@hasna/skills 0.3.0 → 0.4.0

package/dist/sdk/index.js

@@ -2370,11 +2370,11 @@ var require_config = __commonJS((exports) => {
   };
   function getSelectorName(functionString) {
     try {
-      const constants = new Set(Array.from(functionString.match(/([A-Z_]){3,}/g) ?? []));
-      constants.delete("CONFIG");
-      constants.delete("CONFIG_PREFIX_SEPARATOR");
-      constants.delete("ENV");
-      return [...constants].join(", ");
+      const constants2 = new Set(Array.from(functionString.match(/([A-Z_]){3,}/g) ?? []));
+      constants2.delete("CONFIG");
+      constants2.delete("CONFIG_PREFIX_SEPARATOR");
+      constants2.delete("ENV");
+      return [...constants2].join(", ");
     } catch (ignored) {
       return functionString;
     }
@@ -3573,7 +3573,7 @@ var require_serde = __commonJS((exports) => {
   var { createHmac: createHmac2, createHash: createHash2, getRandomValues } = __require("crypto");
   var { hasOwn: hasOwn2, HttpResponse } = require_transport();
   exports.hasOwn = hasOwn2;
-  var { ReadStream, lstatSync, fstatSync: fstatSync2 } = __require("fs");
+  var { ReadStream, lstatSync: lstatSync2, fstatSync: fstatSync3 } = __require("fs");
   var { toEndpointV1 } = require_endpoints();
   var { Readable, Writable, PassThrough } = __require("stream");
   var isArrayBuffer = (arg) => typeof ArrayBuffer === "function" && arg instanceof ArrayBuffer || Object.prototype.toString.call(arg) === "[object ArrayBuffer]";
@@ -4339,9 +4339,9 @@ var require_serde = __commonJS((exports) => {
       return body.end + 1 - body.start;
     } else if (body instanceof ReadStream) {
       if (body.path != null) {
-        return lstatSync(body.path).size;
+        return lstatSync2(body.path).size;
       } else if (typeof body.fd === "number") {
-        return fstatSync2(body.fd).size;
+        return fstatSync3(body.fd).size;
       }
     }
     throw new Error(`Body Length computation failed for ${body}`);
@@ -17645,7 +17645,7 @@ var require_httpAuthSchemes = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-env@3.972.70/node_modules/@aws-sdk/credential-provider-env/dist-es/fromEnv.js
-var import_client6, import_config, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET = "AWS_SECRET_ACCESS_KEY", ENV_SESSION = "AWS_SESSION_TOKEN", ENV_EXPIRATION = "AWS_CREDENTIAL_EXPIRATION", ENV_CREDENTIAL_SCOPE = "AWS_CREDENTIAL_SCOPE", ENV_ACCOUNT_ID = "AWS_ACCOUNT_ID", fromEnv = (init) => async () => {
+var import_client7, import_config, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET = "AWS_SECRET_ACCESS_KEY", ENV_SESSION = "AWS_SESSION_TOKEN", ENV_EXPIRATION = "AWS_CREDENTIAL_EXPIRATION", ENV_CREDENTIAL_SCOPE = "AWS_CREDENTIAL_SCOPE", ENV_ACCOUNT_ID = "AWS_ACCOUNT_ID", fromEnv = (init) => async () => {
   init?.logger?.debug("@aws-sdk/credential-provider-env - fromEnv");
   const accessKeyId = process.env[ENV_KEY];
   const secretAccessKey = process.env[ENV_SECRET];
@@ -17662,13 +17662,13 @@ var import_client6, import_config, ENV_KEY = "AWS_ACCESS_KEY_ID", ENV_SECRET = "
       ...credentialScope && { credentialScope },
       ...accountId && { accountId }
     };
-    import_client6.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS", "g");
+    import_client7.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS", "g");
     return credentials;
   }
   throw new import_config.CredentialsProviderError("Unable to find environment variable credentials.", { logger: init?.logger });
 };
 var init_fromEnv = __esm(() => {
-  import_client6 = __toESM(require_client2(), 1);
+  import_client7 = __toESM(require_client2(), 1);
   import_config = __toESM(require_config(), 1);
 });
 
