@hasna/skills 0.3.0 → 0.4.0

package/bin/index.js

@@ -36860,7 +36860,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.3.0",
+    version: "0.4.0",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -36919,8 +36919,7 @@ var init_package = __esm(() => {
       "verify:release": "bun run scripts/release-guard.ts",
       prepare: "bun run build:js",
       prepack: "bun run build && bun run verify:release",
-      prepublishOnly: "bun run typecheck && bun run test",
-      postinstall: "mkdir -p $HOME/.hasna/skills/custom 2>/dev/null || true"
+      prepublishOnly: "bun run typecheck && bun run test"
     },
     keywords: [
       "skills",
@@ -39056,6 +39055,16 @@ function isHostedMetadataSkill(skillName, frontmatter, registryMeta, packageDecl
     return true;
   return false;
 }
+function frontmatterString(raw) {
+  if (raw.startsWith('"') && raw.endsWith('"')) {
+    try {
+      const decoded = JSON.parse(raw);
+      if (typeof decoded === "string")
+        return decoded;
+    } catch {}
+  }
+  return raw.replace(/^["']|["']$/g, "");
+}
 function parseSkillFrontmatter(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!match)
@@ -39075,12 +39084,12 @@ function parseSkillFrontmatter(content) {
       const tags = [];
       while (i + 1 < lines.length && /^\s+-\s+/.test(lines[i + 1])) {
         i++;
-        tags.push(lines[i].replace(/^\s+-\s+/, "").trim());
+        tags.push(frontmatterString(lines[i].replace(/^\s+-\s+/, "").trim()));
       }
       result2.tags = tags;
       continue;
     }
-    const value = rawValue.replace(/^["']|["']$/g, "");
+    const value = frontmatterString(rawValue);
     if (!value)
       continue;
     if (key === "name")
@@ -39745,8 +39754,8 @@ function createInstructionManifest(name, options) {
     description: options.description,
     version: PORTABLE_SKILL_DEFAULT_VERSION,
     displayName: displayName(name),
-    category: "Development Tools",
-    tags: ["custom", name],
+    category: options.category ?? "Development Tools",
+    tags: options.tags ?? ["custom", name],
     kind: "instruction",
     inputs: [],
     commands: [],
@@ -39761,16 +39770,16 @@ function writeInstructionSkillTemplate(skillPath, manifest) {
 }
 function renderInstructionSkillMd(manifest) {
   const tags = manifest.tags?.length ? `tags:
-${manifest.tags.map((tag) => `  - ${tag}`).join(`
+${manifest.tags.map((tag) => `  - ${yamlString(tag)}`).join(`
 `)}
 ` : "";
   return `---
 name: ${manifest.name}
-description: ${manifest.description}
+description: ${yamlString(manifest.description)}
 kind: instruction
 version: ${manifest.version}
 source: custom
-category: ${manifest.category ?? "Development Tools"}
+category: ${yamlString(manifest.category ?? "Development Tools")}
 ${tags}---
 
 # ${manifest.displayName ?? displayName(manifest.name)}
@@ -39791,8 +39800,8 @@ function createPortableManifest(name, options) {
     description: options.description,
     version: PORTABLE_SKILL_DEFAULT_VERSION,
     displayName: displayName(name),
-    category: "Development Tools",
-    tags: ["custom", name],
+    category: options.category ?? "Development Tools",
+    tags: options.tags ?? ["custom", name],
     inputs: DEFAULT_INPUTS,
     commands: [{
       name,
@@ -39983,10 +39992,13 @@ function isExcludedCopyEntry(name, isFirstSegment) {
     return true;
   return false;
 }
+function yamlString(value) {
+  return JSON.stringify(value);
+}
 function renderSkillMd(manifest) {
   return `---
 name: ${manifest.name}
-description: ${manifest.description}
+description: ${yamlString(manifest.description)}
 ---
 
 # ${manifest.displayName ?? displayName(manifest.name)}
@@ -40396,11 +40408,11 @@ function scaffoldPortableSkill(name, options = {}) {
   const kind = options.kind ?? "executable";
   const description = options.description ?? `${displayName(skillName)} skill`;
   if (kind === "instruction") {
-    const manifest2 = createInstructionManifest(skillName, { description });
+    const manifest2 = createInstructionManifest(skillName, { description, category: options.category, tags: options.tags });
     writeInstructionSkillTemplate(skillPath, manifest2);
     return { name: skillName, path: skillPath, manifest: manifest2, created: true };
   }
-  const manifest = createPortableManifest(skillName, { description });
+  const manifest = createPortableManifest(skillName, { description, category: options.category, tags: options.tags });
   writePortableSkillTemplate(skillPath, manifest);
   return { name: skillName, path: skillPath, manifest, created: true };
 }
@@ -48335,93 +48347,7 @@ function toV1BaseUrl(apiUrl) {
   url.pathname = `${path}/v1`;
   return url.toString().replace(/\/+$/, "");
 }
-function resolveClientTransportSnapshot(name, env3 = process.env, options = {}) {
-  env3 = snapshotClientEnvironment(name, env3);
-  const keys2 = clientTransportEnvKeys(name);
-  const definedUrlEntries = keys2.apiUrlKeys.filter((key) => Object.prototype.hasOwnProperty.call(env3, key) && env3[key] !== undefined).map((key) => ({ key, raw: String(env3[key]) }));
-  const blankUrl = definedUrlEntries.find((entry) => entry.raw.trim().length === 0);
-  if (blankUrl) {
-    throw new ClientTransportConfigurationError(name, `${blankUrl.key} is set but blank; public clients require an explicit HTTPS API URL and never select local storage.`, [blankUrl.key]);
-  }
-  const controlledUrl = definedUrlEntries.find((entry) => ASCII_CONTROL_PATTERN.test(entry.raw));
-  if (controlledUrl) {
-    throw new ClientTransportConfigurationError(name, `${controlledUrl.key} contains ASCII control characters.`, [controlledUrl.key]);
-  }
-  const usableUrlEntries = definedUrlEntries.map((entry) => ({ key: entry.key, value: entry.raw.trim() }));
-  if (usableUrlEntries.length > 1 && new Set(usableUrlEntries.map((entry) => entry.value)).size > 1) {
-    throw new ClientTransportConfigurationError(name, `${usableUrlEntries.map((entry) => entry.key).join(" and ")} disagree; client authority aliases must be identical or only one may be set.`, usableUrlEntries.map((entry) => entry.key));
-  }
-  const envUrlHit = usableUrlEntries[0] ?? null;
-  const keychainUrlHit = keychainConfigValue(name, env3, options.credentials?.keychain);
-  const diskConfigUrlHit = appConfigDiskValue(name, env3, keys2.apiUrlKeys);
-  if (diskConfigUrlHit?.unusable) {
-    throw new ClientTransportConfigurationError(name, `${diskConfigUrlHit.key} in ${diskConfigUrlHit.path} is declared but blank or malformed; public clients require a valid HTTPS service authority.`, [diskConfigUrlHit.path]);
-  }
-  const urlCandidates = [
-    ...envUrlHit ? [envUrlHit] : [],
-    ...keychainUrlHit ? [{ key: keychainUrlHit.source, value: keychainUrlHit.value }] : [],
-    ...diskConfigUrlHit ? [{ key: diskConfigUrlHit.path, value: diskConfigUrlHit.value.trim() }] : []
-  ];
-  const configuredUrl = urlCandidates[0] ?? null;
-  const divergentUrls = urlCandidates.filter((candidate) => candidate.value !== configuredUrl?.value);
-  if (configuredUrl && divergentUrls.length > 0) {
-    throw new ClientTransportConfigurationError(name, `${configuredUrl.key} and ${divergentUrls.map((candidate) => candidate.key).join(" and ")} select different service authorities; refusing to send a credential written for one authority to the other.`, urlCandidates.map((candidate) => candidate.key));
-  }
-  const warnings = [];
-  if (configuredUrl && !envUrlHit) {
-    warnings.push(`No ${keys2.apiUrlKeys[0]} in the environment; the server URL in ${configuredUrl.key} was used, so this client connects to the server. ` + `Keep that entry aligned with the intended service authority.`);
-  }
-  const credential = resolveCredential(name, env3, options.credentials);
-  if (!credential) {
-    const diskHint = credentialDiskSourcesForMessage(name, env3);
-    const lead = configuredUrl ? `${configuredUrl.key} selects the HTTP server for '${name}', but no API key could be resolved` : `${keys2.apiUrlKeys[0]} is not set and no API key could be resolved for '${name}'; a credential is required before the default fleet gateway authority applies`;
-    warnings.push(`${lead}; refusing to create an unauthenticated client \u2014 public clients never fall back to SQLite or another local store. ` + `Looked in the Keychain (macOS only), then for a credential file at ${diskHint}, then for ${keys2.apiKeyKeys[0]} in the environment.`);
-    throw new ClientTransportConfigurationError(name, warnings.join(" "), [configuredUrl?.key ?? keys2.apiUrlKeys[0]]);
-  }
-  if (credential.warning)
-    warnings.push(credential.warning);
-  let urlHit;
-  if (configuredUrl) {
-    urlHit = configuredUrl;
-  } else {
-    try {
-      urlHit = { key: DEFAULT_AUTHORITY_SOURCE, value: defaultFleetGatewayBaseUrl(name) };
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      throw new ClientTransportConfigurationError(name, `No ${keys2.apiUrlKeys[0]} is configured and the default fleet gateway authority cannot be composed for '${name}': ${message}`, [keys2.apiUrlKeys[0]]);
-    }
-  }
-  const apiUrlSource = urlHit.key;
-  let baseUrl;
-  try {
-    baseUrl = toV1BaseUrl(urlHit.value);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new ClientTransportConfigurationError(name, `Invalid API URL from ${apiUrlSource}: ${message}`, [apiUrlSource]);
-  }
-  return {
-    resolution: {
-      transport: "http",
-      transportSource: urlHit.key,
-      baseUrl,
-      apiUrlSource,
-      apiKeyPresent: true,
-      apiKeySource: credential.source,
-      apiKeyTier: credential.tier,
-      misconfigured: false,
-      warning: warnings.length > 0 ? warnings.join(" ") : null
-    },
-    credential
-  };
-}
-function resolveClientTransport(name, env3 = process.env, options = {}) {
-  return resolveClientTransportSnapshot(name, env3, options).resolution;
-}
-function credentialDiskSourcesForMessage(name, env3) {
-  const paths = credentialDiskSources(name, env3);
-  return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
-}
-var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM, CREDENTIAL_SEAL, AMBIENT_ENVIRONMENT, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, ClientTransportConfigurationError, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS;
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM, CREDENTIAL_SEAL, AMBIENT_ENVIRONMENT, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS;
 var init_transport = __esm(() => {
   CredentialResolutionError = class CredentialResolutionError extends Error {
     appName;
@@ -48454,16 +48380,6 @@ var init_transport = __esm(() => {
   requireSecretsSdk = createRequire(import.meta.url);
   ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
   DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
-  ClientTransportConfigurationError = class ClientTransportConfigurationError extends Error {
-    appName;
-    sources;
-    constructor(appName, message, sources = []) {
-      super(message);
-      this.name = "ClientTransportConfigurationError";
-      this.appName = appName;
-      this.sources = Object.freeze([...sources]);
-    }
-  };
   IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
   AUTHORITY_OVERRIDE_HEADERS = new Set([
     "host",
@@ -48474,6 +48390,97 @@ var init_transport = __esm(() => {
   ]);
 });
 
+// src/lib/instance-credentials.ts
+import { closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, lstatSync as lstatSync3, openSync as openSync2, readSync } from "fs";
+function selectedSkillsProfile(env3, explicit) {
+  const selected = explicit ?? env3.HASNA_PROFILE;
+  if (selected === undefined)
+    return null;
+  const profile = selected.trim();
+  if (!/^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/.test(profile))
+    throw new Error("Invalid Skills credential profile");
+  return profile;
+}
+function skillsProfileCredentialFiles(env3, explicit) {
+  return credentialDiskSourceList("skills", env3, selectedSkillsProfile(env3, explicit)).map((source) => source.path);
+}
+function fileIdentity(file) {
+  try {
+    return lstatSync3(file);
+  } catch (error) {
+    if (["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
+      return null;
+    throw new Error("Cannot inspect Skills instance configuration");
+  }
+}
+function unchanged(before2, after2) {
+  return before2 === null || after2 === null ? before2 === after2 : ["dev", "ino", "size", "mtimeMs", "ctimeMs", "mode", "uid"].every((key) => before2[key] === after2[key]);
+}
+function captureSkillsCredentialFiles(files) {
+  const identities = files.map((file) => [file, fileIdentity(file)]);
+  return () => {
+    if (identities.some(([file, before2]) => !unchanged(before2, fileIdentity(file)))) {
+      throw new Error("Skills instance configuration changed while resolving credentials; retry without sending a credential");
+    }
+  };
+}
+function readMetadataText(file) {
+  let fd;
+  try {
+    fd = openSync2(file, constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK);
+  } catch (error) {
+    if (["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
+      return null;
+    throw new Error("Cannot safely read Skills instance configuration");
+  }
+  try {
+    const before2 = fstatSync2(fd);
+    const uid = process.getuid?.() ?? process.geteuid?.();
+    if (!before2.isFile() || ![256, 384].includes(before2.mode & 4095) || uid !== undefined && before2.uid !== uid || before2.size > 64 * 1024) {
+      throw new Error("Unsafe Skills instance configuration; expected a bounded owner-only regular file");
+    }
+    const bytes = Buffer.alloc(64 * 1024 + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const count = readSync(fd, bytes, length, bytes.length - length, null);
+      if (!count)
+        break;
+      length += count;
+    }
+    if (length > 64 * 1024 || !unchanged(before2, fstatSync2(fd)) || !unchanged(before2, fileIdentity(file))) {
+      throw new Error("Skills instance configuration changed while reading");
+    }
+    return bytes.subarray(0, length).toString("utf8");
+  } finally {
+    closeSync2(fd);
+  }
+}
+function readSkillsInstanceMetadata(file) {
+  const text = readMetadataText(file);
+  if (text === null)
+    return {};
+  const values2 = new Map;
+  for (const line of text.split(/\r?\n/)) {
+    const match = /^\s*(?:export\s+)?(HASNA_SKILLS_API_URL|SKILLS_API_URL|HASNA_SKILLS_BOUND_API_URL)\s*=\s*(.*)$/.exec(line);
+    if (!match)
+      continue;
+    let value = match[2].trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))
+      value = value.slice(1, -1);
+    if (!value || /[\x00-\x20\x7f]/.test(value) || values2.has(match[1]))
+      throw new Error("Invalid Skills instance configuration");
+    values2.set(match[1], value);
+  }
+  const urls = [values2.get("HASNA_SKILLS_API_URL"), values2.get("SKILLS_API_URL")].filter(Boolean);
+  if (new Set(urls).size > 1)
+    throw new Error("Skills API URL aliases disagree");
+  return { apiUrl: urls[0], binding: values2.get(SKILLS_BOUND_API_URL) };
+}
+var SKILLS_BOUND_API_URL = "HASNA_SKILLS_BOUND_API_URL";
+var init_instance_credentials = __esm(() => {
+  init_transport();
+});
+
 // src/lib/fleet-credentials.ts
 var exports_fleet_credentials = {};
 __export(exports_fleet_credentials, {
@@ -48481,6 +48488,7 @@ __export(exports_fleet_credentials, {
   skillsCredentialFiles: () => skillsCredentialFiles,
   skillsCredentialFilePath: () => skillsCredentialFilePath,
   resolveSkillsFleet: () => resolveSkillsFleet,
+  resolveSkillsConnection: () => resolveSkillsConnection,
   resolveSkillsApiOrigin: () => resolveSkillsApiOrigin,
   resolveSkillsApiKey: () => resolveSkillsApiKey,
   resetLocalSkillsModeNotice: () => resetLocalSkillsModeNotice,
@@ -48498,9 +48506,6 @@ __export(exports_fleet_credentials, {
   SKILLS_API_KEY_ENV: () => SKILLS_API_KEY_ENV,
   MissingSkillsFleetError: () => MissingSkillsFleetError
 });
-function isClientTransportConfigurationError(error) {
-  return error instanceof ClientTransportConfigurationError || typeof error === "object" && error !== null && error.name === "ClientTransportConfigurationError";
-}
 function isCredentialResolutionError(error) {
   return error instanceof CredentialResolutionError || typeof error === "object" && error !== null && error.name === "CredentialResolutionError";
 }
@@ -48511,6 +48516,9 @@ function asSkillsFleetCredentialError(error) {
 }
 function normalizeSkillsApiOrigin(apiUrl) {
   const url = new URL(apiUrl);
+  if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) {
+    throw new SkillsFleetCredentialError("A Skills API URL must use HTTPS (or loopback HTTP), without credentials, query or fragment", "INVALID_API_URL");
+  }
   const pathname = url.pathname.replace(/\/+$/, "");
   if (pathname === "/api" || pathname === "/api/v1") {
     url.pathname = "/";
@@ -48521,11 +48529,24 @@ function normalizeSkillsApiOrigin(apiUrl) {
   }
   return url.toString().replace(/\/+$/, "");
 }
-function configuredSkillsApiUrl(env3 = process.env, keychain) {
-  for (const key of SKILLS_API_URL_ENV_KEYS) {
-    const value = env3[key]?.trim();
-    if (value)
-      return { value, source: key };
+function configuredSkillsApiUrl(env3 = process.env, keychain, profile) {
+  const declared = SKILLS_API_URL_ENV_KEYS.filter((key) => env3[key] !== undefined).map((key) => ({ key, value: env3[key] }));
+  for (const entry of declared) {
+    if (!entry.value.trim() || /[\x00-\x1f\x7f]/.test(entry.value))
+      throw new SkillsFleetCredentialError(`${entry.key} is blank or contains control characters`, "INVALID_API_URL");
+  }
+  const normalized = declared.map((entry) => ({ value: normalizeSkillsApiOrigin(entry.value), source: entry.key }));
+  if (new Set(normalized.map((entry) => entry.value)).size > 1)
+    throw new SkillsFleetCredentialError("Skills API URL aliases disagree", "INVALID_API_URL");
+  if (normalized[0])
+    return normalized[0];
+  if (selectedSkillsProfile(env3, profile)) {
+    for (const file of skillsProfileCredentialFiles(env3, profile)) {
+      const metadata = readSkillsInstanceMetadata(file);
+      if (metadata.apiUrl || metadata.binding)
+        return { value: metadata.apiUrl ?? metadata.binding, source: file };
+    }
+    return { value: defaultFleetGatewayBaseUrl(SKILLS_APP), source: "default" };
   }
   const fromKeychain = keychainConfigValue(SKILLS_APP, env3, keychain);
   if (fromKeychain)
@@ -48539,7 +48560,7 @@ function configuredSkillsApiUrl(env3 = process.env, keychain) {
   return null;
 }
 function skillsCredentialFiles(env3 = process.env) {
-  return credentialDiskSources(SKILLS_APP, env3);
+  return skillsProfileCredentialFiles(env3);
 }
 function skillsCredentialFilePath(env3 = process.env) {
   const paths = skillsCredentialFiles(env3);
@@ -48560,7 +48581,11 @@ function resetLocalSkillsModeNotice() {
 }
 function resolveSkillsFleet(env3 = process.env, options = {}) {
   try {
-    return resolveSkillsFleetOrThrow(env3, options);
+    const snapshot = snapshotSkillsEnvironment(env3);
+    const resolved = resolveSkillsFleetOrThrow(snapshot, snapshotSkillsOptions(env3, options));
+    if (resolved.mode === "local" && env3 === process.env)
+      noticeLocalSkillsMode();
+    return resolved;
   } catch (error) {
     const translated = asSkillsFleetCredentialError(error);
     if (translated)
@@ -48568,38 +48593,46 @@ function resolveSkillsFleet(env3 = process.env, options = {}) {
     throw error;
   }
 }
-function resolveSkillsFleetOrThrow(env3, options) {
-  let resolution;
-  try {
-    resolution = resolveClientTransport(SKILLS_APP, env3, { credentials: options.credentials });
-  } catch (error) {
-    if (!isClientTransportConfigurationError(error))
-      throw error;
-    const configured2 = configuredSkillsApiUrl(env3, options.credentials?.keychain);
-    const credential2 = resolveCredential(SKILLS_APP, env3, options.credentials);
-    if (!configured2 && !credential2) {
-      if (env3 === process.env)
-        noticeLocalSkillsMode();
-      return { mode: "local", apiOrigin: null, apiKey: null };
-    }
-    if (configured2 && !credential2) {
-      throw new SkillsFleetCredentialError(`${configured2.source} points this CLI at a Skills service but no API key resolved \u2014 ` + `refusing to run locally instead. Looked in the Keychain item ` + `hasna.credentials.${SKILLS_APP}.api-key, then ${skillsCredentialFiles(env3).join(" or ") || "no credentials file (no HOME)"}, ` + `then ${SKILLS_API_KEY_ENV}. Sign in with: skills auth login`);
+function snapshotSkillsEnvironment(env3) {
+  const snapshot = {};
+  for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(env3))) {
+    if (!("value" in descriptor)) {
+      if (/^(?:HASNA_|SKILLS_|HOME$|USER$)/.test(key))
+        throw new SkillsFleetCredentialError("Accessor-backed Skills configuration is unsupported");
+      continue;
     }
-    throw error;
+    snapshot[key] = descriptor.value;
   }
-  const configured = configuredSkillsApiUrl(env3, options.credentials?.keychain);
-  const apiOrigin = configured ? normalizeSkillsApiOrigin(configured.value) : stripV1(resolution.baseUrl);
+  return Object.freeze(snapshot);
+}
+function snapshotSkillsOptions(env3, options) {
+  if (env3 !== process.env)
+    return options;
+  return { ...options, credentials: { ...options.credentials, keychain: {
+    ...options.credentials?.keychain,
+    enabled: options.credentials?.keychain?.enabled ?? true
+  } } };
+}
+function resolveSkillsFleetOrThrow(env3, options) {
+  const assertFilesUnchanged = captureSkillsCredentialFiles(skillsProfileCredentialFiles(env3, options.credentials?.profile));
+  const configured = configuredSkillsApiUrl(env3, options.credentials?.keychain, options.credentials?.profile);
   const credential = resolveCredential(SKILLS_APP, env3, options.credentials);
   if (!credential) {
-    throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills auth login`);
+    if (!configured)
+      return { mode: "local", apiOrigin: null, apiKey: null };
+    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in hasna.credentials.skills.api-key, ${skillsCredentialFiles(env3).join(" or ") || "no credentials file"}, and ${SKILLS_API_KEY_ENV}. Sign in with: skills auth login`);
   }
+  const apiOrigin = normalizeSkillsApiOrigin(configured?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP));
+  toV1BaseUrl(apiOrigin);
+  assertCredentialInstance(credential, apiOrigin, env3, options);
+  assertFilesUnchanged();
   const base2 = {
     mode: "hosted",
     apiOrigin,
-    apiUrlSource: resolution.apiUrlSource ?? (configured?.source ?? "default"),
-    apiKeySource: resolution.apiKeySource ?? credential.source,
-    apiKeyTier: resolution.apiKeyTier,
-    warning: resolution.warning
+    apiUrlSource: configured?.source ?? "default",
+    apiKeySource: credential.source,
+    apiKeyTier: credential.tier,
+    warning: credential.warning
   };
   if (credential.tier === "pointer") {
     return { ...base2, apiKey: null, apiKeyPointer: credential };
@@ -48609,19 +48642,37 @@ function resolveSkillsFleetOrThrow(env3, options) {
   }
   return { ...base2, apiKey: credential.apiKey, apiKeyPointer: null };
 }
+function assertCredentialInstance(credential, apiOrigin, env3, options) {
+  let bound;
+  if (credential.tier === "disk" || credential.tier === "profile") {
+    const metadata = readSkillsInstanceMetadata(credential.source);
+    bound = metadata.binding ?? metadata.apiUrl ?? defaultFleetGatewayBaseUrl(SKILLS_APP);
+  } else if (credential.tier === "keychain") {
+    bound = keychainConfigValue(SKILLS_APP, env3, options.credentials?.keychain)?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP);
+  }
+  if (bound && normalizeSkillsApiOrigin(bound) !== apiOrigin) {
+    throw new SkillsFleetCredentialError("The selected Skills API does not match this credential's instance. Select its profile or sign in to the new instance; no credential was sent.", "INSTANCE_CREDENTIAL_MISMATCH");
+  }
+}
 async function resolveSkillsApiKey(env3 = process.env, options = {}) {
-  const fleet = resolveSkillsFleet(env3, options);
+  return (await resolveSkillsConnection(env3, options))?.apiKey ?? null;
+}
+async function resolveSkillsConnection(env3 = process.env, options = {}) {
+  const snapshotEnv = snapshotSkillsEnvironment(env3);
+  const fleet = resolveSkillsFleet(snapshotEnv, snapshotSkillsOptions(env3, options));
+  if (fleet.mode === "local" && env3 === process.env)
+    noticeLocalSkillsMode();
   if (fleet.mode !== "hosted")
     return null;
   if (fleet.apiKey)
-    return fleet.apiKey;
+    return { ...fleet, apiKey: fleet.apiKey };
   const pointer = fleet.apiKeyPointer;
   if (!pointer) {
     throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills auth login`);
   }
   let completed;
   try {
-    completed = await completePointerCredential(SKILLS_APP, pointer, env3);
+    completed = await completePointerCredential(SKILLS_APP, pointer, snapshotEnv);
   } catch (error) {
     const translated = asSkillsFleetCredentialError(error);
     if (translated)
@@ -48631,7 +48682,7 @@ async function resolveSkillsApiKey(env3 = process.env, options = {}) {
   if (!completed.apiKey?.trim()) {
     throw new SkillsFleetCredentialError(`${credentialPointerEnvKey(SKILLS_APP)} names a vault item that produced an empty Skills API key \u2014 ` + `refusing to send an unauthenticated request.`);
   }
-  return completed.apiKey;
+  return { ...fleet, apiKey: completed.apiKey, apiKeyPointer: null };
 }
 async function requireSkillsApiKey(action = "This command", env3 = process.env, options = {}) {
   const apiKey = await resolveSkillsApiKey(env3, options);
@@ -48639,22 +48690,19 @@ async function requireSkillsApiKey(action = "This command", env3 = process.env,
     throw new MissingSkillsFleetError(action);
   return apiKey;
 }
-function stripV1(baseUrl) {
-  return baseUrl.replace(/\/v1$/, "").replace(/\/+$/, "");
-}
 async function skillsCredentialOrReason(env3 = process.env, options = {}) {
   try {
-    const apiKey = await resolveSkillsApiKey(env3, options);
-    return apiKey ? { apiKey, reason: null } : { apiKey: null, reason: null };
+    const connection = await resolveSkillsConnection(env3, options);
+    return connection ? { apiKey: connection.apiKey, apiOrigin: connection.apiOrigin, reason: null } : { apiKey: null, apiOrigin: null, reason: null };
   } catch (error) {
     if (error instanceof SkillsFleetCredentialError || error?.name === "SkillsFleetCredentialError") {
-      return { apiKey: null, reason: error.message };
+      return { apiKey: null, apiOrigin: null, reason: error.message };
     }
     throw error;
   }
 }
 function resolveSkillsApiOrigin(env3 = process.env, options = {}) {
-  const configured = configuredSkillsApiUrl(env3, options.credentials?.keychain);
+  const configured = configuredSkillsApiUrl(env3, options.credentials?.keychain, options.credentials?.profile);
   if (configured) {
     toV1BaseUrl(configured.value);
     return { origin: normalizeSkillsApiOrigin(configured.value), source: configured.source };
@@ -48677,6 +48725,7 @@ function requireSkillsFleet(action = "This command", env3 = process.env, options
 var SKILLS_APP = "skills", ENV_KEYS, SKILLS_API_URL_ENV_KEYS, SKILLS_API_KEY_ENV_KEYS, SKILLS_API_URL_ENV, SKILLS_API_KEY_ENV, SkillsFleetCredentialError, localNoticePrinted = false, MissingSkillsFleetError;
 var init_fleet_credentials = __esm(() => {
   init_transport();
+  init_instance_credentials();
   ENV_KEYS = clientTransportEnvKeys(SKILLS_APP);
   SKILLS_API_URL_ENV_KEYS = ENV_KEYS.apiUrlKeys;
   SKILLS_API_KEY_ENV_KEYS = ENV_KEYS.apiKeyKeys;
@@ -48889,12 +48938,13 @@ var init_remote_registry = __esm(() => {
 
