@hasna/skills 0.2.0 → 0.3.0

package/dist/index.js

@@ -57,7 +57,12 @@ import { join as join2, dirname } from "path";
 // src/lib/retired-settings.ts
 var RETIRED_ENV_SUFFIXES = ["_STORAGE_MODE", "_DEPLOYMENT_MODE", "_CLOUD_MODE"];
 var RETIRED_CONFIG_KEYS = {
-  mode: "apiUrl"
+  mode: "a configured API origin",
+  apiUrl: "skills setup --api-url <origin>"
+};
+var RETIRED_CONFIG_KEY_REASONS = {
+  mode: "Deployment modes were removed: a Skills client either resolves a credential " + "or it does not, and that is the whole of it.",
+  apiUrl: "The service address is no longer kept in this app's config file: it is read from " + "HASNA_SKILLS_API_URL, then the macOS Keychain item hasna.credentials.skills.api-url, " + "then ~/.hasna/skills/config/credentials, then the fleet gateway."
 };
 
 class RetiredSettingError extends Error {
@@ -96,7 +101,7 @@ function assertNoRetiredConfigKeys(config, source) {
   for (const [key, replacement] of Object.entries(RETIRED_CONFIG_KEYS)) {
     if (!(key in config))
       continue;
-    throw new RetiredSettingError(key, `${source}: "${key}" is no longer a configuration key. ` + "Deployment modes were removed: a Skills client either has an API origin " + "configured or it does not, and that is the whole of it. " + `Use "${replacement}" instead (skills config set ${replacement} <origin>), and ` + `remove the old key with: skills config unset ${key}. ` + "Refused rather than ignored, because silently dropping it would leave an " + "operator believing they had pointed this install at a server.");
+    throw new RetiredSettingError(key, `${source}: "${key}" is no longer a configuration key. ` + `${RETIRED_CONFIG_KEY_REASONS[key] ?? ""} ` + `Use ${replacement} instead, and remove the old key with: skills config unset ${key}. ` + "Refused rather than ignored, because silently dropping it would leave an " + "operator believing they had pointed this install at a server.");
   }
 }
 
@@ -224,7 +229,7 @@ var ENUM_KEYS = {
   defaultScope: ["global", "project"],
   format: ["compact", "json", "csv"]
 };
-var STRING_KEYS = ["apiUrl", "extensionsDir"];
+var STRING_KEYS = ["extensionsDir"];
 function validKeys() {
   return [...Object.keys(ENUM_KEYS), ...STRING_KEYS];
 }
@@ -255,16 +260,6 @@ function normalizeConfigValue(key, value) {
   const allowed = allowedValues(key);
   if (allowed)
     return allowed.includes(value) ? value : undefined;
-  if (key === "apiUrl") {
-    try {
-      const url = new URL(value);
-      if (url.protocol !== "http:" && url.protocol !== "https:")
-        return;
-      return value.replace(/\/+$/, "");
-    } catch {
-      return;
-    }
-  }
   if (key === "extensionsDir")
     return value.trim() ? value : undefined;
   return;
@@ -334,7 +329,7 @@ function saveConfig(key, value, scope = "project") {
   const normalized = normalizeConfigValue(key, value);
   if (normalized === undefined) {
     const allowed = allowedValues(key);
-    throw new Error(allowed ? `Invalid value '${value}' for ${key}. Allowed: ${allowed.join(", ")}` : `Invalid value '${value}' for ${key}. Expected ${key === "apiUrl" ? "an http(s) URL" : "a non-empty path"}`);
+    throw new Error(allowed ? `Invalid value '${value}' for ${key}. Allowed: ${allowed.join(", ")}` : `Invalid value '${value}' for ${key}. Expected a non-empty path`);
   }
   const filePath = getConfigPath(scope);
   let existing = {};
@@ -1842,7 +1837,7 @@ function readPortableSkillManifest(skillPath, fallbackName = basename(skillPath)
   const pkg = existsSync6(pkgPath) ? readJsonObject(pkgPath) : undefined;
   const name = normalizePortableSkillName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
   const description = stringField(jsonManifest, "description") ?? frontmatter?.description ?? stringValue(pkg?.description) ?? `${name} skill`;
-  const version = stringField(jsonManifest, "version") ?? frontmatter?.version ?? stringValue(pkg?.version) ?? PORTABLE_SKILL_DEFAULT_VERSION;
+  const version = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
   const kind = parseSkillKind(stringField(jsonManifest, "kind") ?? frontmatter?.kind);
   const commands = parseManifestCommands(jsonManifest) ?? (kind === "instruction" ? [] : inferPackageCommands(pkg, name)) ?? [];
   return {
@@ -1866,6 +1861,15 @@ function parseSkillKind(value) {
     return value;
   return;
 }
+function readDeclaredSkillVersion(skillPath) {
+  const skillJsonPath = join6(skillPath, "skill.json");
+  const skillMdPath = join6(skillPath, "SKILL.md");
+  const pkgPath = join6(skillPath, "package.json");
+  const jsonManifest = existsSync6(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
+  const frontmatter = existsSync6(skillMdPath) ? parseSkillFrontmatter(readFileSync5(skillMdPath, "utf-8")) ?? undefined : undefined;
+  const pkg = existsSync6(pkgPath) ? readJsonObject(pkgPath) : undefined;
+  return stringField(jsonManifest, "version") ?? frontmatter?.version ?? stringValue(pkg?.version);
+}
 function createInstructionManifest(name, options) {
   return {
     $schema: PORTABLE_SKILL_SCHEMA,
@@ -4181,7 +4185,8 @@ function getSkillRequirements(name) {
       }
     }
     envVars.delete("SKILL_API_KEY");
-    envVars.add("SKILLS_API_KEY");
+    envVars.delete("SKILLS_API_KEY");
+    envVars.add("HASNA_SKILLS_API_KEY");
   }
   const systemDeps = new Set;
   const depPatterns = [
@@ -8400,65 +8405,815 @@ var coerce = {
   date: (arg) => ZodDate.create({ ...arg, coerce: true })
 };
 var NEVER = INVALID;
-// src/lib/api-url.ts
-var API_URL_ENV_VAR = "SKILLS_API_URL";
-var API_URL_CONFIG_KEY = "apiUrl";
-var MISSING_API_URL_HINT = `set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
+// ../contracts/dist/client/transport.js
+import { isIP } from "net";
+import { spawnSync } from "child_process";
+import { closeSync, fstatSync, openSync, readFileSync as readFileSync12 } from "fs";
+import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
+import { createRequire } from "module";
+import { hostname as osHostname } from "os";
+import { isAbsolute as isAbsolute3, join as join14 } from "path";
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function clientTransportEnvKeys(name) {
+  const envSegment = envToken(name);
+  return {
+    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
+    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
+  };
+}
+function credentialOverrideEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
+}
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE";
+function credentialPointerEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_REF`;
+}
 
-class MissingApiUrlError extends Error {
-  code = "MISSING_API_URL";
-  constructor(action = "This command") {
-    super(`${action} requires a Skills API URL and none is configured \u2014 ${MISSING_API_URL_HINT}`);
-    this.name = "MissingApiUrlError";
+class CredentialResolutionError extends Error {
+  appName;
+  attempted;
+  constructor(appName, message, attempted) {
+    super(message);
+    this.name = "CredentialResolutionError";
+    this.appName = appName;
+    this.attempted = attempted;
   }
 }
-function resolveApiUrl(config = loadConfig(), env = process.env) {
-  const raw = env[API_URL_ENV_VAR] || config[API_URL_CONFIG_KEY];
-  const trimmed = raw?.trim().replace(/\/+$/, "");
-  return trimmed || undefined;
+
+class CredentialFileUnsafeError extends Error {
+  path;
+  constructor(path, reason) {
+    super(`Refusing unsafe credential/config file ${path}: ${reason}.`);
+    this.name = "CredentialFileUnsafeError";
+    this.path = path;
+  }
 }
-function requireApiUrl(action = "This command", config, env) {
-  const resolved = resolveApiUrl(config ?? loadConfig(), env ?? process.env);
-  if (!resolved)
-    throw new MissingApiUrlError(action);
-  return resolved;
+var HASNA_HOME_ENV_KEY = "HASNA_HOME";
+var HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME";
+var KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION";
+var HASNA_HOME_DIR = ".hasna";
+var CONFIG_SUBDIR = "config";
+var CREDENTIALS_FILE = "credentials";
+var KEYCHAIN_SECURITY_BIN = "/usr/bin/security";
+var KEYCHAIN_SERVICE_PREFIX = "hasna.credentials";
+var KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44;
+var KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4;
+var MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
+var SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+var SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+var ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+var VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
+function homeDir(env) {
+  const home = env.HOME?.trim();
+  return home ? home : null;
+}
+function absoluteOverride(env, key) {
+  const value = env[key]?.trim();
+  return value && isAbsolute3(value) ? value : null;
+}
+function hasnaHomeDir(env) {
+  const override = absoluteOverride(env, HASNA_HOME_ENV_KEY);
+  if (override)
+    return override;
+  const home = homeDir(env);
+  return home ? join14(home, HASNA_HOME_DIR) : null;
+}
+function appConfigDir(name, env) {
+  const configRoot = absoluteOverride(env, HASNA_CONFIG_HOME_ENV_KEY);
+  if (configRoot)
+    return join14(configRoot, name);
+  const root = hasnaHomeDir(env);
+  return root ? join14(root, name, CONFIG_SUBDIR) : null;
+}