@@ -18738,7 +18738,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return this.connectOptions === undefined ? http2.connect(url) : http2.connect(url, this.connectOptions);
     }
   }
-  var { constants } = http2;
+  var { constants: constants2 } = http2;
 
   class NodeHttp2Handler {
     config;
@@ -18829,8 +18829,8 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
         }
         const clientHttp2Stream = session.request({
           ...request.headers,
-          [constants.HTTP2_HEADER_PATH]: path,
-          [constants.HTTP2_HEADER_METHOD]: method
+          [constants2.HTTP2_HEADER_PATH]: path,
+          [constants2.HTTP2_HEADER_METHOD]: method
         });
         if (effectiveRequestTimeout) {
           clientHttp2Stream.setTimeout(effectiveRequestTimeout, () => {
@@ -19010,7 +19010,7 @@ var retryWrapper = (toRetry, maxRetries, delayMs) => {
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-http@3.972.72/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/fromHttp.js
 import fs from "fs/promises";
-var import_client7, import_config9, import_node_http_handler, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2", AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromHttp = (options = {}) => {
+var import_client8, import_config9, import_node_http_handler, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2", AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromHttp = (options = {}) => {
   options.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");
   let host;
   const relative2 = options.awsContainerCredentialsRelativeUri ?? process.env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI];
@@ -19047,7 +19047,7 @@ Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
     }
     try {
       const result = await requestHandler.handle(request, { requestTimeout });
-      return getCredentials(result.response).then((creds) => import_client7.setCredentialFeature(creds, "CREDENTIALS_HTTP", "z"));
+      return getCredentials(result.response).then((creds) => import_client8.setCredentialFeature(creds, "CREDENTIALS_HTTP", "z"));
     } catch (e2) {
       throw new import_config9.CredentialsProviderError(String(e2), { logger: options.logger });
     }
@@ -19069,7 +19069,7 @@ Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
 var init_fromHttp = __esm(() => {
   init_checkUrl();
   init_requestHelpers();
-  import_client7 = __toESM(require_client2(), 1);
+  import_client8 = __toESM(require_client2(), 1);
   import_config9 = __toESM(require_config(), 1);
   import_node_http_handler = __toESM(require_dist_cjs6(), 1);
 });
@@ -20453,7 +20453,7 @@ var init_loadSso = __esm(() => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/resolveSSOCredentials.js
-var import_client8, import_config15, SHOULD_FAIL_CREDENTIAL_CHAIN = false, resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger }) => {
+var import_client9, import_config15, SHOULD_FAIL_CREDENTIAL_CHAIN = false, resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger }) => {
   let token;
   const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
   if (ssoSession) {
@@ -20529,15 +20529,15 @@ var import_client8, import_config15, SHOULD_FAIL_CREDENTIAL_CHAIN = false, resol
     ...accountId && { accountId }
   };
   if (ssoSession) {
-    import_client8.setCredentialFeature(credentials, "CREDENTIALS_SSO", "s");
+    import_client9.setCredentialFeature(credentials, "CREDENTIALS_SSO", "s");
   } else {
-    import_client8.setCredentialFeature(credentials, "CREDENTIALS_SSO_LEGACY", "u");
+    import_client9.setCredentialFeature(credentials, "CREDENTIALS_SSO_LEGACY", "u");
   }
   return credentials;
 };
 var init_resolveSSOCredentials = __esm(() => {
   init_dist_es4();
-  import_client8 = __toESM(require_client2(), 1);
+  import_client9 = __toESM(require_client2(), 1);
   import_config15 = __toESM(require_config(), 1);
 });
 
@@ -20649,7 +20649,7 @@ var init_dist_es5 = __esm(() => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveCredentialSource.js
-var import_client9, import_config18, resolveCredentialSource = (credentialSource, profileName, logger) => {
+var import_client10, import_config18, resolveCredentialSource = (credentialSource, profileName, logger) => {
   const sourceProvidersMap = {
     EcsContainer: async (options) => {
       const { fromHttp: fromHttp2 } = await Promise.resolve().then(() => (init_dist_es3(), exports_dist_es3));
@@ -20673,9 +20673,9 @@ var import_client9, import_config18, resolveCredentialSource = (credentialSource
   } else {
     throw new import_config18.CredentialsProviderError(`Unsupported credential source in profile ${profileName}. Got ${credentialSource}, expected EcsContainer or Ec2InstanceMetadata or Environment.`, { logger });
   }
-}, setNamedProvider = (creds) => import_client9.setCredentialFeature(creds, "CREDENTIALS_PROFILE_NAMED_PROVIDER", "p");
+}, setNamedProvider = (creds) => import_client10.setCredentialFeature(creds, "CREDENTIALS_PROFILE_NAMED_PROVIDER", "p");
 var init_resolveCredentialSource = __esm(() => {
-  import_client9 = __toESM(require_client2(), 1);
+  import_client10 = __toESM(require_client2(), 1);
   import_config18 = __toESM(require_config(), 1);
 });
 