 // src/lib/auth-store.ts
 import { chmodSync, existsSync as existsSync15, mkdirSync as mkdirSync7, readFileSync as readFileSync12, renameSync as renameSync4, statSync as statSync9, unlinkSync, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname6, join as join16 } from "path";
+import { basename as basename4, dirname as dirname6, join as join16 } from "path";
 function getAuthFilePath(env3 = process.env) {
   return skillsCredentialFilePath(env3);
 }
 function getIdentityFilePath(env3 = process.env) {
-  return join16(dirname6(skillsCredentialFilePath(env3)), "identity.json");
+  const file = skillsCredentialFilePath(env3);
+  return join16(dirname6(file), basename4(file).replace(/^credentials/, "identity") + ".json");
 }
 function getAuthIdentity(env3 = process.env) {
   return readIdentity(env3);
@@ -48905,6 +48955,10 @@ function readIdentity(env3 = process.env) {
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
     const record = parsed;
+    const selected = resolveSkillsApiOrigin(env3)?.origin;
+    const bound = typeof record.apiUrl === "string" ? record.apiUrl : readCredentialValue(SKILLS_BOUND_API_URL, env3) ?? readStoredApiUrl(env3) ?? defaultFleetGatewayBaseUrl("skills");
+    if (selected && normalizeSkillsApiOrigin(bound) !== selected)
+      return {};
     const identity2 = {};
     for (const field of ["email", "orgId", "orgSlug", "userId"]) {
       const value = record[field];
@@ -48982,14 +49036,15 @@ function readCredentialValue(key, env3 = process.env) {
   }
   return null;
 }
-function saveAuthConfig(config, env3 = process.env) {
+function saveAuthConfig(config, env3 = process.env, authenticatedOrigin) {
   const apiKey = config.apiKey.trim();
   if (!apiKey)
     throw new Error("Refusing to store an empty Skills API key.");
   if (/[^\t\x20-\x7e]/.test(apiKey)) {
     throw new Error("Refusing to store a Skills API key containing control characters or non-ASCII bytes.");
   }
-  const file = writeCredentialValues({ [SKILLS_API_KEY_ENV]: apiKey }, env3);
+  const apiUrl = authenticatedOrigin ? normalizeSkillsApiOrigin(authenticatedOrigin) : resolveSkillsApiOrigin(env3)?.origin ?? defaultFleetGatewayBaseUrl("skills");
+  const file = writeCredentialValues({ SKILLS_API_KEY: null, SKILLS_API_URL: null, [SKILLS_API_KEY_ENV]: apiKey, [SKILLS_BOUND_API_URL]: apiUrl, [SKILLS_API_URL_ENV]: apiUrl }, env3);
   const identity2 = {};
   for (const field of ["email", "orgId", "orgSlug", "userId"]) {
     const value = config[field];
@@ -48998,8 +49053,9 @@ function saveAuthConfig(config, env3 = process.env) {
   }
   const identityFile = getIdentityFilePath(env3);
   if (Object.keys(identity2).length > 0) {
-    writeFileSync7(identityFile, JSON.stringify(identity2, null, 2) + `
+    writeFileSync7(identityFile, JSON.stringify({ ...identity2, apiUrl }, null, 2) + `
 `, { mode: 384 });
+    chmodSync(identityFile, 384);
   } else {
     try {
       unlinkSync(identityFile);
@@ -49008,23 +49064,29 @@ function saveAuthConfig(config, env3 = process.env) {
   return file;
 }
 function saveApiUrl(apiUrl, env3 = process.env) {
-  return writeCredentialValues({ [SKILLS_API_URL_ENV]: apiUrl }, env3);
+  const next = apiUrl === null ? null : normalizeSkillsApiOrigin(apiUrl);
+  const values2 = { [SKILLS_API_URL_ENV]: next, SKILLS_API_URL: null };
+  if (!readCredentialValue(SKILLS_BOUND_API_URL, env3) && (readCredentialValue(SKILLS_API_KEY_ENV, env3) || readCredentialValue("SKILLS_API_KEY", env3))) {
+    values2[SKILLS_BOUND_API_URL] = normalizeSkillsApiOrigin(readStoredApiUrl(env3) ?? defaultFleetGatewayBaseUrl("skills"));
+  }
+  return writeCredentialValues(values2, env3);
 }
 function readStoredApiUrl(env3 = process.env) {
-  return readCredentialValue(SKILLS_API_URL_ENV, env3);
+  return readCredentialValue(SKILLS_API_URL_ENV, env3) ?? readCredentialValue("SKILLS_API_URL", env3);
 }
 function clearAuthConfig(env3 = process.env) {
   try {
-    writeCredentialValues({ [SKILLS_API_KEY_ENV]: null }, env3);
+    writeCredentialValues({ [SKILLS_API_KEY_ENV]: null, SKILLS_API_KEY: null, [SKILLS_BOUND_API_URL]: null }, env3);
   } catch {}
   try {
     unlinkSync(getIdentityFilePath(env3));
   } catch {}
   let stillResolves;
   try {
-    stillResolves = resolveSkillsFleet(env3).mode === "hosted";
+    stillResolves = resolveCredential("skills", env3) !== null;
   } catch {
-    stillResolves = true;
+    const emptyProfile = selectedSkillsProfile(env3) && !env3.HASNA_SKILLS_API_KEY_OVERRIDE && !env3.HASNA_SKILLS_API_KEY_REF && !readCredentialValue(SKILLS_API_KEY_ENV, env3) && !readCredentialValue("SKILLS_API_KEY", env3);
+    stillResolves = !emptyProfile;
   }
   return { stillResolves };
 }
@@ -49039,7 +49101,10 @@ function credentialFileMode(env3 = process.env) {
   }
 }
 var init_auth_store = __esm(() => {
+  init_transport();
+  init_instance_credentials();
   init_fleet_credentials();
+  init_transport();
   init_fleet_credentials();
 });
 
@@ -49087,6 +49152,169 @@ function pickNumber(record, key) {
 }
 var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
 
