIdentifier ? "%" + zoneIdentifier : ""),
+      escapedHost: address + (zoneIdentifier ? "%25" + zoneIdentifier : ""),
+      isIPV6: true
+    };
   }
   function findToken(str, token) {
     let ind = 0;
@@ -3283,7 +3333,8 @@ var require_utils = __commonJS((exports, module) => {
   function normalizePathEncoding(input) {
     let output = "";
     for (let i = 0;i < input.length; i++) {
-      if (input[i] === "%" && i + 2 < input.length) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
         const hex = input.slice(i + 1, i + 3);
         if (isHexPair(hex)) {
           const normalizedHex = hex.toUpperCase();
@@ -3297,10 +3348,152 @@ var require_utils = __commonJS((exports, module) => {
           continue;
         }
       }
-      if (isPathCharacter(input[i])) {
-        output += input[i];
+      if (isPathCharacter(ch)) {
+        output += ch;
+      } else {
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
+      }
+    }
+    return output;
+  }
+  function serializePathEncoding(input, pathNoScheme = false) {
+    let output = "";
+    let firstSegment = pathNoScheme && input[0] !== "/";
+    for (let i = 0;i < input.length; i++) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
+        const hex = input.slice(i + 1, i + 3);
+        if (isHexPair(hex)) {
+          output += "%" + hex.toUpperCase();
+          i += 2;
+          continue;
+        }
+      }
+      if (ch === "/") {
+        firstSegment = false;
+      }
+      if (isPathCharacter(ch) && (ch !== ":" || !firstSegment)) {
+        output += ch;
+      } else {
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
+      }
+    }
+    return output;
+  }
+  function encodeComponent(input, isAllowed) {
+    let output = "";
+    for (let i = 0;i < input.length; i++) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
+        const hex = input.slice(i + 1, i + 3);
+        if (isHexPair(hex)) {
+          output += "%" + hex.toUpperCase();
+          i += 2;
+          continue;
+        }
+      }
+      if (isAllowed(ch)) {
+        output += ch;
+      } else {
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
+      }
+    }
+    return output;
+  }
+  function encodeUserinfo(input) {
+    return encodeComponent(input, isUserinfoCharacter);
+  }
+  function encodeQuery(input) {
+    return encodeComponent(input, isQueryFragmentCharacter);
+  }
+  function encodeFragment(input) {
+    return encodeComponent(input, isQueryFragmentCharacter);
+  }
+  function isEscapeSafe(cp) {
+    return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
+  }
+  function normalizeQueryFragmentEncoding(input) {
+    let output = "";
+    for (let i = 0;i < input.length; i++) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
+        const hex = input.slice(i + 1, i + 3);
+        if (isHexPair(hex)) {
+          const normalizedHex = hex.toUpperCase();
+          const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+          if (isUnreserved(decoded)) {
+            output += decoded;
+          } else {
+            output += "%" + normalizedHex;
+          }
+          i += 2;
+          continue;
+        }
+      }
+      if (isQueryFragmentCharacter(ch)) {
+        output += ch;
       } else {
-        output += escape(input[i]);
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
       }
     }
     return output;
@@ -3323,14 +3516,18 @@ var require_utils = __commonJS((exports, module) => {
   function recomposeAuthority(component) {
     const uriTokens = [];
     if (component.userinfo !== undefined) {
-      uriTokens.push(component.userinfo);
+      uriTokens.push(encodeUserinfo(component.userinfo));
       uriTokens.push("@");
     }
     if (component.host !== undefined) {
-      let host = unescape(component.host);
+      let host = component.host;
       if (!isIPv4(host)) {
-        const ipV6res = normalizeIPv6(host);
-        if (ipV6res.isIPV6 === true) {
+        let ipV6res = normalizeIPv6(host);
+        if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
+          host = normalizePercentEncoding(host, true);
+          ipV6res = normalizeIPv6(host);
+        }
+        if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
           host = `[${ipV6res.escapedHost}]`;
         } else {
           host = reescapeHostDelimiters(host, false);
@@ -3339,8 +3536,12 @@ var require_utils = __commonJS((exports, module) => {
       uriTokens.push(host);
     }
     if (typeof component.port === "number" || typeof component.port === "string") {
+      const port = String(component.port);
+      if (!isPort(port)) {
+        throw new TypeError("URI port is malformed.");
+      }
       uriTokens.push(":");
-      uriTokens.push(String(component.port));
+      uriTokens.push(port);
     }
     return uriTokens.length ? uriTokens.join("") : undefined;
   }
@@ -3350,6 +3551,11 @@ var require_utils = __commonJS((exports, module) => {
     reescapeHostDelimiters,
     normalizePercentEncoding,
     normalizePathEncoding,
+    serializePathEncoding,
+    normalizeQueryFragmentEncoding,
+    encodeUserinfo,
+    encodeQuery,
+    encodeFragment,
     escapePreservingEscapes,
     removeDotSegments,
     isIPv4,
@@ -3359,10 +3565,10 @@ var require_utils = __commonJS((exports, module) => {
   };
 });
 
-// ../../node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS((exports, module) => {
   var { isUUID } = require_utils();
-  var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
+  var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
   var supportedSchemeNames = [
     "http",
     "https",
@@ -3417,9 +3623,10 @@ var require_schemes = __commonJS((exports, module) => {
       wsComponent.secure = undefined;
     }
     if (wsComponent.resourceName) {
-      const [path, query] = wsComponent.resourceName.split("?");
+      const queryIndex = wsComponent.resourceName.indexOf("?");
+      const path = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
       wsComponent.path = path && path !== "/" ? path : undefined;
-      wsComponent.query = query;
+      wsComponent.query = queryIndex === -1 ? undefined : wsComponent.resourceName.slice(queryIndex + 1);
       wsComponent.resourceName = undefined;
     }
     wsComponent.fragment = undefined;
@@ -3431,7 +3638,7 @@ var require_schemes = __commonJS((exports, module) => {
       return urnComponent;
     }
     const matches = urnComponent.path.match(URN_REG);
-    if (matches) {
+    if (matches && matches[0] === urnComponent.path) {
       const scheme = options.scheme || urnComponent.scheme || "urn";
       urnComponent.nid = matches[1].toLowerCase();
       urnComponent.nss = matches[2];
@@ -3533,10 +3740,19 @@ var require_schemes = __commonJS((exports, module) => {
   };
 });
 
-// ../../node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/index.js
+// ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS((exports, module) => {
-  var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+  var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
   var { SCHEMES, getSchemeHandler } = require_schemes();
+  var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
+  var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
+  function decodeValidScheme(scheme) {
+    const decodedScheme = unescape(String(scheme));
+    if (!VALID_SCHEME.test(decodedScheme)) {
+      throw new TypeError(MALFORMED_SCHEME_ERROR);
+    }
+    return decodedScheme;
+  }
   function normalize(uri, options) {
     if (typeof uri === "string") {
       uri = normalizeString(uri, options);
@@ -3547,12 +3763,34 @@ var require_fast_uri = __commonJS((exports, module) => {
   }
   function resolve(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-    const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
-    const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
-    if (baseMalformed || relativeMalformed) {
+    const {
+      parsed: baseParsed,
+      malformedAuthorityOrPort: baseMalformed,
+      malformedPercentEncoding: baseMalformedPercentEncoding,
+      malformedSchemeSpecific: baseMalformedSchemeSpecific,
+      malformedHost: baseMalformedHost,
+      malformedScheme: baseMalformedScheme
+    } = parseWithStatus(baseURI, schemelessOptions);
+    const {
+      parsed: relativeParsed,
+      malformedAuthorityOrPort: relativeMalformed,
+      malformedPercentEncoding: relativeMalformedPercentEncoding,
+      malformedSchemeSpecific: relativeMalformedSchemeSpecific,
+      malformedHost: relativeMalformedHost,
+      malformedScheme: relativeMalformedScheme
+    } = parseWithStatus(relativeURI, schemelessOptions);
+    if (baseMalformed || relativeMalformed || baseMalformedPercentEncoding || relativeMalformedPercentEncoding || baseMalformedSchemeSpecific || relativeMalformedSchemeSpecific || baseMalformedHost || relativeMalformedHost || baseMalformedScheme || relativeMalformedScheme) {
       throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
     }
     const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
+    const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
+    const resolvedHost = resolved.host;
+    const resolvedHostIsIP = resolvedHost !== undefined && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+    canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
+    const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !/\P{ASCII}/u.test(resolvedHost);
+    if (resolved.error && !encodedASCIIHost) {
+      throw new Error(resolved.error);
+    }
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
@@ -3612,7 +3850,7 @@ var require_fast_uri = __commonJS((exports, module) => {
   function equal(uriA, uriB, options) {
     const normalizedA = normalizeComparableURI(uriA, options);
     const normalizedB = normalizeComparableURI(uriB, options);
-    return normalizedA !== undefined && normalizedB !== undefined && normalizedA.toLowerCase() === normalizedB.toLowerCase();
+    return normalizedA !== undefined && normalizedB !== undefined && normalizedA === normalizedB;
   }
   function serialize(cmpts, opts) {
     const component = {
@@ -3633,20 +3871,23 @@ var require_fast_uri = __commonJS((exports, module) => {
     };
     const options = Object.assign({}, opts);
     const uriTokens = [];
+    if (component.scheme) {
+      component.scheme = decodeValidScheme(component.scheme);
+    }
     const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
     if (schemeHandler && schemeHandler.serialize)
       schemeHandler.serialize(component, options);
+    const hasAuthority = component.userinfo !== undefined || component.host !== undefined || component.port !== undefined;
+    const pathNoScheme = !options.skipEscape && component.scheme === undefined && !hasAuthority;
     if (component.path !== undefined) {
       if (!options.skipEscape) {
-        component.path = escapePreservingEscapes(component.path);
-        if (component.scheme !== undefined) {
-          component.path = component.path.split("%3A").join(":");
-        }
+        component.path = serializePathEncoding(component.path, pathNoScheme);
       } else {
         component.path = normalizePercentEncoding(component.path);
       }
     }
     if (options.reference !== "suffix" && component.scheme) {
+      component.scheme = decodeValidScheme(component.scheme);
       uriTokens.push(component.scheme, ":");
     }
     const authority = recomposeAuthority(component);
@@ -3664,16 +3905,19 @@ var require_fast_uri = __commonJS((exports, module) => {
       if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
         s = removeDotSegments(s);
       }
+      if (pathNoScheme) {
+        s = serializePathEncoding(s, true);
+      }
       if (authority === undefined && s[0] === "/" && s[1] === "/") {
         s = "/%2F" + s.slice(2);
       }
       uriTokens.push(s);
     }
     if (component.query !== undefined) {
-      uriTokens.push("?", component.query);
+      uriTokens.push("?", encodeQuery(component.query));
     }
     if (component.fragment !== undefined) {
-      uriTokens.push("#", component.fragment);
+      uriTokens.push("#", encodeFragment(component.fragment));
     }
     return uriTokens.join("");
   }
@@ -3689,6 +3933,36 @@ var require_fast_uri = __commonJS((exports, module) => {
     }
     return;
   }
+  function hasMalformedPercentEncoding(component) {
+    if (component === undefined)
+      return false;
+    let percent = component.indexOf("%");
+    while (percent !== -1) {
+      if (percent + 2 >= component.length || !/^[\da-f]{2}$/iu.test(component.slice(percent + 1, percent + 3))) {
+        return true;
+      }
+      percent = component.indexOf("%", percent + 3);
+    }
+    return false;
+  }
+  function isIPLiteral(host) {
+    return host[0] === "[" && host[host.length - 1] === "]";
+  }
+  function hasMalformedComponentPercentEncoding(matches) {
+    const host = matches[4];
+    return hasMalformedPercentEncoding(matches[3]) || host !== undefined && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+  }
+  function canonicalizeHost(parsed, options, schemeHandler, isIP) {
+    if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+      try {
+        parsed.host = new URL("http://" + parsed.host).hostname;
+      } catch (e) {
+        parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+        return true;
+      }
+    }
+    return false;
+  }
   function parseWithStatus(uri, opts) {
     const options = Object.assign({}, opts);
     const parsed = {
@@ -3701,6 +3975,11 @@ var require_fast_uri = __commonJS((exports, module) => {
       fragment: undefined
     };
     let malformedAuthorityOrPort = false;
+    let malformedPercentEncoding = false;
+    let malformedSchemeSpecific = false;
+    let malformedHost = false;
+    let malformedIPLiteral = false;
+    let malformedScheme = false;
     let isIP = false;
     if (options.reference === "suffix") {
       if (options.scheme) {
@@ -3737,6 +4016,19 @@ var require_fast_uri = __commonJS((exports, module) => {
       parsed.path = matches[6] || "";
       parsed.query = matches[7];
       parsed.fragment = matches[8];
+      if (parsed.scheme !== undefined) {
+        const decodedScheme = unescape(parsed.scheme);
+        if (VALID_SCHEME.test(decodedScheme)) {
+          parsed.scheme = decodedScheme.toLowerCase();
+        } else {
+          parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
+          malformedScheme = true;
+        }
+      }
+      malformedPercentEncoding = hasMalformedComponentPercentEncoding(matches);
+      if (malformedPercentEncoding) {
+        parsed.error = parsed.error || "URI contains malformed percent-encoding.";
+      }
       if (isNaN(parsed.port)) {
         parsed.port = matches[5];
       }
@@ -3748,9 +4040,16 @@ var require_fast_uri = __commonJS((exports, module) => {
       if (parsed.host) {
         const ipv4result = isIPv4(parsed.host);
         if (ipv4result === false) {
+          const bracketedIPLiteral = isIPLiteral(parsed.host);
+          const hasIPLiteralBracket = parsed.host.indexOf("[") !== -1 || parsed.host.indexOf("]") !== -1;
           const ipv6result = normalizeIPv6(parsed.host);
-          parsed.host = ipv6result.host.toLowerCase();
-          isIP = ipv6result.isIPV6;
+          isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
+          malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
+          parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
+          if (malformedIPLiteral) {
+            parsed.error = parsed.error || "URI host is malformed.";
+            malformedAuthorityOrPort = true;
+          }
         } else {
           isIP = true;
         }
@@ -3768,42 +4067,36 @@ var require_fast_uri = __commonJS((exports, module) => {
         parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
       }
       const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
-      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-        if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
-          try {
-            parsed.host = new URL("http://" + parsed.host).hostname;
-          } catch (e) {
-            parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
-          }
-        }
+      if (!malformedIPLiteral) {
+        malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
       }
       if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
         if (uri.indexOf("%") !== -1) {
-          if (parsed.scheme !== undefined) {
-            parsed.scheme = unescape(parsed.scheme);
-          }
-          if (parsed.host !== undefined) {
-            parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
+          if (parsed.host !== undefined && !malformedIPLiteral) {
+            const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+            parsed.host = reescapeHostDelimiters(host, isIP);
           }
         }
         if (parsed.path) {
           parsed.path = normalizePathEncoding(parsed.path);
         }
+        if (parsed.query) {
+          parsed.query = normalizeQueryFragmentEncoding(parsed.query);
+        }
         if (parsed.fragment) {
-          try {
-            parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
-          } catch {
-            parsed.error = parsed.error || "URI malformed";
-          }
+          parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
         }
       }
       if (schemeHandler && schemeHandler.parse) {
         schemeHandler.parse(parsed, options);
+        if (schemeHandler === SCHEMES.urn && parsed.nid === undefined) {
+          malformedSchemeSpecific = true;
+        }
       }
     } else {
       parsed.error = parsed.error || "URI can not be parsed.";
     }
-    return { parsed, malformedAuthorityOrPort };
+    return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
   }
   function parse6(uri, opts) {
     return parseWithStatus(uri, opts).parsed;
@@ -3812,20 +4105,28 @@ var require_fast_uri = __commonJS((exports, module) => {
     return normalizeStringWithStatus(uri, opts).normalized;
   }
   function normalizeStringWithStatus(uri, opts) {
-    const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+    const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
     return {
-      normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
-      malformedAuthorityOrPort
+      normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
+      malformedAuthorityOrPort,
+      malformedPercentEncoding,
+      malformedSchemeSpecific,
+      malformedHost,
+      malformedScheme
     };
   }
   function normalizeComparableURI(uri, opts) {
-    if (typeof uri === "string") {
-      const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
-      return malformedAuthorityOrPort ? undefined : normalized;
+    if (typeof uri !== "string" && typeof uri !== "object") {
+      return;
     }
-    if (typeof uri === "object") {
-      return serialize(uri, opts);
+    let value;
+    try {
+      value = typeof uri === "string" ? uri : serialize(uri, opts);
+    } catch {
+      return;
     }
+    const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
+    return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? undefined : normalized;
   }
   var fastUri = {
     SCHEMES,
@@ -6631,451 +6932,855 @@ var require_dist = __commonJS((exports, module) => {
   exports.default = formatsPlugin;
 });
 