+function credentialDiskSourceList(name, env, profile = null) {
+  if (!SAFE_APP_SLUG.test(name))
+    return [];
+  const directory = appConfigDir(name, env);
+  if (!directory)
+    return [];
+  const file = profile ? `${CREDENTIALS_FILE}-${profile}` : CREDENTIALS_FILE;
+  return [{ path: join14(directory, file), tier: "disk" }];
 }
-
-// src/lib/auth-store.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync7, unlinkSync } from "fs";
-import { dirname as dirname6, join as join14 } from "path";
-import { homedir as homedir4 } from "os";
-function getAuthFilePath() {
-  return join14(getDataDir(), "auth.json");
+function credentialDiskSources(name, env) {
+  return credentialDiskSourceList(name, env, null).map((s) => s.path);
+}
+function profileDiskSources(name, env, profile) {
+  return credentialDiskSourceList(name, env, profile).map((s) => s.path);
+}
+function parseEnvFile(text) {
+  const values = new Map;
+  const unusable = new Set;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#"))
+      continue;
+    const withoutExport = line.startsWith("export ") ? line.slice("export ".length).trim() : line;
+    const equals = withoutExport.indexOf("=");
+    if (equals <= 0)
+      continue;
+    const key = withoutExport.slice(0, equals).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+      continue;
+    let value = withoutExport.slice(equals + 1).trim();
+    const quote = value[0];
+    if (quote === '"' || quote === "'") {
+      if (value.length < 2 || !value.endsWith(quote)) {
+        unusable.add(key);
+        continue;
+      }
+      value = value.slice(1, -1);
+    }
+    if (value.trim().length === 0) {
+      unusable.add(key);
+      continue;
+    }
+    if (values.has(key) && values.get(key) !== value)
+      unusable.add(key);
+    values.set(key, value);
+  }
+  return { values, unusable };
 }
-function legacyAuthFilePath() {
-  return join14(process.env["HOME"] || process.env["USERPROFILE"] || homedir4(), ".skills", "auth.json");
+function configFileModeAllowed(mode) {
+  const permissions = mode & 4095;
+  return permissions === 256 || permissions === 384;
 }
-var cachedConfig;
-function getAuthConfig() {
-  if (cachedConfig !== undefined)
-    return cachedConfig;
+function configFileReadsCoherent(before, after) {
+  return before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs;
+}
+function readAppConfigFile(path) {
+  const unsafe = (reason) => {
+    throw new CredentialFileUnsafeError(path, reason);
+  };
+  let fd = -1;
   try {
-    const file = existsSync14(getAuthFilePath()) ? getAuthFilePath() : legacyAuthFilePath();
-    const raw = readFileSync12(file, "utf-8");
-    const config = JSON.parse(raw);
-    if (!config.apiKey) {
-      cachedConfig = null;
+    fd = openSync(path, O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR")
       return null;
+    if (code === "ELOOP")
+      unsafe("the path is a symlink");
+    unsafe(`the path could not be opened (${code ?? "unknown error"})`);
+  }
+  try {
+    const before = fstatSync(fd);
+    if (!before.isFile())
+      unsafe("the path is not a regular file");
+    if (!configFileModeAllowed(before.mode)) {
+      unsafe(`permission mode ${(before.mode & 4095).toString(8).padStart(4, "0")} is not owner-only 0400 or 0600`);
+    }
+    const uid = process.getuid?.() ?? process.geteuid?.();
+    if (uid !== undefined && before.uid !== uid)
+      unsafe("the file is not owned by the current user");
+    if (before.size > MAX_CREDENTIAL_FILE_BYTES)
+      unsafe("the file exceeds the size limit");
+    const bytes = readFileSync12(fd);
+    const after = fstatSync(fd);
+    if (!configFileReadsCoherent(before, after)) {
+      unsafe("the file changed while being read");
+    }
+    return parseEnvFile(bytes.toString("utf8"));
+  } finally {
+    if (fd !== -1)
+      closeSync(fd);
+  }
+}
+function readCredentialFile(path, apiKeyKeys) {
+  const parsed = readAppConfigFile(path);
+  if (!parsed)
+    return null;
+  for (const key of apiKeyKeys) {
+    if (parsed.unusable.has(key)) {
+      throw new CredentialFileUnsafeError(path, `${key} is declared but blank or malformed`);
     }
-    cachedConfig = config;
-    return config;
-  } catch {
-    cachedConfig = null;
+  }
+  const values = apiKeyKeys.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+  if (new Set(values).size > 1) {
+    throw new CredentialFileUnsafeError(path, "credential aliases disagree");
+  }
+  return values[0] ?? null;
+}
+var CREDENTIAL_SHAPED_KEY = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
+function appConfigDiskValue(name, env, keys) {
+  const wanted = keys.filter((key) => !CREDENTIAL_SHAPED_KEY.test(key));
+  if (wanted.length === 0)
+    return null;
+  for (const path of credentialDiskSources(name, env)) {
+    const parsed = readAppConfigFile(path);
+    if (!parsed)
+      continue;
+    if (wanted.some((key) => parsed.unusable.has(key))) {
+      return { key: wanted.find((key) => parsed.unusable.has(key)), value: "", path, unusable: true };
+    }
+    const values = wanted.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+    if (new Set(values).size > 1)
+      throw new CredentialFileUnsafeError(path, "configuration aliases disagree");
+    for (const key of wanted) {
+      if (parsed.unusable.has(key))
+        return { key, value: "", path, unusable: true };
+      const value = parsed.values.get(key)?.trim();
+      if (value)
+        return { key, value, path };
+    }
+  }
+  return null;
+}
+function assertUsableCredential(appName, source, value) {
+  if (VAULT_POINTER_SHAPE.test(value)) {
+    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+  }
+  if (!ILLEGAL_IN_HEADER_VALUE.test(value))
+    return;
+  throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
+}
+var INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+var CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
+function sealCredential(fields) {
+  const { apiKey } = fields;
+  const visible = {
+    tier: fields.tier,
+    source: fields.source,
+    deliberate: fields.deliberate,
+    diskCandidates: Object.freeze([...fields.diskCandidates]),
+    warning: fields.warning
+  };
+  const sealed = { ...visible };
+  Object.defineProperty(sealed, "apiKey", {
+    value: apiKey,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  if (fields.pointerVaultKey !== undefined) {
+    Object.defineProperty(sealed, "pointerVaultKey", {
+      value: fields.pointerVaultKey,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  Object.defineProperty(sealed, INSPECT_CUSTOM, {
+    value: () => ({ ...visible, apiKey: "[redacted]" }),
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(sealed, CREDENTIAL_SEAL, {
+    value: true,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  return Object.freeze(sealed);
+}
+function firstEnvValue(env, keys) {
+  for (const key of keys) {
+    if (!Object.prototype.hasOwnProperty.call(env, key))
+      continue;
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
+}
+var AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+function isAmbientEnvironment(env) {
+  return env === process.env || env[AMBIENT_ENVIRONMENT] === true;
+}
+function defaultKeychainRunner(argv) {
+  const result = spawnSync(KEYCHAIN_SECURITY_BIN, [...argv], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: KEYCHAIN_SPAWN_TIMEOUT_MS
+  });
+  return {
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.error ? result.error.message : result.stderr ?? ""
+  };
+}
+function keychainTierEnabled(env, options) {
+  if ((options.platform ?? process.platform) !== "darwin")
+    return false;
+  if (options.enabled !== undefined)
+    return options.enabled;
+  return options.run !== undefined || isAmbientEnvironment(env);
+}
+function keychainAccount(env, options) {
+  const station = env[KEYCHAIN_STATION_ENV_KEY]?.trim();
+  if (station)
+    return station;
+  const host = (options.hostname ?? osHostname)().split(".")[0]?.trim() ?? "";
+  if (host)
+    return host;
+  const user = env.USER?.trim();
+  return user || null;
+}
+function keychainFailureHint(text) {
+  const line = text.split(/\r?\n/).find((entry) => entry.trim().length > 0)?.trim() ?? "";
+  const clean = line.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 200);
+  return clean ? `: ${clean}` : "";
+}
+function readKeychainItem(name, env, kind, options) {
+  if (!SAFE_APP_SLUG.test(name) || !keychainTierEnabled(env, options))
+    return null;
+  const account = keychainAccount(env, options);
+  if (!account)
+    return null;
+  const service = `${KEYCHAIN_SERVICE_PREFIX}.${name}.${kind}`;
+  const source = `keychain:${service}@${account}`;
+  const run = options.run ?? defaultKeychainRunner;
+  let result;
+  try {
+    result = run(["find-generic-password", "-a", account, "-s", service, "-w"]);
+  } catch (error) {
+    const reason = keychainFailureHint(error instanceof Error ? error.message : String(error));
+    throw new CredentialResolutionError(name, `The Keychain lookup for ${source} could not run${reason}. A Keychain failure is never resolved ` + `around: fix the keychain, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  if (result.status === KEYCHAIN_ITEM_NOT_FOUND_STATUS)
     return null;
+  if (result.status !== 0) {