+// src/lib/remote-account.ts
+function creditCount(value) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0 || value > 2147483647) {
+    throw new Error("The Skills server returned an invalid credit count");
+  }
+  return value;
+}
+function parseRemoteRunQuote(value) {
+  const quote = object(value);
+  const pricing = object(quote.pricing);
+  if (typeof quote.skill !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(quote.skill))
+    throw new Error("Invalid quoted skill");
+  const costCents = creditCount(pricing.costCredits ?? pricing.costCents);
+  if (pricing.costCredits !== undefined && pricing.costCents !== undefined && pricing.costCents !== costCents)
+    throw new Error("Inconsistent quoted credit count");
+  if (quote.availability && object(quote.availability).status !== "available")
+    throw new Error("This skill is unavailable for remote execution");
+  return { ...quote, skill: quote.skill, pricing: { ...pricing, costCredits: costCents, costCents, formattedCost: `${costCents} credits` } };
+}
+function parseRemoteCreditPacks(value) {
+  if (!Array.isArray(value))
+    throw new Error("Invalid credit pack response");
+  const ids = new Set;
+  return value.map((value2) => {
+    const row = object(value2);
+    const counts = [row.credits, row.creditsCents, row.amountCents].filter((value3) => value3 !== undefined).map(creditCount);
+    if (!counts.length || counts[0] === 0 || counts.some((count) => count !== counts[0]))
+      throw new Error("Inconsistent credit pack counts");
+    const credits = counts[0];
+    const id = row.id ?? `credits_${credits}`;
+    if (typeof id !== "string" || !/^[a-z0-9][a-z0-9_-]{0,99}$/.test(id) || ids.has(id))
+      throw new Error("Invalid credit pack ID");
+    if (id.startsWith("credits_") && id !== `credits_${credits}`)
+      throw new Error("Inconsistent credit pack ID");
+    ids.add(id);
+    return { id, credits, ...row.expiresInDays === undefined ? {} : { expiresInDays: creditCount(row.expiresInDays) } };
+  });
+}
+function parseRemoteBillingStatus(value) {
+  const row = object(value);
+  const counts = [row.creditBalance, row.balanceCents].filter((value2) => value2 !== undefined).map(creditCount);
+  if (!counts.length || counts.some((count) => count !== counts[0]))
+    throw new Error("Inconsistent credit balance");
+  return {
+    creditBalance: counts[0],
+    formattedCreditBalance: `${counts[0]} credits`,
+    ...typeof row.plan === "string" ? { plan: row.plan } : {},
+    ...typeof row.hasPaymentMethod === "boolean" ? { hasPaymentMethod: row.hasPaymentMethod } : {}
+  };
+}
+function parseRemoteCheckout(value) {
+  const row = object(value);
+  if (typeof row.url !== "string")
+    throw new Error("Invalid checkout URL");
+  const url = new URL(row.url);
+  if (url.protocol !== "https:" || url.username || url.password)
+    throw new Error("Invalid checkout URL");
+  return { url: row.url };
+}
+function object(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Invalid Skills server response");
+  return value;
+}
+var RemoteCreditApprovalError;
+var init_remote_account = __esm(() => {
+  RemoteCreditApprovalError = class RemoteCreditApprovalError extends Error {
+    requiredCredits;
+    maximumCredits;
+    code = "CREDIT_APPROVAL_REQUIRED";
+    constructor(requiredCredits, maximumCredits) {
+      super(`This run requires ${requiredCredits} credits; the approved maximum is ${maximumCredits}. Quote the run and explicitly approve its cost.`);
+      this.requiredCredits = requiredCredits;
+      this.maximumCredits = maximumCredits;
+      this.name = "RemoteCreditApprovalError";
+    }
+  };
+});
+
+// src/lib/remote-files.ts
+var exports_remote_files = {};
+__export(exports_remote_files, {
+  sha256: () => sha256,
+  readBoundedResponse: () => readBoundedResponse,
+  describeRemoteFiles: () => describeRemoteFiles,
+  decodeRemoteFiles: () => decodeRemoteFiles,
+  MAX_REMOTE_FILE_BYTES: () => MAX_REMOTE_FILE_BYTES
+});
+import { createHash as createHash2 } from "crypto";
+function describeRemoteFiles(files) {
+  if (files.length > 10)
+    throw new Error("At most 10 input files are supported");
+  const names = new Set;
+  let total = 0;
+  return files.map((file) => {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(file.name) || file.name === "." || file.name === ".." || names.has(file.name))
+      throw new Error("Input file names must be unique safe basenames");
+    names.add(file.name);
+    total += file.bytes.byteLength;
+    if (file.bytes.byteLength > 20 * 1024 * 1024 || total > 50 * 1024 * 1024)
+      throw new Error("Input files exceed the supported size limit");
+    return { name: file.name, sizeBytes: file.bytes.byteLength, sha256: sha256(file.bytes), contentType: file.contentType ?? "application/octet-stream" };
+  });
+}
+function sha256(bytes) {
+  return createHash2("sha256").update(bytes).digest("hex");
+}
+async function readBoundedResponse(response, maximum) {
+  if (!Number.isSafeInteger(maximum) || maximum < 0 || maximum > MAX_REMOTE_FILE_BYTES)
+    throw new Error("Invalid artifact size limit");
+  const length = response.headers.get("content-length");
+  if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
+    await response.body?.cancel();
+    throw new Error("Artifact exceeds its declared size limit");
+  }
+  const reader = response.body?.getReader();
+  if (!reader)
+    return new Uint8Array;
+  const chunks = [];
+  let size2 = 0;
+  try {
+    while (true) {
+      const next = await reader.read();
+      if (next.done)
+        break;
+      size2 += next.value.byteLength;
+      if (size2 > maximum)
+        throw new Error("Artifact exceeds its declared size limit");
+      chunks.push(next.value);
+    }
+  } catch (error) {
+    await reader.cancel().catch(() => {});
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(size2);
+  let offset = 0;
+  for (const chunk2 of chunks) {
+    bytes.set(chunk2, offset);
+    offset += chunk2.byteLength;
+  }
+  return bytes;
+}
+function decodeRemoteFiles(files) {
+  let total = 0;
+  const decoded = files.map((file) => {
+    if (file.base64.length > 1398104 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(file.base64))
+      throw new Error("Invalid inline input encoding");
+    const bytes = Buffer.from(file.base64, "base64");
+    total += bytes.byteLength;
+    if (total > 1024 * 1024 || bytes.toString("base64") !== file.base64)
+      throw new Error("Inline inputs must total at most 1 MiB");
+    return { name: file.name, bytes, contentType: file.contentType };
+  });
+  describeRemoteFiles(decoded);
+  return decoded;
+}
+var MAX_REMOTE_FILE_BYTES;
+var init_remote_files = __esm(() => {
+  MAX_REMOTE_FILE_BYTES = 64 * 1024 * 1024;
+});
+
 // src/lib/remote-client.ts
 var exports_remote_client = {};
 __export(exports_remote_client, {
@@ -49100,13 +49328,16 @@ __export(exports_remote_client, {
 class RemoteSkillsClient {
   apiUrl;
   apiKey;
+  capabilities;
   constructor(apiKey, apiUrl = getApiUrl()) {
     this.apiKey = apiKey;
-    this.apiUrl = apiUrl.replace(/\/$/, "");
+    this.apiUrl = normalizeSkillsApiOrigin(apiUrl);
   }
   async request(path, options) {
     return fetch(`${this.apiUrl}${path}`, {
       ...options,
+      redirect: "error",
+      signal: options?.signal ?? AbortSignal.timeout(15000),
       headers: {
         Authorization: `Bearer ${this.apiKey}`,
         "Content-Type": "application/json",
@@ -49129,8 +49360,7 @@ class RemoteSkillsClient {
     return response;
   }
   async listSkills() {
-    const res = await this.request("/api/v1/skills");
-    return res.json();
+    return this.arrayResponse("/api/v1/skills");
   }
   async getSkillMd(slug) {
     const res = await this.request(`/api/v1/skills/${slug}/skill.md`);
@@ -49152,39 +49382,217 @@ class RemoteSkillsClient {
     } catch {}
     return { status: res.status, body };
   }
-  async submitRun(slug, input, args) {
-    const res = await this.request(`/api/v1/runs/${slug}`, {
+  async submitRun(slug, input, args, approval = {}) {
+    if (approval.idempotencyKey !== undefined && !/^[A-Za-z0-9._:-]{1,128}$/.test(approval.idempotencyKey))
+      throw new Error("Idempotency key must be 1-128 URL-safe characters");
+    if (approval.maxCostCents !== undefined)
+      creditCount(approval.maxCostCents);
+    if (approval.maxCredits !== undefined)
+      creditCount(approval.maxCredits);
+    if (approval.maxCredits !== undefined && approval.maxCostCents !== undefined && approval.maxCredits !== approval.maxCostCents)
+      throw new Error("Credit approval fields disagree");
+    const res = await this.request(`/api/v1/runs/${encodeURIComponent(slug)}`, {
       method: "POST",
-      body: JSON.stringify({ input, args })
+      body: JSON.stringify({
+        input,
+        args,
+        ...approval.maxCredits !== undefined ? { maxCredits: approval.maxCredits } : {},
+        ...approval.maxCostCents !== undefined ? { maxCostCents: approval.maxCostCents } : {},
+        ...approval.idempotencyKey !== undefined ? { idempotencyKey: approval.idempotencyKey } : {},
+        ...approval.inputFiles !== undefined ? { files: approval.inputFiles } : {}
+      })
     });
     return normalizeRemoteSkillRunContract(await res.json(), slug);
   }
+  async quoteRun(slug, input = {}, args = []) {
+    const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/quote`, {
+      method: "POST",
+      body: JSON.stringify({ input, args })
+    });
+    return parseRemoteRunQuote(await response.json());
+  }
+  getCapabilities() {
+    if (!this.capabilities)
+      this.capabilities = (async () => {
+        const value = await (await this.requestNewRoute("/api/v1/capabilities")).json();
+        if (value.contractVersion !== 1 || value.apiVersion !== 1 || !Array.isArray(value.capabilities) || value.capabilities.some((item) => typeof item !== "string"))
+          throw new Error("Unsupported Skills server capability contract");
+        const billing = value.billing;
+        return { contractVersion: 1, apiVersion: 1, capabilities: value.capabilities, ...billing ? { billing } : {} };
+      })();
+    return this.capabilities;
+  }
+  async submitQuotedRun(slug, input = {}, args = [], approval = {}) {
+    const maximum = creditCount(approval.maxCredits ?? approval.maxCostCents ?? 0);
+    if (approval.maxCostCents !== undefined && approval.maxCostCents !== maximum)
+      throw new Error("Credit approval fields disagree");
+    const quote = await this.quoteRun(slug, input, args);
+    if (quote.pricing.costCents > maximum)
+      throw new RemoteCreditApprovalError(quote.pricing.costCents, maximum);
+    const capabilities = await this.getCapabilities();
+    if (!capabilities.capabilities.includes("runs.submit") || capabilities.billing?.boundedRunApproval !== true || capabilities.billing.unit !== "credits") {
+      throw new Error("The configured server does not support bounded credit approval; refusing remote submission");
+    }
+    return this.submitRun(quote.skill, input, args, { ...approval, maxCredits: maximum, maxCostCents: maximum });
+  }
+  async getIdentity() {
+    return (await this.requestNewRoute("/api/auth/whoami")).json();
+  }
+  async listApiKeys() {
+    return this.arrayResponse("/api/auth/keys");
+  }
+  async createApiKey(name, scopes) {
+    if (!name.trim() || name.length > 100)
+      throw new Error("API key name must be 1-100 characters");
+    const value = await (await this.requestNewRoute("/api/auth/keys", { method: "POST", body: JSON.stringify({ name, ...scopes ? { scopes } : {} }) })).json();
+    if (!value || typeof value.key !== "string" || !value.key.trim())
+      throw new Error("The server did not return a created API key");
+    return value;
+  }
+  async revokeApiKey(keyId) {
+    return (await this.requestNewRoute(`/api/auth/keys/${encodeURIComponent(keyId)}`, { method: "DELETE" })).json();
+  }
+  async getBillingStatus() {
+    return parseRemoteBillingStatus(await (await this.requestNewRoute("/api/v1/billing/status")).json());
+  }
+  async listCreditPacks() {
+    return parseRemoteCreditPacks(await (await this.requestNewRoute("/api/v1/billing/credits")).json());
+  }
+  async createCreditCheckout(packId) {
+    const packs = await this.listCreditPacks();
+    if (!packs.some((pack) => pack.id === packId))
+      throw new Error("Choose a credit pack returned by skills credits packs");
+    return parseRemoteCheckout(await (await this.requestNewRoute("/api/v1/billing/credits", {
+      method: "POST",
+      body: JSON.stringify({ packId })
+    })).json());
+  }
+  async getUsage() {
+    return this.arrayResponse("/api/v1/billing/usage");
+  }
+  async listInvoices() {
+    return this.arrayResponse("/api/v1/billing/invoices");
+  }
+  async createBillingCheckout() {
+    return this.checkoutResponse("/api/v1/billing/checkout");
+  }
+  async createBillingPortal() {
+    return this.checkoutResponse("/api/v1/billing/portal");
+  }
+  async cancelRun(runId) {
+    return this.controlRun(runId, "cancel");
+  }
+  async resumeRun(runId) {
+    return this.controlRun(runId, "resume");
+  }
+  async controlRun(runId, action) {
+    const response = await this.requestNewRoute(`/api/v1/runs/${encodeURIComponent(runId)}/${action}`, { method: "POST", body: "{}" });
+    return normalizeRemoteSkillRunContract(await response.json());
+  }
+  async checkoutResponse(path) {
+    return parseRemoteCheckout(await (await this.requestNewRoute(path, { method: "POST", body: "{}" })).json());
+  }
+  async arrayResponse(path) {
+    const rows = await (await this.requestNewRoute(path)).json();
+    if (!Array.isArray(rows) || rows.some((row) => !row || typeof row !== "object" || Array.isArray(row)))
+      throw new Error("Invalid Skills server list response");
+    return rows;
+  }
   async getRun(runId) {
-    const res = await this.request(`/api/v1/runs/${runId}`);
-    if (!res.ok)
+    const path = `/api/v1/runs/${encodeURIComponent(runId)}`;
+    const res = await this.request(path);
+    if (res.status === 404)
       return null;
+    if (!res.ok)
+      throw new RemoteRequestError(path, res.status, res.statusText);
     return normalizeRemoteSkillRunContract(await res.json());
   }
   async getRunLogs(runId) {
-    const res = await this.request(`/api/v1/runs/${runId}/logs`);
-    if (!res.ok)
-      return [];
-    const payload = await res.json();
-    return Array.isArray(payload) ? payload : [];
+    return this.arrayResponse(`/api/v1/runs/${encodeURIComponent(runId)}/logs`);
   }
   async listRuns(limit = 20) {
-    const res = await this.request(`/api/v1/runs?limit=${limit}`);
-    return res.json();
+    if (!Number.isInteger(limit) || limit < 1 || limit > 100)
+      throw new Error("Run limit must be an integer from 1 to 100");
+    return this.arrayResponse(`/api/v1/runs?limit=${limit}`);
   }
   async getRunArtifacts(runId) {
-    const res = await this.request(`/api/v1/runs/${runId}/artifacts`);
-    return res.json();
+    return this.arrayResponse(`/api/v1/runs/${encodeURIComponent(runId)}/artifacts`);
   }
   async downloadRunArtifact(runId, artifactId) {
-    return this.request(`/api/v1/runs/${runId}/artifacts/${artifactId}/download`, {
+    return this.request(`/api/v1/runs/${encodeURIComponent(runId)}/artifacts/${encodeURIComponent(artifactId)}/download`, {
       method: "GET"
     });
   }
+  async getVerifiedRunArtifact(runId, artifactId, maximumBytes = MAX_REMOTE_FILE_BYTES) {
+    const artifacts = await this.getRunArtifacts(runId);
+    const artifact = artifacts.find((row) => row.id === artifactId);
+    if (!artifact)
+      throw new Error("Run artifact not found");
+    if (!Number.isSafeInteger(artifact.byteSize) || artifact.byteSize < 0 || artifact.byteSize > maximumBytes || typeof artifact.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(artifact.sha256))
+      throw new Error("The server does not provide valid artifact integrity metadata");
+    const response = await this.downloadRunArtifact(runId, artifactId);
+    if (!response.ok)
+      throw new RemoteRequestError("artifact download", response.status, response.statusText);
+    const bytes = await readBoundedResponse(response, artifact.byteSize);
+    if (bytes.byteLength !== artifact.byteSize || sha256(bytes) !== artifact.sha256)
+      throw new Error("Artifact integrity verification failed");
+    return { id: artifactId, fileName: String(artifact.fileName ?? artifactId), bytes, byteSize: bytes.byteLength, sha256: artifact.sha256 };
+  }
+  async submitQuotedRunWithFiles(slug, input, args, files, approval = {}) {
+    const inputFiles = describeRemoteFiles(files);
+    if (files.length && !(await this.getCapabilities()).capabilities.includes("runs.uploads"))
+      throw new Error("The configured server does not support input uploads");
+    const run = await this.submitQuotedRun(slug, input, args, { ...approval, inputFiles });
+    if (run.error || !run.id || !files.length)
+      return run;
+    const pastUploads = (status) => typeof status === "string" && [
+      "running",
+      "completed",
+      "failed",
+      "cancelled",
+      "expired",
+      "pending_approval",
+      "approved",
+      "waiting"
+    ].includes(status);
+    if (pastUploads(run.status))
+      return run;
+    try {
+      await this.uploadRunFiles(run.id, files);
+    } catch {
+      try {
+        const current = await this.getRun(run.id);
+        if (current && pastUploads(current.status))
+          return current;
+      } catch {}
+      let cancellationRequested = false;
+      try {
+        await this.cancelRun(run.id);
+        cancellationRequested = true;
+      } catch {}
+      throw new Error(`Input upload failed for run ${run.id}; ${cancellationRequested ? "cancellation requested" : "check its status and cancel the run"}`);
+    }
+    return run;
+  }
+  async uploadRunFiles(runId, files) {
+    const descriptors = describeRemoteFiles(files);
+    const response = await this.requestNewRoute(`/api/v1/runs/${encodeURIComponent(runId)}/uploads`, { method: "POST", body: JSON.stringify({ files: descriptors }) });
+    const payload = await response.json();
+    if (!Array.isArray(payload.files) || payload.files.length !== files.length || new Set(payload.files.map((file) => file.name)).size !== files.length)
+      throw new Error("Invalid input upload response");
+    for (const file of files) {
+      const upload = payload.files.find((row) => row.name === file.name);
+      if (!upload)
+        throw new Error("Missing input upload URL");
+      const url = new URL(upload.uploadUrl);
+      if (url.username || url.password || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+        throw new Error("Unsafe input upload URL");
+      const uploaded = await fetch(url, { method: "PUT", body: file.bytes, headers: { "Content-Type": file.contentType ?? "application/octet-stream" }, redirect: "error", signal: AbortSignal.timeout(60000) });
+      if (!uploaded.ok)
+        throw new Error("Input upload failed");
+      await uploaded.body?.cancel();
+    }
+  }
   async publishSkill(manifest, bundle, ifMatch) {
     const form = new FormData;
     form.set("manifest", JSON.stringify(manifest));
@@ -49197,7 +49605,9 @@ class RemoteSkillsClient {
     return fetch(`${this.apiUrl}/api/v1/skills`, {
       method: "POST",
       headers,
-      body: form
+      body: form,
+      redirect: "error",
+      signal: AbortSignal.timeout(15000)
     });
   }
   async deleteSkill(slug) {
@@ -49253,12 +49663,13 @@ class RemoteSkillsClient {
     if (!Array.isArray(payload)) {
       throw new Error("Remote tags payload did not match the expected contract (expected an array of tag names)");
     }
-    for (const tag of payload) {
-      if (typeof tag !== "string" || tag.trim().length === 0) {
-        throw new Error("Remote tags payload did not match the expected contract (every element must be a non-empty tag name)");
-      }
+    const isName = (value) => typeof value === "string" && value.trim().length > 0;
+    if (payload.every(isName))
+      return payload;
+    if (payload.every((tag) => tag !== null && typeof tag === "object" && !Array.isArray(tag) && isName(tag.name) && Number.isSafeInteger(tag.count) && tag.count >= 0)) {
+      return payload.map((tag) => tag.name);
     }
-    return payload;
+    throw new Error("Remote tags payload did not match the expected contract (every element must be a non-empty tag name, or every element must be a counted tag record)");
   }
   async skillsByTag(tag) {
     const path = `/api/v1/tags/${encodeURIComponent(tag)}/skills`;
@@ -49361,14 +49772,8 @@ function normalizeUpdatedSincePage(payload) {
   return { skills, nextCursor };
 }
 async function createRemoteSkillsClient(env3 = process.env) {
-  const fleet = resolveSkillsFleet(env3);
-  if (fleet.mode !== "hosted")
-    return null;
-  const apiKey = await resolveSkillsApiKey(env3);
-  if (!apiKey) {
-    throw new Error("A Skills authority resolved but no API key did. Sign in with: skills auth login");
-  }
-  return new RemoteSkillsClient(apiKey, fleet.apiOrigin);
+  const connection = await resolveSkillsConnection(env3);
+  return connection ? new RemoteSkillsClient(connection.apiKey, connection.apiOrigin) : null;
 }
 function createRemoteSkillsClientReadOnly(env3 = process.env) {
   return createRemoteSkillsClient(env3);
@@ -49377,6 +49782,8 @@ var RemoteRouteUnsupportedError, RemoteRequestError;
 var init_remote_client = __esm(() => {
   init_auth_store();
   init_fleet_credentials();
+  init_remote_account();
+  init_remote_files();
   RemoteRouteUnsupportedError = class RemoteRouteUnsupportedError extends Error {
     path;
     status;
@@ -49402,7 +49809,7 @@ var init_remote_client = __esm(() => {
 });
 
 // src/lib/revision.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 function revisionIdOf(content) {
   const canonical = JSON.stringify({
     slug: content.slug,
@@ -49417,7 +49824,7 @@ function revisionIdOf(content) {
     bundleSha256: content.bundleSha256 ?? null,
     bundleByteSize: content.bundleByteSize ?? null
   });
-  return createHash2("sha256").update(canonical).digest("hex");
+  return createHash3("sha256").update(canonical).digest("hex");
 }
 var REVISION_ID_PATTERN;
 var init_revision = __esm(() => {
@@ -49425,7 +49832,7 @@ var init_revision = __esm(() => {
 });
 
 // src/lib/skill-bundle.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { readFileSync as readFileSync13, readdirSync as readdirSync9, statSync as statSync10 } from "fs";
 import { join as join17, relative as relative2 } from "path";
 function isDotenvFile(lower) {
@@ -49456,7 +49863,7 @@ function ownBytes(view) {
   return out;
 }
 function sha256Hex(bytes) {
-  return createHash3("sha256").update(bytes).digest("hex");
+  return createHash4("sha256").update(bytes).digest("hex");
 }
 function collectSkillBundleEntries(dir) {
   const entries = [];
@@ -53188,7 +53595,7 @@ var init_runs = __esm(() => {
 });
 