-// src/lib/retired-settings.ts
-function isRetiredModeEnvVar(name, app) {
-  const upper = name.toUpperCase();
-  if (!upper.includes(app.toUpperCase()))
-    return false;
-  return RETIRED_ENV_SUFFIXES.some((suffix) => upper.endsWith(suffix));
+// src/lib/remote-run-contract.ts
+function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
+  const record3 = isRecord3(payload) ? payload : {};
+  return {
+    contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
+    ...pickString(record3, "id"),
+    skill: pickStringValue(record3, "skill") ?? fallbackSkill,
+    ...pickString(record3, "requestedSlug"),
+    ...pickString(record3, "status"),
+    ...pickNumber(record3, "exitCode"),
+    ...pickString(record3, "correlationId"),
+    ...pickString(record3, "createdAt"),
+    ...pickString(record3, "startedAt"),
+    ...pickString(record3, "completedAt"),
+    ...pickNumber(record3, "durationMs"),
+    ...pickString(record3, "outputType"),
+    ...hasOwn(record3, "outputPreview") ? { outputPreview: record3.outputPreview } : {},
+    ...pickString(record3, "errorCode"),
+    ...pickString(record3, "errorMessage"),
+    ...pickString(record3, "error"),
+    ...pickString(record3, "code"),
+    ...hasOwn(record3, "details") ? { details: record3.details } : {}
+  };
 }
-function findRetiredModeEnvVars(env, app) {
-  const found = [];
-  for (const [name, value] of Object.entries(env)) {
-    if (value === undefined || value === "")
-      continue;
-    if (isRetiredModeEnvVar(name, app))
-      found.push({ name, value });
-  }
-  return found.sort((a, b) => a.name.localeCompare(b.name));
+function isRecord3(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function assertNoRetiredModeEnvVars(env, options) {
-  const found = findRetiredModeEnvVars(env, options.app);
-  if (found.length === 0)
-    return;
-  const names = found.map((entry) => entry.name);
-  throw new RetiredSettingError(names[0], `${names.join(", ")} ${names.length === 1 ? "is" : "are"} no longer read. ` + "Deployment modes were removed: where a server keeps its data is decided by the " + `database it is given, not by a declared label. Set ${options.replacement} to a ` + "postgres:// URL to use PostgreSQL, or leave it unset for the on-box SQLite database. " + `Then unset ${names.join(" and ")}. ` + "Refused rather than ignored, because a discarded setting looks exactly like a " + "working one until something needs the data.");
+function hasOwn(record3, key) {
+  return Object.prototype.hasOwnProperty.call(record3, key);
 }
-function assertNoRetiredConfigKeys(config2, source) {
-  for (const [key, replacement] of Object.entries(RETIRED_CONFIG_KEYS)) {
-    if (!(key in config2))
-      continue;
-    throw new RetiredSettingError(key, `${source}: "${key}" is no longer a configuration key. ` + "Deployment modes were removed: a Skills client either has an API origin " + "configured or it does not, and that is the whole of it. " + `Use "${replacement}" instead (skills config set ${replacement} <origin>), and ` + `remove the old key with: skills config unset ${key}. ` + "Refused rather than ignored, because silently dropping it would leave an " + "operator believing they had pointed this install at a server.");
-  }
+function pickString(record3, key) {
+  const value = pickStringValue(record3, key);
+  return value === undefined ? {} : { [key]: value };
 }
-var RETIRED_ENV_SUFFIXES, RETIRED_CONFIG_KEYS, RetiredSettingError;
-var init_retired_settings = __esm(() => {
-  RETIRED_ENV_SUFFIXES = ["_STORAGE_MODE", "_DEPLOYMENT_MODE", "_CLOUD_MODE"];
-  RETIRED_CONFIG_KEYS = {
-    mode: "apiUrl"
-  };
-  RetiredSettingError = class RetiredSettingError extends Error {
-    code = "RETIRED_SETTING";
-    setting;
-    constructor(setting, message) {
-      super(message);
-      this.name = "RetiredSettingError";
-      this.setting = setting;
-    }
-  };
-});
+function pickStringValue(record3, key) {
+  const value = record3[key];
+  return typeof value === "string" ? value : undefined;
+}
+function pickNumber(record3, key) {
+  const value = record3[key];
+  return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
+}
+var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
 