+    throw new CredentialResolutionError(name, `The Keychain lookup for ${source} failed (security exited ` + `${result.status ?? "without a status"}${keychainFailureHint(result.stderr)}). A Keychain item that ` + `exists but cannot be read is never resolved around: unlock the keychain, run from a session that ` + `may use it, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  const value = result.stdout.trim();
+  if (!value) {
+    throw new CredentialResolutionError(name, `${source} exists but holds an empty value; a declared item never falls through to another ` + `identity. Store a value in it or delete the item.`, [source]);
+  }
+  return { value, source };
+}
+function keychainConfigValue(name, env, options = {}) {
+  return readKeychainItem(name, env, "api-url", options);
+}
+function snapshotClientEnvironment(name, env) {
+  const keys = clientTransportEnvKeys(name);
+  const ambient = isAmbientEnvironment(env);
+  const snapshot = Object.create(null);
+  for (const key of [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey(name),
+    credentialPointerEnvKey(name),
+    CREDENTIAL_PROFILE_ENV_KEY,
+    "HOME",
+    HASNA_HOME_ENV_KEY,
+    HASNA_CONFIG_HOME_ENV_KEY,
+    KEYCHAIN_STATION_ENV_KEY,
+    "USER"
+  ]) {
+    const descriptor = Object.getOwnPropertyDescriptor(env, key);
+    if (!descriptor)
+      continue;
+    if (!("value" in descriptor)) {
+      throw new CredentialResolutionError(name, `${key} is accessor-backed; client configuration requires own data properties.`, [key]);
+    }
+    if (descriptor.value !== undefined && typeof descriptor.value !== "string") {
+      throw new CredentialResolutionError(name, `${key} must be a string data property.`, [key]);
+    }
+    snapshot[key] = descriptor.value;
+  }
+  if (ambient) {
+    Object.defineProperty(snapshot, AMBIENT_ENVIRONMENT, {
+      value: true,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  return Object.freeze(snapshot);
+}
+function resolveCredential(name, env, options = {}) {
+  env = snapshotClientEnvironment(name, env);
+  const { apiKeyKeys } = clientTransportEnvKeys(name);
+  const diskPaths = credentialDiskSources(name, env);
+  if (options.apiKey !== undefined) {
+    const explicitKey = options.apiKey.trim();
+    if (!explicitKey) {
+      throw new CredentialResolutionError(name, "The explicit apiKey argument is blank; an explicit credential never falls through to another identity.", ["explicit apiKey argument"]);
+    }
+    assertUsableCredential(name, "the explicit apiKey argument", explicitKey);
+    return sealCredential({
+      apiKey: explicitKey,
+      tier: "argument",
+      source: "explicit apiKey argument",
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const overrideKeyName = credentialOverrideEnvKey(name);
+  const overrideRaw = Object.prototype.hasOwnProperty.call(env, overrideKeyName) ? env[overrideKeyName] : undefined;
+  if (overrideRaw !== undefined) {
+    const override = overrideRaw.trim();
+    if (!override) {
+      throw new CredentialResolutionError(name, `${overrideKeyName} is set but empty. It is a deliberate override, so it is not resolved around: ` + `either give it a real key or unset it to fall back to the credential on disk.`, [overrideKeyName]);
+    }
+    assertUsableCredential(name, overrideKeyName, override);
+    return sealCredential({
+      apiKey: override,
+      tier: "override",
+      source: overrideKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const pointerKeyName = credentialPointerEnvKey(name);
+  const pointerRaw = Object.prototype.hasOwnProperty.call(env, pointerKeyName) ? env[pointerKeyName] : undefined;
+  if (pointerRaw !== undefined) {
+    const pointer = pointerRaw.trim();
+    if (!pointer) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
+    }
+    if (!VAULT_POINTER_SHAPE.test(pointer)) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
+    }
+    return sealCredential({
+      apiKey: "",
+      pointerVaultKey: pointer,
+      tier: "pointer",
+      source: pointerKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  if (options.profile !== undefined && !options.profile.trim()) {
+    throw new CredentialResolutionError(name, "The explicit profile argument is blank; an explicit identity selection never falls through.", ["explicit profile argument"]);
+  }
+  const profileRaw = Object.prototype.hasOwnProperty.call(env, CREDENTIAL_PROFILE_ENV_KEY) ? env[CREDENTIAL_PROFILE_ENV_KEY] : undefined;
+  if (profileRaw !== undefined && !profileRaw.trim()) {
+    throw new CredentialResolutionError(name, `${CREDENTIAL_PROFILE_ENV_KEY} is set but blank.`, [CREDENTIAL_PROFILE_ENV_KEY]);
+  }
+  const profile = options.profile?.trim() || profileRaw?.trim();
+  if (profile) {
+    const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
+    if (!SAFE_PROFILE.test(profile)) {
+      throw new CredentialResolutionError(name, `Profile name from ${profileSource} is not usable in a path. ` + `Use letters, digits, dot, dash, or underscore.`, [profileSource]);
+    }
+    const paths = profileDiskSources(name, env, profile);
+    for (const path of paths) {
+      const value = readCredentialFile(path, apiKeyKeys);
+      if (value) {
+        assertUsableCredential(name, path, value);
+        return sealCredential({
+          apiKey: value,
+          tier: "profile",
+          source: path,
+          deliberate: true,
+          diskCandidates: paths,
+          warning: null
+        });
+      }
+    }
+    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
+  }
+  const definedEnvEntries = apiKeyKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, value: String(env[key]).trim() }));
+  const blankEnv = definedEnvEntries.find((entry) => entry.value.length === 0);
+  if (blankEnv) {
+    throw new CredentialResolutionError(name, `${blankEnv.key} is set but blank; a declared credential never falls through to another alias or identity.`, [blankEnv.key]);
+  }
+  if (definedEnvEntries.length > 1 && new Set(definedEnvEntries.map((entry) => entry.value)).size > 1) {
+    throw new CredentialResolutionError(name, `${definedEnvEntries.map((entry) => entry.key).join(" and ")} disagree; credential aliases must be identical or only one may be set.`, definedEnvEntries.map((entry) => entry.key));
+  }
+  const envHit = firstEnvValue(env, apiKeyKeys);
+  const keychainHit = readKeychainItem(name, env, "api-key", options.keychain ?? {});
+  if (keychainHit) {
+    assertUsableCredential(name, keychainHit.source, keychainHit.value);
+    const warning = envHit && envHit.value !== keychainHit.value ? `Credential sources disagree for '${name}': ${keychainHit.source} and ${envHit.key} hold ` + `different keys. ${keychainHit.source} wins, because the Keychain is re-read on every call while ` + `an environment variable is a snapshot. Reconcile them \u2014 a rotation that updated only one leaves ` + `the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: keychainHit.value,
+      tier: "keychain",
+      source: keychainHit.source,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  const diskSourceList = credentialDiskSourceList(name, env, null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  if (diskHits.length > 0) {
+    const winner = diskHits[0];
+    assertUsableCredential(name, winner.src.path, winner.value);
+    const divergentSources = [
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
+      ...envHit && envHit.value !== winner.value ? [envHit.key] : []
+    ];
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: winner.value,
+      tier: winner.src.tier,
+      source: winner.src.path,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  if (envHit) {
+    assertUsableCredential(name, envHit.key, envHit.value);
+    return sealCredential({
+      apiKey: envHit.value,
+      tier: "env",
+      source: envHit.key,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  return null;
+}
+var SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+var requireSecretsSdk = createRequire(import.meta.url);
+async function completePointerCredential(name, pointerResolution, env = process.env) {
+  const vaultKey = pointerResolution.pointerVaultKey;
+  const pointerEnvKey = pointerResolution.source;
+  if (!vaultKey) {
+    throw new CredentialResolutionError(name, `Pointer resolution from ${pointerEnvKey} carries no vault item key; this is a defect in the resolver.`, [pointerEnvKey]);
+  }
+  let secretsSdk;
+  try {
+    secretsSdk = requireSecretsSdk(SECRETS_PACKAGE_SPECIFIER);
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
+  }
+  let client;
+  try {
+    client = secretsSdk.createSecretsClientFromEnv(env);
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets client could not be configured from this ` + `environment (the secrets service URL and key env are missing or invalid). A vault pointer is TERMINAL and ` + `never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  let secret;
+  try {
+    secret = await client.getSecret({ key: vaultKey });
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the vault could not be reached or the item is ` + `unavailable. A vault pointer is TERMINAL and never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  const value = secret.value;