@@ -21702,7 +21702,7 @@ var require_sts = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveAssumeRoleCredentials.js
-var import_client10, import_config19, isAssumeRoleProfile = (arg, { profile = "default", logger } = {}) => {
+var import_client11, import_config19, isAssumeRoleProfile = (arg, { profile = "default", logger } = {}) => {
   return Boolean(arg) && typeof arg === "object" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1 && ["undefined", "string"].indexOf(typeof arg.external_id) > -1 && ["undefined", "string"].indexOf(typeof arg.mfa_serial) > -1 && (isAssumeRoleWithSourceProfile(arg, { profile, logger }) || isCredentialSourceProfile(arg, { profile, logger }));
 }, isAssumeRoleWithSourceProfile = (arg, { profile, logger }) => {
   const withSourceProfile = typeof arg.source_profile === "string" && typeof arg.credential_source === "undefined";
@@ -21741,7 +21741,7 @@ var import_client10, import_config19, isAssumeRoleProfile = (arg, { profile = "d
     [source_profile]: true
   }, isCredentialSourceWithoutRoleArn(profiles[source_profile] ?? {})) : (await resolveCredentialSource(profileData.credential_source, profileName, options.logger)(options))();
   if (isCredentialSourceWithoutRoleArn(profileData)) {
-    return sourceCredsProvider.then((creds) => import_client10.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
+    return sourceCredsProvider.then((creds) => import_client11.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
   } else {
     const params = {
       RoleArn: profileData.role_arn,
@@ -21758,14 +21758,14 @@ var import_client10, import_config19, isAssumeRoleProfile = (arg, { profile = "d
       params.TokenCode = await options.mfaCodeProvider(mfa_serial);
     }
     const sourceCreds = await sourceCredsProvider;
-    return options.roleAssumer(sourceCreds, params).then((creds) => import_client10.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
+    return options.roleAssumer(sourceCreds, params).then((creds) => import_client11.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
   }
 }, isCredentialSourceWithoutRoleArn = (section) => {
   return !section.role_arn && !!section.credential_source;
 };
 var init_resolveAssumeRoleCredentials = __esm(() => {
   init_resolveCredentialSource();
-  import_client10 = __toESM(require_client2(), 1);
+  import_client11 = __toESM(require_client2(), 1);
   import_config19 = __toESM(require_config(), 1);
 });
 
@@ -22766,7 +22766,7 @@ var init_LoginCredentialsFetcher = __esm(() => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-login@3.972.77/node_modules/@aws-sdk/credential-provider-login/dist-es/fromLoginCredentials.js
-var import_client11, import_config21, fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
+var import_client12, import_config21, fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
   init?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");
   const profiles = await import_config21.parseKnownFiles(init || {});
   const profileName = import_config21.getProfileName({
@@ -22781,11 +22781,11 @@ var import_client11, import_config21, fromLoginCredentials = (init) => async ({
   }
   const fetcher = new LoginCredentialsFetcher(profile, init, callerClientConfig);
   const credentials = await fetcher.loadCredentials();
-  return import_client11.setCredentialFeature(credentials, "CREDENTIALS_LOGIN", "AD");
+  return import_client12.setCredentialFeature(credentials, "CREDENTIALS_LOGIN", "AD");
 };
 var init_fromLoginCredentials = __esm(() => {
   init_LoginCredentialsFetcher();
-  import_client11 = __toESM(require_client2(), 1);
+  import_client12 = __toESM(require_client2(), 1);
   import_config21 = __toESM(require_config(), 1);
 });
 