 // src/lib/run-state.ts
-import { createHash as createHash4, randomBytes } from "crypto";
+import { createHash as createHash5, randomBytes } from "crypto";
 import { existsSync as existsSync23, mkdirSync as mkdirSync10, readFileSync as readFileSync21, readdirSync as readdirSync13, statSync as statSync14, writeFileSync as writeFileSync12 } from "fs";
 import { extname, join as join25, relative as relative3 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
@@ -53212,6 +53619,7 @@ function createSkillRun(params, targetDir = process.cwd()) {
     startedAt: now3.toISOString(),
     remote: params.remote ?? false,
     ...params.remoteRunId ? { remoteRunId: params.remoteRunId } : {},
+    ...params.remoteApiOrigin ? { remoteApiOrigin: params.remoteApiOrigin } : {},
     ...params.costCents !== undefined ? { costCents: params.costCents } : {},
     artifacts: [],
     paths: {
@@ -53324,7 +53732,7 @@ function collectRunArtifacts(context) {
     artifacts.push({
       path: toProjectRelative(context.targetDir, path),
       mime: mimeForPath(path),
-      sha256: createHash4("sha256").update(bytes).digest("hex"),
+      sha256: createHash5("sha256").update(bytes).digest("hex"),
       sizeBytes: stat.size
     });
   }
@@ -53561,19 +53969,19 @@ function floatSafeRemainder2(val, step) {
   const stepInt = Number.parseInt(step.toFixed(decCount).replace(".", ""));
   return valInt % stepInt / 10 ** decCount;
 }
-function defineLazy(object, key, getter) {
+function defineLazy(object2, key, getter) {
   const set2 = false;
-  Object.defineProperty(object, key, {
+  Object.defineProperty(object2, key, {
     get() {
       if (!set2) {
         const value = getter();
-        object[key] = value;
+        object2[key] = value;
         return value;
       }
       throw new Error("cached value already set");
     },
     set(v) {
-      Object.defineProperty(object, key, {
+      Object.defineProperty(object2, key, {
         value: v
       });
     },
@@ -57357,7 +57765,7 @@ function never(params) {
 function array(element, params) {
   return _array(ZodArray2, element, params);
 }
-function object(shape, params) {
+function object2(shape, params) {
   const def = {
     type: "object",
     get shape() {
@@ -58000,30 +58408,30 @@ var init_types2 = __esm(() => {
     ttl: number2().optional(),
     pollInterval: number2().optional()
   });
-  TaskMetadataSchema = object({
+  TaskMetadataSchema = object2({
     ttl: number2().optional()
   });
-  RelatedTaskMetadataSchema = object({
+  RelatedTaskMetadataSchema = object2({
     taskId: string2()
   });
   RequestMetaSchema = looseObject({
     progressToken: ProgressTokenSchema.optional(),
     [RELATED_TASK_META_KEY]: RelatedTaskMetadataSchema.optional()
   });
-  BaseRequestParamsSchema = object({
+  BaseRequestParamsSchema = object2({
     _meta: RequestMetaSchema.optional()
   });
   TaskAugmentedRequestParamsSchema = BaseRequestParamsSchema.extend({
     task: TaskMetadataSchema.optional()
   });
-  RequestSchema = object({
+  RequestSchema = object2({
     method: string2(),
     params: BaseRequestParamsSchema.loose().optional()
   });
-  NotificationsParamsSchema = object({
+  NotificationsParamsSchema = object2({
     _meta: RequestMetaSchema.optional()
   });
-  NotificationSchema = object({
+  NotificationSchema = object2({
     method: string2(),
     params: NotificationsParamsSchema.loose().optional()
   });
@@ -58031,16 +58439,16 @@ var init_types2 = __esm(() => {
     _meta: RequestMetaSchema.optional()
   });
   RequestIdSchema = union2([string2(), number2().int()]);
-  JSONRPCRequestSchema = object({
+  JSONRPCRequestSchema = object2({
     jsonrpc: literal(JSONRPC_VERSION),
     id: RequestIdSchema,
     ...RequestSchema.shape
   }).strict();
-  JSONRPCNotificationSchema = object({
+  JSONRPCNotificationSchema = object2({
     jsonrpc: literal(JSONRPC_VERSION),
     ...NotificationSchema.shape
   }).strict();
-  JSONRPCResultResponseSchema = object({
+  JSONRPCResultResponseSchema = object2({
     jsonrpc: literal(JSONRPC_VERSION),
     id: RequestIdSchema,
     result: ResultSchema
@@ -58055,10 +58463,10 @@ var init_types2 = __esm(() => {
     ErrorCode2[ErrorCode2["InternalError"] = -32603] = "InternalError";
     ErrorCode2[ErrorCode2["UrlElicitationRequired"] = -32042] = "UrlElicitationRequired";
   })(ErrorCode || (ErrorCode = {}));
-  JSONRPCErrorResponseSchema = object({
+  JSONRPCErrorResponseSchema = object2({
     jsonrpc: literal(JSONRPC_VERSION),
     id: RequestIdSchema.optional(),
-    error: object({
+    error: object2({
       code: number2().int(),
       message: string2(),
       data: unknown().optional()
@@ -58080,16 +58488,16 @@ var init_types2 = __esm(() => {
     method: literal("notifications/cancelled"),
     params: CancelledNotificationParamsSchema
   });
-  IconSchema = object({
+  IconSchema = object2({
     src: string2(),
     mimeType: string2().optional(),
     sizes: array(string2()).optional(),
     theme: _enum(["light", "dark"]).optional()
   });
-  IconsSchema = object({
+  IconsSchema = object2({
     icons: array(IconSchema).optional()
   });
-  BaseMetadataSchema = object({
+  BaseMetadataSchema = object2({
     name: string2(),
     title: string2().optional()
   });
@@ -58100,7 +58508,7 @@ var init_types2 = __esm(() => {
     websiteUrl: string2().optional(),
     description: string2().optional()
   });
-  FormElicitationCapabilitySchema = intersection2(object({
+  FormElicitationCapabilitySchema = intersection2(object2({
     applyDefaults: boolean2().optional()
   }), record(string2(), unknown()));
   ElicitationCapabilitySchema = preprocess((value) => {
@@ -58110,7 +58518,7 @@ var init_types2 = __esm(() => {
       }
     }
     return value;
-  }, intersection2(object({
+  }, intersection2(object2({
     form: FormElicitationCapabilitySchema.optional(),
     url: AssertObjectSchema.optional()
   }), record(string2(), unknown()).optional()));
@@ -58135,14 +58543,14 @@ var init_types2 = __esm(() => {
       }).optional()
     }).optional()
   });
-  ClientCapabilitiesSchema = object({
+  ClientCapabilitiesSchema = object2({
     experimental: record(string2(), AssertObjectSchema).optional(),
-    sampling: object({
+    sampling: object2({
       context: AssertObjectSchema.optional(),
       tools: AssertObjectSchema.optional()
     }).optional(),
     elicitation: ElicitationCapabilitySchema.optional(),
-    roots: object({
+    roots: object2({
       listChanged: boolean2().optional()
     }).optional(),
     tasks: ClientTasksCapabilitySchema.optional(),
@@ -58157,18 +58565,18 @@ var init_types2 = __esm(() => {
     method: literal("initialize"),
     params: InitializeRequestParamsSchema
   });
-  ServerCapabilitiesSchema = object({
+  ServerCapabilitiesSchema = object2({
     experimental: record(string2(), AssertObjectSchema).optional(),
     logging: AssertObjectSchema.optional(),
     completions: AssertObjectSchema.optional(),
-    prompts: object({
+    prompts: object2({
       listChanged: boolean2().optional()
     }).optional(),
-    resources: object({
+    resources: object2({
       subscribe: boolean2().optional(),
       listChanged: boolean2().optional()
     }).optional(),
-    tools: object({
+    tools: object2({
       listChanged: boolean2().optional()
     }).optional(),
     tasks: ServerTasksCapabilitySchema.optional(),
@@ -58188,12 +58596,12 @@ var init_types2 = __esm(() => {
     method: literal("ping"),
     params: BaseRequestParamsSchema.optional()
   });
-  ProgressSchema = object({
+  ProgressSchema = object2({
     progress: number2(),
     total: optional(number2()),
     message: optional(string2())
   });
-  ProgressNotificationParamsSchema = object({
+  ProgressNotificationParamsSchema = object2({
     ...NotificationsParamsSchema.shape,
     ...ProgressSchema.shape,
     progressToken: ProgressTokenSchema
@@ -58212,7 +58620,7 @@ var init_types2 = __esm(() => {
     nextCursor: CursorSchema.optional()
   });
   TaskStatusSchema = _enum(["working", "input_required", "completed", "failed", "cancelled"]);
-  TaskSchema = object({
+  TaskSchema = object2({
     taskId: string2(),
     status: TaskStatusSchema,
     ttl: union2([number2(), _null3()]),
@@ -58256,7 +58664,7 @@ var init_types2 = __esm(() => {
     })
   });
   CancelTaskResultSchema = ResultSchema.merge(TaskSchema);
-  ResourceContentsSchema = object({
+  ResourceContentsSchema = object2({
     uri: string2(),
     mimeType: optional(string2()),
     _meta: record(string2(), unknown()).optional()
@@ -58276,12 +58684,12 @@ var init_types2 = __esm(() => {
     blob: Base64Schema
   });
   RoleSchema = _enum(["user", "assistant"]);
-  AnnotationsSchema = object({
+  AnnotationsSchema = object2({
     audience: array(RoleSchema).optional(),
     priority: number2().min(0).max(1).optional(),
     lastModified: exports_iso.datetime({ offset: true }).optional()
   });
-  ResourceSchema = object({
+  ResourceSchema = object2({
     ...BaseMetadataSchema.shape,
     ...IconsSchema.shape,
     uri: string2(),
@@ -58291,7 +58699,7 @@ var init_types2 = __esm(() => {
     annotations: AnnotationsSchema.optional(),
     _meta: optional(looseObject({}))
   });
-  ResourceTemplateSchema = object({
+  ResourceTemplateSchema = object2({
     ...BaseMetadataSchema.shape,
     ...IconsSchema.shape,
     uriTemplate: string2(),
@@ -58344,12 +58752,12 @@ var init_types2 = __esm(() => {
     method: literal("notifications/resources/updated"),
     params: ResourceUpdatedNotificationParamsSchema
   });
-  PromptArgumentSchema = object({
+  PromptArgumentSchema = object2({
     name: string2(),
     description: optional(string2()),
     required: optional(boolean2())
   });
-  PromptSchema = object({
+  PromptSchema = object2({
     ...BaseMetadataSchema.shape,
     ...IconsSchema.shape,
     description: optional(string2()),
@@ -58370,34 +58778,34 @@ var init_types2 = __esm(() => {
     method: literal("prompts/get"),
     params: GetPromptRequestParamsSchema
   });
-  TextContentSchema = object({
+  TextContentSchema = object2({
     type: literal("text"),
     text: string2(),
     annotations: AnnotationsSchema.optional(),
     _meta: record(string2(), unknown()).optional()
   });
-  ImageContentSchema = object({
+  ImageContentSchema = object2({
     type: literal("image"),
     data: Base64Schema,
     mimeType: string2(),
     annotations: AnnotationsSchema.optional(),
     _meta: record(string2(), unknown()).optional()
   });
-  AudioContentSchema = object({
+  AudioContentSchema = object2({
     type: literal("audio"),
     data: Base64Schema,
     mimeType: string2(),
     annotations: AnnotationsSchema.optional(),
     _meta: record(string2(), unknown()).optional()
   });
-  ToolUseContentSchema = object({
+  ToolUseContentSchema = object2({
     type: literal("tool_use"),
     name: string2(),
     id: string2(),
     input: record(string2(), unknown()),
     _meta: record(string2(), unknown()).optional()
   });
-  EmbeddedResourceSchema = object({
+  EmbeddedResourceSchema = object2({
     type: literal("resource"),
     resource: union2([TextResourceContentsSchema, BlobResourceContentsSchema]),
     annotations: AnnotationsSchema.optional(),
@@ -58413,7 +58821,7 @@ var init_types2 = __esm(() => {
     ResourceLinkSchema,
     EmbeddedResourceSchema
   ]);
-  PromptMessageSchema = object({
+  PromptMessageSchema = object2({
     role: RoleSchema,
     content: ContentBlockSchema
   });
@@ -58425,26 +58833,26 @@ var init_types2 = __esm(() => {
     method: literal("notifications/prompts/list_changed"),
     params: NotificationsParamsSchema.optional()
   });
-  ToolAnnotationsSchema = object({
+  ToolAnnotationsSchema = object2({
     title: string2().optional(),
     readOnlyHint: boolean2().optional(),
     destructiveHint: boolean2().optional(),
     idempotentHint: boolean2().optional(),
     openWorldHint: boolean2().optional()
   });
-  ToolExecutionSchema = object({
+  ToolExecutionSchema = object2({
     taskSupport: _enum(["required", "optional", "forbidden"]).optional()
   });
-  ToolSchema = object({
+  ToolSchema = object2({
     ...BaseMetadataSchema.shape,
     ...IconsSchema.shape,
     description: string2().optional(),
-    inputSchema: object({
+    inputSchema: object2({
       type: literal("object"),
       properties: record(string2(), AssertObjectSchema).optional(),
       required: array(string2()).optional()
     }).catchall(unknown()),
-    outputSchema: object({
+    outputSchema: object2({
       type: literal("object"),
       properties: record(string2(), AssertObjectSchema).optional(),
       required: array(string2()).optional()
@@ -58479,7 +58887,7 @@ var init_types2 = __esm(() => {
     method: literal("notifications/tools/list_changed"),
     params: NotificationsParamsSchema.optional()
   });
-  ListChangedOptionsBaseSchema = object({
+  ListChangedOptionsBaseSchema = object2({
     autoRefresh: boolean2().default(true),
     debounceMs: number2().int().nonnegative().default(300)
   });
@@ -58500,23 +58908,23 @@ var init_types2 = __esm(() => {
     method: literal("notifications/message"),
     params: LoggingMessageNotificationParamsSchema
   });
-  ModelHintSchema = object({
+  ModelHintSchema = object2({
     name: string2().optional()
   });
-  ModelPreferencesSchema = object({
+  ModelPreferencesSchema = object2({
     hints: array(ModelHintSchema).optional(),
     costPriority: number2().min(0).max(1).optional(),
     speedPriority: number2().min(0).max(1).optional(),
     intelligencePriority: number2().min(0).max(1).optional()
   });
-  ToolChoiceSchema = object({
+  ToolChoiceSchema = object2({
     mode: _enum(["auto", "required", "none"]).optional()
   });
-  ToolResultContentSchema = object({
+  ToolResultContentSchema = object2({
     type: literal("tool_result"),
     toolUseId: string2().describe("The unique identifier for the corresponding tool call."),
     content: array(ContentBlockSchema).default([]),
-    structuredContent: object({}).loose().optional(),
+    structuredContent: object2({}).loose().optional(),
     isError: boolean2().optional(),
     _meta: record(string2(), unknown()).optional()
   });
@@ -58528,7 +58936,7 @@ var init_types2 = __esm(() => {
     ToolUseContentSchema,
     ToolResultContentSchema
   ]);
-  SamplingMessageSchema = object({
+  SamplingMessageSchema = object2({
     role: RoleSchema,
     content: union2([SamplingMessageContentBlockSchema, array(SamplingMessageContentBlockSchema)]),
     _meta: record(string2(), unknown()).optional()
@@ -58561,13 +58969,13 @@ var init_types2 = __esm(() => {
     role: RoleSchema,
     content: union2([SamplingMessageContentBlockSchema, array(SamplingMessageContentBlockSchema)])
   });
-  BooleanSchemaSchema = object({
+  BooleanSchemaSchema = object2({
     type: literal("boolean"),
     title: string2().optional(),
     description: string2().optional(),
     default: boolean2().optional()
   });
-  StringSchemaSchema = object({
+  StringSchemaSchema = object2({
     type: literal("string"),
     title: string2().optional(),
     description: string2().optional(),
@@ -58576,7 +58984,7 @@ var init_types2 = __esm(() => {
     format: _enum(["email", "uri", "date", "date-time"]).optional(),
     default: string2().optional()
   });
-  NumberSchemaSchema = object({
+  NumberSchemaSchema = object2({
     type: _enum(["number", "integer"]),
     title: string2().optional(),
     description: string2().optional(),
@@ -58584,24 +58992,24 @@ var init_types2 = __esm(() => {
     maximum: number2().optional(),
     default: number2().optional()
   });
-  UntitledSingleSelectEnumSchemaSchema = object({
+  UntitledSingleSelectEnumSchemaSchema = object2({
     type: literal("string"),
     title: string2().optional(),
     description: string2().optional(),
     enum: array(string2()),
     default: string2().optional()
   });
-  TitledSingleSelectEnumSchemaSchema = object({
+  TitledSingleSelectEnumSchemaSchema = object2({
     type: literal("string"),
     title: string2().optional(),
     description: string2().optional(),
-    oneOf: array(object({
+    oneOf: array(object2({
       const: string2(),
       title: string2()
     })),
     default: string2().optional()
   });
-  LegacyTitledEnumSchemaSchema = object({
+  LegacyTitledEnumSchemaSchema = object2({
     type: literal("string"),
     title: string2().optional(),
     description: string2().optional(),
@@ -58610,26 +59018,26 @@ var init_types2 = __esm(() => {
     default: string2().optional()
   });
   SingleSelectEnumSchemaSchema = union2([UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema]);
-  UntitledMultiSelectEnumSchemaSchema = object({
+  UntitledMultiSelectEnumSchemaSchema = object2({
     type: literal("array"),
     title: string2().optional(),
     description: string2().optional(),
     minItems: number2().optional(),
     maxItems: number2().optional(),
-    items: object({
+    items: object2({
       type: literal("string"),
       enum: array(string2())
     }),
     default: array(string2()).optional()
   });
-  TitledMultiSelectEnumSchemaSchema = object({
+  TitledMultiSelectEnumSchemaSchema = object2({
     type: literal("array"),
     title: string2().optional(),
     description: string2().optional(),
     minItems: number2().optional(),
     maxItems: number2().optional(),
-    items: object({
-      anyOf: array(object({
+    items: object2({
+      anyOf: array(object2({
         const: string2(),
         title: string2()
       }))
@@ -58642,7 +59050,7 @@ var init_types2 = __esm(() => {
   ElicitRequestFormParamsSchema = TaskAugmentedRequestParamsSchema.extend({
     mode: literal("form").optional(),
     message: string2(),
-    requestedSchema: object({
+    requestedSchema: object2({
       type: literal("object"),
       properties: record(string2(), PrimitiveSchemaDefinitionSchema),
       required: array(string2()).optional()
@@ -58670,21 +59078,21 @@ var init_types2 = __esm(() => {
     action: _enum(["accept", "decline", "cancel"]),
     content: preprocess((val) => val === null ? undefined : val, record(string2(), union2([string2(), number2(), boolean2(), array(string2())])).optional())
   });
-  ResourceTemplateReferenceSchema = object({
+  ResourceTemplateReferenceSchema = object2({
     type: literal("ref/resource"),
     uri: string2()
   });
-  PromptReferenceSchema = object({
+  PromptReferenceSchema = object2({
     type: literal("ref/prompt"),
     name: string2()
   });
   CompleteRequestParamsSchema = BaseRequestParamsSchema.extend({
     ref: union2([PromptReferenceSchema, ResourceTemplateReferenceSchema]),
-    argument: object({
+    argument: object2({
       name: string2(),
       value: string2()
     }),
-    context: object({
+    context: object2({
       arguments: record(string2(), string2()).optional()
     }).optional()
   });
@@ -58699,7 +59107,7 @@ var init_types2 = __esm(() => {
       hasMore: optional(boolean2())
     })
   });
-  RootSchema = object({
+  RootSchema = object2({
     uri: string2().startsWith("file://"),
     name: string2().optional(),
     _meta: record(string2(), unknown()).optional()
@@ -58938,7 +59346,7 @@ var init_parse3 = __esm(() => {
 });
 
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v4/mini/schemas.js
-function object2(shape, params) {
+function object3(shape, params) {
   const def = {
     type: "object",
     get shape() {
@@ -59025,11 +59433,11 @@ function isZ4Schema(s) {
 function objectFromShape(shape) {
   const values2 = Object.values(shape);
   if (values2.length === 0)
-    return object2({});
+    return object3({});
   const allV4 = values2.every(isZ4Schema);
   const allV3 = values2.every((s) => !isZ4Schema(s));
   if (allV4)
-    return object2(shape);
+    return object3(shape);
   if (allV3)
     return objectType(shape);
   throw new Error("Mixed Zod versions detected in object shape.");
@@ -59916,11 +60324,11 @@ var init_map = __esm(() => {
 
 // ../../node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/nativeEnum.js
 function parseNativeEnumDef(def) {
-  const object3 = def.values;
+  const object4 = def.values;
   const actualKeys = Object.keys(def.values).filter((key) => {
-    return typeof object3[object3[key]] !== "number";
+    return typeof object4[object4[key]] !== "number";
   });
-  const actualValues = actualKeys.map((key) => object3[key]);
+  const actualValues = actualKeys.map((key) => object4[key]);
   const parsedTypes = Array.from(new Set(actualValues.map((values2) => typeof values2)));
   return {
     type: parsedTypes.length === 1 ? parsedTypes[0] === "string" ? "string" : "number" : ["string", "number"],
@@ -61856,11 +62264,11 @@ var require_codegen = __commonJS((exports) => {
       const rhs = this.rhs === undefined ? "" : ` = ${this.rhs}`;
       return `${varKind} ${this.name}${rhs};` + _n;
     }
-    optimizeNames(names, constants2) {
+    optimizeNames(names, constants3) {
       if (!names[this.name.str])
         return;
       if (this.rhs)
-        this.rhs = optimizeExpr(this.rhs, names, constants2);
+        this.rhs = optimizeExpr(this.rhs, names, constants3);
       return this;
     }
     get names() {
@@ -61878,10 +62286,10 @@ var require_codegen = __commonJS((exports) => {
     render({ _n }) {
       return `${this.lhs} = ${this.rhs};` + _n;
     }
-    optimizeNames(names, constants2) {
+    optimizeNames(names, constants3) {
       if (this.lhs instanceof code_1.Name && !names[this.lhs.str] && !this.sideEffects)
         return;
-      this.rhs = optimizeExpr(this.rhs, names, constants2);
+      this.rhs = optimizeExpr(this.rhs, names, constants3);
       return this;
     }
     get names() {
@@ -61947,8 +62355,8 @@ var require_codegen = __commonJS((exports) => {
     optimizeNodes() {
       return `${this.code}` ? this : undefined;
     }
-    optimizeNames(names, constants2) {
-      this.code = optimizeExpr(this.code, names, constants2);
+    optimizeNames(names, constants3) {
+      this.code = optimizeExpr(this.code, names, constants3);
       return this;
     }
     get names() {
@@ -61978,12 +62386,12 @@ var require_codegen = __commonJS((exports) => {
       }
       return nodes.length > 0 ? this : undefined;
     }
-    optimizeNames(names, constants2) {
+    optimizeNames(names, constants3) {
       const { nodes } = this;
       let i = nodes.length;
       while (i--) {
         const n = nodes[i];
-        if (n.optimizeNames(names, constants2))
+        if (n.optimizeNames(names, constants3))
           continue;
         subtractNames(names, n.names);
         nodes.splice(i, 1);
@@ -62040,12 +62448,12 @@ var require_codegen = __commonJS((exports) => {
         return;
       return this;
     }
-    optimizeNames(names, constants2) {
+    optimizeNames(names, constants3) {
       var _a;
-      this.else = (_a = this.else) === null || _a === undefined ? undefined : _a.optimizeNames(names, constants2);
-      if (!(super.optimizeNames(names, constants2) || this.else))
+      this.else = (_a = this.else) === null || _a === undefined ? undefined : _a.optimizeNames(names, constants3);
+      if (!(super.optimizeNames(names, constants3) || this.else))
         return;
-      this.condition = optimizeExpr(this.condition, names, constants2);
+      this.condition = optimizeExpr(this.condition, names, constants3);
       return this;
     }
     get names() {
@@ -62070,10 +62478,10 @@ var require_codegen = __commonJS((exports) => {
     render(opts) {
       return `for(${this.iteration})` + super.render(opts);
     }
-    optimizeNames(names, constants2) {
-      if (!super.optimizeNames(names, constants2))
+    optimizeNames(names, constants3) {
+      if (!super.optimizeNames(names, constants3))
         return;
-      this.iteration = optimizeExpr(this.iteration, names, constants2);
+      this.iteration = optimizeExpr(this.iteration, names, constants3);
       return this;
     }
     get names() {
@@ -62111,10 +62519,10 @@ var require_codegen = __commonJS((exports) => {
     render(opts) {
       return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
     }
-    optimizeNames(names, constants2) {
-      if (!super.optimizeNames(names, constants2))
+    optimizeNames(names, constants3) {
+      if (!super.optimizeNames(names, constants3))
         return;
-      this.iterable = optimizeExpr(this.iterable, names, constants2);
+      this.iterable = optimizeExpr(this.iterable, names, constants3);
       return this;
     }
     get names() {
@@ -62159,11 +62567,11 @@ var require_codegen = __commonJS((exports) => {
       (_b = this.finally) === null || _b === undefined || _b.optimizeNodes();
       return this;
     }
-    optimizeNames(names, constants2) {
+    optimizeNames(names, constants3) {
       var _a, _b;
-      super.optimizeNames(names, constants2);
-      (_a = this.catch) === null || _a === undefined || _a.optimizeNames(names, constants2);
-      (_b = this.finally) === null || _b === undefined || _b.optimizeNames(names, constants2);
+      super.optimizeNames(names, constants3);
+      (_a = this.catch) === null || _a === undefined || _a.optimizeNames(names, constants3);
+      (_b = this.finally) === null || _b === undefined || _b.optimizeNames(names, constants3);
       return this;
     }
     get names() {
@@ -62437,7 +62845,7 @@ var require_codegen = __commonJS((exports) => {
   function addExprNames(names, from) {
     return from instanceof code_1._CodeOrName ? addNames(names, from.names) : names;
   }
-  function optimizeExpr(expr, names, constants2) {
+  function optimizeExpr(expr, names, constants3) {
     if (expr instanceof code_1.Name)
       return replaceName(expr);
     if (!canOptimize(expr))
@@ -62452,14 +62860,14 @@ var require_codegen = __commonJS((exports) => {
       return items;
     }, []));
     function replaceName(n) {
-      const c = constants2[n.str];
+      const c = constants3[n.str];
       if (c === undefined || names[n.str] !== 1)
         return n;
       delete names[n.str];
       return c;
     }
     function canOptimize(e) {
-      return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants2[c.str] !== undefined);
+      return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants3[c.str] !== undefined);
     }
   }
   function subtractNames(names, from) {
@@ -69913,6 +70321,27 @@ var init_mcp = __esm(() => {
   };
 });
 