+  if (!value) {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} resolved vault item '${vaultKey}', but it holds no value. A vault pointer is TERMINAL.`, [pointerEnvKey]);
+  }
+  assertUsableCredential(name, `${pointerEnvKey} -> vault:${vaultKey}`, value);
+  return sealCredential({
+    apiKey: value,
+    tier: "pointer",
+    source: `${pointerEnvKey} -> vault:${vaultKey}`,
+    deliberate: true,
+    diskCandidates: pointerResolution.diskCandidates,
+    warning: null
+  });
+}
+var DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com";
+var DEFAULT_AUTHORITY_SOURCE = "default";
+function defaultFleetGatewayBaseUrl(name) {
+  return `${DEFAULT_FLEET_GATEWAY_ORIGIN}/${validateAppSlug(name)}`;
+}
+var ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
+var DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+function isValidDnsDomain(value) {
+  if (value.length === 0 || value.length > 253 || ASCII_CONTROL_PATTERN.test(value) || /[^\x00-\x7f]/.test(value)) {
+    return false;
   }
+  return value.split(".").every((label) => label.length <= 63 && !label.startsWith("xn--") && DNS_LABEL_PATTERN.test(label));
 }
-function getApiKey() {
-  if (process.env.SKILLS_API_KEY)
-    return process.env.SKILLS_API_KEY;
-  if (process.env.SKILL_API_KEY)
-    return process.env.SKILL_API_KEY;
-  return getAuthConfig()?.apiKey || null;
+function validateAppSlug(name) {
+  if (name.length > 63 || !DNS_LABEL_PATTERN.test(name)) {
+    throw new Error("App name must be one lowercase DNS label.");
+  }
+  return name;
+}
+function rawAuthority(value) {
+  const match = /^[a-z][a-z0-9+.-]*:\/\//i.exec(value);
+  if (!match)
+    throw new Error("API URL must be absolute.");
+  const afterScheme = value.slice(match[0].length);
+  const boundary = afterScheme.search(/[/?#]/);
+  const authority = boundary === -1 ? afterScheme : afterScheme.slice(0, boundary);
+  if (!authority)
+    throw new Error("API URL must include a hostname.");
+  return authority;
+}
+function assertCanonicalPort(port) {
+  if (!/^[0-9]+$/.test(port) || port.length > 1 && port.startsWith("0")) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
+  }
+  const numericPort = Number(port);
+  if (!Number.isSafeInteger(numericPort) || numericPort < 1 || numericPort > 65535) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
+  }
+}
+function canonicalAuthorityHostname(authority) {
+  let rawHostname;
+  if (authority.startsWith("[")) {
+    const closingBracket = authority.indexOf("]");
+    if (closingBracket === -1) {
+      throw new Error("API URL authority must contain a canonical hostname.");
+    }
+    rawHostname = authority.slice(0, closingBracket + 1);
+    const portSuffix = authority.slice(closingBracket + 1);
+    if (portSuffix) {
+      if (!portSuffix.startsWith(":")) {
+        throw new Error("API URL authority must contain a canonical hostname and port.");
+      }
+      assertCanonicalPort(portSuffix.slice(1));
+    }
+    if (isIP(rawHostname.slice(1, -1)) !== 6) {
+      throw new Error("API URL authority must contain a canonical IPv6 literal.");
+    }
+  } else {
+    const firstColon = authority.indexOf(":");
+    const lastColon = authority.lastIndexOf(":");
+    if (firstColon !== lastColon) {
+      throw new Error("IPv6 API URL authorities must use brackets.");
+    }
+    if (lastColon !== -1) {
+      const port = authority.slice(lastColon + 1);
+      assertCanonicalPort(port);
+      rawHostname = authority.slice(0, lastColon);
+    } else {
+      rawHostname = authority;
+    }
+    const ipVersion = isIP(rawHostname);
+    const numericAddressParts = rawHostname.split(".");
+    const looksLikeNonCanonicalIpv4 = numericAddressParts.every((part) => /^(?:0x[0-9a-f]+|[0-9]+)$/i.test(part));
+    if (ipVersion !== 4 && looksLikeNonCanonicalIpv4 || ipVersion !== 4 && !isValidDnsDomain(rawHostname.toLowerCase())) {
+      throw new Error("API URL authority must contain a canonical ASCII hostname.");
+    }
+  }
+  return rawHostname.toLowerCase();
+}
+function isDeliberateLoopbackHttpAuthority(authority) {
+  return /^(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?$/i.test(authority);
+}
+function toV1BaseUrl(apiUrl) {
+  if (ASCII_CONTROL_PATTERN.test(apiUrl)) {
+    throw new Error("API URL must not contain ASCII control characters.");
+  }
+  const input = apiUrl.trim();
+  const authority = rawAuthority(input);
+  if (authority.includes("@") || authority.includes("\\") || authority.includes("%") || /[^\x00-\x7f]/.test(authority)) {
+    throw new Error("API URL authority must be canonical ASCII without credentials.");
+  }
+  const canonicalHostname = canonicalAuthorityHostname(authority);
+  const url = new URL(input);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("API URL must use http or https.");
+  }
+  if (url.username || url.password) {
+    throw new Error("API URL must not include credentials.");
+  }
+  if (!url.hostname || url.hostname.endsWith(".")) {
+    throw new Error("API URL must include a canonical hostname.");
+  }
+  if (url.hostname.toLowerCase() !== canonicalHostname) {
+    throw new Error("API URL authority must not rely on parser hostname normalization.");
+  }
+  if (url.hostname.split(".").some((label) => label.toLowerCase().startsWith("xn--"))) {
+    throw new Error("API URL must not use IDN or punycode hostnames.");
+  }
+  if (url.protocol === "http:" && !isDeliberateLoopbackHttpAuthority(authority)) {
+    throw new Error("API URL may use http only for an exact loopback authority.");
+  }
+  if (url.search || url.hash) {
+    throw new Error("API URL must not include a query string or fragment.");
+  }
+  let path = url.pathname.replace(/\/+$/, "");
+  if (path.endsWith("/v1"))
+    path = path.slice(0, -"/v1".length);
+  url.pathname = `${path}/v1`;
+  return url.toString().replace(/\/+$/, "");
+}
+class ClientTransportConfigurationError extends Error {
+  appName;
+  sources;
+  constructor(appName, message, sources = []) {
+    super(message);
+    this.name = "ClientTransportConfigurationError";
+    this.appName = appName;
+    this.sources = Object.freeze([...sources]);
+  }
+}
+function resolveClientTransportSnapshot(name, env = process.env, options = {}) {
+  env = snapshotClientEnvironment(name, env);
+  const keys = clientTransportEnvKeys(name);
+  const definedUrlEntries = keys.apiUrlKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, raw: String(env[key]) }));
+  const blankUrl = definedUrlEntries.find((entry) => entry.raw.trim().length === 0);
+  if (blankUrl) {
+    throw new ClientTransportConfigurationError(name, `${blankUrl.key} is set but blank; public clients require an explicit HTTPS API URL and never select local storage.`, [blankUrl.key]);
+  }
+  const controlledUrl = definedUrlEntries.find((entry) => ASCII_CONTROL_PATTERN.test(entry.raw));
+  if (controlledUrl) {
+    throw new ClientTransportConfigurationError(name, `${controlledUrl.key} contains ASCII control characters.`, [controlledUrl.key]);
+  }
+  const usableUrlEntries = definedUrlEntries.map((entry) => ({ key: entry.key, value: entry.raw.trim() }));
+  if (usableUrlEntries.length > 1 && new Set(usableUrlEntries.map((entry) => entry.value)).size > 1) {
+    throw new ClientTransportConfigurationError(name, `${usableUrlEntries.map((entry) => entry.key).join(" and ")} disagree; client authority aliases must be identical or only one may be set.`, usableUrlEntries.map((entry) => entry.key));
+  }
+  const envUrlHit = usableUrlEntries[0] ?? null;
+  const keychainUrlHit = keychainConfigValue(name, env, options.credentials?.keychain);
+  const diskConfigUrlHit = appConfigDiskValue(name, env, keys.apiUrlKeys);
+  if (diskConfigUrlHit?.unusable) {
+    throw new ClientTransportConfigurationError(name, `${diskConfigUrlHit.key} in ${diskConfigUrlHit.path} is declared but blank or malformed; public clients require a valid HTTPS service authority.`, [diskConfigUrlHit.path]);
+  }
+  const urlCandidates = [
+    ...envUrlHit ? [envUrlHit] : [],
+    ...keychainUrlHit ? [{ key: keychainUrlHit.source, value: keychainUrlHit.value }] : [],
+    ...diskConfigUrlHit ? [{ key: diskConfigUrlHit.path, value: diskConfigUrlHit.value.trim() }] : []
+  ];
+  const configuredUrl = urlCandidates[0] ?? null;
+  const divergentUrls = urlCandidates.filter((candidate) => candidate.value !== configuredUrl?.value);
+  if (configuredUrl && divergentUrls.length > 0) {
+    throw new ClientTransportConfigurationError(name, `${configuredUrl.key} and ${divergentUrls.map((candidate) => candidate.key).join(" and ")} select different service authorities; refusing to send a credential written for one authority to the other.`, urlCandidates.map((candidate) => candidate.key));
+  }
+  const warnings = [];
+  if (configuredUrl && !envUrlHit) {
+    warnings.push(`No ${keys.apiUrlKeys[0]} in the environment; the server URL in ${configuredUrl.key} was used, so this client connects to the server. ` + `Keep that entry aligned with the intended service authority.`);
+  }
+  const credential = resolveCredential(name, env, options.credentials);
+  if (!credential) {
+    const diskHint = credentialDiskSourcesForMessage(name, env);
+    const lead = configuredUrl ? `${configuredUrl.key} selects the HTTP server for '${name}', but no API key could be resolved` : `${keys.apiUrlKeys[0]} is not set and no API key could be resolved for '${name}'; a credential is required before the default fleet gateway authority applies`;