-// src/lib/app-home.ts
-import { existsSync } from "fs";
-import { homedir } from "os";
-import { join, resolve } from "path";
-import { homedir as pathsResolverHomedir } from "os";
-import { join as pathsResolverJoin } from "path";
-function pathsResolverAssertApp(app) {
-  if (typeof app !== "string" || app.length === 0) {
-    throw new TypeError("paths: app must be a non-empty string");
-  }
-  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
-    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
-  }
+// ../contracts/dist/client/transport.js
+import { isIP } from "net";
+import { spawnSync } from "child_process";
+import { closeSync, fstatSync, openSync, readFileSync as readFileSync11 } from "fs";
+import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
+import { createRequire } from "module";
+import { hostname as osHostname } from "os";
+import { isAbsolute as isAbsolute3, join as join13 } from "path";
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function clientTransportEnvKeys(name) {
+  const envSegment = envToken(name);
+  return {
+    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
+    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
+  };
 }
-function pathsResolverAssertKind(kind) {
-  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
-    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
-  }
+function credentialOverrideEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
 }
-function pathsResolverBaseDir(kind, options) {
-  pathsResolverAssertKind(kind);
-  const env = options.env ?? process.env;
-  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
-  if (typeof override === "string" && override.length > 0)
+function credentialPointerEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_REF`;
+}
+function homeDir(env) {
+  const home = env.HOME?.trim();
+  return home ? home : null;
+}
+function absoluteOverride(env, key) {
+  const value = env[key]?.trim();
+  return value && isAbsolute3(value) ? value : null;
+}
+function hasnaHomeDir(env) {
+  const override = absoluteOverride(env, HASNA_HOME_ENV_KEY);
+  if (override)
     return override;
-  const home = options.home ?? pathsResolverHomedir();
-  const platform = options.platform ?? process.platform;
-  if (platform === "darwin") {
-    switch (kind) {
-      case "config":
-      case "data":
-        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
-      case "cache":
-        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
-      case "state":
-        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
-    }
-  }
-  switch (kind) {
-    case "config":
-      return pathsResolverJoin(home, ".config", "hasna");
-    case "data":
-      return pathsResolverJoin(home, ".local", "share", "hasna");
-    case "state":
-      return pathsResolverJoin(home, ".local", "state", "hasna");
-    case "cache":
-      return pathsResolverJoin(home, ".cache", "hasna");
-  }
+  const home = homeDir(env);
+  return home ? join13(home, HASNA_HOME_DIR) : null;
+}
+function appConfigDir(name, env) {
+  const configRoot = absoluteOverride(env, HASNA_CONFIG_HOME_ENV_KEY);
+  if (configRoot)
+    return join13(configRoot, name);
+  const root = hasnaHomeDir(env);
+  return root ? join13(root, name, CONFIG_SUBDIR) : null;
+}
+function credentialDiskSourceList(name, env, profile = null) {
+  if (!SAFE_APP_SLUG.test(name))
+    return [];
+  const directory = appConfigDir(name, env);
+  if (!directory)
+    return [];
+  const file = profile ? `${CREDENTIALS_FILE}-${profile}` : CREDENTIALS_FILE;
+  return [{ path: join13(directory, file), tier: "disk" }];
 }
-function pathsResolverResolve(kind, options) {
-  pathsResolverAssertApp(options.app);
-  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
-  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+function credentialDiskSources(name, env) {
+  return credentialDiskSourceList(name, env, null).map((s) => s.path);
 }
-function dataDir(options) {
-  return pathsResolverResolve("data", options);
+function profileDiskSources(name, env, profile) {
+  return credentialDiskSourceList(name, env, profile).map((s) => s.path);
 }
-function effectiveHome() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || homedir() || "/tmp";
+function parseEnvFile(text) {
+  const values = new Map;
+  const unusable = new Set;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#"))
+      continue;
+    const withoutExport = line.startsWith("export ") ? line.slice("export ".length).trim() : line;
+    const equals = withoutExport.indexOf("=");
+    if (equals <= 0)
+      continue;
+    const key = withoutExport.slice(0, equals).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+      continue;
+    let value = withoutExport.slice(equals + 1).trim();
+    const quote = value[0];
+    if (quote === '"' || quote === "'") {
+      if (value.length < 2 || !value.endsWith(quote)) {
+        unusable.add(key);
+        continue;
+      }
+      value = value.slice(1, -1);
+    }
+    if (value.trim().length === 0) {
+      unusable.add(key);
+      continue;
+    }
+    if (values.has(key) && values.get(key) !== value)
+      unusable.add(key);
+    values.set(key, value);
+  }
+  return { values, unusable };
 }
-function legacyDataRoot() {
-  return join(effectiveHome(), ".hasna", "skills");
+function configFileModeAllowed(mode) {
+  const permissions = mode & 4095;
+  return permissions === 256 || permissions === 384;
 }
-function resolverDataRoot(home = effectiveHome(), env) {
-  return dataDir({ app: "skills", home, env });
+function configFileReadsCoherent(before, after) {
+  return before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs;
 }
-function adoptResolverDataRoot(resolved, env = process.env) {
-  const dataOverride = env.HASNA_DATA_HOME;
-  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
-    return true;
-  return existsSync(join(resolved, DEFAULT_SQLITE_FILENAME)) || existsSync(join(resolved, GLOBAL_CONFIG_FILENAME));
+function readAppConfigFile(path) {
+  const unsafe = (reason) => {
+    throw new CredentialFileUnsafeError(path, reason);
+  };
+  let fd = -1;
+  try {
+    fd = openSync(path, O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  } catch (error2) {
+    const code = error2.code;
+    if (code === "ENOENT" || code === "ENOTDIR")
+      return null;
+    if (code === "ELOOP")
+      unsafe("the path is a symlink");
+    unsafe(`the path could not be opened (${code ?? "unknown error"})`);
+  }
+  try {
+    const before = fstatSync(fd);
+    if (!before.isFile())
+      unsafe("the path is not a regular file");
+    if (!configFileModeAllowed(before.mode)) {
+      unsafe(`permission mode ${(before.mode & 4095).toString(8).padStart(4, "0")} is not owner-only 0400 or 0600`);
+    }
+    const uid = process.getuid?.() ?? process.geteuid?.();
+    if (uid !== undefined && before.uid !== uid)
+      unsafe("the file is not owned by the current user");
+    if (before.size > MAX_CREDENTIAL_FILE_BYTES)
+      unsafe("the file exceeds the size limit");
+    const bytes = readFileSync11(fd);
+    const after = fstatSync(fd);
+    if (!configFileReadsCoherent(before, after)) {
+      unsafe("the file changed while being read");
+    }
+    return parseEnvFile(bytes.toString("utf8"));
+  } finally {
+    if (fd !== -1)
+      closeSync(fd);
+  }
 }
-function exactDataRoot() {
-  for (const key of [DATA_DIR_ENV, HASNA_SKILLS_HOME_ENV, SKILLS_HOME_ENV]) {
-    const dir = process.env[key]?.trim();
-    if (dir)
-      return resolve(dir);
+function readCredentialFile(path, apiKeyKeys) {
+  const parsed = readAppConfigFile(path);
+  if (!parsed)
+    return null;
+  for (const key of apiKeyKeys) {
+    if (parsed.unusable.has(key)) {
+      throw new CredentialFileUnsafeError(path, `${key} is declared but blank or malformed`);
+    }
   }
-  return;
+  const values = apiKeyKeys.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+  if (new Set(values).size > 1) {
+    throw new CredentialFileUnsafeError(path, "credential aliases disagree");
+  }
+  return values[0] ?? null;
 }
-function hasExactOverride(env = process.env) {
-  return Boolean(env[DATA_DIR_ENV]?.trim()) || Boolean(env[HASNA_SKILLS_HOME_ENV]?.trim()) || Boolean(env[SKILLS_HOME_ENV]?.trim());
+function appConfigDiskValue(name, env, keys) {
+  const wanted = keys.filter((key) => !CREDENTIAL_SHAPED_KEY.test(key));
+  if (wanted.length === 0)
+    return null;
+  for (const path of credentialDiskSources(name, env)) {
+    const parsed = readAppConfigFile(path);
+    if (!parsed)
+      continue;
+    if (wanted.some((key) => parsed.unusable.has(key))) {
+      return { key: wanted.find((key) => parsed.unusable.has(key)), value: "", path, unusable: true };
+    }
+    const values = wanted.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+    if (new Set(values).size > 1)
+      throw new CredentialFileUnsafeError(path, "configuration aliases disagree");
+    for (const key of wanted) {
+      if (parsed.unusable.has(key))
+        return { key, value: "", path, unusable: true };
+      const value = parsed.values.get(key)?.trim();
+      if (value)
+        return { key, value, path };
+    }
+  }
+  return null;
 }
-function hasOperatorOverride(env = process.env) {
-  return hasExactOverride(env) || Boolean(env.HASNA_DATA_HOME?.trim());
+function assertUsableCredential(appName, source, value) {
+  if (VAULT_POINTER_SHAPE.test(value)) {
+    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+  }
+  if (!ILLEGAL_IN_HEADER_VALUE.test(value))
+    return;
+  throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
+}
+function sealCredential(fields) {
+  const { apiKey } = fields;
+  const visible = {
+    tier: fields.tier,
+    source: fields.source,
+    deliberate: fields.deliberate,
+    diskCandidates: Object.freeze([...fields.diskCandidates]),
+    warning: fields.warning
+  };
+  const sealed = { ...visible };
+  Object.defineProperty(sealed, "apiKey", {
+    value: apiKey,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  if (fields.pointerVaultKey !== undefined) {
+    Object.defineProperty(sealed, "pointerVaultKey", {
+      value: fields.pointerVaultKey,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  Object.defineProperty(sealed, INSPECT_CUSTOM, {
+    value: () => ({ ...visible, apiKey: "[redacted]" }),
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(sealed, CREDENTIAL_SEAL, {
+    value: true,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  return Object.freeze(sealed);
 }
-function getDataRoot() {
-  const exact = exactDataRoot();
-  if (exact)
-    return exact;
-  const resolved = resolverDataRoot();
-  return adoptResolverDataRoot(resolved) ? resolve(resolved) : resolve(legacyDataRoot());
+function firstEnvValue(env, keys) {
+  for (const key of keys) {
+    if (!Object.prototype.hasOwnProperty.call(env, key))
+      continue;
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
 }
-var PATHS_RESOLVER_KIND_ENV, PATHS_RESOLVER_APP_SLUG_RE, DATA_DIR_ENV = "HASNA_SKILLS_DIR", HASNA_SKILLS_HOME_ENV = "HASNA_SKILLS_HOME", SKILLS_HOME_ENV = "SKILLS_HOME", DEFAULT_SQLITE_FILENAME = "server.db", GLOBAL_CONFIG_FILENAME = "config.json";
-var init_app_home = __esm(() => {
-  PATHS_RESOLVER_KIND_ENV = {
-    config: "HASNA_CONFIG_HOME",
-    data: "HASNA_DATA_HOME",
-    state: "HASNA_STATE_HOME",
-    cache: "HASNA_CACHE_HOME"
-  };
-  PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-});
-
-// src/lib/config.ts
-import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
-import { join as join2, dirname } from "path";
-import { homedir as homedir2 } from "os";
-function validKeys() {
-  return [...Object.keys(ENUM_KEYS), ...STRING_KEYS];
+function isAmbientEnvironment(env) {
+  return env === process.env || env[AMBIENT_ENVIRONMENT] === true;
 }
-function allowedValues(key) {
-  return ENUM_KEYS[key];
+function defaultKeychainRunner(argv) {
+  const result = spawnSync(KEYCHAIN_SECURITY_BIN, [...argv], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: KEYCHAIN_SPAWN_TIMEOUT_MS
+  });
+  return {
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.error ? result.error.message : result.stderr ?? ""
+  };
 }
-function mergeDirectoryContents(sourceDir, targetDir) {
-  if (!existsSync2(sourceDir))
-    return;
-  mkdirSync(targetDir, { recursive: true });
-  for (const entry of readdirSync(sourceDir)) {
-    const sourcePath = join2(sourceDir, entry);
-    const targetPath = join2(targetDir, entry);
-    try {
-      const sourceStat = statSync(sourcePath);
-      if (sourceStat.isDirectory()) {
-        mergeDirectoryContents(sourcePath, targetPath);
-        continue;
-      }
-      if (!existsSync2(targetPath))
-        copyFileSync(sourcePath, targetPath);
-    } catch {}
+function keychainTierEnabled(env, options) {
+  if ((options.platform ?? process.platform) !== "darwin")
+    return false;
+  if (options.enabled !== undefined)
+    return options.enabled;
+  return options.run !== undefined || isAmbientEnvironment(env);
+}
+function keychainAccount(env, options) {
+  const station = env[KEYCHAIN_STATION_ENV_KEY]?.trim();
+  if (station)
+    return station;
+  const host = (options.hostname ?? osHostname)().split(".")[0]?.trim() ?? "";
+  if (host)
+    return host;
+  const user = env.USER?.trim();
+  return user || null;
+}
+function keychainFailureHint(text) {
+  const line = text.split(/\r?\n/).find((entry) => entry.trim().length > 0)?.trim() ?? "";
+  const clean = line.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 200);
+  return clean ? `: ${clean}` : "";
+}
+function readKeychainItem(name, env, kind, options) {
+  if (!SAFE_APP_SLUG.test(name) || !keychainTierEnabled(env, options))
+    return null;
+  const account = keychainAccount(env, options);
+  if (!account)
+    return null;
+  const service = `${KEYCHAIN_SERVICE_PREFIX}.${name}.${kind}`;
+  const source = `keychain:${service}@${account}`;
+  const run = options.run ?? defaultKeychainRunner;
+  let result;
+  try {
+    result = run(["find-generic-password", "-a", account, "-s", service, "-w"]);
+  } catch (error2) {
+    const reason = keychainFailureHint(error2 instanceof Error ? error2.message : String(error2));
+    throw new CredentialResolutionError(name, `The Keychain lookup for ${source} could not run${reason}. A Keychain failure is never resolved ` + `around: fix the keychain, or delete the item to fall through to the credential on disk.`, [source]);
   }
-}
-function normalizeConfigValue(key, value) {
-  if (typeof value !== "string")
-    return;
-  const allowed = allowedValues(key);
-  if (allowed)
-    return allowed.includes(value) ? value : undefined;
-  if (key === "apiUrl") {
-    try {
-      const url = new URL(value);
-      if (url.protocol !== "http:" && url.protocol !== "https:")
-        return;
-      return value.replace(/\/+$/, "");
-    } catch {
-      return;
+  if (result.status === KEYCHAIN_ITEM_NOT_FOUND_STATUS)
+    return null;
+  if (result.status !== 0) {
+    throw new CredentialResolutionError(name, `The Keychain lookup for ${source} failed (security exited ` + `${result.status ?? "without a status"}${keychainFailureHint(result.stderr)}). A Keychain item that ` + `exists but cannot be read is never resolved around: unlock the keychain, run from a session that ` + `may use it, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  const value = result.stdout.trim();
+  if (!value) {
+    throw new CredentialResolutionError(name, `${source} exists but holds an empty value; a declared item never falls through to another ` + `identity. Store a value in it or delete the item.`, [source]);
+  }
+  return { value, source };
+}
+function keychainConfigValue(name, env, options = {}) {
+  return readKeychainItem(name, env, "api-url", options);
+}
+function snapshotClientEnvironment(name, env) {
+  const keys = clientTransportEnvKeys(name);
+  const ambient = isAmbientEnvironment(env);
+  const snapshot = Object.create(null);
+  for (const key of [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey(name),
+    credentialPointerEnvKey(name),
+    CREDENTIAL_PROFILE_ENV_KEY,
+    "HOME",
+    HASNA_HOME_ENV_KEY,
+    HASNA_CONFIG_HOME_ENV_KEY,
+    KEYCHAIN_STATION_ENV_KEY,
+    "USER"
+  ]) {
+    const descriptor = Object.getOwnPropertyDescriptor(env, key);
+    if (!descriptor)
+      continue;
+    if (!("value" in descriptor)) {
+      throw new CredentialResolutionError(name, `${key} is accessor-backed; client configuration requires own data properties.`, [key]);
+    }
+    if (descriptor.value !== undefined && typeof descriptor.value !== "string") {
+      throw new CredentialResolutionError(name, `${key} must be a string data property.`, [key]);
     }
+    snapshot[key] = descriptor.value;
   }
-  if (key === "extensionsDir")
-    return value.trim() ? value : undefined;
-  return;
-}
-function isOwnerLayoutMigrated(appDir) {
-  return existsSync2(join2(appDir, SKILLS_CACHE_DIRNAME, LAYOUT_MIGRATION_RECORD));
+  if (ambient) {
+    Object.defineProperty(snapshot, AMBIENT_ENVIRONMENT, {
+      value: true,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  return Object.freeze(snapshot);
+}
+function resolveCredential(name, env, options = {}) {
+  env = snapshotClientEnvironment(name, env);
+  const { apiKeyKeys } = clientTransportEnvKeys(name);
+  const diskPaths = credentialDiskSources(name, env);
+  if (options.apiKey !== undefined) {
+    const explicitKey = options.apiKey.trim();
+    if (!explicitKey) {
+      throw new CredentialResolutionError(name, "The explicit apiKey argument is blank; an explicit credential never falls through to another identity.", ["explicit apiKey argument"]);
+    }
+    assertUsableCredential(name, "the explicit apiKey argument", explicitKey);
+    return sealCredential({
+      apiKey: explicitKey,
+      tier: "argument",
+      source: "explicit apiKey argument",
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const overrideKeyName = credentialOverrideEnvKey(name);
+  const overrideRaw = Object.prototype.hasOwnProperty.call(env, overrideKeyName) ? env[overrideKeyName] : undefined;
+  if (overrideRaw !== undefined) {
+    const override = overrideRaw.trim();
+    if (!override) {
+      throw new CredentialResolutionError(name, `${overrideKeyName} is set but empty. It is a deliberate override, so it is not resolved around: ` + `either give it a real key or unset it to fall back to the credential on disk.`, [overrideKeyName]);
+    }
+    assertUsableCredential(name, overrideKeyName, override);
+    return sealCredential({
+      apiKey: override,
+      tier: "override",
+      source: overrideKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const pointerKeyName = credentialPointerEnvKey(name);
+  const pointerRaw = Object.prototype.hasOwnProperty.call(env, pointerKeyName) ? env[pointerKeyName] : undefined;
+  if (pointerRaw !== undefined) {
+    const pointer = pointerRaw.trim();
+    if (!pointer) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
+    }
+    if (!VAULT_POINTER_SHAPE.test(pointer)) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
+    }
+    return sealCredential({
+      apiKey: "",
+      pointerVaultKey: pointer,
+      tier: "pointer",
+      source: pointerKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  if (options.profile !== undefined && !options.profile.trim()) {
+    throw new CredentialResolutionError(name, "The explicit profile argument is blank; an explicit identity selection never falls through.", ["explicit profile argument"]);
+  }
+  const profileRaw = Object.prototype.hasOwnProperty.call(env, CREDENTIAL_PROFILE_ENV_KEY) ? env[CREDENTIAL_PROFILE_ENV_KEY] : undefined;
+  if (profileRaw !== undefined && !profileRaw.trim()) {
+    throw new CredentialResolutionError(name, `${CREDENTIAL_PROFILE_ENV_KEY} is set but blank.`, [CREDENTIAL_PROFILE_ENV_KEY]);
+  }
+  const profile = options.profile?.trim() || profileRaw?.trim();
+  if (profile) {
+    const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
+    if (!SAFE_PROFILE.test(profile)) {
+      throw new CredentialResolutionError(name, `Profile name from ${profileSource} is not usable in a path. ` + `Use letters, digits, dot, dash, or underscore.`, [profileSource]);
+    }
+    const paths = profileDiskSources(name, env, profile);
+    for (const path of paths) {
+      const value = readCredentialFile(path, apiKeyKeys);
+      if (value) {
+        assertUsableCredential(name, path, value);
+        return sealCredential({
+          apiKey: value,
+          tier: "profile",
+          source: path,
+          deliberate: true,
+          diskCandidates: paths,
+          warning: null
+        });
+      }
+    }
+    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
+  }
+  const definedEnvEntries = apiKeyKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, value: String(env[key]).trim() }));
+  const blankEnv = definedEnvEntries.find((entry) => entry.value.length === 0);
+  if (blankEnv) {
+    throw new CredentialResolutionError(name, `${blankEnv.key} is set but blank; a declared credential never falls through to another alias or identity.`, [blankEnv.key]);
+  }
+  if (definedEnvEntries.length > 1 && new Set(definedEnvEntries.map((entry) => entry.value)).size > 1) {