+// src/lib/remote-customer-operations.ts
+var REMOTE_CUSTOMER_OPERATIONS;
+var init_remote_customer_operations = __esm(() => {
+  REMOTE_CUSTOMER_OPERATIONS = [
+    { name: "get_account", title: "Get Account Identity", parameter: null, mutates: false, invoke: (client) => client.getIdentity() },
+    { name: "get_server_capabilities", title: "Get Server Capabilities", parameter: null, mutates: false, invoke: (client) => client.getCapabilities() },
+    { name: "list_remote_skills", title: "List Remote Skills", parameter: null, mutates: false, invoke: (client) => client.listSkills() },
+    { name: "get_billing_status", title: "Get Billing Status", parameter: null, mutates: false, invoke: (client) => client.getBillingStatus() },
+    { name: "list_credit_packs", title: "List Credit Packs", parameter: null, mutates: false, invoke: (client) => client.listCreditPacks() },
+    { name: "create_credit_checkout", title: "Create Credit Checkout", parameter: "pack_id", mutates: true, invoke: (client, value) => client.createCreditCheckout(value) },
+    { name: "get_billing_usage", title: "Get Billing Usage", parameter: null, mutates: false, invoke: (client) => client.getUsage() },
+    { name: "list_invoices", title: "List Invoices", parameter: null, mutates: false, invoke: (client) => client.listInvoices() },
+    { name: "create_billing_checkout", title: "Create Billing Checkout", parameter: null, mutates: true, invoke: (client) => client.createBillingCheckout() },
+    { name: "create_billing_portal", title: "Create Billing Portal", parameter: null, mutates: true, invoke: (client) => client.createBillingPortal() },
+    { name: "get_run_logs", title: "Get Run Logs", parameter: "run_id", mutates: false, invoke: (client, value) => client.getRunLogs(value) },
+    { name: "cancel_run", title: "Cancel Run", parameter: "run_id", mutates: true, invoke: (client, value) => client.cancelRun(value) },
+    { name: "resume_run", title: "Resume Run", parameter: "run_id", mutates: true, invoke: (client, value) => client.resumeRun(value) },
+    { name: "list_run_artifacts", title: "List Run Artifacts", parameter: "run_id", mutates: false, invoke: (client, value) => client.getRunArtifacts(value) }
+  ];
+});
+
 // src/lib/mcp-contracts.ts
 function listMcpToolContracts(query) {
   const needle = query?.toLowerCase();
@@ -70054,8 +70483,9 @@ var MCP_CONTRACT_SCHEMA_VERSION = 1, stringSchema = (description) => ({
   type: "array",
   items,
   ...description ? { description } : {}
-}), skillNameInput, optionalAgentInput, scopeInput, runInputSchema, runArgsSchema, errorSchema, skillSummarySchema, toolPrimitiveSummarySchema, skillToolDependencySchema, validationMessageSchema, validationOutputSchema, installOutputSchema, runOutputSchema, toolContracts, contracts, resourceContracts;
+}), skillNameInput, optionalAgentInput, scopeInput, runInputSchema, runArgsSchema, errorSchema, skillSummarySchema, toolPrimitiveSummarySchema, skillToolDependencySchema, validationMessageSchema, validationOutputSchema, installOutputSchema, runOutputSchema, toolContracts, remoteCustomerContracts, contracts, resourceContracts;
 var init_mcp_contracts = __esm(() => {
+  init_remote_customer_operations();
   skillNameInput = stringSchema("skill name or alias.");
   optionalAgentInput = stringSchema("Optional target agent slug. Use MCP registration instead of direct skill-folder installs.");
   scopeInput = {
@@ -70424,11 +70854,44 @@ var init_mcp_contracts = __esm(() => {
         dependencies: objectSchema({}, [], "Package dependencies.", true)
       })
     },
+    {
+      name: "list_api_keys",
+      title: "List API Keys",
+      description: "List keys using fresh email OTP reauthentication.",
+      params: ["email", "code"],
+      category: "execution",
+      sideEffects: "local-process-or-remote-run",
+      stable: true,
+      inputSchema: objectSchema({ email: { type: "string", format: "email" }, code: { type: "string", pattern: "^\\d{6}$" } }, ["email", "code"]),
+      outputSchema: arraySchema(objectSchema({}, [], "API key metadata", true))
+    },
+    {
+      name: "revoke_api_key",
+      title: "Revoke API Key",
+      description: "Revoke a key using fresh email OTP reauthentication.",
+      params: ["key_id", "email", "code"],
+      category: "execution",
+      sideEffects: "local-process-or-remote-run",
+      stable: true,
+      inputSchema: objectSchema({ key_id: stringSchema("API key ID"), email: { type: "string", format: "email" }, code: { type: "string", pattern: "^\\d{6}$" } }, ["key_id", "email", "code"]),
+      outputSchema: objectSchema({}, [], "Revocation result", true)
+    },
+    {
+      name: "create_api_key",
+      title: "Create API Key",
+      description: "Create a key with fresh email OTP reauthentication; returns the secret once.",
+      params: ["name", "email", "code", "scopes?"],
+      category: "execution",
+      sideEffects: "local-process-or-remote-run",
+      stable: true,
+      inputSchema: objectSchema({ name: stringSchema("Key name"), email: { type: "string", format: "email" }, code: { type: "string", pattern: "^\\d{6}$" }, scopes: arraySchema(stringSchema("Scope")) }, ["name", "email", "code"]),
+      outputSchema: objectSchema({}, [], "Created key and one-time secret", true)
+    },
     {
       name: "run_skill",
       title: "Run Skill",
       description: "Run a skill locally or through a configured remote runner. Returns compact stdout/stderr previews and run summaries by default; pass detail:true for full records.",
-      params: ["name", "input?", "args?", "detail?"],
+      params: ["name", "input?", "args?", "detail?", "remote?", "maxCredits?", "maxCostCents?", "idempotency_key?", "files?"],
       category: "execution",
       sideEffects: "local-process-or-remote-run",
       stable: true,
@@ -70436,7 +70899,12 @@ var init_mcp_contracts = __esm(() => {
         name: skillNameInput,
         input: runInputSchema,
         args: runArgsSchema,
-        detail: { type: "boolean", default: false, description: "Return full stdout/stderr, remote run, and local run metadata." }
+        detail: { type: "boolean", default: false, description: "Return full stdout/stderr, remote run, and local run metadata." },
+        remote: { type: "boolean", description: "Use the configured server catalog." },
+        maxCredits: { type: "integer", minimum: 0, description: "Maximum explicitly approved integer credits; omitted permits only free remote runs." },
+        maxCostCents: { type: "integer", minimum: 0, description: "Legacy alias for maxCredits; both must agree." },
+        idempotency_key: { type: "string", pattern: "^[A-Za-z0-9._:-]{1,128}$", description: "Stable retry key for the same remote submission." },
+        files: { type: "array", maxItems: 10, items: objectSchema({ name: stringSchema("Safe basename"), base64: { type: "string", maxLength: 1398104 }, contentType: stringSchema("MIME type") }, ["name", "base64"]), description: "Inline remote inputs, at most 1 MiB combined." }
       }, ["name"]),
       outputSchema: runOutputSchema
     },
@@ -70703,7 +71171,40 @@ var init_mcp_contracts = __esm(() => {
       outputSchema: objectSchema({}, [], "Feedback save result.", true)
     }
   ];
-  contracts = [...toolContracts].sort((a, b) => a.name.localeCompare(b.name));
+  remoteCustomerContracts = REMOTE_CUSTOMER_OPERATIONS.map((operation) => ({
+    name: operation.name,
+    title: operation.title,
+    description: `${operation.title} on the configured server; unavailable capabilities fail explicitly.`,
+    params: operation.parameter ? [operation.parameter] : [],
+    category: "execution",
+    sideEffects: operation.mutates ? "local-process-or-remote-run" : "none",
+    stable: true,
+    inputSchema: objectSchema(operation.parameter ? { [operation.parameter]: stringSchema("Server resource identifier.") } : {}, operation.parameter ? [operation.parameter] : []),
+    outputSchema: { oneOf: [objectSchema({}, [], "Server response.", true), { type: "array", items: objectSchema({}, [], "Server record.", true) }] }
+  }));
+  remoteCustomerContracts.push({
+    name: "quote_skill",
+    title: "Quote Remote Skill",
+    description: "Get a server credit quote without submitting a run.",
+    params: ["name", "input?", "args?"],
+    category: "execution",
+    sideEffects: "none",
+    stable: true,
+    inputSchema: objectSchema({ name: skillNameInput, input: runInputSchema, args: runArgsSchema }, ["name"]),
+    outputSchema: objectSchema({ skill: stringSchema("Canonical server skill."), pricing: objectSchema({}, [], "Quoted integer credits.", true) }, ["skill", "pricing"], undefined, true)
+  });
+  remoteCustomerContracts.push({
+    name: "download_run_artifact",
+    title: "Download Verified Run Artifact",
+    description: "Return verified artifact bytes as base64, bounded to 1 MiB.",
+    params: ["run_id", "artifact_id"],
+    category: "execution",
+    sideEffects: "none",
+    stable: true,
+    inputSchema: objectSchema({ run_id: stringSchema("Run identifier."), artifact_id: stringSchema("Artifact identifier.") }, ["run_id", "artifact_id"]),
+    outputSchema: objectSchema({ id: stringSchema("Artifact identifier."), fileName: stringSchema("Artifact file name."), base64: stringSchema("Verified bytes."), sha256: stringSchema("SHA256 digest."), byteSize: { type: "integer", minimum: 0 } }, ["id", "fileName", "base64", "sha256", "byteSize"])
+  });
+  contracts = [...toolContracts, ...remoteCustomerContracts].sort((a, b) => a.name.localeCompare(b.name));
   resourceContracts = [
     {
       uri: "skills://mcp/contracts",
@@ -70985,14 +71486,12 @@ function resolveRunRouting(skill, apiKey, apiUrl) {
       error: `${skill.name} is a server-owned skill. Run: skills auth login`
     };
   }
-  return { route: "remote", apiKey };
+  return { route: "remote", apiKey, apiOrigin: apiUrl };
 }
 async function resolveConfiguredRunRouting(skill, env3 = process.env) {
-  let fleet;
-  let apiKey;
+  let connection;
   try {
-    fleet = resolveSkillsFleet(env3);
-    apiKey = fleet.mode === "hosted" ? await resolveSkillsApiKey(env3) : null;
+    connection = await resolveSkillsConnection(env3);
   } catch (error2) {
     const isMissingCredential = (error2 instanceof SkillsFleetCredentialError || error2?.name === "SkillsFleetCredentialError") && error2.code === "MISSING_API_CREDENTIAL";
     if (!isMissingCredential)
@@ -71003,7 +71502,7 @@ async function resolveConfiguredRunRouting(skill, env3 = process.env) {
       error: `${skill.name} is a server-owned skill. ${error2.message}`
     };
   }
-  return resolveRunRouting(skill, apiKey, fleet.apiOrigin ?? undefined);
+  return resolveRunRouting(skill, connection?.apiKey, connection?.apiOrigin);
 }
 var init_run_routing = __esm(() => {
   init_fleet_credentials();
@@ -71212,10 +71711,15 @@ function registerOperationTools(server) {
       name: exports_external.string(),
       input: exports_external.record(exports_external.string(), exports_external.unknown()).optional(),
       args: exports_external.array(exports_external.string()).optional(),
-      detail: exports_external.boolean().optional()
-    }
-  }, async ({ name, input, args, detail }) => {
-    const skill = getSkill(name);
+      detail: exports_external.boolean().optional(),
+      maxCostCents: exports_external.number().int().min(0).max(2147483647).optional().describe("Maximum integer credits explicitly approved by the user for a remote run; omitted permits only free runs"),
+      maxCredits: exports_external.number().int().min(0).max(2147483647).optional(),
+      remote: exports_external.boolean().optional().describe("Use the configured server catalog, including skills not installed locally"),
+      idempotency_key: exports_external.string().regex(/^[A-Za-z0-9._:-]{1,128}$/).optional().describe("Reuse for the same approved submission after an interrupted response"),
+      files: exports_external.array(exports_external.object({ name: exports_external.string(), base64: exports_external.string().max(1398104), contentType: exports_external.string().optional() })).max(10).optional().describe("Inline remote inputs, at most 1 MiB combined; use CLI or SDK for larger files")
+    }
+  }, async ({ name, input, args, detail, maxCostCents, maxCredits, remote, idempotency_key, files }) => {
+    const skill = remote ? { name, serverOwned: true } : getSkill(name);
     if (!skill) {
       return mcpError("SKILL_NOT_FOUND", `Skill '${name}' not found`, findSimilarSkills(name));
     }
@@ -71226,17 +71730,26 @@ function registerOperationTools(server) {
     const skillName = skill.name;
     const runInput = input || {};
     const runArgs = args || [];
-    if (skillName === ARTICLE_GENERATION_SLUG2) {
+    if (!remote && skillName === ARTICLE_GENERATION_SLUG2) {
       const validation = validateBlogArticleRunOptions2(runInput, runArgs, { requireTopic: true });
       if (!validation.ok) {
         return mcpError("INVALID_BLOG_ARTICLE_OPTIONS", validation.errors.join(" "));
       }
     }
     const routing = await resolveConfiguredRunRouting(skill);
+    if (files?.length && routing.route !== "remote")
+      return mcpError("REMOTE_REQUIRED", "Inline inputs require a remote run");
+    let inputFiles;
+    try {
+      inputFiles = (await Promise.resolve().then(() => (init_remote_files(), exports_remote_files))).decodeRemoteFiles(files ?? []);
+    } catch (error2) {
+      return mcpError("INVALID_INPUT_FILES", error2.message);
+    }
     const runContext = createSkillRun({
       skill: skillName,
       args: runArgs,
-      remote: routing.route === "remote"
+      remote: routing.route === "remote",
+      ...routing.route === "remote" ? { remoteApiOrigin: routing.apiOrigin } : {}
     });
     if (routing.route === "error") {
       const error2 = routing.error;
@@ -71249,8 +71762,8 @@ function registerOperationTools(server) {
     if (routing.route === "remote") {
       try {
         const { RemoteSkillsClient: RemoteSkillsClient2 } = await Promise.resolve().then(() => (init_remote_client(), exports_remote_client));
-        const client = new RemoteSkillsClient2(routing.apiKey);
-        const run = await client.submitRun(skillName, runInput, runArgs);
+        const client = new RemoteSkillsClient2(routing.apiKey, routing.apiOrigin);
+        const run = await client.submitQuotedRunWithFiles(skillName, runInput, runArgs, inputFiles, { maxCredits, maxCostCents, idempotencyKey: idempotency_key ?? runContext.record.id });
         if (run.error) {
           writeRunLogs(runContext, "", String(run.error) + `
 `);
@@ -71312,7 +71825,7 @@ function registerOperationTools(server) {
     }
   }, async ({ run_id, detail }) => {
     const { skillsCredentialOrReason: skillsCredentialOrReason2 } = await Promise.resolve().then(() => (init_fleet_credentials(), exports_fleet_credentials));
-    const { apiKey, reason } = await skillsCredentialOrReason2();
+    const { apiKey, apiOrigin, reason } = await skillsCredentialOrReason2();
     if (!apiKey) {
       return mcpError("AUTH_REQUIRED", reason ?? "Remote run status requires API access. Run: skills auth login", ["skills auth login"]);
     }
@@ -71323,7 +71836,9 @@ function registerOperationTools(server) {
     }
     try {
       const { RemoteSkillsClient: RemoteSkillsClient2 } = await Promise.resolve().then(() => (init_remote_client(), exports_remote_client));
-      const client = new RemoteSkillsClient2(apiKey);
+      if (localRun?.remoteApiOrigin && localRun.remoteApiOrigin !== apiOrigin)
+        return mcpError("INSTANCE_MISMATCH", "This run belongs to another Skills instance; select its credential profile");
+      const client = new RemoteSkillsClient2(apiKey, apiOrigin);
       const run = await client.getRun(remoteRunId);
       if (!run)
         return mcpError("RUN_NOT_FOUND", `Remote run '${remoteRunId}' not found`);
@@ -71985,7 +72500,7 @@ var init_schedule_tools = __esm(() => {
 });
 
 // src/lib/native-storage.ts
-import { createHash as createHash5, createHmac as createHmac3 } from "crypto";
+import { createHash as createHash6, createHmac as createHmac3 } from "crypto";
 import {
   existsSync as existsSync27,
   mkdirSync as mkdirSync13,
@@ -72062,7 +72577,7 @@ function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
       files.push({
         path: relativePath,
         sizeBytes: bytes.byteLength,
-        sha256: createHash5("sha256").update(bytes).digest("hex"),
+        sha256: createHash6("sha256").update(bytes).digest("hex"),
         ...options.includeFileContents ? { contentBase64: Buffer.from(bytes).toString("base64") } : {}
       });
     }
@@ -72239,6 +72754,201 @@ var init_storage_tools = __esm(() => {
   init_helpers();
 });
 