+    warnings.push(`${lead}; refusing to create an unauthenticated client \u2014 public clients never fall back to SQLite or another local store. ` + `Looked in the Keychain (macOS only), then for a credential file at ${diskHint}, then for ${keys.apiKeyKeys[0]} in the environment.`);
+    throw new ClientTransportConfigurationError(name, warnings.join(" "), [configuredUrl?.key ?? keys.apiUrlKeys[0]]);
+  }
+  if (credential.warning)
+    warnings.push(credential.warning);
+  let urlHit;
+  if (configuredUrl) {
+    urlHit = configuredUrl;
+  } else {
+    try {
+      urlHit = { key: DEFAULT_AUTHORITY_SOURCE, value: defaultFleetGatewayBaseUrl(name) };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new ClientTransportConfigurationError(name, `No ${keys.apiUrlKeys[0]} is configured and the default fleet gateway authority cannot be composed for '${name}': ${message}`, [keys.apiUrlKeys[0]]);
+    }
+  }
+  const apiUrlSource = urlHit.key;
+  let baseUrl;
+  try {
+    baseUrl = toV1BaseUrl(urlHit.value);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new ClientTransportConfigurationError(name, `Invalid API URL from ${apiUrlSource}: ${message}`, [apiUrlSource]);
+  }
+  return {
+    resolution: {
+      transport: "http",
+      transportSource: urlHit.key,
+      baseUrl,
+      apiUrlSource,
+      apiKeyPresent: true,
+      apiKeySource: credential.source,
+      apiKeyTier: credential.tier,
+      misconfigured: false,
+      warning: warnings.length > 0 ? warnings.join(" ") : null
+    },
+    credential
+  };
+}
+function resolveClientTransport(name, env = process.env, options = {}) {
+  return resolveClientTransportSnapshot(name, env, options).resolution;
+}
+function credentialDiskSourcesForMessage(name, env) {
+  const paths = credentialDiskSources(name, env);
+  return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
+}
+var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+var AUTHORITY_OVERRIDE_HEADERS = new Set([
+  "host",
+  ":authority",
+  "forwarded",
+  "x-forwarded-host",
+  "x-original-host"
+]);
+
+// src/lib/fleet-credentials.ts
+var SKILLS_APP = "skills";
+var ENV_KEYS = clientTransportEnvKeys(SKILLS_APP);
+var SKILLS_API_URL_ENV_KEYS = ENV_KEYS.apiUrlKeys;
+var SKILLS_API_KEY_ENV_KEYS = ENV_KEYS.apiKeyKeys;
+var SKILLS_API_URL_ENV = SKILLS_API_URL_ENV_KEYS[0];
+var SKILLS_API_KEY_ENV = SKILLS_API_KEY_ENV_KEYS[0];
+
+class SkillsFleetCredentialError extends Error {
+  code;
+  constructor(message, code = "MISSING_API_CREDENTIAL") {
+    super(message);
+    this.name = "SkillsFleetCredentialError";
+    this.code = code;
+  }
+}
+function isClientTransportConfigurationError(error) {
+  return error instanceof ClientTransportConfigurationError || typeof error === "object" && error !== null && error.name === "ClientTransportConfigurationError";
+}
+function isCredentialResolutionError(error) {
+  return error instanceof CredentialResolutionError || typeof error === "object" && error !== null && error.name === "CredentialResolutionError";
+}
+function asSkillsFleetCredentialError(error) {
+  if (!isCredentialResolutionError(error))
+    return null;
+  return new SkillsFleetCredentialError(error.message, "MISSING_API_CREDENTIAL");
 }
 function normalizeSkillsApiOrigin(apiUrl) {
   const url = new URL(apiUrl);
@@ -8472,8 +9227,172 @@ function normalizeSkillsApiOrigin(apiUrl) {
   }
   return url.toString().replace(/\/+$/, "");
 }
-function getApiUrl(action) {
-  return normalizeSkillsApiOrigin(requireApiUrl(action));
+function configuredSkillsApiUrl(env = process.env, keychain) {
+  for (const key of SKILLS_API_URL_ENV_KEYS) {
+    const value = env[key]?.trim();
+    if (value)
+      return { value, source: key };
+  }
+  const fromKeychain = keychainConfigValue(SKILLS_APP, env, keychain);
+  if (fromKeychain)
+    return { value: fromKeychain.value.trim(), source: fromKeychain.source };
+  const fromDisk = appConfigDiskValue(SKILLS_APP, env, SKILLS_API_URL_ENV_KEYS);
+  if (fromDisk?.unusable) {
+    throw new SkillsFleetCredentialError(`${fromDisk.key} in ${fromDisk.path} is declared but blank or malformed; ` + `a Skills authority must be a valid https URL (or an exact loopback http URL).`, "INVALID_API_URL");
+  }
+  if (fromDisk)
+    return { value: fromDisk.value.trim(), source: fromDisk.path };
+  return null;
+}
+function skillsCredentialFiles(env = process.env) {
+  return credentialDiskSources(SKILLS_APP, env);
+}
+function skillsCredentialFilePath(env = process.env) {
+  const paths = skillsCredentialFiles(env);
+  const path = paths[0];
+  if (!path) {
+    throw new Error("No home directory is set (HOME or HASNA_HOME), so there is nowhere to store a Skills credential.");
+  }
+  return path;
+}
+var localNoticePrinted = false;
+function noticeLocalSkillsMode(write = (line) => console.error(line)) {
+  if (localNoticePrinted)
+    return;
+  localNoticePrinted = true;
+  write(`skills: local mode \u2014 no ${SKILLS_API_KEY_ENV} and no ${SKILLS_API_URL_ENV} resolved, ` + `so this runs on this machine against the bundled corpus. ` + `Sign in with: skills auth login`);
+}
+function resolveSkillsFleet(env = process.env, options = {}) {
+  try {
+    return resolveSkillsFleetOrThrow(env, options);
+  } catch (error) {
+    const translated = asSkillsFleetCredentialError(error);
+    if (translated)
+      throw translated;
+    throw error;
+  }
+}
+function resolveSkillsFleetOrThrow(env, options) {
+  let resolution;
+  try {
+    resolution = resolveClientTransport(SKILLS_APP, env, { credentials: options.credentials });
+  } catch (error) {
+    if (!isClientTransportConfigurationError(error))
+      throw error;
+    const configured2 = configuredSkillsApiUrl(env, options.credentials?.keychain);
+    const credential2 = resolveCredential(SKILLS_APP, env, options.credentials);
+    if (!configured2 && !credential2) {
+      if (env === process.env)
+        noticeLocalSkillsMode();
+      return { mode: "local", apiOrigin: null, apiKey: null };
+    }
+    if (configured2 && !credential2) {
+      throw new SkillsFleetCredentialError(`${configured2.source} points this CLI at a Skills service but no API key resolved \u2014 ` + `refusing to run locally instead. Looked in the Keychain item ` + `hasna.credentials.${SKILLS_APP}.api-key, then ${skillsCredentialFiles(env).join(" or ") || "no credentials file (no HOME)"}, ` + `then ${SKILLS_API_KEY_ENV}. Sign in with: skills auth login`);
+    }
+    throw error;
+  }
+  const configured = configuredSkillsApiUrl(env, options.credentials?.keychain);
+  const apiOrigin = configured ? normalizeSkillsApiOrigin(configured.value) : stripV1(resolution.baseUrl);
+  const credential = resolveCredential(SKILLS_APP, env, options.credentials);
+  if (!credential) {
+    throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills auth login`);
+  }
+  const base = {
+    mode: "hosted",
+    apiOrigin,
+    apiUrlSource: resolution.apiUrlSource ?? (configured?.source ?? "default"),
+    apiKeySource: resolution.apiKeySource ?? credential.source,
+    apiKeyTier: resolution.apiKeyTier,
+    warning: resolution.warning
+  };
+  if (credential.tier === "pointer") {
+    return { ...base, apiKey: null, apiKeyPointer: credential };
+  }
+  if (!credential.apiKey.trim()) {
+    throw new SkillsFleetCredentialError(`The Skills API key from ${credential.source} is empty \u2014 refusing to send an unauthenticated request. ` + `Sign in with: skills auth login`);
+  }
+  return { ...base, apiKey: credential.apiKey, apiKeyPointer: null };
+}
+async function resolveSkillsApiKey(env = process.env, options = {}) {
+  const fleet = resolveSkillsFleet(env, options);
+  if (fleet.mode !== "hosted")
+    return null;
+  if (fleet.apiKey)
+    return fleet.apiKey;
+  const pointer = fleet.apiKeyPointer;
+  if (!pointer) {
+    throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills auth login`);
+  }
+  let completed;
+  try {
+    completed = await completePointerCredential(SKILLS_APP, pointer, env);
+  } catch (error) {
+    const translated = asSkillsFleetCredentialError(error);
+    if (translated)
+      throw translated;
+    throw error;
+  }
+  if (!completed.apiKey?.trim()) {
+    throw new SkillsFleetCredentialError(`${credentialPointerEnvKey(SKILLS_APP)} names a vault item that produced an empty Skills API key \u2014 ` + `refusing to send an unauthenticated request.`);
+  }
+  return completed.apiKey;
+}
+async function requireSkillsApiKey(action = "This command", env = process.env, options = {}) {
+  const apiKey = await resolveSkillsApiKey(env, options);
+  if (!apiKey)
+    throw new MissingSkillsFleetError(action);
+  return apiKey;
+}
+function stripV1(baseUrl) {
+  return baseUrl.replace(/\/v1$/, "").replace(/\/+$/, "");
+}
+async function skillsCredentialOrReason(env = process.env, options = {}) {
+  try {
+    const apiKey = await resolveSkillsApiKey(env, options);
+    return apiKey ? { apiKey, reason: null } : { apiKey: null, reason: null };
+  } catch (error) {
+    if (error instanceof SkillsFleetCredentialError || error?.name === "SkillsFleetCredentialError") {
+      return { apiKey: null, reason: error.message };
+    }