+    throw new CredentialResolutionError(name, `${definedEnvEntries.map((entry) => entry.key).join(" and ")} disagree; credential aliases must be identical or only one may be set.`, definedEnvEntries.map((entry) => entry.key));
+  }
+  const envHit = firstEnvValue(env, apiKeyKeys);
+  const keychainHit = readKeychainItem(name, env, "api-key", options.keychain ?? {});
+  if (keychainHit) {
+    assertUsableCredential(name, keychainHit.source, keychainHit.value);
+    const warning = envHit && envHit.value !== keychainHit.value ? `Credential sources disagree for '${name}': ${keychainHit.source} and ${envHit.key} hold ` + `different keys. ${keychainHit.source} wins, because the Keychain is re-read on every call while ` + `an environment variable is a snapshot. Reconcile them \u2014 a rotation that updated only one leaves ` + `the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: keychainHit.value,
+      tier: "keychain",
+      source: keychainHit.source,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  const diskSourceList = credentialDiskSourceList(name, env, null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  if (diskHits.length > 0) {
+    const winner = diskHits[0];
+    assertUsableCredential(name, winner.src.path, winner.value);
+    const divergentSources = [
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
+      ...envHit && envHit.value !== winner.value ? [envHit.key] : []
+    ];
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: winner.value,
+      tier: winner.src.tier,
+      source: winner.src.path,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  if (envHit) {
+    assertUsableCredential(name, envHit.key, envHit.value);
+    return sealCredential({
+      apiKey: envHit.value,
+      tier: "env",
+      source: envHit.key,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  return null;
 }
-function getDataDir() {
-  const root = getDataRoot();
+async function completePointerCredential(name, pointerResolution, env = process.env) {
+  const vaultKey = pointerResolution.pointerVaultKey;
+  const pointerEnvKey = pointerResolution.source;
+  if (!vaultKey) {
+    throw new CredentialResolutionError(name, `Pointer resolution from ${pointerEnvKey} carries no vault item key; this is a defect in the resolver.`, [pointerEnvKey]);
+  }
+  let secretsSdk;
   try {
-    mkdirSync(root, { recursive: true });
-  } catch {}
-  if (hasOperatorOverride())
-    return root;
-  const home = effectiveHome();
-  const oldDir = join2(home, ".skills");
-  const oldConfigFile = join2(home, ".skillsrc");
+    secretsSdk = requireSecretsSdk(SECRETS_PACKAGE_SPECIFIER);
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
+  }
+  let client;
   try {
-    mergeDirectoryContents(oldDir, root);
-  } catch {}
-  if (existsSync2(oldConfigFile) && !existsSync2(join2(root, "config.json"))) {
-    try {
-      copyFileSync(oldConfigFile, join2(root, "config.json"));
-    } catch {}
+    client = secretsSdk.createSecretsClientFromEnv(env);
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets client could not be configured from this ` + `environment (the secrets service URL and key env are missing or invalid). A vault pointer is TERMINAL and ` + `never falls through to a literal or disk credential.`, [pointerEnvKey]);
   }
-  return root;
+  let secret;
+  try {
+    secret = await client.getSecret({ key: vaultKey });
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the vault could not be reached or the item is ` + `unavailable. A vault pointer is TERMINAL and never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  const value = secret.value;
+  if (!value) {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} resolved vault item '${vaultKey}', but it holds no value. A vault pointer is TERMINAL.`, [pointerEnvKey]);
+  }
+  assertUsableCredential(name, `${pointerEnvKey} -> vault:${vaultKey}`, value);
+  return sealCredential({
+    apiKey: value,
+    tier: "pointer",
+    source: `${pointerEnvKey} -> vault:${vaultKey}`,
+    deliberate: true,
+    diskCandidates: pointerResolution.diskCandidates,
+    warning: null
+  });
 }
-function getDataDirReadOnly() {
-  return getDataRoot();
+function defaultFleetGatewayBaseUrl(name) {
+  return `${DEFAULT_FLEET_GATEWAY_ORIGIN}/${validateAppSlug(name)}`;
 }
-function getConfigPathReadOnly(scope) {
-  if (scope === "global")
-    return join2(getDataDirReadOnly(), "config.json");
-  return join2(process.cwd(), "skills.config.json");
+function isValidDnsDomain(value) {
+  if (value.length === 0 || value.length > 253 || ASCII_CONTROL_PATTERN.test(value) || /[^\x00-\x7f]/.test(value)) {
+    return false;
+  }
+  return value.split(".").every((label) => label.length <= 63 && !label.startsWith("xn--") && DNS_LABEL_PATTERN.test(label));
 }
-function loadConfigReadOnly() {
-  const canonicalConfigPath = getConfigPathReadOnly("global");
-  let globalConfig2;
-  if (existsSync2(canonicalConfigPath)) {
-    globalConfig2 = readConfigFile(canonicalConfigPath);
-  } else if (hasOperatorOverride()) {
-    globalConfig2 = {};
-  } else {
-    globalConfig2 = readConfigFile(legacyConfigFilePath());
+function validateAppSlug(name) {
+  if (name.length > 63 || !DNS_LABEL_PATTERN.test(name)) {
+    throw new Error("App name must be one lowercase DNS label.");
   }
-  const projectConfig = readConfigFile(getConfigPathReadOnly("project"));
-  return { ...globalConfig2, ...projectConfig };
+  return name;
 }
-function legacyConfigFilePath() {
-  return join2(process.env["HOME"] || process.env["USERPROFILE"] || homedir2(), ".skillsrc");
+function rawAuthority(value) {
+  const match = /^[a-z][a-z0-9+.-]*:\/\//i.exec(value);
+  if (!match)
+    throw new Error("API URL must be absolute.");
+  const afterScheme = value.slice(match[0].length);
+  const boundary = afterScheme.search(/[/?#]/);
+  const authority = boundary === -1 ? afterScheme : afterScheme.slice(0, boundary);
+  if (!authority)
+    throw new Error("API URL must include a hostname.");
+  return authority;
 }
-function getConfigPath(scope) {
-  if (scope === "global") {
-    return join2(getDataDir(), "config.json");
+function assertCanonicalPort(port) {
+  if (!/^[0-9]+$/.test(port) || port.length > 1 && port.startsWith("0")) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
   }
-  return join2(process.cwd(), "skills.config.json");
-}
-function readConfigFile(path) {
-  if (!existsSync2(path))
-    return {};
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync(path, "utf-8"));
-  } catch {
-    return {};
+  const numericPort = Number(port);
+  if (!Number.isSafeInteger(numericPort) || numericPort < 1 || numericPort > 65535) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
   }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
-    return {};
-  assertNoRetiredConfigKeys(parsed, path);
-  const config2 = {};
-  for (const key of validKeys()) {
-    const value = normalizeConfigValue(key, parsed[key]);
-    if (value !== undefined)
-      config2[key] = value;
+}
+function canonicalAuthorityHostname(authority) {
+  let rawHostname;
+  if (authority.startsWith("[")) {
+    const closingBracket = authority.indexOf("]");
+    if (closingBracket === -1) {
+      throw new Error("API URL authority must contain a canonical hostname.");
+    }
+    rawHostname = authority.slice(0, closingBracket + 1);
+    const portSuffix = authority.slice(closingBracket + 1);
+    if (portSuffix) {
+      if (!portSuffix.startsWith(":")) {
+        throw new Error("API URL authority must contain a canonical hostname and port.");
+      }
+      assertCanonicalPort(portSuffix.slice(1));
+    }
+    if (isIP(rawHostname.slice(1, -1)) !== 6) {
+      throw new Error("API URL authority must contain a canonical IPv6 literal.");
+    }
+  } else {
+    const firstColon = authority.indexOf(":");
+    const lastColon = authority.lastIndexOf(":");
+    if (firstColon !== lastColon) {
+      throw new Error("IPv6 API URL authorities must use brackets.");
+    }
+    if (lastColon !== -1) {
+      const port = authority.slice(lastColon + 1);
+      assertCanonicalPort(port);
+      rawHostname = authority.slice(0, lastColon);
+    } else {
+      rawHostname = authority;
+    }
+    const ipVersion = isIP(rawHostname);
+    const numericAddressParts = rawHostname.split(".");
+    const looksLikeNonCanonicalIpv4 = numericAddressParts.every((part) => /^(?:0x[0-9a-f]+|[0-9]+)$/i.test(part));
+    if (ipVersion !== 4 && looksLikeNonCanonicalIpv4 || ipVersion !== 4 && !isValidDnsDomain(rawHostname.toLowerCase())) {
+      throw new Error("API URL authority must contain a canonical ASCII hostname.");
+    }
   }
-  return config2;
+  return rawHostname.toLowerCase();
 }
-function loadConfig() {
-  const globalConfig2 = readConfigFile(getConfigPath("global"));
-  const projectConfig = readConfigFile(getConfigPath("project"));
-  return { ...globalConfig2, ...projectConfig };
+function isDeliberateLoopbackHttpAuthority(authority) {
+  return /^(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?$/i.test(authority);
 }
-var ENUM_KEYS, STRING_KEYS, INSTALLED_SKILLS_DIRNAME = "installed", SKILLS_CACHE_DIRNAME = "skills", LAYOUT_MIGRATION_RECORD = ".layout-migration.json";
-var init_config = __esm(() => {
-  init_retired_settings();
-  init_app_home();
-  init_app_home();
-  ENUM_KEYS = {
-    defaultAgent: ["claude", "codex", "gemini", "pi", "opencode", "all"],
-    defaultScope: ["global", "project"],
-    format: ["compact", "json", "csv"]
-  };
-  STRING_KEYS = ["apiUrl", "extensionsDir"];
-});
-
-// src/lib/remote-run-contract.ts
-function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
-  const record3 = isRecord3(payload) ? payload : {};
+function toV1BaseUrl(apiUrl) {
+  if (ASCII_CONTROL_PATTERN.test(apiUrl)) {
+    throw new Error("API URL must not contain ASCII control characters.");
+  }
+  const input = apiUrl.trim();
+  const authority = rawAuthority(input);
+  if (authority.includes("@") || authority.includes("\\") || authority.includes("%") || /[^\x00-\x7f]/.test(authority)) {
+    throw new Error("API URL authority must be canonical ASCII without credentials.");
+  }
+  const canonicalHostname = canonicalAuthorityHostname(authority);
+  const url = new URL(input);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("API URL must use http or https.");
+  }
+  if (url.username || url.password) {
+    throw new Error("API URL must not include credentials.");
+  }
+  if (!url.hostname || url.hostname.endsWith(".")) {
+    throw new Error("API URL must include a canonical hostname.");
+  }
+  if (url.hostname.toLowerCase() !== canonicalHostname) {
+    throw new Error("API URL authority must not rely on parser hostname normalization.");
+  }
+  if (url.hostname.split(".").some((label) => label.toLowerCase().startsWith("xn--"))) {
+    throw new Error("API URL must not use IDN or punycode hostnames.");
+  }
+  if (url.protocol === "http:" && !isDeliberateLoopbackHttpAuthority(authority)) {
+    throw new Error("API URL may use http only for an exact loopback authority.");
+  }
+  if (url.search || url.hash) {
+    throw new Error("API URL must not include a query string or fragment.");
+  }
+  let path = url.pathname.replace(/\/+$/, "");
+  if (path.endsWith("/v1"))
+    path = path.slice(0, -"/v1".length);
+  url.pathname = `${path}/v1`;
+  return url.toString().replace(/\/+$/, "");
+}
+function resolveClientTransportSnapshot(name, env = process.env, options = {}) {
+  env = snapshotClientEnvironment(name, env);
+  const keys = clientTransportEnvKeys(name);
+  const definedUrlEntries = keys.apiUrlKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, raw: String(env[key]) }));
+  const blankUrl = definedUrlEntries.find((entry) => entry.raw.trim().length === 0);
+  if (blankUrl) {
+    throw new ClientTransportConfigurationError(name, `${blankUrl.key} is set but blank; public clients require an explicit HTTPS API URL and never select local storage.`, [blankUrl.key]);
+  }
+  const controlledUrl = definedUrlEntries.find((entry) => ASCII_CONTROL_PATTERN.test(entry.raw));
+  if (controlledUrl) {
+    throw new ClientTransportConfigurationError(name, `${controlledUrl.key} contains ASCII control characters.`, [controlledUrl.key]);
+  }
+  const usableUrlEntries = definedUrlEntries.map((entry) => ({ key: entry.key, value: entry.raw.trim() }));
+  if (usableUrlEntries.length > 1 && new Set(usableUrlEntries.map((entry) => entry.value)).size > 1) {
+    throw new ClientTransportConfigurationError(name, `${usableUrlEntries.map((entry) => entry.key).join(" and ")} disagree; client authority aliases must be identical or only one may be set.`, usableUrlEntries.map((entry) => entry.key));
+  }
+  const envUrlHit = usableUrlEntries[0] ?? null;
+  const keychainUrlHit = keychainConfigValue(name, env, options.credentials?.keychain);
+  const diskConfigUrlHit = appConfigDiskValue(name, env, keys.apiUrlKeys);
+  if (diskConfigUrlHit?.unusable) {
+    throw new ClientTransportConfigurationError(name, `${diskConfigUrlHit.key} in ${diskConfigUrlHit.path} is declared but blank or malformed; public clients require a valid HTTPS service authority.`, [diskConfigUrlHit.path]);
+  }
+  const urlCandidates = [
+    ...envUrlHit ? [envUrlHit] : [],
+    ...keychainUrlHit ? [{ key: keychainUrlHit.source, value: keychainUrlHit.value }] : [],
+    ...diskConfigUrlHit ? [{ key: diskConfigUrlHit.path, value: diskConfigUrlHit.value.trim() }] : []
+  ];
+  const configuredUrl = urlCandidates[0] ?? null;
+  const divergentUrls = urlCandidates.filter((candidate) => candidate.value !== configuredUrl?.value);
+  if (configuredUrl && divergentUrls.length > 0) {
+    throw new ClientTransportConfigurationError(name, `${configuredUrl.key} and ${divergentUrls.map((candidate) => candidate.key).join(" and ")} select different service authorities; refusing to send a credential written for one authority to the other.`, urlCandidates.map((candidate) => candidate.key));
+  }
+  const warnings = [];
+  if (configuredUrl && !envUrlHit) {
+    warnings.push(`No ${keys.apiUrlKeys[0]} in the environment; the server URL in ${configuredUrl.key} was used, so this client connects to the server. ` + `Keep that entry aligned with the intended service authority.`);
+  }
+  const credential = resolveCredential(name, env, options.credentials);
+  if (!credential) {
+    const diskHint = credentialDiskSourcesForMessage(name, env);
+    const lead = configuredUrl ? `${configuredUrl.key} selects the HTTP server for '${name}', but no API key could be resolved` : `${keys.apiUrlKeys[0]} is not set and no API key could be resolved for '${name}'; a credential is required before the default fleet gateway authority applies`;
+    warnings.push(`${lead}; refusing to create an unauthenticated client \u2014 public clients never fall back to SQLite or another local store. ` + `Looked in the Keychain (macOS only), then for a credential file at ${diskHint}, then for ${keys.apiKeyKeys[0]} in the environment.`);
+    throw new ClientTransportConfigurationError(name, warnings.join(" "), [configuredUrl?.key ?? keys.apiUrlKeys[0]]);
+  }
+  if (credential.warning)
+    warnings.push(credential.warning);
+  let urlHit;
+  if (configuredUrl) {
+    urlHit = configuredUrl;
+  } else {
+    try {
+      urlHit = { key: DEFAULT_AUTHORITY_SOURCE, value: defaultFleetGatewayBaseUrl(name) };
+    } catch (error2) {
+      const message = error2 instanceof Error ? error2.message : String(error2);
+      throw new ClientTransportConfigurationError(name, `No ${keys.apiUrlKeys[0]} is configured and the default fleet gateway authority cannot be composed for '${name}': ${message}`, [keys.apiUrlKeys[0]]);
+    }
+  }
+  const apiUrlSource = urlHit.key;
+  let baseUrl;
+  try {
+    baseUrl = toV1BaseUrl(urlHit.value);
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : String(error2);
+    throw new ClientTransportConfigurationError(name, `Invalid API URL from ${apiUrlSource}: ${message}`, [apiUrlSource]);
+  }
   return {
-    contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
-    ...pickString(record3, "id"),
-    skill: pickStringValue(record3, "skill") ?? fallbackSkill,
-    ...pickString(record3, "requestedSlug"),
-    ...pickString(record3, "status"),
-    ...pickNumber(record3, "exitCode"),
-    ...pickString(record3, "correlationId"),
-    ...pickString(record3, "createdAt"),
-    ...pickString(record3, "startedAt"),
-    ...pickString(record3, "completedAt"),
-    ...pickNumber(record3, "durationMs"),
-    ...pickString(record3, "outputType"),
-    ...hasOwn(record3, "outputPreview") ? { outputPreview: record3.outputPreview } : {},
-    ...pickString(record3, "errorCode"),
-    ...pickString(record3, "errorMessage"),
-    ...pickString(record3, "error"),
-    ...pickString(record3, "code"),
-    ...hasOwn(record3, "details") ? { details: record3.details } : {}
+    resolution: {
+      transport: "http",
+      transportSource: urlHit.key,
+      baseUrl,
+      apiUrlSource,
+      apiKeyPresent: true,
+      apiKeySource: credential.source,
+      apiKeyTier: credential.tier,
+      misconfigured: false,
+      warning: warnings.length > 0 ? warnings.join(" ") : null
+    },
+    credential
   };
 }
-function isRecord3(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function hasOwn(record3, key) {
-  return Object.prototype.hasOwnProperty.call(record3, key);
+function resolveClientTransport(name, env = process.env, options = {}) {
+  return resolveClientTransportSnapshot(name, env, options).resolution;
 }
-function pickString(record3, key) {
-  const value = pickStringValue(record3, key);
-  return value === undefined ? {} : { [key]: value };
+function credentialDiskSourcesForMessage(name, env) {
+  const paths = credentialDiskSources(name, env);
+  return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
 }
-function pickStringValue(record3, key) {
-  const value = record3[key];
-  return typeof value === "string" ? value : undefined;
-}
-function pickNumber(record3, key) {
-  const value = record3[key];
-  return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
-}
-var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
-
-// src/lib/api-url.ts
-function resolveApiUrl(config2 = loadConfig(), env = process.env) {
-  const raw = env[API_URL_ENV_VAR] || config2[API_URL_CONFIG_KEY];
-  const trimmed = raw?.trim().replace(/\/+$/, "");
-  return trimmed || undefined;
-}
-function requireApiUrl(action = "This command", config2, env) {
-  const resolved = resolveApiUrl(config2 ?? loadConfig(), env ?? process.env);
-  if (!resolved)
-    throw new MissingApiUrlError(action);
-  return resolved;
-}
-var API_URL_ENV_VAR = "SKILLS_API_URL", API_URL_CONFIG_KEY = "apiUrl", MISSING_API_URL_HINT, MissingApiUrlError;
-var init_api_url = __esm(() => {
-  init_config();
-  MISSING_API_URL_HINT = `set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
-  MissingApiUrlError = class MissingApiUrlError extends Error {
-    code = "MISSING_API_URL";
-    constructor(action = "This command") {
-      super(`${action} requires a Skills API URL and none is configured \u2014 ${MISSING_API_URL_HINT}`);
-      this.name = "MissingApiUrlError";
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM, CREDENTIAL_SEAL, AMBIENT_ENVIRONMENT, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, ClientTransportConfigurationError, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS;
+var init_transport = __esm(() => {
+  CredentialResolutionError = class CredentialResolutionError extends Error {
+    appName;
+    attempted;
+    constructor(appName, message, attempted) {
+      super(message);
+      this.name = "CredentialResolutionError";
+      this.appName = appName;
+      this.attempted = attempted;
+    }
+  };
+  CredentialFileUnsafeError = class CredentialFileUnsafeError extends Error {
+    path;
+    constructor(path, reason) {
+      super(`Refusing unsafe credential/config file ${path}: ${reason}.`);
+      this.name = "CredentialFileUnsafeError";
+      this.path = path;
     }
   };
+  MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
+  SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+  SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+  ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+  VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
+  CREDENTIAL_SHAPED_KEY = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
+  INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+  CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
+  AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+  SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+  requireSecretsSdk = createRequire(import.meta.url);
+  ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
+  DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+  ClientTransportConfigurationError = class ClientTransportConfigurationError extends Error {
+    appName;
+    sources;
+    constructor(appName, message, sources = []) {
+      super(message);
+      this.name = "ClientTransportConfigurationError";
+      this.appName = appName;
+      this.sources = Object.freeze([...sources]);
+    }
+  };
+  IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+  AUTHORITY_OVERRIDE_HEADERS = new Set([
+    "host",
+    ":authority",
+    "forwarded",
+    "x-forwarded-host",
+    "x-original-host"
+  ]);
 });
 