+// src/lib/remote-auth.ts
+async function requestAuthApi(instance, path, options) {
+  const url = normalizeSkillsApiOrigin(instance);
+  const safeUrl = url;
+  const endpoint = `${(options?.method || "GET").toUpperCase()} ${safeUrl}${path}`;
+  let res;
+  try {
+    res = await fetch(`${url}${path}`, {
+      ...options,
+      redirect: "error",
+      signal: options?.signal ?? AbortSignal.timeout(15000),
+      headers: { "Content-Type": "application/json", ...options?.headers }
+    });
+  } catch (err) {
+    throw new HostedApiError(`Unable to reach the Skills API: ${err.message}`, {
+      endpoint,
+      apiUrl: safeUrl
+    });
+  }
+  const text = await res.text();
+  const body = text ? parseJsonBody(text) : {};
+  if (!res.ok) {
+    const record3 = isRecord4(body) ? body : {};
+    const detail = typeof record3.detail === "string" ? record3.detail : undefined;
+    const error2 = typeof record3.error === "string" ? record3.error : undefined;
+    const code = typeof record3.code === "string" ? record3.code : undefined;
+    throw new HostedApiError(detail || error2 || `${res.status} ${res.statusText}`, {
+      status: res.status,
+      code,
+      detail,
+      endpoint,
+      apiUrl: safeUrl
+    });
+  }
+  return body;
+}
+function parseJsonBody(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { detail: condenseErrorBody(text) };
+  }
+}
+function condenseErrorBody(text) {
+  const stripped = /<[a-z!/]/i.test(text) ? text.replace(/<(script|style)[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]*>/g, " ") : text;
+  const collapsed = stripped.replace(/\s+/g, " ").trim();
+  if (collapsed.length <= MAX_ERROR_DETAIL_LENGTH)
+    return collapsed;
+  return `${collapsed.slice(0, MAX_ERROR_DETAIL_LENGTH - 1).trimEnd()}\u2026`;
+}
+function isRecord4(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+
+class RemoteSkillsAuthClient {
+  apiOrigin;
+  constructor(apiUrl) {
+    this.apiOrigin = normalizeSkillsApiOrigin(apiUrl);
+  }
+  requestCode(email2) {
+    return this.request("/api/auth/login", { method: "POST", body: JSON.stringify({ email: email2 }) });
+  }
+  verifyCode(email2, code) {
+    return this.request("/api/auth/verify", { method: "POST", body: JSON.stringify({ email: email2, code }) });
+  }
+  startDevice() {
+    return this.request("/api/auth/device/start", { method: "POST", body: JSON.stringify({ client: "skills-sdk" }) });
+  }
+  pollDevice(deviceCode) {
+    return this.request("/api/auth/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) });
+  }
+  async sessionClient(email2, code) {
+    if (!email2.includes("@") || !/^\d{6}$/.test(code))
+      throw new Error("Fresh email and six-digit verification code are required to manage API keys");
+    const login = await this.verifyCode(email2, code);
+    if (!login || typeof login.token !== "string" || !login.token)
+      throw new Error("The server did not return an authorized account session");
+    return new RemoteSkillsClient(login.token, this.apiOrigin);
+  }
+  async createApiKey(email2, code, name, scopes) {
+    return (await this.sessionClient(email2, code)).createApiKey(name, scopes);
+  }
+  async listApiKeys(email2, code) {
+    return (await this.sessionClient(email2, code)).listApiKeys();
+  }
+  async revokeApiKey(email2, code, keyId) {
+    return (await this.sessionClient(email2, code)).revokeApiKey(keyId);
+  }
+  request(path, options) {
+    if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
+      throw new Error("Unsupported authentication operation");
+    return requestAuthApi(this.apiOrigin, path, options);
+  }
+}
+var MAX_ERROR_DETAIL_LENGTH = 200, HostedApiError;
+var init_remote_auth = __esm(() => {
+  init_remote_client();
+  init_fleet_credentials();
+  HostedApiError = class HostedApiError extends Error {
+    status;
+    code;
+    detail;
+    endpoint;
+    apiUrl;
+    constructor(message, options = {}) {
+      super(message);
+      this.name = "HostedApiError";
+      this.status = options.status;
+      this.code = options.code;
+      this.detail = options.detail;
+      this.endpoint = options.endpoint;
+      this.apiUrl = options.apiUrl;
+    }
+  };
+});
+
+// src/mcp/remote-customer-tools.ts
+function registerRemoteCustomerTools(server) {
+  for (const operation of REMOTE_CUSTOMER_OPERATIONS) {
+    const inputSchema = {};
+    if (operation.parameter)
+      inputSchema[operation.parameter] = exports_external.string().min(1);
+    server.registerTool(operation.name, {
+      title: operation.title,
+      description: `${operation.title} on the explicitly configured Skills server. Missing server capabilities return an error. Checkout links require external customer confirmation.`,
+      inputSchema
+    }, async (input) => callRemote((client) => operation.invoke(client, operation.parameter ? String(input[operation.parameter]) : "")));
+  }
+  server.registerTool("list_api_keys", {
+    title: "List API Keys",
+    description: "List account API keys using fresh email OTP reauthentication.",
+    inputSchema: { email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }
+  }, async ({ email: email2, code }) => {
+    try {
+      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("List API keys")).listApiKeys(email2, code));
+    } catch (error2) {
+      return mcpError("KEY_LIST_FAILED", error2.message);
+    }
+  });
+  server.registerTool("revoke_api_key", {
+    title: "Revoke API Key",
+    description: "Revoke an account API key using fresh email OTP reauthentication.",
+    inputSchema: { key_id: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }
+  }, async ({ key_id, email: email2, code }) => {
+    try {
+      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("Revoke API key")).revokeApiKey(email2, code, key_id));
+    } catch (error2) {
+      return mcpError("KEY_REVOKE_FAILED", error2.message);
+    }
+  });
+  server.registerTool("create_api_key", {
+    title: "Create API Key",
+    description: "Create an API key using fresh email OTP reauthentication; returns its secret once. A stored API key cannot grant this authority.",
+    inputSchema: { name: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/), scopes: exports_external.array(exports_external.string()).optional() }
+  }, async ({ name, email: email2, code, scopes }) => {
+    try {
+      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("Create API key")).createApiKey(email2, code, name, scopes));
+    } catch (error2) {
+      return mcpError("KEY_CREATION_FAILED", error2.message);
+    }
+  });
+  server.registerTool("quote_skill", {
+    title: "Quote Remote Skill",
+    description: "Get the configured server's credit quote without submitting a run.",
+    inputSchema: { name: exports_external.string(), input: exports_external.record(exports_external.string(), exports_external.unknown()).optional(), args: exports_external.array(exports_external.string()).optional() }
+  }, ({ name, input, args }) => callRemote((client) => client.quoteRun(name, input, args)));
+  server.registerTool("download_run_artifact", {
+    title: "Download Verified Run Artifact",
+    description: "Return verified artifact bytes as base64 (at most 1 MiB); use the CLI for larger files.",
+    inputSchema: { run_id: exports_external.string(), artifact_id: exports_external.string() }
+  }, ({ run_id, artifact_id }) => callRemote(async (client) => {
+    const artifact = await client.getVerifiedRunArtifact(run_id, artifact_id, 1024 * 1024);
+    const { bytes, ...metadata } = artifact;
+    return { ...metadata, base64: Buffer.from(bytes).toString("base64") };
+  }));
+}
+async function callRemote(action) {
+  try {
+    const client = await createRemoteSkillsClient();
+    if (!client)
+      return mcpError("AUTH_REQUIRED", "Configure a Skills API and sign in with skills auth login");
+    return mcpJson(await action(client));
+  } catch (error2) {
+    return mcpError("REMOTE_REQUEST_FAILED", error2 instanceof Error ? error2.message : "Skills server request failed");
+  }
+}
+var init_remote_customer_tools = __esm(() => {
+  init_zod();
+  init_remote_auth();
+  init_auth_store();
+  init_remote_customer_operations();
+  init_remote_client();
+  init_helpers();
+});
+
 // src/mcp/server.ts
 function buildServer() {
   const server = new McpServer({
@@ -72250,6 +72960,7 @@ function buildServer() {
   registerScheduleTools(server);
   registerStorageTools(server);
   registerResourceMetaTools(server);
+  registerRemoteCustomerTools(server);
   return server;
 }
 var server;
@@ -72261,6 +72972,7 @@ var init_server3 = __esm(() => {
   init_resource_meta_tools();
   init_schedule_tools();
   init_storage_tools();
+  init_remote_customer_tools();
   server = buildServer();
 });
 
@@ -72638,7 +73350,8 @@ MCP server for ${package_default.name}
 Options:
   -V, --version  output the version number
   -h, --help     display help for command
-  --http         run Streamable HTTP transport on 127.0.0.1 (default port 8836)
+  --stdio        run newline-delimited JSON-RPC for agent hosts
+  --http         run Streamable HTTP transport on 127.0.0.1 (default; port 8836)
   --port <n>     HTTP port (--http or MCP_HTTP=1)`);
 }
 async function startMcpStdio() {
@@ -72887,18 +73600,61 @@ var init_runtime_mcp = __esm(() => {
   init_installer();
 });
 
+// src/cli/commands/remote-account.ts
+var exports_remote_account = {};
+__export(exports_remote_account, {
+  registerRemoteAccount: () => registerRemoteAccount,
+  execute: () => execute
+});
+function registerRemoteAccount(parent) {
+  parent.command("capabilities").option("--json", "Output as JSON", false).description("Inspect the selected server's supported API contract").action((options) => execute(options, (client) => client.getCapabilities()));
+  parent.command("quote").argument("<skill>").argument("[args...]").allowUnknownOption(true).passThroughOptions(true).option("--json", "Output the server quote as JSON", false).description("Quote a skill on the configured server without submitting it").action((skill, args2, options) => execute(options, async (client) => client.quoteRun(skill, {}, args2)));
+  const billing = parent.command("billing").description("Inspect the configured server's billing account");
+  billing.command("status").option("--json", "Output as JSON", false).action((options) => execute(options, (client) => client.getBillingStatus()));
+  billing.command("usage").option("--json", "Output as JSON", false).action((options) => execute(options, (client) => client.getUsage()));
+  billing.command("invoices").option("--json", "Output as JSON", false).action((options) => execute(options, (client) => client.listInvoices()));
+  billing.command("checkout").option("--json", "Output as JSON", false).description("Create an external subscription checkout link").action((options) => execute(options, (client) => client.createBillingCheckout()));
+  billing.command("portal").option("--json", "Output as JSON", false).description("Create an external customer billing portal link").action((options) => execute(options, (client) => client.createBillingPortal()));
+  const credits = parent.command("credits").description("Inspect and purchase credits from the configured server");
+  credits.command("packs").option("--json", "Output as JSON", false).action((options) => execute(options, (client) => client.listCreditPacks()));
+  credits.command("buy").argument("<pack-id>", "An ID returned by credits packs").option("--json", "Output as JSON", false).description("Create an external checkout link; payment is confirmed in the browser").action((packId, options) => execute(options, (client) => client.createCreditCheckout(packId)));
+}
+async function execute(options, action) {
+  try {
+    const client = await createRemoteSkillsClient();
+    if (!client)
+      throw new Error("Configure a Skills server with skills setup --api-url <url>, then skills auth login");
+    const result2 = await action(client);
+    console.log(JSON.stringify(result2, null, 2));
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : "The Skills server request failed";
+    if (options.json)
+      console.log(JSON.stringify({ error: message }));
+    else
+      console.error(message);
+    process.exitCode = 1;
+  }
+}
+var init_remote_account2 = __esm(() => {
+  init_remote_client();
+});
+
 // src/cli/commands/runtime.ts
 var exports_runtime = {};
 __export(exports_runtime, {
   registerRuntime: () => registerRuntime
 });
-import { mkdirSync as mkdirSync15, writeFileSync as writeFileSync16 } from "fs";
-import { dirname as dirname11, join as join31 } from "path";
+import { lstatSync as lstatSync4, mkdirSync as mkdirSync15, readFileSync as readFileSync25, writeFileSync as writeFileSync16 } from "fs";
+import { basename as basename5, join as join31 } from "path";
 import { createInterface } from "readline";
 function registerRuntime(parent) {
-  parent.command("run").argument("<skill>", "Skill name").argument("[args...]", "Arguments to pass to the skill").allowUnknownOption(true).passThroughOptions(true).option("--json", "Output result as JSON", false).option("--wait", "Poll remote runs until a terminal status", false).option("--poll-interval-ms <ms>", "Remote polling interval in milliseconds", "1000").option("--poll-timeout-ms <ms>", "Maximum time to wait for a remote run", "300000").description("Run a skill directly").action(async (name, args2, options) => handleRun(name, args2, options));
+  parent.command("run").argument("<skill>", "Skill name").argument("[args...]", "Arguments to pass to the skill").allowUnknownOption(true).passThroughOptions(true).option("--json", "Output result as JSON", false).option("--remote", "Run on the configured server, using its catalog and quote", false).option("--yes", "Approve the server's quoted credit cost for this run", false).option("--idempotency-key <key>", "Reuse this key when retrying the same remote submission").option("--file <path>", "Attach a local input file to a remote run (repeatable)", (value, prior) => [...prior, value], []).option("--wait", "Poll remote runs until a terminal status", false).option("--poll-interval-ms <ms>", "Remote polling interval in milliseconds", "1000").option("--poll-timeout-ms <ms>", "Maximum time to wait for a remote run", "300000").description("Run a skill directly").action(async (name, args2, options) => handleRun(name, args2, options));
   const runs = parent.command("runs").description("Inspect local skill run records");
-  runs.command("list").option("--json", "Output as JSON", false).option("--limit <n>", "Maximum number of runs", "20").option("--cursor <n>", "Numeric offset for human-output pagination", "0").description("List recent skill runs").action((options) => handleRunsList(options));
+  runs.command("list").option("--remote", "List runs on the configured server", false).option("--json", "Output as JSON", false).option("--limit <n>", "Maximum number of runs", "20").option("--cursor <n>", "Numeric offset for human-output pagination", "0").description("List recent skill runs").action((options) => options.remote ? execute(options, (client) => client.listRuns(Number(options.limit))) : handleRunsList(options));
+  runs.command("logs").argument("<run-id>").option("--json", "Output as JSON", false).action((id, options) => execute(options, (client) => client.getRunLogs(id)));
+  runs.command("cancel").argument("<run-id>").option("--json", "Output as JSON", false).action((id, options) => execute(options, (client) => client.cancelRun(id)));
+  runs.command("resume").argument("<run-id>").option("--json", "Output as JSON", false).action((id, options) => execute(options, (client) => client.resumeRun(id)));
+  runs.command("artifacts").argument("<run-id>").option("--json", "Output as JSON", false).action((id, options) => execute(options, (client) => client.getRunArtifacts(id)));
   runs.command("show").argument("<run-id>", "Run id").option("--json", "Output as JSON", false).description("Show a skill run record").action((runId, options) => handleRunsShow(runId, options));
   runs.command("status").argument("<run-id>", "Remote run id, or local run id linked to a remote run").option("--json", "Output as JSON", false).description("Fetch remote run status").action((runId, options) => handleRunsStatus(runId, options));
   const exportsCommand = parent.command("exports").description("Inspect or open skill run exports");
@@ -72968,8 +73724,13 @@ async function handleSetup(options) {
     return;
   }
   let requested = options.apiUrl?.trim();
-  if (!requested && process.stdin.isTTY && process.stdout.isTTY) {
-    requested = (await promptLine("Skills API URL (blank to leave unchanged): ")).trim();
+  if (!requested && !options.json && process.stdin.isTTY && process.stdout.isTTY) {
+    const answer = await promptLine("Skills API URL (blank to leave unchanged): ");
+    if (answer === null) {
+      process.exitCode = 130;
+      return;
+    }
+    requested = answer.trim();
   }
   let saved = null;
   let credentialsFile = null;
@@ -73000,8 +73761,14 @@ async function handleSetup(options) {
       authenticated = true;
     }
   } catch (err) {
-    error2 = err.message;
-    configured = saved;
+    if (err instanceof SkillsFleetCredentialError && err.code === "MISSING_API_CREDENTIAL") {
+      const authority = resolveSkillsApiOrigin();
+      configured = authority?.origin ?? saved;
+      source = authority?.source ?? null;
+    } else {
+      error2 = err.message;
+      configured = saved;
+    }
   }
   const next = error2 ? ["skills auth login"] : configured ? ["skills auth login", "skills list --remote"] : ["skills list", "skills run <skill>"];
   const payload = {
@@ -73058,14 +73825,23 @@ function requireHttpUrl(value) {
 function promptLine(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((resolve2) => {
-    rl.question(source_default.bold(question), (answer) => {
+    let settled = false;
+    const finish = (answer) => {
+      if (settled)
+        return;
+      settled = true;
       rl.close();
-      resolve2(answer.trim());
+      resolve2(answer);
+    };
+    rl.once("SIGINT", () => finish(null));
+    rl.once("close", () => finish(null));
+    rl.question(source_default.bold(question), (answer) => {
+      finish(answer.trim());
     });
   });
 }
 async function handleRun(name, args2, options) {
-  const skill = getSkill(name);
+  const skill = options.remote ? { name, serverOwned: true } : getSkill(name);
   if (!skill) {
     const similar = findSimilarSkills(name);
     if (options.json) {
@@ -73079,7 +73855,7 @@ async function handleRun(name, args2, options) {
     return;
   }
   const prompt = extractPrompt(args2);
-  if (skill.name === ARTICLE_GENERATION_SLUG) {
+  if (!options.remote && skill.name === ARTICLE_GENERATION_SLUG) {
     const validation = validateBlogArticleRunOptions({}, args2, { requireTopic: true });
     if (!validation.ok) {
       writeBlogArticleValidationError(validation.errors, options.json);
@@ -73087,11 +73863,62 @@ async function handleRun(name, args2, options) {
     }
   }
   const routing = await resolveConfiguredRunRouting(skill);
+  if (routing.route !== "remote" && options.file?.length) {
+    const error2 = "File uploads require an explicitly remote run";
+    if (options.json)
+      console.log(JSON.stringify({ error: error2 }));
+    else
+      console.error(error2);
+    process.exitCode = 1;
+    return;
+  }
+  let client;
+  let approvedCredits = 0;
+  let inputFiles = [];
+  if (routing.route === "remote") {
+    try {
+      parsePollingOptions(options);
+      inputFiles = (options.file ?? []).map((path) => {
+        const info = lstatSync4(path);
+        if (!info.isFile() || info.size > 20 * 1024 * 1024)
+          throw new Error("Input must be a regular file no larger than 20 MiB");
+        return { name: basename5(path), bytes: new Uint8Array(readFileSync25(path)) };
+      });
+      describeRemoteFiles(inputFiles);
+      client = new RemoteSkillsClient(routing.apiKey, routing.apiOrigin);
+      const quote = await client.quoteRun(skill.name, {}, args2);
+      approvedCredits = quote.pricing.costCents;
+      if (approvedCredits > 0 && !options.yes) {
+        if (options.json || !process.stdin.isTTY || !process.stdout.isTTY) {
+          throw new Error(`CREDIT_APPROVAL_REQUIRED: This run costs ${approvedCredits} credits. Review skills quote, then rerun with --yes before the skill name.`);
+        }
+        const answer = await promptLine(`Approve ${approvedCredits} credits for ${quote.skill}? (y/N) `);
+        if (answer === null) {
+          process.exitCode = 130;
+          return;
+        }
+        if (!/^(y|yes)$/i.test(answer)) {
+          process.exitCode = 1;
+          return;
+        }
+      }
+      skill.name = quote.skill;
+    } catch (error2) {
+      const message = error2 instanceof Error ? error2.message : "Remote quote failed";
+      if (options.json)
+        console.log(JSON.stringify({ skill: name, exitCode: 1, remote: true, error: message }));
+      else
+        console.error(message);
+      process.exitCode = 1;
+      return;
+    }
+  }
   const runContext = createSkillRun({
     skill: skill.name,
     args: args2,
     prompt,
-    remote: routing.route === "remote"
+    remote: routing.route === "remote",
+    ...routing.route === "remote" ? { remoteApiOrigin: routing.apiOrigin } : {}
   });
   if (routing.route === "error") {
     const error2 = routing.error;
@@ -73107,9 +73934,10 @@ async function handleRun(name, args2, options) {
   }
   if (routing.route === "remote") {
     try {
-      const { RemoteSkillsClient: RemoteSkillsClient2 } = await Promise.resolve().then(() => (init_remote_client(), exports_remote_client));
-      const client = new RemoteSkillsClient2(routing.apiKey);
-      const run = await client.submitRun(skill.name, {}, args2);
+      const run = await client.submitQuotedRunWithFiles(skill.name, {}, args2, inputFiles, {
+        maxCredits: approvedCredits,
+        idempotencyKey: options.idempotencyKey ?? runContext.record.id
+      });
       if (run.error) {
         writeRunLogs(runContext, "", String(run.error) + `
 `);
@@ -73283,7 +74111,7 @@ ${run.id}
 }
 async function handleRunsStatus(runId, options) {
   const { skillsCredentialOrReason: skillsCredentialOrReason2 } = await Promise.resolve().then(() => (init_fleet_credentials(), exports_fleet_credentials));
-  const { apiKey, reason } = await skillsCredentialOrReason2();
+  const { apiKey, apiOrigin, reason } = await skillsCredentialOrReason2();
   if (!apiKey) {
     const error2 = reason ?? "Remote run status requires API access. Run: skills auth login";
     if (options.json)
@@ -73306,7 +74134,9 @@ async function handleRunsStatus(runId, options) {
   }
   try {
     const { RemoteSkillsClient: RemoteSkillsClient2 } = await Promise.resolve().then(() => (init_remote_client(), exports_remote_client));
-    const client = new RemoteSkillsClient2(apiKey);
+    if (localRun?.remoteApiOrigin && localRun.remoteApiOrigin !== apiOrigin)
+      throw new Error("This run belongs to another Skills instance; select its credential profile");
+    const client = new RemoteSkillsClient2(apiKey, apiOrigin);
     const run = await client.getRun(remoteRunId);
     if (!run) {
       const error2 = `Remote run '${remoteRunId}' not found`;
@@ -73384,7 +74214,7 @@ async function handleExportsOpen(runId, options) {
 }
 async function handleExportsDownload(runId, options) {
   const { skillsCredentialOrReason: skillsCredentialOrReason2 } = await Promise.resolve().then(() => (init_fleet_credentials(), exports_fleet_credentials));
-  const { apiKey, reason } = await skillsCredentialOrReason2();
+  const { apiKey, apiOrigin, reason } = await skillsCredentialOrReason2();
   if (!apiKey) {
     const error2 = reason ?? "Remote artifact downloads require API access. Run: skills auth login";
     if (options.json)
@@ -73396,7 +74226,7 @@ async function handleExportsDownload(runId, options) {
   }
   try {
     const { RemoteSkillsClient: RemoteSkillsClient2 } = await Promise.resolve().then(() => (init_remote_client(), exports_remote_client));
-    const client = new RemoteSkillsClient2(apiKey);
+    const client = new RemoteSkillsClient2(apiKey, apiOrigin);
     const remoteRun = await client.getRun(runId);
     if (!remoteRun) {
       const error2 = `Remote run '${runId}' not found`;
@@ -73417,15 +74247,12 @@ async function handleExportsDownload(runId, options) {
       const artifactId = String(artifact.id || "");
       if (!artifactId)
         continue;
-      const response = await client.downloadRunArtifact(runId, artifactId);
-      if (!response.ok)
-        throw new Error(`download failed for artifact ${artifactId}: ${response.status}`);
+      const verified = await client.getVerifiedRunArtifact(runId, artifactId);
       const relativePath = safeArtifactRelativePath(typeof artifact.relativePath === "string" ? artifact.relativePath : artifact.fileName, String(artifact.fileName || artifactId));
       const outputPath = join31(exportDir, relativePath);
-      mkdirSync15(dirname11(outputPath), { recursive: true });
-      const bytes = new Uint8Array(await response.arrayBuffer());
-      writeFileSync16(outputPath, bytes);
-      downloaded.push({ id: artifactId, path: outputPath, byteSize: bytes.byteLength });
+      ensureSafeExportParent(exportDir, relativePath);
+      writeFileSync16(outputPath, verified.bytes, { flag: "wx", mode: 384 });
+      downloaded.push({ id: artifactId, path: outputPath, byteSize: verified.byteSize });
     }
     const payload = {
       runId,
@@ -73452,11 +74279,26 @@ async function handleExportsDownload(runId, options) {
 function safeArtifactRelativePath(value, fallback) {
   const raw = typeof value === "string" && value.trim() ? value : fallback;
   const parts = raw.split(/[\\/]+/).filter((part) => part && part !== ".");
-  if (parts.length === 0 || parts.some((part) => part === "..")) {
-    return fallback.replace(/[\\/\r\n"]/g, "_");
-  }
+  if (raw.startsWith("/") || /^[A-Za-z]:/.test(raw) || parts.length === 0 || parts.some((part) => part === ".." || /[\x00-\x1f\x7f]/.test(part)))
+    throw new Error("Unsafe artifact path");
   return parts.join("/");
 }
+function ensureSafeExportParent(root, relativePath) {
+  const parts = relativePath.split("/").slice(0, -1);
+  let parent = root;
+  for (const part of ["", ...parts]) {
+    if (part)
+      parent = join31(parent, part);
+    try {
+      if (!lstatSync4(parent).isDirectory() || lstatSync4(parent).isSymbolicLink())
+        throw new Error("Unsafe artifact directory");
+    } catch (error2) {
+      if (error2.code !== "ENOENT")
+        throw error2;
+      mkdirSync15(parent, { mode: 448 });
+    }
+  }
+}
 function parsePollingOptions(options) {
   return {
     intervalMs: parsePositiveInt(options.pollIntervalMs, 1000),
@@ -73643,6 +74485,9 @@ var init_runtime = __esm(() => {
   init_run_state();
   init_runtime_mcp();
   init_run_routing();
+  init_remote_client();
+  init_remote_account2();
+  init_remote_files();
 });
 