+    throw error;
+  }
+}
+function resolveSkillsApiOrigin(env = process.env, options = {}) {
+  const configured = configuredSkillsApiUrl(env, options.credentials?.keychain);
+  if (configured) {
+    toV1BaseUrl(configured.value);
+    return { origin: normalizeSkillsApiOrigin(configured.value), source: configured.source };
+  }
+  const fleet = resolveSkillsFleet(env, options);
+  return fleet.mode === "hosted" ? { origin: fleet.apiOrigin, source: fleet.apiUrlSource } : null;
+}
+function requireSkillsApiOrigin(action = "This command", env = process.env, options = {}) {
+  const resolved = resolveSkillsApiOrigin(env, options);
+  if (!resolved)
+    throw new MissingSkillsFleetError(action);
+  return resolved.origin;
+}
+function requireSkillsFleet(action = "This command", env = process.env, options = {}) {
+  const fleet = resolveSkillsFleet(env, options);
+  if (fleet.mode === "hosted")
+    return fleet;
+  throw new MissingSkillsFleetError(action);
+}
+
+class MissingSkillsFleetError extends Error {
+  code = "MISSING_API_URL";
+  constructor(action = "This command") {
+    super(`${action} requires a Skills API credential and none is configured \u2014 ` + `run: skills auth login, or set ${SKILLS_API_KEY_ENV} ` + `(add the Keychain item hasna.credentials.${SKILLS_APP}.api-key, or write ~/.hasna/skills/config/credentials). ` + `Point at your own instance with ${SKILLS_API_URL_ENV}, or run: skills setup --api-url <your Skills instance origin>`);
+    this.name = "MissingSkillsFleetError";
+  }
+}
+
+// src/lib/api-url.ts
+var API_URL_ENV_VAR = SKILLS_API_URL_ENV;
+var MISSING_API_URL_HINT = `run: skills auth login, or set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
+function resolveApiUrl(env = process.env, options = {}) {
+  const fleet = resolveSkillsFleet(env, options);
+  return fleet.mode === "hosted" ? fleet.apiOrigin : undefined;
 }
 
 // src/lib/discovery.ts
@@ -8601,26 +9520,19 @@ var remoteRegistrySchema = exports_external.union([
   exports_external.object({ skills: exports_external.array(remoteSkillSchema) }),
   exports_external.object({ data: exports_external.array(remoteSkillSchema) })
 ]);
-function getConfiguredApiUrl(config = loadConfig(), env = process.env) {
-  return resolveApiUrl(config, env);
+function getConfiguredApiUrl(env = process.env) {
+  return resolveApiUrl(env);
 }
 function buildSkillsApiUrl(apiUrl, endpoint = "/skills") {
   const url = new URL(apiUrl);
   const cleanEndpoint = endpoint.startsWith("/") ? endpoint : `/${endpoint}`;
   const pathname = url.pathname.replace(/\/+$/, "");
-  if (pathname.endsWith("/skills")) {
-    if (cleanEndpoint === "/skills") {
-      url.pathname = pathname;
-    } else {
-      url.pathname = `${pathname.slice(0, -"/skills".length)}${cleanEndpoint}` || cleanEndpoint;
-    }
-    return url.toString();
-  }
-  if (pathname.endsWith("/api") || pathname.endsWith("/api/v1")) {
-    url.pathname = `${pathname}${cleanEndpoint}`;
+  const apiBase = /\/api(?:\/v1)?\/skills$/.test(pathname) ? pathname.slice(0, -"/skills".length) : pathname;
+  if (/\/api(?:\/v1)?$/.test(apiBase)) {
+    url.pathname = `${apiBase}${cleanEndpoint}`;
     return url.toString();
   }
-  url.pathname = `${pathname}/api/v1${cleanEndpoint}`.replace(/\/{2,}/g, "/");
+  url.pathname = `${apiBase}/api/v1${cleanEndpoint}`.replace(/\/{2,}/g, "/");
   return url.toString();
 }
 function titleize(name) {
@@ -8681,9 +9593,9 @@ function parseRemoteContract(schema, payload, message) {
     throw error;
   }
 }
-function remoteRequestHeaders(options) {
+async function remoteRequestHeaders(options) {
   const headers = new Headers({ Accept: "application/json" });
-  const token = options.authToken !== undefined ? options.authToken : getApiKey();
+  const token = options.authToken !== undefined ? options.authToken : await resolveSkillsApiKey();
   const trimmed = token?.trim();
   if (trimmed)
     headers.set("Authorization", `Bearer ${trimmed}`);
@@ -8691,11 +9603,12 @@ function remoteRequestHeaders(options) {
 }
 async function fetchRemoteJson(url, options) {
   const fetchImpl = options.fetchImpl || fetch;
+  const headers = await remoteRequestHeaders(options);
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 1e4);
   try {
     const response = await fetchImpl(url, {
-      headers: remoteRequestHeaders(options),
+      headers,
       signal: controller.signal
     });
     if (!response.ok) {
@@ -8709,7 +9622,7 @@ async function fetchRemoteJson(url, options) {
 async function loadRemoteRegistry(options = {}) {
   const apiUrl = options.apiUrl || getConfiguredApiUrl();
   if (!apiUrl) {
-    throw new Error("Remote registry requires SKILLS_API_URL or config apiUrl");
+    throw new Error(`Remote registry requires a Skills credential (${SKILLS_API_KEY_ENV}, the Keychain item, or ~/.hasna/skills/config/credentials) and, for your own instance, ${SKILLS_API_URL_ENV}`);
   }
   const url = buildSkillsApiUrl(apiUrl, options.endpoint);
   return parseRemoteRegistryPayload(await fetchRemoteJson(url, options));
@@ -8717,7 +9630,7 @@ async function loadRemoteRegistry(options = {}) {
 async function loadRemoteSkill(name, options = {}) {
   const apiUrl = options.apiUrl || getConfiguredApiUrl();
   if (!apiUrl) {
-    throw new Error("Remote registry requires SKILLS_API_URL or config apiUrl");
+    throw new Error(`Remote registry requires a Skills credential (${SKILLS_API_KEY_ENV}, the Keychain item, or ~/.hasna/skills/config/credentials) and, for your own instance, ${SKILLS_API_URL_ENV}`);
   }
   const slug = encodeURIComponent(name);
   const url = buildSkillsApiUrl(apiUrl, options.endpoint ?? `/skills/${slug}`);
@@ -8857,7 +9770,7 @@ var TOOL_PRIMITIVES = [
     cliCommands: ["skills tools deps <skill>", "skills run <skill>"],
     mcpTools: ["get_skill_tool_dependencies", "run_skill"],
     apiSurfaces: ["runSkill", "SkillRunRecord", "RemoteSkillRunContract"],
-    envVars: ["SKILLS_API_KEY"],
+    envVars: ["HASNA_SKILLS_API_KEY"],
     outputTypes: ["text", "json", "markdown", "artifact"],
     capabilities: ["completion", "reasoning", "tool-calling", "vision-input", "structured-output"]
   },
@@ -8913,7 +9826,7 @@ var TOOL_PRIMITIVES = [
     cliCommands: ["skills tools deps <skill>", "skills run <skill>"],
     mcpTools: ["get_skill_tool_dependencies", "run_skill"],
     apiSurfaces: ["runSkill", "RemoteSkillRunContract"],
-    envVars: ["SKILLS_API_KEY"],
+    envVars: ["HASNA_SKILLS_API_KEY"],
     outputTypes: ["png", "jpeg", "webp", "svg", "zip"],
     capabilities: ["image-generation", "image-analysis", "image-editing", "asset-packaging"]
   },
@@ -8927,7 +9840,7 @@ var TOOL_PRIMITIVES = [
     cliCommands: ["skills tools deps <skill>", "skills run <skill>"],
     mcpTools: ["get_skill_tool_dependencies", "run_skill"],
     apiSurfaces: ["runSkill", "RemoteSkillRunContract"],
-    envVars: ["SKILLS_API_KEY"],
+    envVars: ["HASNA_SKILLS_API_KEY"],
     outputTypes: ["mp3", "wav", "txt", "srt", "json", "zip"],
     capabilities: ["transcription", "audio-generation", "voiceover", "audio-cleanup"]
   },
@@ -8941,7 +9854,7 @@ var TOOL_PRIMITIVES = [
     cliCommands: ["skills tools deps <skill>", "skills run <skill>"],
     mcpTools: ["get_skill_tool_dependencies", "run_skill"],
     apiSurfaces: ["runSkill", "RemoteSkillRunContract"],
-    envVars: ["SKILLS_API_KEY"],
+    envVars: ["HASNA_SKILLS_API_KEY"],
     outputTypes: ["mp4", "mov", "srt", "png", "json", "zip"],
     capabilities: ["video-generation", "video-analysis", "captioning", "highlight-extraction"]
   },
@@ -8969,7 +9882,7 @@ var TOOL_PRIMITIVES = [
     cliCommands: ["skills tools deps <skill>", "skills run <skill>"],
     mcpTools: ["get_skill_tool_dependencies", "run_skill"],
     apiSurfaces: ["SkillRunContext", "RemoteSkillRunContract"],
-    envVars: ["SKILLS_API_KEY"],
+    envVars: ["HASNA_SKILLS_API_KEY"],
     outputTypes: ["json", "artifact"],
     capabilities: ["approval", "external-api", "account-scoped-execution"]
   },
@@ -9011,7 +9924,7 @@ var TOOL_PRIMITIVES = [
     cliCommands: ["skills auth login", "skills run <skill>"],
     mcpTools: ["run_skill"],
     apiSurfaces: ["RemoteSkillsClient", "RemoteSkillRunContract"],
-    envVars: ["SKILLS_API_KEY"],
+    envVars: ["HASNA_SKILLS_API_KEY"],
     outputTypes: ["json"],
     capabilities: ["account-auth", "remote-run-submit"]
   }
@@ -9219,6 +10132,11 @@ function primitiveHaystack(primitive) {
 function clone(value) {
   return value === undefined ? undefined : JSON.parse(JSON.stringify(value));
 }
+// src/lib/auth-store.ts
+function getApiUrl(action, env = process.env, options = {}) {
+  return requireSkillsApiOrigin(action, env, options);
+}
+
 // src/lib/remote-run-contract.ts
 var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
 function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
@@ -9551,21 +10469,25 @@ function normalizeUpdatedSincePage(payload) {
   }
   return { skills, nextCursor };
 }
-function createRemoteSkillsClient() {
-  const apiKey = getApiKey();
-  if (!apiKey)
+async function createRemoteSkillsClient(env = process.env) {
+  const fleet = resolveSkillsFleet(env);
+  if (fleet.mode !== "hosted")
     return null;
-  return new RemoteSkillsClient(apiKey);
+  const apiKey = await resolveSkillsApiKey(env);
+  if (!apiKey) {