-// src/lib/auth-store.ts
-var exports_auth_store = {};
-__export(exports_auth_store, {
-  saveAuthConfig: () => saveAuthConfig,
+// src/lib/fleet-credentials.ts
+var exports_fleet_credentials = {};
+__export(exports_fleet_credentials, {
+  skillsCredentialOrReason: () => skillsCredentialOrReason,
+  skillsCredentialFiles: () => skillsCredentialFiles,
+  skillsCredentialFilePath: () => skillsCredentialFilePath,
+  resolveSkillsFleet: () => resolveSkillsFleet,
+  resolveSkillsApiOrigin: () => resolveSkillsApiOrigin,
+  resolveSkillsApiKey: () => resolveSkillsApiKey,
+  resetLocalSkillsModeNotice: () => resetLocalSkillsModeNotice,
+  requireSkillsFleet: () => requireSkillsFleet,
+  requireSkillsApiOrigin: () => requireSkillsApiOrigin,
+  requireSkillsApiKey: () => requireSkillsApiKey,
+  noticeLocalSkillsMode: () => noticeLocalSkillsMode,
   normalizeSkillsApiOrigin: () => normalizeSkillsApiOrigin,
-  getAuthFilePathReadOnly: () => getAuthFilePathReadOnly,
-  getAuthFilePath: () => getAuthFilePath,
-  getAuthConfigReadOnly: () => getAuthConfigReadOnly,
-  getAuthConfig: () => getAuthConfig,
-  getApiUrl: () => getApiUrl,
-  getApiKeyReadOnly: () => getApiKeyReadOnly,
-  getApiKey: () => getApiKey,
-  clearAuthConfig: () => clearAuthConfig
-});
-import { existsSync as existsSync13, mkdirSync as mkdirSync6, readFileSync as readFileSync11, writeFileSync as writeFileSync6, unlinkSync } from "fs";
-import { dirname as dirname5, join as join13 } from "path";
-import { homedir as homedir4 } from "os";
-function getAuthFilePath() {
-  return join13(getDataDir(), "auth.json");
-}
-function getAuthFilePathReadOnly() {
-  return join13(getDataDirReadOnly(), "auth.json");
-}
-function legacyAuthFilePath() {
-  return join13(process.env["HOME"] || process.env["USERPROFILE"] || homedir4(), ".skills", "auth.json");
-}
-function getAuthConfig() {
-  if (cachedConfig !== undefined)
-    return cachedConfig;
-  try {
-    const file = existsSync13(getAuthFilePath()) ? getAuthFilePath() : legacyAuthFilePath();
-    const raw = readFileSync11(file, "utf-8");
-    const config2 = JSON.parse(raw);
-    if (!config2.apiKey) {
-      cachedConfig = null;
-      return null;
-    }
-    cachedConfig = config2;
-    return config2;
-  } catch {
-    cachedConfig = null;
-    return null;
-  }
-}
-function saveAuthConfig(config2) {
-  const file = getAuthFilePath();
-  mkdirSync6(dirname5(file), { recursive: true, mode: 448 });
-  writeFileSync6(file, JSON.stringify(config2, null, 2) + `
-`, { mode: 384 });
-  cachedConfig = config2;
-}
-function clearAuthConfig() {
-  try {
-    unlinkSync(getAuthFilePath());
-  } catch {}
-  try {
-    unlinkSync(legacyAuthFilePath());
-  } catch {}
-  cachedConfig = undefined;
-}
-function getApiKey() {
-  if (process.env.SKILLS_API_KEY)
-    return process.env.SKILLS_API_KEY;
-  if (process.env.SKILL_API_KEY)
-    return process.env.SKILL_API_KEY;
-  return getAuthConfig()?.apiKey || null;
-}
-function getAuthConfigReadOnly() {
-  try {
-    const file = existsSync13(getAuthFilePathReadOnly()) ? getAuthFilePathReadOnly() : legacyAuthFilePath();
-    const raw = readFileSync11(file, "utf-8");
-    const config2 = JSON.parse(raw);
-    if (!config2.apiKey)
-      return null;
-    return config2;
-  } catch {
+  configuredSkillsApiUrl: () => configuredSkillsApiUrl,
+  SkillsFleetCredentialError: () => SkillsFleetCredentialError,
+  SKILLS_APP: () => SKILLS_APP,
+  SKILLS_API_URL_ENV_KEYS: () => SKILLS_API_URL_ENV_KEYS,
+  SKILLS_API_URL_ENV: () => SKILLS_API_URL_ENV,
+  SKILLS_API_KEY_ENV_KEYS: () => SKILLS_API_KEY_ENV_KEYS,
+  SKILLS_API_KEY_ENV: () => SKILLS_API_KEY_ENV,
+  MissingSkillsFleetError: () => MissingSkillsFleetError
+});
+function isClientTransportConfigurationError(error2) {
+  return error2 instanceof ClientTransportConfigurationError || typeof error2 === "object" && error2 !== null && error2.name === "ClientTransportConfigurationError";
+}
+function isCredentialResolutionError(error2) {
+  return error2 instanceof CredentialResolutionError || typeof error2 === "object" && error2 !== null && error2.name === "CredentialResolutionError";
+}
+function asSkillsFleetCredentialError(error2) {
+  if (!isCredentialResolutionError(error2))
     return null;
-  }
-}
-function getApiKeyReadOnly() {
-  if (process.env.SKILLS_API_KEY)
-    return process.env.SKILLS_API_KEY;
-  if (process.env.SKILL_API_KEY)
-    return process.env.SKILL_API_KEY;
-  return getAuthConfigReadOnly()?.apiKey || null;
+  return new SkillsFleetCredentialError(error2.message, "MISSING_API_CREDENTIAL");
 }
 function normalizeSkillsApiOrigin(apiUrl) {
   const url = new URL(apiUrl);
@@ -7089,13 +7794,182 @@ function normalizeSkillsApiOrigin(apiUrl) {
   }
   return url.toString().replace(/\/+$/, "");
 }
-function getApiUrl(action) {
-  return normalizeSkillsApiOrigin(requireApiUrl(action));
+function configuredSkillsApiUrl(env = process.env, keychain) {
+  for (const key of SKILLS_API_URL_ENV_KEYS) {
+    const value = env[key]?.trim();
+    if (value)
+      return { value, source: key };
+  }
+  const fromKeychain = keychainConfigValue(SKILLS_APP, env, keychain);
+  if (fromKeychain)
+    return { value: fromKeychain.value.trim(), source: fromKeychain.source };
+  const fromDisk = appConfigDiskValue(SKILLS_APP, env, SKILLS_API_URL_ENV_KEYS);
+  if (fromDisk?.unusable) {
+    throw new SkillsFleetCredentialError(`${fromDisk.key} in ${fromDisk.path} is declared but blank or malformed; ` + `a Skills authority must be a valid https URL (or an exact loopback http URL).`, "INVALID_API_URL");
+  }
+  if (fromDisk)
+    return { value: fromDisk.value.trim(), source: fromDisk.path };
+  return null;
 }
-var cachedConfig;
-var init_auth_store = __esm(() => {
-  init_api_url();
-  init_config();
+function skillsCredentialFiles(env = process.env) {
+  return credentialDiskSources(SKILLS_APP, env);
+}
+function skillsCredentialFilePath(env = process.env) {
+  const paths = skillsCredentialFiles(env);
+  const path = paths[0];
+  if (!path) {
+    throw new Error("No home directory is set (HOME or HASNA_HOME), so there is nowhere to store a Skills credential.");
+  }
+  return path;
+}
+function noticeLocalSkillsMode(write = (line) => console.error(line)) {
+  if (localNoticePrinted)
+    return;
+  localNoticePrinted = true;
+  write(`skills: local mode \u2014 no ${SKILLS_API_KEY_ENV} and no ${SKILLS_API_URL_ENV} resolved, ` + `so this runs on this machine against the bundled corpus. ` + `Sign in with: skills auth login`);
+}
+function resetLocalSkillsModeNotice() {
+  localNoticePrinted = false;
+}
+function resolveSkillsFleet(env = process.env, options = {}) {
+  try {
+    return resolveSkillsFleetOrThrow(env, options);
+  } catch (error2) {
+    const translated = asSkillsFleetCredentialError(error2);
+    if (translated)
+      throw translated;
+    throw error2;
+  }
+}
+function resolveSkillsFleetOrThrow(env, options) {
+  let resolution;
+  try {
+    resolution = resolveClientTransport(SKILLS_APP, env, { credentials: options.credentials });
+  } catch (error2) {
+    if (!isClientTransportConfigurationError(error2))
+      throw error2;
+    const configured2 = configuredSkillsApiUrl(env, options.credentials?.keychain);
+    const credential2 = resolveCredential(SKILLS_APP, env, options.credentials);
+    if (!configured2 && !credential2) {
+      if (env === process.env)
+        noticeLocalSkillsMode();
+      return { mode: "local", apiOrigin: null, apiKey: null };
+    }
+    if (configured2 && !credential2) {
+      throw new SkillsFleetCredentialError(`${configured2.source} points this CLI at a Skills service but no API key resolved \u2014 ` + `refusing to run locally instead. Looked in the Keychain item ` + `hasna.credentials.${SKILLS_APP}.api-key, then ${skillsCredentialFiles(env).join(" or ") || "no credentials file (no HOME)"}, ` + `then ${SKILLS_API_KEY_ENV}. Sign in with: skills auth login`);
+    }
+    throw error2;
+  }
+  const configured = configuredSkillsApiUrl(env, options.credentials?.keychain);
+  const apiOrigin = configured ? normalizeSkillsApiOrigin(configured.value) : stripV1(resolution.baseUrl);
+  const credential = resolveCredential(SKILLS_APP, env, options.credentials);
+  if (!credential) {
+    throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills auth login`);
+  }
+  const base = {
+    mode: "hosted",
+    apiOrigin,
+    apiUrlSource: resolution.apiUrlSource ?? (configured?.source ?? "default"),
+    apiKeySource: resolution.apiKeySource ?? credential.source,
+    apiKeyTier: resolution.apiKeyTier,
+    warning: resolution.warning
+  };
+  if (credential.tier === "pointer") {
+    return { ...base, apiKey: null, apiKeyPointer: credential };
+  }
+  if (!credential.apiKey.trim()) {
+    throw new SkillsFleetCredentialError(`The Skills API key from ${credential.source} is empty \u2014 refusing to send an unauthenticated request. ` + `Sign in with: skills auth login`);
+  }
+  return { ...base, apiKey: credential.apiKey, apiKeyPointer: null };
+}
+async function resolveSkillsApiKey(env = process.env, options = {}) {
+  const fleet = resolveSkillsFleet(env, options);
+  if (fleet.mode !== "hosted")
+    return null;
+  if (fleet.apiKey)
+    return fleet.apiKey;
+  const pointer = fleet.apiKeyPointer;
+  if (!pointer) {
+    throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills auth login`);
+  }
+  let completed;
+  try {
+    completed = await completePointerCredential(SKILLS_APP, pointer, env);
+  } catch (error2) {
+    const translated = asSkillsFleetCredentialError(error2);
+    if (translated)
+      throw translated;
+    throw error2;
+  }
+  if (!completed.apiKey?.trim()) {
+    throw new SkillsFleetCredentialError(`${credentialPointerEnvKey(SKILLS_APP)} names a vault item that produced an empty Skills API key \u2014 ` + `refusing to send an unauthenticated request.`);
+  }
+  return completed.apiKey;
+}
+async function requireSkillsApiKey(action = "This command", env = process.env, options = {}) {
+  const apiKey = await resolveSkillsApiKey(env, options);
+  if (!apiKey)
+    throw new MissingSkillsFleetError(action);
+  return apiKey;
+}
+function stripV1(baseUrl) {
+  return baseUrl.replace(/\/v1$/, "").replace(/\/+$/, "");
+}
+async function skillsCredentialOrReason(env = process.env, options = {}) {
+  try {
+    const apiKey = await resolveSkillsApiKey(env, options);
+    return apiKey ? { apiKey, reason: null } : { apiKey: null, reason: null };
+  } catch (error2) {
+    if (error2 instanceof SkillsFleetCredentialError || error2?.name === "SkillsFleetCredentialError") {
+      return { apiKey: null, reason: error2.message };
+    }
+    throw error2;
+  }
+}
+function resolveSkillsApiOrigin(env = process.env, options = {}) {
+  const configured = configuredSkillsApiUrl(env, options.credentials?.keychain);
+  if (configured) {
+    toV1BaseUrl(configured.value);
+    return { origin: normalizeSkillsApiOrigin(configured.value), source: configured.source };
+  }
+  const fleet = resolveSkillsFleet(env, options);
+  return fleet.mode === "hosted" ? { origin: fleet.apiOrigin, source: fleet.apiUrlSource } : null;
+}
+function requireSkillsApiOrigin(action = "This command", env = process.env, options = {}) {
+  const resolved = resolveSkillsApiOrigin(env, options);
+  if (!resolved)
+    throw new MissingSkillsFleetError(action);
+  return resolved.origin;
+}
+function requireSkillsFleet(action = "This command", env = process.env, options = {}) {
+  const fleet = resolveSkillsFleet(env, options);
+  if (fleet.mode === "hosted")
+    return fleet;
+  throw new MissingSkillsFleetError(action);
+}
+var SKILLS_APP = "skills", ENV_KEYS, SKILLS_API_URL_ENV_KEYS, SKILLS_API_KEY_ENV_KEYS, SKILLS_API_URL_ENV, SKILLS_API_KEY_ENV, SkillsFleetCredentialError, localNoticePrinted = false, MissingSkillsFleetError;
+var init_fleet_credentials = __esm(() => {
+  init_transport();
+  ENV_KEYS = clientTransportEnvKeys(SKILLS_APP);
+  SKILLS_API_URL_ENV_KEYS = ENV_KEYS.apiUrlKeys;
+  SKILLS_API_KEY_ENV_KEYS = ENV_KEYS.apiKeyKeys;
+  SKILLS_API_URL_ENV = SKILLS_API_URL_ENV_KEYS[0];
+  SKILLS_API_KEY_ENV = SKILLS_API_KEY_ENV_KEYS[0];
+  SkillsFleetCredentialError = class SkillsFleetCredentialError extends Error {
+    code;
+    constructor(message, code = "MISSING_API_CREDENTIAL") {
+      super(message);
+      this.name = "SkillsFleetCredentialError";
+      this.code = code;
+    }
+  };
+  MissingSkillsFleetError = class MissingSkillsFleetError extends Error {
+    code = "MISSING_API_URL";
+    constructor(action = "This command") {
+      super(`${action} requires a Skills API credential and none is configured \u2014 ` + `run: skills auth login, or set ${SKILLS_API_KEY_ENV} ` + `(add the Keychain item hasna.credentials.${SKILLS_APP}.api-key, or write ~/.hasna/skills/config/credentials). ` + `Point at your own instance with ${SKILLS_API_URL_ENV}, or run: skills setup --api-url <your Skills instance origin>`);
+      this.name = "MissingSkillsFleetError";
+    }
+  };
 });
 