 // src/cli/commands/completion.ts
@@ -73934,11 +74779,11 @@ var init_portable_snapshot_filter = __esm(() => {
 });
 
 // src/lib/station-snapshot.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
   mkdirSync as mkdirSync16,
-  readFileSync as readFileSync25,
+  readFileSync as readFileSync26,
   statSync as statSync18,
   writeFileSync as writeFileSync17
 } from "fs";
@@ -73949,7 +74794,7 @@ function validateStationId(stationId) {
   }
 }
 function sha256File(filePath) {
-  return createHash6("sha256").update(readFileSync25(filePath)).digest("hex");
+  return createHash7("sha256").update(readFileSync26(filePath)).digest("hex");
 }
 function scanHome(definition, homesRoot) {
   const homePath = homePathFor(definition, homesRoot);
@@ -74074,7 +74919,7 @@ function writeStationSnapshot(options) {
     copyFileSync2(plan.source.fullPath, destination);
     written += 1;
   }
-  const unchanged = plans.length - untouched.length;
+  const unchanged2 = plans.length - untouched.length;
   const manifest = {
     schema: STATION_SYNC_MANIFEST_SCHEMA,
     stationId: options.stationId,
@@ -74082,7 +74927,7 @@ function writeStationSnapshot(options) {
     producer: STATION_SNAPSHOT_PRODUCER,
     stats: {
       written,
-      unchanged,
+      unchanged: unchanged2,
       files: plans.length,
       bytes: totalBytes
     },
@@ -74095,7 +74940,7 @@ function writeStationSnapshot(options) {
   return {
     ...base2,
     mode: "populate",
-    stats: { files: plans.length, bytes: totalBytes, written, unchanged },
+    stats: { files: plans.length, bytes: totalBytes, written, unchanged: unchanged2 },
     manifestPath
   };
 }
@@ -74121,7 +74966,7 @@ var exports_create_sync_config = {};
 __export(exports_create_sync_config, {
   registerCreateSync: () => registerCreateSync
 });
-import { existsSync as existsSync29, writeFileSync as writeFileSync18, mkdirSync as mkdirSync17 } from "fs";
+import { existsSync as existsSync29 } from "fs";
 import { join as join33 } from "path";
 function registerCreateSync(parent) {
   const configCmd = parent.command("config").description("Manage skills configuration");
@@ -74214,54 +75059,27 @@ function registerCreateSync(parent) {
   parent.command("sync").alias("render").argument("[names...]", "Skills to sync (default: every skill in this machine's corpus)").option("--for <agent>", `Target one agent (${SYNC_AGENTS.join(", ")}, or all)`, "all").option("--all", "Sync every corpus skill (the default)", false).option("--source <path>", "Canonical corpus source: a directory of skill folders, or a package root with skills/ (overrides $SKILLS_SOURCE)").option("--dry-run", "Show what would be written without touching any agent folder", false).option("--force", "Adopt an unmanaged skill that already has SKILL.md; other unmarked directories are never overwritten", false).option("--check", "Home drift census (missing-from-home / stray-in-home / diverged); exits non-zero on drift, writes nothing", false).option("--adopt", "Unmarked-home adoption mode: hash unmarked home skills against the corpus; exact matches are marked (dry-run by default)", false).option("--prune", "Prune mode: list (or with --apply, remove) marked home skill dirs that have no canonical corpus entry", false).option("--apply", "Write adoption markers / conflicts ledger, or perform prune removals", false).option("--json", "Output as JSON", false).option("--station <id>", "Per-station snapshot mode: snapshot the installed skill homes into resources/<station>/skills with a v3 sync-manifest (dry-run by default; --populate writes)").option("--populate", "Write the per-station snapshot (station mode; the default is dry-run)", false).option("--repo-root <path>", "Station snapshot destination repo root (default: cwd)").option("--homes-root <dir>", "Build the station snapshot from a staged mirror of the skill homes instead of this machine's $HOME").description("Write corpus skills into each coding agent's global skills folder, per-tool adapted; with --station, snapshot the homes into a reviewed snapshot repo instead").action((names, options) => handleSync(names, options));
 }
 function handleCreate(name, options) {
-  const bare = name.trim();
-  const dirName = bare;
-  const baseDir = getPortableSkillsRoot();
-  const skillDir = join33(baseDir, dirName);
-  if (existsSync29(skillDir)) {
-    console.log(options.json ? JSON.stringify({ error: `Skill '${bare}' already exists at ${skillDir}` }) : source_default.red(`Skill '${bare}' already exists at ${skillDir}`));
+  try {
+    const tags = options.tags?.split(",").map((tag) => tag.trim()).filter(Boolean);
+    const result2 = scaffoldPortableSkill(name, {
+      description: options.description,
+      category: options.category,
+      tags
+    });
+    clearRegistryCache();
+    if (options.json)
+      console.log(JSON.stringify({ created: result2.created, name: result2.name, path: result2.path, category: result2.manifest.category, tags: result2.manifest.tags }));
+    else {
+      console.log(source_default.green(`\u2713 Created custom skill '${result2.name}' at ${result2.path}`));
+      console.log(source_default.dim(`  Category: ${result2.manifest.category}`));
+      console.log(source_default.dim(`  Tags: ${result2.manifest.tags?.join(", ")}`));
+      console.log(`  ${source_default.cyan("Edit:")} ${join33(result2.path, "src", "index.ts")}`);
+      console.log(`  ${source_default.cyan("Run:")}  skills run ${result2.name} --help`);
+    }
+  } catch (error2) {
+    const message = error2.message;
+    console.log(options.json ? JSON.stringify({ error: message }) : source_default.red(message));
     process.exitCode = 1;
-    return;
-  }
-  const description = options.description || `${bare} skill`;
-  const tags = options.tags ? options.tags.split(",").map((t) => t.trim()).filter(Boolean) : [bare];
-  const displayName2 = bare.replace(/-/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
-  mkdirSync17(join33(skillDir, "src"), { recursive: true });
-  writeFileSync18(join33(skillDir, "SKILL.md"), [
-    "---",
-    `name: ${bare}`,
-    `description: ${description}`,
-    `displayName: ${displayName2}`,
-    `category: ${options.category}`,
-    `tags: [${tags.join(", ")}]`,
-    "",
-    `# ${displayName2}`,
-    "",
-    description,
-    "",
-    "## Usage",
-    "",
-    "```bash",
-    `${bare} --help`,
-    "```",
-    ""
-  ].join(`
-`));
-  writeFileSync18(join33(skillDir, "src", "index.ts"), [`#!/usr/bin/env bun`, `/**`, ` * ${displayName2} \u2014 ${description}`, ` */`, "", `console.log("${displayName2}");`, ""].join(`
-`));
-  writeFileSync18(join33(skillDir, "package.json"), JSON.stringify({ name: bare, version: "0.1.0", description, bin: { [bare]: "./src/index.ts" }, scripts: { dev: `bun src/index.ts` }, dependencies: {} }, null, 2) + `
-`);
-  writeFileSync18(join33(skillDir, "tsconfig.json"), JSON.stringify({ compilerOptions: { target: "ES2022", module: "ESNext", moduleResolution: "bundler", strict: true, outDir: "dist" }, include: ["src/**/*.ts"] }, null, 2) + `
-`);
-  clearRegistryCache();
-  if (options.json)
-    console.log(JSON.stringify({ created: true, name: bare, path: skillDir, category: options.category, tags }));
-  else {
-    console.log(source_default.green(`\u2713 Created custom skill '${bare}' at ${skillDir}`));
-    console.log(source_default.dim(`  Category: ${options.category}`));
-    console.log(source_default.dim(`  Tags: ${tags.join(", ")}`));
-    console.log(`  ${source_default.cyan("Edit:")} ${join33(skillDir, "src", "index.ts")}`);
-    console.log(`  ${source_default.cyan("Run:")}  bun ${join33(skillDir, "src", "index.ts")}`);
   }
 }
 function handleSync(names, options) {
@@ -74507,14 +75325,14 @@ var init_create_sync_config = __esm(() => {
 });
 
 // src/lib/station-hydrate.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 import {
   copyFileSync as copyFileSync3,
-  mkdirSync as mkdirSync18,
+  mkdirSync as mkdirSync17,
   readdirSync as readdirSync17,
-  readFileSync as readFileSync26,
+  readFileSync as readFileSync27,
   statSync as statSync19,
-  writeFileSync as writeFileSync19
+  writeFileSync as writeFileSync18
 } from "fs";
 import { dirname as dirname13, join as join34, resolve as resolve3, sep as sep5 } from "path";
 function fail2(code, message, detail = []) {
@@ -74528,7 +75346,7 @@ function readSnapshotManifest(repoRoot, stationId) {
   const manifestPath = join34(snapshotRoot, "sync-manifest.json");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync26(manifestPath, "utf8"));
+    manifest = JSON.parse(readFileSync27(manifestPath, "utf8"));
   } catch (error2) {
     fail2("MANIFEST_UNREADABLE", `cannot read snapshot manifest: ${manifestPath}: ${error2.message}`);
   }
@@ -74664,7 +75482,7 @@ function planStationHydration(stationId, repoRoot) {
         for (const copy of copies) {
           let isStub = false;
           try {
-            isStub = isPointerSkillMd(readFileSync26(copy.fullPath, "utf8"));
+            isStub = isPointerSkillMd(readFileSync27(copy.fullPath, "utf8"));
           } catch {
             isStub = false;
           }
@@ -74710,7 +75528,7 @@ function skillSha256(skill) {
     return sha256File(skill.files[0].winner.fullPath);
   }
   const joined = skill.files.map((file) => sha256File(file.winner.fullPath));
-  return createHash7("sha256").update(joined.sort().join(`
+  return createHash8("sha256").update(joined.sort().join(`
 `)).digest("hex");
 }
 function writeStationHydration(options) {
@@ -74769,11 +75587,11 @@ function writeStationHydration(options) {
   }
   let written = 0;
   for (const entry of toWrite) {
-    mkdirSync18(dirname13(entry.destination), { recursive: true });
+    mkdirSync17(dirname13(entry.destination), { recursive: true });
     copyFileSync3(entry.fullPath, entry.destination);
     written += 1;
   }
-  const unchanged = plan.totalFiles - written;
+  const unchanged2 = plan.totalFiles - written;
   const hydration = {
     schema: STATION_HYDRATION_MANIFEST_SCHEMA,
     stationId: options.stationId,
@@ -74784,20 +75602,20 @@ function writeStationHydration(options) {
     stats: {
       idents: plan.winners.length,
       written,
-      unchanged,
+      unchanged: unchanged2,
       files: plan.totalFiles,
       bytes: plan.totalBytes
     },
     skills: resultSkills
   };
   const hydrationManifestPath = join34(dirname13(cacheRoot), `hydration-${options.stationId}.json`);
-  mkdirSync18(dirname13(hydrationManifestPath), { recursive: true });
-  writeFileSync19(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
+  mkdirSync17(dirname13(hydrationManifestPath), { recursive: true });
+  writeFileSync18(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
   return {
     ...base2,
     mode: "apply",
-    stats: { ...base2.stats, written, unchanged },
+    stats: { ...base2.stats, written, unchanged: unchanged2 },
     manifestPath: hydrationManifestPath
   };
 }
@@ -75194,7 +76012,7 @@ var init_schedule = __esm(() => {
 });
 