+    throw new Error("A Skills authority resolved but no API key did. Sign in with: skills auth login");
+  }
+  return new RemoteSkillsClient(apiKey, fleet.apiOrigin);
 }
 // src/lib/scheduler.ts
-import { existsSync as existsSync15, readFileSync as readFileSync13, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync13, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7 } from "fs";
 import { join as join15 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
   return join15(targetDir, ".skills", "schedules.json");
 }
 function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  if (existsSync15(path)) {
+  if (existsSync14(path)) {
     try {
       return JSON.parse(readFileSync13(path, "utf-8"));
     } catch {}
@@ -9575,9 +10497,9 @@ function loadSchedules(targetDir = process.cwd()) {
 function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
   const dir = join15(targetDir, ".skills");
-  if (!existsSync15(dir))
-    mkdirSync8(dir, { recursive: true });
-  writeFileSync8(path, JSON.stringify(data, null, 2));
+  if (!existsSync14(dir))
+    mkdirSync7(dir, { recursive: true });
+  writeFileSync7(path, JSON.stringify(data, null, 2));
 }
 function validateCronField(expr, min, max, label) {
   for (const part of expr.split(",")) {
@@ -9762,8 +10684,8 @@ function recordScheduleRun(id, status, targetDir) {
   saveSchedules(data, targetDir);
 }
 // src/lib/pull.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync3, readFileSync as readFileSync15, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname7, join as join17 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync3, readFileSync as readFileSync15, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname6, join as join17 } from "path";
 
 // src/lib/revision.ts
 import { createHash as createHash3 } from "crypto";
@@ -10160,9 +11082,9 @@ class PullSkillError extends Error {
   }
 }
 async function pullSkills(options = {}) {
-  const client = options.client !== undefined ? options.client : createRemoteSkillsClient();
+  const client = options.client !== undefined ? options.client : await createRemoteSkillsClient();
   if (!client) {
-    throw new PullSkillError("No API key configured, so there is no instance to pull from.", ["Run `skills login`, or set SKILLS_API_KEY and SKILLS_API_URL for this instance."]);
+    throw new PullSkillError("No API key configured, so there is no instance to pull from.", ["Run `skills auth login`, or set HASNA_SKILLS_API_KEY (and HASNA_SKILLS_API_URL for your own instance)."]);
   }
   const signingKey = options.signingKey ?? resolveSigningKey() ?? undefined;
   const targets = await resolveTargetSlugs(client, options);
@@ -10215,7 +11137,7 @@ async function pullOne(client, rawName, corpusOptions, verify) {
     }
     if (bundleResponse.status === 404) {
       const marker = readPullMarker(join17(getPortableSkillsRoot(corpusOptions), slug));
-      if (marker && typeof marker.revisionId === "string" && marker.revisionId) {
+      if (isPublishedInstallMarker(marker)) {
         return { name: slug, success: true, purged: true, removed: false };
       }
     }
@@ -10254,7 +11176,7 @@ async function pullOne(client, rawName, corpusOptions, verify) {
   }
   if (!meta?.revisionId) {
     const marker = readPullMarker(join17(getPortableSkillsRoot(corpusOptions), slug));
-    if (marker && typeof marker.revisionId === "string" && marker.revisionId) {
+    if (isPublishedInstallMarker(marker)) {
       return { name: slug, success: true, purged: true, removed: false };
     }
   }
@@ -10311,7 +11233,7 @@ function provenRevision(meta, slug, bundle) {
 }
 function reconcileTombstone(slug, corpusOptions) {
   const target = join17(getPortableSkillsRoot(corpusOptions), slug);
-  if (!existsSync16(join17(target, PULL_MARKER_FILE))) {
+  if (!existsSync15(join17(target, PULL_MARKER_FILE))) {
     return { name: slug, success: true, tombstoned: true, removed: false, leftInPlace: true };
   }
   rmSync4(target, { recursive: true, force: true });
@@ -10324,6 +11246,13 @@ function readPullMarker(dir) {
     return null;
   }
 }
+function isPublishedInstallMarker(marker) {
+  if (!marker)
+    return false;
+  const revisionId = typeof marker.revisionId === "string" ? marker.revisionId : "";
+  const contentHash = typeof marker.contentHash === "string" ? marker.contentHash : "";
+  return revisionId.length > 0 || contentHash.length > 0;
+}
 function installVerifiedBundle(slug, response, meta, corpusOptions, verify, exact) {
   return response.arrayBuffer().then((buffer) => {
     const verified = verifyBundleResponseBytes(buffer, response, verify);
@@ -10446,17 +11375,17 @@ function verifyBundleResponseBytes(buffer, response, verify = {}) {
 }
 function installBundleAtomically(name, entries, options = {}, marker = {}) {
   const root = getPortableSkillsRoot(options);
-  mkdirSync9(root, { recursive: true });
+  mkdirSync8(root, { recursive: true });
   const target = join17(root, name);
-  const created = !existsSync16(target);
+  const created = !existsSync15(target);
   const staging = mkdtempSync3(join17(root, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
     for (const entry of entries) {
       const destination = join17(staging, entry.path);
-      mkdirSync9(dirname7(destination), { recursive: true });
-      writeFileSync9(destination, entry.bytes, { mode: entry.mode });
+      mkdirSync8(dirname6(destination), { recursive: true });
+      writeFileSync8(destination, entry.bytes, { mode: entry.mode });
     }
     writePullMarker(staging, {
       skill: name,
@@ -10466,7 +11395,7 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
       ...marker.signature ? { signature: marker.signature } : {},
       ...marker.revisionId ? { revisionId: marker.revisionId } : {}
     });
-    if (existsSync16(target)) {
+    if (existsSync15(target)) {
       backup = mkdtempSync3(join17(root, `.pull-backup-${name}-`));
       renameSync3(target, join17(backup, name));
       moved = true;
@@ -10476,7 +11405,7 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
       rmSync4(backup, { recursive: true, force: true });
   } catch (error) {
     rmSync4(staging, { recursive: true, force: true });
-    if (moved && backup && existsSync16(join17(backup, name))) {
+    if (moved && backup && existsSync15(join17(backup, name))) {
       try {
         renameSync3(join17(backup, name), target);
       } catch {}
@@ -10497,7 +11426,7 @@ function writePullMarker(dir, record) {
     ...record.revisionId ? { revisionId: record.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
-  writeFileSync9(join17(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
+  writeFileSync8(join17(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
 `);
 }
 async function safeMeta(client, slug) {
@@ -10652,17 +11581,18 @@ function findSkillsParityForMcpTool(tool) {
   return SKILLS_CLI_MCP_PARITY.find((entry) => entry.mcpTools.includes(tool));
 }
 // src/lib/registry-sync.ts
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname8, relative as relative4 } from "path";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname7, relative as relative4 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.2.0",
+  version: "0.3.0",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
     skills: "bin/index.js",
     "skills-mcp": "bin/mcp.js",
+    "skills-serve": "bin/server.js",
     "skills-server": "bin/server.js",
     "skills-worker": "bin/worker.js",
     "skills-migrate": "bin/migrate.js"
@@ -10748,6 +11678,7 @@ var package_default = {
   dependencies: {
     "@aws-sdk/client-ecs": "^3.1079.0",
     "@aws-sdk/client-s3": "^3.1079.0",
+    "@hasna/contracts": "1.0.1",
     "@hasna/events": "0.1.16",
     "@modelcontextprotocol/sdk": "^1.26.0",
     chalk: "^5.3.0",
@@ -10833,8 +11764,8 @@ function createRegistrySyncArtifact(options = {}) {
   };
 }
 function writeRegistrySyncArtifact(path, artifact) {
-  mkdirSync10(dirname8(path), { recursive: true });
-  writeFileSync10(path, `${JSON.stringify(artifact, null, 2)}
+  mkdirSync9(dirname7(path), { recursive: true });
+  writeFileSync9(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
 function buildDocs(name) {
@@ -11673,17 +12604,17 @@ function clone2(value) {
   return JSON.parse(JSON.stringify(value));
 }
 // src/lib/feedback.ts
-import { appendFileSync, existsSync as existsSync17, mkdirSync as mkdirSync11 } from "fs";
-import { dirname as dirname9, join as join18 } from "path";
+import { appendFileSync, existsSync as existsSync16, mkdirSync as mkdirSync10 } from "fs";
+import { dirname as dirname8, join as join18 } from "path";
 import { Database } from "bun:sqlite";
 function getFeedbackDbPath() {
   return join18(getDataDir(), "skills.db");
 }
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
-  const dir = dirname9(dbPath);
-  if (!existsSync17(dir))
-    mkdirSync11(dir, { recursive: true });
+  const dir = dirname8(dbPath);
+  if (!existsSync16(dir))
+    mkdirSync10(dir, { recursive: true });
   const db = new Database(dbPath);
   db.exec("PRAGMA journal_mode = WAL");
   db.exec([
@@ -11710,9 +12641,9 @@ function saveFeedback(input) {
   const category = input.category ?? "general";
   if (isApiMode()) {
     const path = join18(getDataDir(), "feedback.jsonl");
-    const dir = dirname9(path);