 // src/lib/blog-article.ts
@@ -7228,6 +8102,15 @@ var init_blog_article = __esm(() => {
   ARTICLE_LENGTHS = ["short", "medium", "long"];
 });
 
+// src/lib/auth-store.ts
+function getApiUrl(action, env = process.env, options = {}) {
+  return requireSkillsApiOrigin(action, env, options);
+}
+var init_auth_store = __esm(() => {
+  init_fleet_credentials();
+  init_fleet_credentials();
+});
+
 // src/lib/remote-client.ts
 var exports_remote_client = {};
 __export(exports_remote_client, {
@@ -7501,26 +8384,23 @@ function normalizeUpdatedSincePage(payload) {
   }
   return { skills, nextCursor };
 }
-function createRemoteSkillsClient() {
-  const apiKey = getApiKey();
-  if (!apiKey)
+async function createRemoteSkillsClient(env = process.env) {
+  const fleet = resolveSkillsFleet(env);
+  if (fleet.mode !== "hosted")
     return null;
-  return new RemoteSkillsClient(apiKey);
-}
-function createRemoteSkillsClientReadOnly() {
-  const apiKey = getApiKeyReadOnly();
-  if (!apiKey)
-    return null;
-  const apiUrl = resolveApiUrl(loadConfigReadOnly(), process.env);
-  if (!apiUrl)
-    throw new MissingApiUrlError("the cloud group's sync verb (--dry-run)");
-  return new RemoteSkillsClient(apiKey, apiUrl);
+  const apiKey = await resolveSkillsApiKey(env);
+  if (!apiKey) {
+    throw new Error("A Skills authority resolved but no API key did. Sign in with: skills auth login");
+  }
+  return new RemoteSkillsClient(apiKey, fleet.apiOrigin);
+}
+function createRemoteSkillsClientReadOnly(env = process.env) {
+  return createRemoteSkillsClient(env);
 }
 var RemoteRouteUnsupportedError, RemoteRequestError;
 var init_remote_client = __esm(() => {
   init_auth_store();
-  init_api_url();
-  init_config();
+  init_fleet_credentials();
   RemoteRouteUnsupportedError = class RemoteRouteUnsupportedError extends Error {
     path;
     status;
@@ -7651,7 +8531,7 @@ var require_content_type = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 import process2 from "process";
 
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v4/core/core.js
@@ -12109,7 +12989,7 @@ function preprocess(fn, schema) {
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var DEFAULT_NEGOTIATED_PROTOCOL_VERSION = "2025-03-26";
 var SUPPORTED_PROTOCOL_VERSIONS = [LATEST_PROTOCOL_VERSION, "2025-06-18", "2025-03-26", "2024-11-05", "2024-10-07"];
@@ -12956,7 +13836,7 @@ class UrlElicitationRequiredError extends McpError {
   }
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
 var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 
 class ReadBuffer {
@@ -12996,7 +13876,7 @@ function serializeMessage(message) {
 `;
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 class StdioServerTransport {
   constructor(_stdin = process2.stdin, _stdout = process2.stdout, options) {
     this._stdin = _stdin;
@@ -13061,12 +13941,13 @@ class StdioServerTransport {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.2.0",
+  version: "0.3.0",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
     skills: "bin/index.js",
     "skills-mcp": "bin/mcp.js",
+    "skills-serve": "bin/server.js",
     "skills-server": "bin/server.js",
     "skills-worker": "bin/worker.js",
     "skills-migrate": "bin/migrate.js"
@@ -13152,6 +14033,7 @@ var package_default = {
   dependencies: {
     "@aws-sdk/client-ecs": "^3.1079.0",
     "@aws-sdk/client-s3": "^3.1079.0",
+    "@hasna/contracts": "1.0.1",
     "@hasna/events": "0.1.16",
     "@modelcontextprotocol/sdk": "^1.26.0",
     chalk: "^5.3.0",
@@ -17195,7 +18077,7 @@ function object2(shape, params) {
   };
   return new ZodMiniObject(def);
 }
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema = s;
   return !!schema._zod;
@@ -17356,7 +18238,7 @@ function getLiteralValue(schema) {
   return;
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 function isTerminal(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
@@ -18597,7 +19479,7 @@ var zodToJsonSchema = (schema, options) => {
   }
   return combined;
 };
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function mapMiniTarget(t) {
   if (!t)
     return "draft-7";
@@ -18639,7 +19521,7 @@ function parseWithCompat(schema, data) {
   return result.data;
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 var DEFAULT_REQUEST_TIMEOUT_MSEC = 60000;
 
 class Protocol {
@@ -19480,7 +20362,7 @@ function mergeCapabilities(base, additional) {
   return result;
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 var import_ajv = __toESM(require_ajv(), 1);
 var import_ajv_formats = __toESM(require_dist(), 1);
 function createDefaultAjvInstance() {
@@ -19520,7 +20402,7 @@ class AjvJsonSchemaValidator {
   }
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 class ExperimentalServerTasks {
   constructor(_server) {
     this._server = _server;
@@ -19598,7 +20480,7 @@ class ExperimentalServerTasks {
   }
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 function assertToolsCallTaskCapability(requests, method, entityName) {
   if (!requests) {
     throw new Error(`${entityName} does not support task creation (required for ${method})`);
@@ -19633,7 +20515,7 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
   }
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
 class Server extends Protocol {
   constructor(_serverInfo, options) {
     super(options);
@@ -19957,7 +20839,7 @@ class Server extends Protocol {
   }
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
 var COMPLETABLE_SYMBOL = Symbol.for("mcp.completable");
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
@@ -19971,7 +20853,7 @@ var McpZodTypeKind;
   McpZodTypeKind2["Completable"] = "McpCompletable";
 })(McpZodTypeKind || (McpZodTypeKind = {}));
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/uriTemplate.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/uriTemplate.js
 var MAX_TEMPLATE_LENGTH = 1e6;
 var MAX_VARIABLE_LENGTH = 1e6;
 var MAX_TEMPLATE_EXPRESSIONS = 1e4;
@@ -20189,7 +21071,7 @@ class UriTemplate {
   }
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
 var TOOL_NAME_REGEX = /^[A-Za-z0-9._-]{1,128}$/;
 function validateToolName(name) {
   const warnings = [];
@@ -20247,7 +21129,7 @@ function validateAndWarnToolName(name) {
   return result.isValid;
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
 class ExperimentalMcpServerTasks {
   constructor(_mcpServer) {
     this._mcpServer = _mcpServer;
@@ -20261,7 +21143,7 @@ class ExperimentalMcpServerTasks {
     return mcpServerInternal._createRegisteredTool(name, config2.title, config2.description, config2.inputSchema, config2.outputSchema, config2.annotations, execution, config2._meta, handler);
   }
 }
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
 class McpServer {
   constructor(serverInfo, options) {
     this._registeredResources = {};
@@ -21004,12 +21886,270 @@ var EMPTY_COMPLETION_RESULT = {
 };
 