 // src/lib/registry-sync.ts
-import { mkdirSync as mkdirSync19, writeFileSync as writeFileSync20 } from "fs";
+import { mkdirSync as mkdirSync18, writeFileSync as writeFileSync19 } from "fs";
 import { dirname as dirname14, relative as relative6 } from "path";
 function createRegistrySyncArtifact(options = {}) {
   const profile = options.profile ?? "all";
@@ -75252,8 +76070,8 @@ function createRegistrySyncArtifact(options = {}) {
   };
 }
 function writeRegistrySyncArtifact(path, artifact) {
-  mkdirSync19(dirname14(path), { recursive: true });
-  writeFileSync20(path, `${JSON.stringify(artifact, null, 2)}
+  mkdirSync18(dirname14(path), { recursive: true });
+  writeFileSync19(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
 function buildDocs(name) {
@@ -75426,7 +76244,7 @@ __export(exports_publish, {
   PushSkillError: () => PushSkillError
 });
 import { execFileSync } from "child_process";
-import { existsSync as existsSync30, readFileSync as readFileSync27 } from "fs";
+import { existsSync as existsSync30, readFileSync as readFileSync28 } from "fs";
 import { hostname as hostname2 } from "os";
 import { join as join35 } from "path";
 function registerPublish(parent) {
@@ -75476,7 +76294,7 @@ async function pushSkill(name, options = {}) {
   const packed = packSkillBundle(skill.path, { maxUnpackedBytes: MAX_UNPACKED_BYTES });
   const versionManifest = buildVersionManifest(skill.path, packed);
   const skillMdPath = join35(skill.path, "SKILL.md");
-  const skillMd = existsSync30(skillMdPath) ? readFileSync27(skillMdPath, "utf-8") : undefined;
+  const skillMd = existsSync30(skillMdPath) ? readFileSync28(skillMdPath, "utf-8") : undefined;
   const base2 = {
     slug: skill.name,
     path: skill.path,
@@ -75680,72 +76498,35 @@ import { createInterface as createInterface2 } from "readline";
 function prompt(question) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
   return new Promise((resolve4) => {
-    rl.question(question, (answer) => {
+    let settled = false;
+    const finish = (answer) => {
+      if (settled)
+        return;
+      settled = true;
       rl.close();
-      resolve4(answer.trim());
-    });
+      if (answer === null)
+        process.exitCode = 130;
+      resolve4(answer);
+    };
+    rl.once("SIGINT", () => finish(null));
+    rl.once("close", () => finish(null));
+    rl.question(question, (answer) => finish(answer.trim()));
   });
 }
-function redactUrl(url) {
-  try {
-    const parsed = new URL(url);
-    if (!parsed.username && !parsed.password)
-      return url;
-    parsed.username = "";
-    parsed.password = "";
-    return parsed.toString().replace(/\/+$/, "");
-  } catch {
-    return url;
-  }
-}
-async function apiRequest(path, options) {
-  const url = getApiUrl(`${(options?.method || "GET").toUpperCase()} ${path}`);
-  const safeUrl = redactUrl(url);
-  const endpoint = `${(options?.method || "GET").toUpperCase()} ${safeUrl}${path}`;
-  let res;
+function authForPrompt() {
   try {
-    res = await fetch(`${url}${path}`, {
-      ...options,
-      headers: { "Content-Type": "application/json", ...options?.headers }
-    });
-  } catch (err) {
-    throw new HostedApiError(`Unable to reach the Skills API: ${err.message}`, {
-      endpoint,
-      apiUrl: safeUrl
-    });
-  }
-  const text = await res.text();
-  const body = text ? parseJsonBody(text) : {};
-  if (!res.ok) {
-    const record3 = isRecord4(body) ? body : {};
-    const detail = typeof record3.detail === "string" ? record3.detail : undefined;
-    const error2 = typeof record3.error === "string" ? record3.error : undefined;
-    const code = typeof record3.code === "string" ? record3.code : undefined;
-    throw new HostedApiError(detail || error2 || `${res.status} ${res.statusText}`, {
-      status: res.status,
-      code,
-      detail,
-      endpoint,
-      apiUrl: safeUrl
-    });
-  }
-  return body;
-}
-function parseJsonBody(text) {
-  try {
-    return JSON.parse(text);
-  } catch {
-    return { detail: condenseErrorBody(text) };
+    return getAuthConfig();
+  } catch (error2) {
+    if (error2 instanceof SkillsFleetCredentialError && error2.code === "MISSING_API_CREDENTIAL")
+      return null;
+    throw error2;
   }
 }
-function condenseErrorBody(text) {
-  const stripped = /<[a-z!/]/i.test(text) ? text.replace(/<(script|style)[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]*>/g, " ") : text;
-  const collapsed = stripped.replace(/\s+/g, " ").trim();
-  if (collapsed.length <= MAX_ERROR_DETAIL_LENGTH)
-    return collapsed;
-  return `${collapsed.slice(0, MAX_ERROR_DETAIL_LENGTH - 1).trimEnd()}\u2026`;
+async function apiRequest(path, options, instance) {
+  const origin = instance ?? getApiUrl(`${(options?.method || "GET").toUpperCase()} ${path}`);
+  return new RemoteSkillsAuthClient(origin).request(path, options);
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function commandErrorPayload(err, fallback) {
@@ -75759,7 +76540,7 @@ function commandErrorPayload(err, fallback) {
       ...err.apiUrl ? { apiUrl: err.apiUrl } : {}
     };
   }
-  const code = isRecord4(err) && typeof err.code === "string" ? err.code : undefined;
+  const code = isRecord5(err) && typeof err.code === "string" ? err.code : undefined;
   return {
     error: err?.message || fallback,
     ...code ? { code } : {}
@@ -75783,19 +76564,11 @@ function writeCommandError(err, fallback, json) {
   }
   process.exitCode = 1;
 }
-function credentialSource() {
-  try {
-    const fleet = resolveSkillsFleet();
-    return fleet.mode === "hosted" ? fleet.apiKeySource : null;
-  } catch {
-    return null;
-  }
-}
 function stringField2(value) {
   return typeof value === "string" && value.length > 0 ? value : undefined;
 }
 function recordField(value) {
-  return isRecord4(value) ? value : undefined;
+  return isRecord5(value) ? value : undefined;
 }
 function authIdentityPayload(authSource, live, cached2, offline = false) {
   const root = recordField(live) ?? {};
@@ -75852,7 +76625,7 @@ function openBrowser(url) {
     Bun.spawn(command, { stdout: "ignore", stderr: "ignore" });
   } catch {}
 }
-async function ensureApiKey(loginResult) {
+async function ensureApiKey(loginResult, origin) {
   if (loginResult.apiKey)
     return loginResult.apiKey;
   if (!loginResult.token)
@@ -75861,11 +76634,11 @@ async function ensureApiKey(loginResult) {
     method: "POST",
     headers: { Authorization: `Bearer ${loginResult.token}` },
     body: JSON.stringify({ name: "cli" })
-  });
+  }, origin);
   return keyRes.key;
 }
-async function persistLoginResult(loginResult) {
-  const storedKey = await ensureApiKey(loginResult);
+async function persistLoginResult(loginResult, origin, env3) {
+  const storedKey = await ensureApiKey(loginResult, origin);
   if (!storedKey)
     return;
   saveAuthConfig({
@@ -75874,7 +76647,7 @@ async function persistLoginResult(loginResult) {
     orgId: loginResult.organization.id,
     orgSlug: loginResult.organization.slug,
     userId: loginResult.user.id
-  });
+  }, env3, origin);
   return storedKey;
 }
 function printLoginSuccess(loginResult, json) {
@@ -75895,6 +76668,14 @@ function printLoginSuccess(loginResult, json) {
   }
 }
 async function doLogin(email2, code, json) {
+  const env3 = { ...process.env };
+  let origin;
+  try {
+    origin = getApiUrl("Sign in");
+  } catch (error2) {
+    writeCommandError(error2, "Configure a Skills API before signing in", json);
+    return;
+  }
   if (!email2 || !email2.includes("@")) {
     writeCommandError(new Error("Invalid email"), "Invalid email", json);
     process.exitCode = 1;
@@ -75908,7 +76689,7 @@ async function doLogin(email2, code, json) {
       sendRes = await apiRequest("/api/auth/login", {
         method: "POST",
         body: JSON.stringify({ email: email2 })
-      });
+      }, origin);
     } catch (err) {
       writeCommandError(err, "Failed to request login code", json);
       return;
@@ -75923,14 +76704,17 @@ async function doLogin(email2, code, json) {
       console.log(JSON.stringify({ status: "code_sent", email: email2, message: "Check email for 6-digit code, then run: skills auth login --email " + email2 + " --code <CODE>" }));
       return;
     }
-    code = await prompt(source_default.bold("Code: "));
+    const answer = await prompt(source_default.bold("Code: "));
+    if (answer === null)
+      return;
+    code = answer;
   }
   let verifyRes;
   try {
     verifyRes = await apiRequest("/api/auth/verify", {
       method: "POST",
       body: JSON.stringify({ email: email2, code })
-    });
+    }, origin);
   } catch (err) {
     writeCommandError(err, "Failed to verify login code", json);
     return;
@@ -75941,7 +76725,7 @@ async function doLogin(email2, code, json) {
   }
   let storedKey;
   try {
-    storedKey = await persistLoginResult(verifyRes);
+    storedKey = await persistLoginResult(verifyRes, origin, env3);
   } catch (err) {
     writeCommandError(err, "Login succeeded but API key creation failed", json);
     return;
@@ -75953,6 +76737,14 @@ async function doLogin(email2, code, json) {
   printLoginSuccess(verifyRes, Boolean(json));
 }
 async function doApiKeyLogin(apiKey, json) {
+  const env3 = { ...process.env };
+  let origin;
+  try {
+    origin = getApiUrl("Verify API key");
+  } catch (error2) {
+    writeCommandError(error2, "Configure a Skills API before signing in", json);
+    return;
+  }
   const trimmed = apiKey.trim();
   if (!trimmed) {
     writeCommandError(new Error("API key required"), "API key required", json);
@@ -75962,7 +76754,7 @@ async function doApiKeyLogin(apiKey, json) {
   try {
     whoami = await apiRequest("/api/auth/whoami", {
       headers: { Authorization: `Bearer ${trimmed}` }
-    });
+    }, origin);
   } catch (err) {
     writeCommandError(err, "Failed to verify API key", json);
     return;
@@ -75978,7 +76770,7 @@ async function doApiKeyLogin(apiKey, json) {
     ...orgId ? { orgId } : {},
     ...orgSlug ? { orgSlug } : {},
     ...userId ? { userId } : {}
-  });
+  }, env3, origin);
   if (json || !isTTY) {
     console.log(JSON.stringify({ ...identity2, status: "authenticated" }, null, 2));
     return;
@@ -75986,12 +76778,25 @@ async function doApiKeyLogin(apiKey, json) {
   printWhoami(identity2);
 }
 async function doDeviceLogin(options) {
+  const timeoutMs = Number(options.pollTimeoutMs ?? DEFAULT_DEVICE_POLL_TIMEOUT_MS);
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > DEFAULT_DEVICE_POLL_TIMEOUT_MS) {
+    writeCommandError(new Error("Device polling timeout must be an integer from 1 to 600000 milliseconds"), "Invalid polling timeout", options.json);
+    return;
+  }
+  const env3 = { ...process.env };
+  let origin;
+  try {
+    origin = getApiUrl("Device sign in");
+  } catch (error3) {
+    writeCommandError(error3, "Configure a Skills API before signing in", options.json);
+    return;
+  }
   let start;
   try {
     start = await apiRequest("/api/auth/device/start", {
       method: "POST",
       body: JSON.stringify({ client: "skills-cli" })
-    });
+    }, origin);
   } catch (err) {
     writeCommandError(err, "Failed to start device login", options.json);
     return;
@@ -76035,8 +76840,8 @@ Sign in in your browser
     console.log(source_default.dim(`
 Waiting for authentication...`));
   }
-  const intervalMs = Math.max(1000, Number(start.interval || 5) * 1000);
-  const timeoutMs = Number(options.pollTimeoutMs || DEFAULT_DEVICE_POLL_TIMEOUT_MS);
+  const interval = Number(start.interval ?? 5);
+  const intervalMs = Number.isFinite(interval) ? Math.min(30000, Math.max(1000, interval * 1000)) : 5000;
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     let tokenRes;
@@ -76044,13 +76849,13 @@ Waiting for authentication...`));
       tokenRes = await apiRequest("/api/auth/device/token", {
         method: "POST",
         body: JSON.stringify({ deviceCode: start.deviceCode })
-      });
+      }, origin);
     } catch (err) {
       writeCommandError(err, "Failed to poll device login", options.json);
       return;
     }
     if (tokenRes.error === "authorization_pending" || tokenRes.status === "pending") {
-      await sleep(intervalMs);
+      await sleep(Math.min(intervalMs, Math.max(0, deadline - Date.now())));
       continue;
     }
     if (tokenRes.error) {
@@ -76059,7 +76864,7 @@ Waiting for authentication...`));
     }
     let storedKey;
     try {
-      storedKey = await persistLoginResult(tokenRes);
+      storedKey = await persistLoginResult(tokenRes, origin, env3);
     } catch (err) {
       writeCommandError(err, "Login succeeded but API key creation failed", options.json);
       return;
@@ -76080,6 +76885,30 @@ Waiting for authentication...`));
 }
 function registerAuth(parent) {
   const auth = parent.command("auth").description("Manage account authentication");
+  const keys2 = auth.command("keys").description("Manage API keys on the configured instance");
+  keys2.command("list").option("--json", "Output as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").action(async (options) => {
+    try {
+      console.log(JSON.stringify(await new RemoteSkillsAuthClient(getApiUrl("List API keys")).listApiKeys(options.email, options.code), null, 2));
+    } catch (error2) {
+      writeCommandError(error2, "Failed to list API keys", options.json);
+    }
+  });
+  keys2.command("create").argument("<name>").option("--scope <scope>", "Limit key scope (repeatable)", (value, all) => [...all, value], []).option("--json", "Output the newly created key as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").description("Create a key; the returned secret is shown once and must be stored securely").action(async (name, options) => {
+    try {
+      const client = new RemoteSkillsAuthClient(getApiUrl("Create API key"));
+      const created = await client.createApiKey(options.email, options.code, name, options.scope.length ? options.scope : undefined);
+      console.log(JSON.stringify(created, null, 2));
+    } catch (error2) {
+      writeCommandError(error2, "Failed to create API key", options.json);
+    }
+  });
+  keys2.command("revoke").argument("<key-id>").option("--json", "Output as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").action(async (id, options) => {
+    try {
+      console.log(JSON.stringify(await new RemoteSkillsAuthClient(getApiUrl("Revoke API key")).revokeApiKey(options.email, options.code, id), null, 2));
+    } catch (error2) {
+      writeCommandError(error2, "Failed to revoke API key", options.json);
+    }
+  });
   auth.command("login").description("Sign in with browser/device code or email code").option("--email <email>", "Email address (non-interactive)").option("--code <code>", "Verification code (non-interactive)").option("--api-key <key>", "Verify and store an API key").option("--device", "Use browser/device-code login", false).option("--no-open", "Do not open a browser for device-code login").option("--poll", "Poll until browser authentication completes in non-interactive mode", false).option("--poll-timeout-ms <ms>", "Maximum time to wait for device-code login").option("--json", "Output result as JSON", false).action(async (options) => {
     if (options.apiKey) {
       await doApiKeyLogin(options.apiKey, options.json);
@@ -76090,63 +76919,67 @@ function registerAuth(parent) {
       return;
     }
     let email2 = options.email;
-    if (!email2 && isTTY) {
-      const existing = getAuthConfig();
+    if (!email2 && isTTY && !options.json) {
+      const existing = authForPrompt();
       if (existing) {
         console.log(source_default.dim(`Already signed in as ${existing.email}`));
         const again = await prompt("Sign in with a different account? (y/N) ");
-        if (again.toLowerCase() !== "y")
+        if (again === null || again.toLowerCase() !== "y")
           return;
       }
-      email2 = await prompt(source_default.bold("Email: "));
+      const answer = await prompt(source_default.bold("Email: "));
+      if (answer === null)
+        return;
+      email2 = answer;
     }
     if (!email2) {
-      console.error(source_default.red("Email required. Use: skills auth login --email you@example.com"));
-      process.exitCode = 1;
+      writeCommandError(new Error("Email required. Use: skills auth login --email you@example.com"), "Email required", options.json);
       return;
     }
     await doLogin(email2, options.code, options.json);
   });
-  auth.command("signup").description("Create or sign in with your email (passwordless)").option("--email <email>", "Email address (non-interactive)").option("--code <code>", "Verification code (non-interactive)").action(async (options) => {
+  auth.command("signup").description("Create or sign in with your email (passwordless)").option("--email <email>", "Email address (non-interactive)").option("--code <code>", "Verification code (non-interactive)").option("--json", "Output result as JSON without prompting", false).action(async (options) => {
     let email2 = options.email;
-    if (!email2 && isTTY) {
-      const existing = getAuthConfig();
+    if (!email2 && isTTY && !options.json) {
+      const existing = authForPrompt();
       if (existing) {
         console.log(source_default.dim(`Already signed in as ${existing.email}`));
         const again = await prompt("Continue with a different account? (y/N) ");
-        if (again.toLowerCase() !== "y")
+        if (again === null || again.toLowerCase() !== "y")
           return;
       }
-      email2 = await prompt(source_default.bold("Email: "));
+      const answer = await prompt(source_default.bold("Email: "));
+      if (answer === null)
+        return;
+      email2 = answer;
     }
     if (!email2) {
-      console.error(source_default.red("Email required. Use: skills auth signup --email you@example.com"));
+      const error2 = "Email required. Use: skills auth signup --email you@example.com";
+      if (options.json)
+        console.log(JSON.stringify({ error: error2 }));
+      else
+        console.error(source_default.red(error2));
       process.exitCode = 1;
       return;
     }
-    await doLogin(email2, options.code);
+    await doLogin(email2, options.code, options.json);
   });
-  auth.command("logout").description("Sign out and remove stored credentials").action(() => {
-    const existing = getAuthConfig();
-    if (!existing) {
-      console.log(source_default.dim("Not signed in"));
-      return;
-    }
+  auth.command("logout").description("Remove this profile's stored credentials; injected keys remain configured").option("--json", "Output as JSON", false).action((options) => {
     const { stillResolves } = clearAuthConfig();
-    console.log(source_default.green(`\u2713 Signed out${existing.email ? ` (was ${existing.email})` : ""}`));
-    if (stillResolves) {
-      console.log(source_default.yellow(`A Skills credential still resolves from ${credentialSource() ?? "another source"}; ` + `clear it there to finish signing out.`));
-    }
+    if (options.json)
+      console.log(JSON.stringify({ status: stillResolves ? "credential_still_configured" : "signed_out", stillResolves }));
+    else
+      console.log(stillResolves ? "Stored credential removed. A credential is still configured by the environment, profile selection, or Keychain; clear it there to finish signing out." : "Signed out; this profile has no stored credential.");
   });
   auth.command("whoami").description("Show current account info").option("--json", "Output as JSON", false).action(async (options) => {
     let fleet;
     try {
-      fleet = resolveSkillsFleet();
+      fleet = await resolveSkillsConnection();
     } catch (err) {
       writeCommandError(err, "Failed to resolve the Skills credential", options.json);
       return;
     }
-    if (fleet.mode !== "hosted") {
+    if (!fleet) {
       const payload = {
         status: "unauthenticated",
         error: `Not signed in. Run: skills auth login, or set ${SKILLS_API_KEY_ENV}`
@@ -76157,12 +76990,12 @@ function registerAuth(parent) {
         console.log(source_default.dim(payload.error));
       return;
     }
-    const cached2 = fleet.apiKeyTier === "disk" ? getAuthIdentity() : null;
+    const cached2 = fleet.apiKeyTier === "disk" || fleet.apiKeyTier === "profile" ? getAuthIdentity() : null;
     const authSource = fleet.apiKeySource;
     try {
       const res = await apiRequest("/api/auth/whoami", {
         headers: { Authorization: `Bearer ${fleet.apiKey}` }
-      });
+      }, fleet.apiOrigin);
       const payload = authIdentityPayload(authSource, res, cached2);
       if (options.json) {
         console.log(JSON.stringify(payload, null, 2));
@@ -76170,7 +77003,7 @@ function registerAuth(parent) {
         printWhoami(payload);
       }
     } catch (err) {
-      if (cached2 && Object.keys(cached2).length > 0) {
+      if (cached2 && Object.keys(cached2).length > 0 && !(err instanceof HostedApiError && err.status !== undefined && err.status < 500)) {
         const payload = authIdentityPayload(authSource, {}, cached2, true);
         if (options.json)
           console.log(JSON.stringify(payload, null, 2));
@@ -76182,30 +77015,15 @@ function registerAuth(parent) {
     }
   });
 }
-var isTTY, DEFAULT_DEVICE_POLL_TIMEOUT_MS, MAX_ERROR_DETAIL_LENGTH = 200, CONFIG_HINT_STATUSES, HostedApiError;
+var isTTY, DEFAULT_DEVICE_POLL_TIMEOUT_MS, CONFIG_HINT_STATUSES;
 var init_auth = __esm(() => {
   init_source();
   init_auth_store();
   init_fleet_credentials();
+  init_remote_auth();
   isTTY = process.stdin.isTTY && process.stdout.isTTY;
   DEFAULT_DEVICE_POLL_TIMEOUT_MS = 10 * 60 * 1000;
   CONFIG_HINT_STATUSES = new Set([401, 403, 404, 405, 501]);
-  HostedApiError = class HostedApiError extends Error {
-    status;
-    code;
-    detail;
-    endpoint;
-    apiUrl;
-    constructor(message, options = {}) {
-      super(message);
-      this.name = "HostedApiError";
-      this.status = options.status;
-      this.code = options.code;
-      this.detail = options.detail;
-      this.endpoint = options.endpoint;
-      this.apiUrl = options.apiUrl;
-    }
-  };
 });
 
 // src/cli/commands/feedback.ts
@@ -76348,7 +77166,7 @@ var init_storage = __esm(() => {
 });
 
 // src/lib/registry-reconcile.ts
-import { existsSync as existsSync31, readFileSync as readFileSync28, statSync as statSync20, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync31, readFileSync as readFileSync29, statSync as statSync20, writeFileSync as writeFileSync20 } from "fs";
 import { join as join36 } from "path";
 function isDirectory2(path) {
   try {
@@ -76368,7 +77186,7 @@ function readBaseline(skillDir) {
   if (!existsSync31(markerPath))
     return;
   try {
-    const marker = JSON.parse(readFileSync28(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync29(markerPath, "utf-8"));
     return {
       ...typeof marker.contentHash === "string" && marker.contentHash ? { contentHash: marker.contentHash } : {},
       ...typeof marker.version === "string" && marker.version ? { version: marker.version } : {}
@@ -76382,7 +77200,7 @@ function readCursor(root) {
   if (!existsSync31(path))
     return { runCount: 0 };
   try {
-    const cursor = JSON.parse(readFileSync28(path, "utf-8"));
+    const cursor = JSON.parse(readFileSync29(path, "utf-8"));
     return { runCount: typeof cursor.runCount === "number" ? cursor.runCount : 0 };
   } catch {
     return { runCount: 0 };
@@ -76510,7 +77328,9 @@ async function reconcileRegistry(options = {}) {
       locals.set(meta.name, { slug: meta.name, version: meta.version, sha256: "" });
     }
   }
-  const remoteRowsPayload = await client.listSkills();
+  const remoteRowsPayload = await client.listSkills().catch(() => {
+    throw new Error("Registry listing failed: the server refused or could not return the catalog.");
+  });
   if (!Array.isArray(remoteRowsPayload)) {
     const shape = remoteRowsPayload && typeof remoteRowsPayload === "object" ? `object with keys [${Object.keys(remoteRowsPayload).join(", ")}]` : typeof remoteRowsPayload;
     throw new ReconcileRegistryError(`Registry listing failed: expected an array of skills, got ${shape}.`, ["Check HASNA_SKILLS_API_URL and the resolved credential; a failed listing must not be read as an empty registry."]);
@@ -76659,7 +77479,7 @@ async function reconcileRegistry(options = {}) {
         runCount: readCursor(root).runCount + 1,
         summary
       };
-      writeFileSync21(join36(root, SYNC_CURSOR_FILE), `${JSON.stringify(cursor, null, 2)}
+      writeFileSync20(join36(root, SYNC_CURSOR_FILE), `${JSON.stringify(cursor, null, 2)}
 `);
       return {
         corpusRoot: root,
@@ -84089,7 +84909,12 @@ if (process.argv.includes("--no-color")) {
   process.argv.splice(idx, 1);
 }
 var program2 = new Command;
-program2.name("skills").description("Discover and run AI agent skills through the Skills CLI/MCP").version(package_default.version).option("--verbose", "Enable verbose logging", false).option("--no-color", "Disable colored output (also respects NO_COLOR env var)").enablePositionalOptions();
+program2.name("skills").description("Discover and run AI agent skills through the Skills CLI/MCP").version(package_default.version).option("--verbose", "Enable verbose logging", false).option("--profile <name>", "Use an isolated Skills instance credential profile").option("--no-color", "Disable colored output (also respects NO_COLOR env var)").enablePositionalOptions();
+program2.hook("preAction", () => {
+  const profile = program2.opts().profile;
+  if (profile !== undefined)
+    process.env.HASNA_PROFILE = profile;
+});
 program2.command("interactive", { isDefault: true }).alias("i").allowExcessArguments(true).description("Interactive skill browser (TUI)").action((_options, command) => {
   const stray = command.args[0];
   if (stray !== undefined) {
@@ -84117,6 +84942,8 @@ var { registerDiagnostic: registerDiagnostic2 } = await Promise.resolve().then((
 registerDiagnostic2(program2);
 var { registerRuntime: registerRuntime2 } = await Promise.resolve().then(() => (init_runtime(), exports_runtime));
 registerRuntime2(program2);
+var { registerRemoteAccount: registerRemoteAccount2 } = await Promise.resolve().then(() => (init_remote_account2(), exports_remote_account));
+registerRemoteAccount2(program2);
 var { registerCompletion: registerCompletion2 } = await Promise.resolve().then(() => (init_completion(), exports_completion));
 registerCompletion2(program2);
 var { registerCreateSync: registerCreateSync2 } = await Promise.resolve().then(() => (init_create_sync_config(), exports_create_sync_config));