-    if (!existsSync17(dir))
-      mkdirSync11(dir, { recursive: true });
+    const dir = dirname8(path);
+    if (!existsSync16(dir))
+      mkdirSync10(dir, { recursive: true });
     appendFileSync(path, JSON.stringify({ message, category, email: input.email ?? null, agent: input.agent ?? null, version: input.version ?? null, createdAt: new Date().toISOString() }) + `
 `);
     return { saved: true, category, path };
@@ -11726,25 +12657,23 @@ function saveFeedback(input) {
   return { saved: true, category, path: getFeedbackDbPath() };
 }
 function isApiMode(env = process.env) {
-  if (env.HASNA_SKILLS_API_URL?.trim())
-    return true;
   try {
-    return Boolean(resolveApiUrl(undefined, env));
+    return Boolean(resolveApiUrl(env));
   } catch {
-    return Boolean(env.SKILLS_API_URL?.trim());
+    return true;
   }
 }
 // src/lib/native-storage.ts
 import { createHash as createHash5, createHmac as createHmac2 } from "crypto";
 import {
-  existsSync as existsSync18,
-  mkdirSync as mkdirSync12,
+  existsSync as existsSync17,
+  mkdirSync as mkdirSync11,
   readFileSync as readFileSync16,
   readdirSync as readdirSync10,
   statSync as statSync10,
-  writeFileSync as writeFileSync11
+  writeFileSync as writeFileSync10
 } from "fs";
-import { dirname as dirname10, join as join19, normalize as normalize3, relative as relative5, sep as sep2 } from "path";
+import { dirname as dirname9, join as join19, normalize as normalize3, relative as relative5, sep as sep2 } from "path";
 var SKILLS_STORAGE_TABLES = [
   "skills_sync_records",
   "skills_sync_cursors"
@@ -11904,7 +12833,7 @@ function getStorageStatus(options = {}) {
 function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
   const projectStateDir = getProjectStateDir(targetDir);
   const files = [];
-  if (existsSync18(projectStateDir)) {
+  if (existsSync17(projectStateDir)) {
     for (const filePath of walkFiles2(projectStateDir)) {
       const bytes = readFileSync16(filePath);
       const relativePath = toPosix(relative5(targetDir, filePath));
@@ -11931,7 +12860,7 @@ function importSkillsLocalSnapshot(snapshot, targetDir = process.cwd(), options
       continue;
     }
     const absolutePath = resolveSnapshotPath(targetDir, file.path);
-    if (existsSync18(absolutePath) && !options.overwrite) {
+    if (existsSync17(absolutePath) && !options.overwrite) {
       skipped += 1;
       continue;
     }
@@ -11940,8 +12869,8 @@ function importSkillsLocalSnapshot(snapshot, targetDir = process.cwd(), options
     if (hash !== file.sha256) {
       throw new Error(`Snapshot file checksum mismatch: ${file.path}`);
     }
-    mkdirSync12(dirname10(absolutePath), { recursive: true });
-    writeFileSync11(absolutePath, bytes);
+    mkdirSync11(dirname9(absolutePath), { recursive: true });
+    writeFileSync10(absolutePath, bytes);
     written += 1;
   }
   return { written, skipped };
@@ -12319,16 +13248,16 @@ function toArrayBuffer(bytes) {
 import { createHash as createHash6 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
-  mkdirSync as mkdirSync13,
+  mkdirSync as mkdirSync12,
   readFileSync as readFileSync17,
   statSync as statSync12,
-  writeFileSync as writeFileSync12
+  writeFileSync as writeFileSync11
 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute3, relative as relative6, resolve as resolve2, sep as sep4 } from "path";
+import { dirname as dirname10, isAbsolute as isAbsolute4, relative as relative6, resolve as resolve2, sep as sep4 } from "path";
 
 // src/lib/portable-snapshot-filter.ts
 import { readdirSync as readdirSync11, statSync as statSync11 } from "fs";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir4 } from "os";
 import { join as join20, sep as sep3 } from "path";
 var SYNC_HOMES = [
   { name: "skills", subClass: "skills", agent: null },
@@ -12420,7 +13349,7 @@ function isPortableWithinSkill(relativeParts) {
   return PORTABLE_SUBDIRS.has(second);
 }
 function homePathFor(definition, homesRoot) {
-  const home = homesRoot ?? homedir5();
+  const home = homesRoot ?? homedir4();
   if (definition.subClass === "skills" || definition.subClass === "custom") {
     return join20(skillsDataRootForHome(home), definition.name);
   }
@@ -12590,7 +13519,7 @@ function writeStationSnapshot(options) {
   for (const plan of plans) {
     const destination = resolve2(repoRoot, plan.destination);
     const destinationRelative = relative6(repoRoot, destination);
-    if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep4) || isAbsolute3(destinationRelative)) {
+    if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep4) || isAbsolute4(destinationRelative)) {
       throw new StationSnapshotError("DESTINATION_ESCAPE", `destination escapes repo root: ${plan.destination}`);
     }
     let existingDigest = null;
@@ -12612,7 +13541,7 @@ function writeStationSnapshot(options) {
   let written = 0;
   for (const plan of untouched) {
     const destination = resolve2(repoRoot, plan.destination);
-    mkdirSync13(dirname11(destination), { recursive: true });
+    mkdirSync12(dirname10(destination), { recursive: true });
     copyFileSync2(plan.source.fullPath, destination);
     written += 1;
   }
@@ -12631,8 +13560,8 @@ function writeStationSnapshot(options) {
     files: manifestFiles
   };
   const manifestPath = resolve2(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
-  mkdirSync13(dirname11(manifestPath), { recursive: true });
-  writeFileSync12(manifestPath, `${JSON.stringify(manifest, null, 2)}
+  mkdirSync12(dirname10(manifestPath), { recursive: true });
+  writeFileSync11(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
   return {
     ...base,
@@ -12645,13 +13574,13 @@ function writeStationSnapshot(options) {
 import { createHash as createHash7 } from "crypto";
 import {
   copyFileSync as copyFileSync3,
-  mkdirSync as mkdirSync14,
+  mkdirSync as mkdirSync13,
   readdirSync as readdirSync12,
   readFileSync as readFileSync18,
   statSync as statSync13,
-  writeFileSync as writeFileSync13
+  writeFileSync as writeFileSync12
 } from "fs";
-import { dirname as dirname12, join as join21, resolve as resolve3, sep as sep5 } from "path";
+import { dirname as dirname11, join as join21, resolve as resolve3, sep as sep5 } from "path";
 var STATION_HYDRATION_MANIFEST_SCHEMA = "hasna.fleet-resources.skills-hydration-manifest/v1";
 var STATION_HYDRATION_PRODUCER = { name: "@hasna/skills", version: package_default.version };
 var MANIFEST_HASH_KEY_SEP = String.fromCharCode(0);
@@ -12907,7 +13836,7 @@ function writeStationHydration(options) {
   }
   let written = 0;
   for (const entry of toWrite) {
-    mkdirSync14(dirname12(entry.destination), { recursive: true });
+    mkdirSync13(dirname11(entry.destination), { recursive: true });
     copyFileSync3(entry.fullPath, entry.destination);
     written += 1;
   }
@@ -12928,9 +13857,9 @@ function writeStationHydration(options) {
     },
     skills: resultSkills
   };
-  const hydrationManifestPath = join21(dirname12(cacheRoot), `hydration-${options.stationId}.json`);
-  mkdirSync14(dirname12(hydrationManifestPath), { recursive: true });
-  writeFileSync13(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
+  const hydrationManifestPath = join21(dirname11(cacheRoot), `hydration-${options.stationId}.json`);
+  mkdirSync13(dirname11(hydrationManifestPath), { recursive: true });
+  writeFileSync12(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
   return {
     ...base,
@@ -12967,6 +13896,9 @@ export {
   summarizeMcpToolContract,
   storageCapabilities,
   skillsPostgresSyncSchemaSql,
+  skillsCredentialOrReason,
+  skillsCredentialFiles,
+  skillsCredentialFilePath,
   skillExists,
   signSkillsAwsV4Request,
   sha256File,
@@ -12983,7 +13915,13 @@ export {
   resolveSyncAgents,
   resolveStorageConfig,
   resolveSkillsNativeStorageConfig,
+  resolveSkillsFleet,
+  resolveSkillsApiOrigin,
+  resolveSkillsApiKey,
   resolveSkillAlias,
+  requireSkillsFleet,
+  requireSkillsApiOrigin,
+  requireSkillsApiKey,
   removeSkillForAgent,
   removeSkill,
   removeSchedule,
@@ -13005,6 +13943,8 @@ export {
   parseSkillFrontmatter,
   parseRemoteSkillPayload,
   parseRemoteRegistryPayload,
+  noticeLocalSkillsMode,
+  normalizeSkillsApiOrigin,
   normalizeSkillSlug,
   normalizeRemoteSkillRunContract,
   normalizePortableSkillName,
@@ -13097,6 +14037,7 @@ export {
   createRegistrySyncArtifact,
   createMcpContractManifest,
   createLocalSkillManifest,
+  configuredSkillsApiUrl,
   computeContentHash,
   completeSkillRun,
   clearRegistryCache,
@@ -13112,6 +14053,7 @@ export {
   StationSnapshotError,
   SkillsS3ObjectStore,
   SkillsPostgresSyncStore,
+  SkillsFleetCredentialError,
   SYNC_MARKER_MANAGED_BY,
   SYNC_MARKER_FILE,
   SYNC_HOMES,
@@ -13130,6 +14072,11 @@ export {
   SKILLS_NATIVE_STORAGE_FALLBACK_ENV,
   SKILLS_NATIVE_STORAGE_ENV,
   SKILLS_CLI_MCP_PARITY,
+  SKILLS_APP,
+  SKILLS_API_URL_ENV_KEYS,
+  SKILLS_API_URL_ENV,
+  SKILLS_API_KEY_ENV_KEYS,
+  SKILLS_API_KEY_ENV,
   SKILLS,
   RemoteSkillsClient,
   RemoteRouteUnsupportedError,
@@ -13141,6 +14088,7 @@ export {
   PORTABLE_SKILL_STANDARD,
   PORTABLE_SKILL_SCHEMA,
   PORTABLE_SKILL_DEFAULT_VERSION,
+  MissingSkillsFleetError,
   MCP_CONTRACT_SCHEMA_VERSION,
   DEFAULT_EXPORT_DIR,
   CATEGORIES,