 // src/lib/registry.ts
-init_config();
 import { existsSync as existsSync8, readFileSync as readFileSync6, readdirSync as readdirSync6 } from "fs";
 import { join as join8 } from "path";
 
+// src/lib/config.ts
+import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
+import { join as join2, dirname } from "path";
+
+// src/lib/retired-settings.ts
+var RETIRED_ENV_SUFFIXES = ["_STORAGE_MODE", "_DEPLOYMENT_MODE", "_CLOUD_MODE"];
+var RETIRED_CONFIG_KEYS = {
+  mode: "a configured API origin",
+  apiUrl: "skills setup --api-url <origin>"
+};
+var RETIRED_CONFIG_KEY_REASONS = {
+  mode: "Deployment modes were removed: a Skills client either resolves a credential " + "or it does not, and that is the whole of it.",
+  apiUrl: "The service address is no longer kept in this app's config file: it is read from " + "HASNA_SKILLS_API_URL, then the macOS Keychain item hasna.credentials.skills.api-url, " + "then ~/.hasna/skills/config/credentials, then the fleet gateway."
+};
+
+class RetiredSettingError extends Error {
+  code = "RETIRED_SETTING";
+  setting;
+  constructor(setting, message) {
+    super(message);
+    this.name = "RetiredSettingError";
+    this.setting = setting;
+  }
+}
+function isRetiredModeEnvVar(name, app) {
+  const upper = name.toUpperCase();
+  if (!upper.includes(app.toUpperCase()))
+    return false;
+  return RETIRED_ENV_SUFFIXES.some((suffix) => upper.endsWith(suffix));
+}
+function findRetiredModeEnvVars(env, app) {
+  const found = [];
+  for (const [name, value] of Object.entries(env)) {
+    if (value === undefined || value === "")
+      continue;
+    if (isRetiredModeEnvVar(name, app))
+      found.push({ name, value });
+  }
+  return found.sort((a, b) => a.name.localeCompare(b.name));
+}
+function assertNoRetiredModeEnvVars(env, options) {
+  const found = findRetiredModeEnvVars(env, options.app);
+  if (found.length === 0)
+    return;
+  const names = found.map((entry) => entry.name);
+  throw new RetiredSettingError(names[0], `${names.join(", ")} ${names.length === 1 ? "is" : "are"} no longer read. ` + "Deployment modes were removed: where a server keeps its data is decided by the " + `database it is given, not by a declared label. Set ${options.replacement} to a ` + "postgres:// URL to use PostgreSQL, or leave it unset for the on-box SQLite database. " + `Then unset ${names.join(" and ")}. ` + "Refused rather than ignored, because a discarded setting looks exactly like a " + "working one until something needs the data.");
+}
+function assertNoRetiredConfigKeys(config2, source) {
+  for (const [key, replacement] of Object.entries(RETIRED_CONFIG_KEYS)) {
+    if (!(key in config2))
+      continue;
+    throw new RetiredSettingError(key, `${source}: "${key}" is no longer a configuration key. ` + `${RETIRED_CONFIG_KEY_REASONS[key] ?? ""} ` + `Use ${replacement} instead, and remove the old key with: skills config unset ${key}. ` + "Refused rather than ignored, because silently dropping it would leave an " + "operator believing they had pointed this install at a server.");
+  }
+}
+
+// src/lib/app-home.ts
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { join, resolve } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+var PATHS_RESOLVER_KIND_ENV = {
+  config: "HASNA_CONFIG_HOME",
+  data: "HASNA_DATA_HOME",
+  state: "HASNA_STATE_HOME",
+  cache: "HASNA_CACHE_HOME"
+};
+var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathsResolverAssertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
+}
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
+    return override;
+  const home = options.home ?? pathsResolverHomedir();
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    switch (kind) {
+      case "config":
+      case "data":
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
+      case "state":
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return pathsResolverJoin(home, ".config", "hasna");
+    case "data":
+      return pathsResolverJoin(home, ".local", "share", "hasna");
+    case "state":
+      return pathsResolverJoin(home, ".local", "state", "hasna");
+    case "cache":
+      return pathsResolverJoin(home, ".cache", "hasna");
+  }
+}
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return pathsResolverResolve("data", options);
+}
+var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
+var HASNA_SKILLS_HOME_ENV = "HASNA_SKILLS_HOME";
+var SKILLS_HOME_ENV = "SKILLS_HOME";
+var DEFAULT_SQLITE_FILENAME = "server.db";
+var GLOBAL_CONFIG_FILENAME = "config.json";
+function effectiveHome() {
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir() || "/tmp";
+}
+function legacyDataRoot() {
+  return join(effectiveHome(), ".hasna", "skills");
+}
+function resolverDataRoot(home = effectiveHome(), env) {
+  return dataDir({ app: "skills", home, env });
+}
+function adoptResolverDataRoot(resolved, env = process.env) {
+  const dataOverride = env.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync(join(resolved, DEFAULT_SQLITE_FILENAME)) || existsSync(join(resolved, GLOBAL_CONFIG_FILENAME));
+}
+function exactDataRoot() {
+  for (const key of [DATA_DIR_ENV, HASNA_SKILLS_HOME_ENV, SKILLS_HOME_ENV]) {
+    const dir = process.env[key]?.trim();
+    if (dir)
+      return resolve(dir);
+  }
+  return;
+}
+function hasExactOverride(env = process.env) {
+  return Boolean(env[DATA_DIR_ENV]?.trim()) || Boolean(env[HASNA_SKILLS_HOME_ENV]?.trim()) || Boolean(env[SKILLS_HOME_ENV]?.trim());
+}
+function hasOperatorOverride(env = process.env) {
+  return hasExactOverride(env) || Boolean(env.HASNA_DATA_HOME?.trim());
+}
+function getDataRoot() {
+  const exact = exactDataRoot();
+  if (exact)
+    return exact;
+  const resolved = resolverDataRoot();
+  return adoptResolverDataRoot(resolved) ? resolve(resolved) : resolve(legacyDataRoot());
+}
+
+// src/lib/config.ts
+var ENUM_KEYS = {
+  defaultAgent: ["claude", "codex", "gemini", "pi", "opencode", "all"],
+  defaultScope: ["global", "project"],
+  format: ["compact", "json", "csv"]
+};
+var STRING_KEYS = ["extensionsDir"];
+function validKeys() {
+  return [...Object.keys(ENUM_KEYS), ...STRING_KEYS];
+}
+function allowedValues(key) {
+  return ENUM_KEYS[key];
+}
+function mergeDirectoryContents(sourceDir, targetDir) {
+  if (!existsSync2(sourceDir))
+    return;
+  mkdirSync(targetDir, { recursive: true });
+  for (const entry of readdirSync(sourceDir)) {
+    const sourcePath = join2(sourceDir, entry);
+    const targetPath = join2(targetDir, entry);
+    try {
+      const sourceStat = statSync(sourcePath);
+      if (sourceStat.isDirectory()) {
+        mergeDirectoryContents(sourcePath, targetPath);
+        continue;
+      }
+      if (!existsSync2(targetPath))
+        copyFileSync(sourcePath, targetPath);
+    } catch {}
+  }
+}
+function normalizeConfigValue(key, value) {
+  if (typeof value !== "string")
+    return;
+  const allowed = allowedValues(key);
+  if (allowed)
+    return allowed.includes(value) ? value : undefined;
+  if (key === "extensionsDir")
+    return value.trim() ? value : undefined;
+  return;
+}
+var INSTALLED_SKILLS_DIRNAME = "installed";
+var SKILLS_CACHE_DIRNAME = "skills";
+var LAYOUT_MIGRATION_RECORD = ".layout-migration.json";
+function isOwnerLayoutMigrated(appDir) {
+  return existsSync2(join2(appDir, SKILLS_CACHE_DIRNAME, LAYOUT_MIGRATION_RECORD));
+}
+function getDataDir() {
+  const root = getDataRoot();
+  try {
+    mkdirSync(root, { recursive: true });
+  } catch {}
+  if (hasOperatorOverride())
+    return root;
+  const home = effectiveHome();
+  const oldDir = join2(home, ".skills");
+  const oldConfigFile = join2(home, ".skillsrc");
+  try {
+    mergeDirectoryContents(oldDir, root);
+  } catch {}
+  if (existsSync2(oldConfigFile) && !existsSync2(join2(root, "config.json"))) {
+    try {
+      copyFileSync(oldConfigFile, join2(root, "config.json"));
+    } catch {}
+  }
+  return root;
+}
+function getConfigPath(scope) {
+  if (scope === "global") {
+    return join2(getDataDir(), "config.json");
+  }
+  return join2(process.cwd(), "skills.config.json");
+}
+function readConfigFile(path) {
+  if (!existsSync2(path))
+    return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    return {};
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+    return {};
+  assertNoRetiredConfigKeys(parsed, path);
+  const config2 = {};
+  for (const key of validKeys()) {
+    const value = normalizeConfigValue(key, parsed[key]);
+    if (value !== undefined)
+      config2[key] = value;
+  }
+  return config2;
+}
+function loadConfig() {
+  const globalConfig2 = readConfigFile(getConfigPath("global"));
+  const projectConfig = readConfigFile(getConfigPath("project"));
+  return { ...globalConfig2, ...projectConfig };
+}
+
 // src/lib/portable-skills.ts
-init_config();
 import {
   cpSync as cpSync2,
   existsSync as existsSync7,
@@ -22445,7 +23585,7 @@ function readPortableSkillManifest(skillPath, fallbackName = basename(skillPath)
   const pkg = existsSync6(pkgPath) ? readJsonObject(pkgPath) : undefined;
   const name = normalizePortableSkillName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
   const description = stringField(jsonManifest, "description") ?? frontmatter?.description ?? stringValue(pkg?.description) ?? `${name} skill`;
-  const version2 = stringField(jsonManifest, "version") ?? frontmatter?.version ?? stringValue(pkg?.version) ?? PORTABLE_SKILL_DEFAULT_VERSION;
+  const version2 = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
   const kind = parseSkillKind(stringField(jsonManifest, "kind") ?? frontmatter?.kind);
   const commands = parseManifestCommands(jsonManifest) ?? (kind === "instruction" ? [] : inferPackageCommands(pkg, name)) ?? [];
   return {
@@ -22469,6 +23609,15 @@ function parseSkillKind(value) {
     return value;
   return;
 }
+function readDeclaredSkillVersion(skillPath) {
+  const skillJsonPath = join6(skillPath, "skill.json");
+  const skillMdPath = join6(skillPath, "SKILL.md");
+  const pkgPath = join6(skillPath, "package.json");
+  const jsonManifest = existsSync6(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
+  const frontmatter = existsSync6(skillMdPath) ? parseSkillFrontmatter(readFileSync5(skillMdPath, "utf-8")) ?? undefined : undefined;
+  const pkg = existsSync6(pkgPath) ? readJsonObject(pkgPath) : undefined;
+  return stringField(jsonManifest, "version") ?? frontmatter?.version ?? stringValue(pkg?.version);
+}
 function createInstructionManifest(name, options) {
   return {
     $schema: PORTABLE_SKILL_SCHEMA,
@@ -23591,21 +24740,13 @@ function mergeCustomSkills(skills) {
 // src/lib/installer.ts
 import { existsSync as existsSync10, readFileSync as readFileSync8, rmSync as rmSync2 } from "fs";
 import { dirname as dirname4, join as join10 } from "path";
-import { homedir as homedir3 } from "os";
+import { homedir as homedir2 } from "os";
 import { fileURLToPath } from "url";
-
-// src/lib/home-migration.ts
-init_config();
-init_config();
-
 // src/lib/utils.ts
 function normalizeSkillName(name) {
   return name;
 }
 
-// src/lib/installer.ts
-init_config();
-
 // src/lib/project-state.ts
 import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
 import { join as join9 } from "path";
@@ -23815,11 +24956,11 @@ function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const base = projectDir || process.cwd();
   switch (agent) {
     case "pi":
-      return scope === "project" ? join10(base, ".pi", "skills") : join10(homedir3(), ".pi", "agent", "skills");
+      return scope === "project" ? join10(base, ".pi", "skills") : join10(homedir2(), ".pi", "agent", "skills");
     case "opencode":
-      return scope === "project" ? join10(base, ".opencode", "skills") : join10(homedir3(), ".config", "opencode", "skills");
+      return scope === "project" ? join10(base, ".opencode", "skills") : join10(homedir2(), ".config", "opencode", "skills");
     default:
-      return scope === "project" ? join10(base, `.${agent}`, "skills") : join10(homedir3(), `.${agent}`, "skills");
+      return scope === "project" ? join10(base, `.${agent}`, "skills") : join10(homedir2(), `.${agent}`, "skills");
   }
 }
 function warnMissingDependencies(name, targetDir) {
@@ -23914,7 +25055,8 @@ function getSkillRequirements(name) {
       }
     }
     envVars.delete("SKILL_API_KEY");
-    envVars.add("SKILLS_API_KEY");
+    envVars.delete("SKILLS_API_KEY");
+    envVars.add("HASNA_SKILLS_API_KEY");
   }
   const systemDeps = new Set;
   const depPatterns = [
@@ -25049,7 +26191,7 @@ var TOOL_PRIMITIVES = [
     cliCommands: ["skills tools deps <skill>", "skills run <skill>"],
     mcpTools: ["get_skill_tool_dependencies", "run_skill"],
     apiSurfaces: ["runSkill", "SkillRunRecord", "RemoteSkillRunContract"],
-    envVars: ["SKILLS_API_KEY"],
+    envVars: ["HASNA_SKILLS_API_KEY"],
     outputTypes: ["text", "json", "markdown", "artifact"],
     capabilities: ["completion", "reasoning", "tool-calling", "vision-input", "structured-output"]
   },
@@ -25105,7 +26247,7 @@ var TOOL_PRIMITIVES = [
     cliCommands: ["skills tools deps <skill>", "skills run <skill>"],
     mcpTools: ["get_skill_tool_dependencies", "run_skill"],
     apiSurfaces: ["runSkill", "RemoteSkillRunContract"],
-    envVars: ["SKILLS_API_KEY"],
+    envVars: ["HASNA_SKILLS_API_KEY"],
     outputTypes: ["png", "jpeg", "webp", "svg", "zip"],
     capabilities: ["image-generation", "image-analysis", "image-editing", "asset-packaging"]
   },
@@ -25119,7 +26261,7 @@ var TOOL_PRIMITIVES = [
     cliCommands: ["skills tools deps <skill>", "skills run <skill>"],
     mcpTools: ["get_skill_tool_dependencies", "run_skill"],
     apiSurfaces: ["runSkill", "RemoteSkillRunContract"],
-    envVars: ["SKILLS_API_KEY"],
+    envVars: ["HASNA_SKILLS_API_KEY"],
     outputTypes: ["mp3", "wav", "txt", "srt", "json", "zip"],
     capabilities: ["transcription", "audio-generation", "voiceover", "audio-cleanup"]
   },
@@ -25133,7 +26275,7 @@ var TOOL_PRIMITIVES = [
     cliCommands: ["skills tools deps <skill>", "skills run <skill>"],
     mcpTools: ["get_skill_tool_dependencies", "run_skill"],
     apiSurfaces: ["runSkill", "RemoteSkillRunContract"],
-    envVars: ["SKILLS_API_KEY"],
+    envVars: ["HASNA_SKILLS_API_KEY"],
     outputTypes: ["mp4", "mov", "srt", "png", "json", "zip"],
     capabilities: ["video-generation", "video-analysis", "captioning", "highlight-extraction"]
   },
@@ -25161,7 +26303,7 @@ var TOOL_PRIMITIVES = [
     cliCommands: ["skills tools deps <skill>", "skills run <skill>"],
     mcpTools: ["get_skill_tool_dependencies", "run_skill"],
     apiSurfaces: ["SkillRunContext", "RemoteSkillRunContract"],
-    envVars: ["SKILLS_API_KEY"],
+    envVars: ["HASNA_SKILLS_API_KEY"],
     outputTypes: ["json", "artifact"],
     capabilities: ["approval", "external-api", "account-scoped-execution"]
   },
@@ -25203,7 +26345,7 @@ var TOOL_PRIMITIVES = [
     cliCommands: ["skills auth login", "skills run <skill>"],
     mcpTools: ["run_skill"],
     apiSurfaces: ["RemoteSkillsClient", "RemoteSkillRunContract"],
-    envVars: ["SKILLS_API_KEY"],
+    envVars: ["HASNA_SKILLS_API_KEY"],
     outputTypes: ["json"],
     capabilities: ["account-auth", "remote-run-submit"]
   }
@@ -25699,7 +26841,7 @@ function registerDiscoveryTools(server) {
 }
 
 // src/mcp/operation-tools.ts
-import { existsSync as existsSync14, readdirSync as readdirSync8, statSync as statSync8 } from "fs";
+import { existsSync as existsSync13, readdirSync as readdirSync8, statSync as statSync8 } from "fs";
 import { join as join14 } from "path";
 
 // src/lib/run-state.ts
@@ -25882,8 +27024,7 @@ function mimeForPath(path) {
   }
 }
 // src/lib/run-routing.ts
-init_api_url();
-init_auth_store();
+init_fleet_credentials();
 function isServerOwnedSkill(skill) {
   return skill.serverOwned === true;
 }
@@ -25894,7 +27035,7 @@ function resolveRunRouting(skill, apiKey, apiUrl) {
     return {
       route: "error",
       code: "REMOTE_REQUIRES_ORIGIN",
-      error: `${skill.name} is a server-owned skill. Point the CLI at a Skills API: ` + `skills setup --api-url <url> (or export SKILLS_API_URL)`
+      error: `${skill.name} is a server-owned skill. Point the CLI at a Skills API: ` + `skills setup --api-url <url> (or export HASNA_SKILLS_API_URL)`
     };
   }
   if (!apiKey) {
@@ -25906,8 +27047,23 @@ function resolveRunRouting(skill, apiKey, apiUrl) {
   }
   return { route: "remote", apiKey };
 }
-function resolveConfiguredRunRouting(skill) {
-  return resolveRunRouting(skill, getApiKey(), resolveApiUrl());
+async function resolveConfiguredRunRouting(skill, env = process.env) {
+  let fleet;
+  let apiKey;
+  try {
+    fleet = resolveSkillsFleet(env);
+    apiKey = fleet.mode === "hosted" ? await resolveSkillsApiKey(env) : null;
+  } catch (error2) {
+    const isMissingCredential = (error2 instanceof SkillsFleetCredentialError || error2?.name === "SkillsFleetCredentialError") && error2.code === "MISSING_API_CREDENTIAL";
+    if (!isMissingCredential)
+      throw error2;
+    return {
+      route: "error",
+      code: "REMOTE_REQUIRES_CREDENTIAL",
+      error: `${skill.name} is a server-owned skill. ${error2.message}`
+    };
+  }
+  return resolveRunRouting(skill, apiKey, fleet.apiOrigin ?? undefined);
 }
 
 // src/mcp/operation-tools.ts
@@ -26131,7 +27287,7 @@ function registerOperationTools(server) {
         return mcpError("INVALID_BLOG_ARTICLE_OPTIONS", validation.errors.join(" "));
       }
     }
-    const routing = resolveConfiguredRunRouting(skill);
+    const routing = await resolveConfiguredRunRouting(skill);
     const runContext = createSkillRun({
       skill: skillName,
       args: runArgs,
@@ -26210,10 +27366,10 @@ function registerOperationTools(server) {
       detail: exports_external.boolean().optional()
     }
   }, async ({ run_id, detail }) => {
-    const { getApiKey: getApiKey2 } = await Promise.resolve().then(() => (init_auth_store(), exports_auth_store));
-    const apiKey = getApiKey2();
+    const { skillsCredentialOrReason: skillsCredentialOrReason2 } = await Promise.resolve().then(() => (init_fleet_credentials(), exports_fleet_credentials));
+    const { apiKey, reason } = await skillsCredentialOrReason2();
     if (!apiKey) {
-      return mcpError("AUTH_REQUIRED", "Remote run status requires API access. Run: skills auth login", ["skills auth login"]);
+      return mcpError("AUTH_REQUIRED", reason ?? "Remote run status requires API access. Run: skills auth login", ["skills auth login"]);
     }
     const localRun = findSkillRun(run_id);
     const remoteRunId = localRun?.remoteRunId || run_id;
@@ -26307,7 +27463,7 @@ function registerOperationTools(server) {
     const agents = [];
     for (const agent of AGENT_TARGETS) {
       const agentSkillsPath = getAgentSkillsDir(agent, "global");
-      const exists = existsSync14(agentSkillsPath);
+      const exists = existsSync13(agentSkillsPath);
       let skillCount = 0;
       if (exists) {
         try {
@@ -26358,19 +27514,29 @@ function compactRunToolPayload(payload, detailHint) {
 }
 
 // src/lib/feedback.ts
-init_api_url();
-init_config();
-import { appendFileSync, existsSync as existsSync15, mkdirSync as mkdirSync7 } from "fs";
-import { dirname as dirname6, join as join15 } from "path";
+import { appendFileSync, existsSync as existsSync14, mkdirSync as mkdirSync6 } from "fs";
+import { dirname as dirname5, join as join15 } from "path";
 import { Database } from "bun:sqlite";
+
+// src/lib/api-url.ts
+init_fleet_credentials();
+init_fleet_credentials();
+var API_URL_ENV_VAR = SKILLS_API_URL_ENV;
+var MISSING_API_URL_HINT = `run: skills auth login, or set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
+function resolveApiUrl(env = process.env, options = {}) {
+  const fleet = resolveSkillsFleet(env, options);
+  return fleet.mode === "hosted" ? fleet.apiOrigin : undefined;
+}
+
+// src/lib/feedback.ts
 function getFeedbackDbPath() {
   return join15(getDataDir(), "skills.db");
 }
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
-  const dir = dirname6(dbPath);
-  if (!existsSync15(dir))
-    mkdirSync7(dir, { recursive: true });
+  const dir = dirname5(dbPath);
+  if (!existsSync14(dir))
+    mkdirSync6(dir, { recursive: true });
   const db = new Database(dbPath);
   db.exec("PRAGMA journal_mode = WAL");
   db.exec([
@@ -26397,9 +27563,9 @@ function saveFeedback(input) {
   const category = input.category ?? "general";
   if (isApiMode()) {
     const path = join15(getDataDir(), "feedback.jsonl");
-    const dir = dirname6(path);
-    if (!existsSync15(dir))
-      mkdirSync7(dir, { recursive: true });
+    const dir = dirname5(path);
+    if (!existsSync14(dir))
+      mkdirSync6(dir, { recursive: true });
     appendFileSync(path, JSON.stringify({ message, category, email: input.email ?? null, agent: input.agent ?? null, version: input.version ?? null, createdAt: new Date().toISOString() }) + `
 `);
     return { saved: true, category, path };
@@ -26413,12 +27579,10 @@ function saveFeedback(input) {
   return { saved: true, category, path: getFeedbackDbPath() };
 }
 function isApiMode(env = process.env) {
-  if (env.HASNA_SKILLS_API_URL?.trim())
-    return true;
   try {
-    return Boolean(resolveApiUrl(undefined, env));
+    return Boolean(resolveApiUrl(env));
   } catch {
-    return Boolean(env.SKILLS_API_URL?.trim());
+    return true;
   }
 }
 
@@ -26546,14 +27710,14 @@ function registerResourceMetaTools(server) {
 }
 
 // src/lib/scheduler.ts
-import { existsSync as existsSync16, readFileSync as readFileSync12, writeFileSync as writeFileSync7, mkdirSync as mkdirSync8 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync12, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7 } from "fs";
 import { join as join16 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
   return join16(targetDir, ".skills", "schedules.json");
 }
 function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  if (existsSync16(path)) {
+  if (existsSync15(path)) {
     try {
       return JSON.parse(readFileSync12(path, "utf-8"));
     } catch {}
@@ -26563,9 +27727,9 @@ function loadSchedules(targetDir = process.cwd()) {
 function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
   const dir = join16(targetDir, ".skills");
-  if (!existsSync16(dir))
-    mkdirSync8(dir, { recursive: true });
-  writeFileSync7(path, JSON.stringify(data, null, 2));
+  if (!existsSync15(dir))
+    mkdirSync7(dir, { recursive: true });
+  writeFileSync6(path, JSON.stringify(data, null, 2));
 }
 function validateCronField(expr, min, max, label) {
   for (const part of expr.split(",")) {
@@ -26823,18 +27987,16 @@ function registerScheduleTools(server) {
 }
 
 // src/lib/native-storage.ts
-init_config();
 import { createHash as createHash3, createHmac } from "crypto";
 import {
-  existsSync as existsSync17,
-  mkdirSync as mkdirSync9,
+  existsSync as existsSync16,
+  mkdirSync as mkdirSync8,
   readFileSync as readFileSync13,
   readdirSync as readdirSync9,
   statSync as statSync9,
-  writeFileSync as writeFileSync8
+  writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname7, join as join17, normalize as normalize3, relative as relative3, sep as sep2 } from "path";
-init_retired_settings();
+import { dirname as dirname6, join as join17, normalize as normalize3, relative as relative3, sep as sep2 } from "path";
 var SKILLS_STORAGE_TABLES = [
   "skills_sync_records",
   "skills_sync_cursors"
@@ -26930,7 +28092,7 @@ function getStorageStatus(options = {}) {
 function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
   const projectStateDir = getProjectStateDir(targetDir);
   const files = [];
-  if (existsSync17(projectStateDir)) {
+  if (existsSync16(projectStateDir)) {
     for (const filePath of walkFiles2(projectStateDir)) {
       const bytes = readFileSync13(filePath);
       const relativePath = toPosix(relative3(targetDir, filePath));
@@ -27685,7 +28847,7 @@ var getRequestListener = (fetchCallback, options = {}) => {
   };
 };
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
 var import_content_type = __toESM(require_content_type(), 1);
 function mediaTypeEssence(header) {
   if (!header) {
@@ -27708,7 +28870,7 @@ function isJsonContentType(header) {
   return mediaTypeEssence(header) === "application/json";
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/sseKeepAlive.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/sseKeepAlive.js
 var DEFAULT_SSE_KEEP_ALIVE_MS = 15000;
 var MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
 function armSseKeepAlive(intervalMs, onTick) {
@@ -27720,7 +28882,7 @@ function armSseKeepAlive(intervalMs, onTick) {
   return timer;
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
 class WebStandardStreamableHTTPServerTransport {
   constructor(options = {}) {
     this._started = false;
@@ -28377,7 +29539,7 @@ data:
   }
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/streamableHttp.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/streamableHttp.js
 class StreamableHTTPServerTransport {
   constructor(options = {}) {
     this._requestContext = new WeakMap;