@@ -22799,7 +22799,7 @@ var init_dist_es6 = __esm(() => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveLoginCredentials.js
-var import_client12, isLoginProfile = (data) => {
+var import_client13, isLoginProfile = (data) => {
   return Boolean(data && data.login_session);
 }, resolveLoginCredentials = async (profileName, options, callerClientConfig) => {
   const { fromLoginCredentials: fromLoginCredentials2 } = await Promise.resolve().then(() => (init_dist_es6(), exports_dist_es5));
@@ -22807,14 +22807,14 @@ var import_client12, isLoginProfile = (data) => {
     ...options,
     profile: profileName
   })({ callerClientConfig });
-  return import_client12.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_LOGIN", "AC");
+  return import_client13.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_LOGIN", "AC");
 };
 var init_resolveLoginCredentials = __esm(() => {
-  import_client12 = __toESM(require_client2(), 1);
+  import_client13 = __toESM(require_client2(), 1);
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-process@3.972.70/node_modules/@aws-sdk/credential-provider-process/dist-es/getValidatedProcessCredentials.js
-var import_client13, getValidatedProcessCredentials = (profileName, data, profiles) => {
+var import_client14, getValidatedProcessCredentials = (profileName, data, profiles) => {
   if (data.Version !== 1) {
     throw Error(`Profile ${profileName} credential_process did not return Version 1.`);
   }
@@ -22840,11 +22840,11 @@ var import_client13, getValidatedProcessCredentials = (profileName, data, profil
     ...data.CredentialScope && { credentialScope: data.CredentialScope },
     ...accountId && { accountId }
   };
-  import_client13.setCredentialFeature(credentials, "CREDENTIALS_PROCESS", "w");
+  import_client14.setCredentialFeature(credentials, "CREDENTIALS_PROCESS", "w");
   return credentials;
 };
 var init_getValidatedProcessCredentials = __esm(() => {
-  import_client13 = __toESM(require_client2(), 1);
+  import_client14 = __toESM(require_client2(), 1);
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-process@3.972.70/node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js
@@ -22905,20 +22905,20 @@ var init_dist_es7 = __esm(() => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProcessCredentials.js
-var import_client14, isProcessProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.credential_process === "string", resolveProcessCredentials2 = async (options, profile) => {
+var import_client15, isProcessProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.credential_process === "string", resolveProcessCredentials2 = async (options, profile) => {
   const { fromProcess: fromProcess2 } = await Promise.resolve().then(() => (init_dist_es7(), exports_dist_es6));
   const credentials = await fromProcess2({
     ...options,
     profile
   })();
-  return import_client14.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_PROCESS", "v");
+  return import_client15.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_PROCESS", "v");
 };
 var init_resolveProcessCredentials2 = __esm(() => {
-  import_client14 = __toESM(require_client2(), 1);
+  import_client15 = __toESM(require_client2(), 1);
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveSsoCredentials.js
-var import_client15, resolveSsoCredentials = async (profile, profileData, options = {}, callerClientConfig) => {
+var import_client16, resolveSsoCredentials = async (profile, profileData, options = {}, callerClientConfig) => {
   const { fromSSO: fromSSO2 } = await Promise.resolve().then(() => (init_dist_es5(), exports_dist_es4));
   return fromSSO2({
     profile,
@@ -22929,18 +22929,18 @@ var import_client15, resolveSsoCredentials = async (profile, profileData, option
     callerClientConfig
   }).then((creds) => {
     if (profileData.sso_session) {
-      return import_client15.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO", "r");
+      return import_client16.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO", "r");
     } else {
-      return import_client15.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO_LEGACY", "t");
+      return import_client16.setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO_LEGACY", "t");
     }
   });
 }, isSsoProfile2 = (arg) => arg && (typeof arg.sso_start_url === "string" || typeof arg.sso_account_id === "string" || typeof arg.sso_session === "string" || typeof arg.sso_region === "string" || typeof arg.sso_role_name === "string");
 var init_resolveSsoCredentials = __esm(() => {
-  import_client15 = __toESM(require_client2(), 1);
+  import_client16 = __toESM(require_client2(), 1);
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveStaticCredentials.js
-var import_client16, isStaticCredsProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.aws_access_key_id === "string" && typeof arg.aws_secret_access_key === "string" && ["undefined", "string"].indexOf(typeof arg.aws_session_token) > -1 && ["undefined", "string"].indexOf(typeof arg.aws_account_id) > -1, resolveStaticCredentials = async (profile, options) => {
+var import_client17, isStaticCredsProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.aws_access_key_id === "string" && typeof arg.aws_secret_access_key === "string" && ["undefined", "string"].indexOf(typeof arg.aws_session_token) > -1 && ["undefined", "string"].indexOf(typeof arg.aws_account_id) > -1, resolveStaticCredentials = async (profile, options) => {
   options?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");
   const credentials = {
     accessKeyId: profile.aws_access_key_id,
@@ -22949,10 +22949,10 @@ var import_client16, isStaticCredsProfile = (arg) => Boolean(arg) && typeof arg
     ...profile.aws_credential_scope && { credentialScope: profile.aws_credential_scope },
     ...profile.aws_account_id && { accountId: profile.aws_account_id }
   };
-  return import_client16.setCredentialFeature(credentials, "CREDENTIALS_PROFILE", "n");
+  return import_client17.setCredentialFeature(credentials, "CREDENTIALS_PROFILE", "n");
 };
 var init_resolveStaticCredentials = __esm(() => {
-  import_client16 = __toESM(require_client2(), 1);
+  import_client17 = __toESM(require_client2(), 1);
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-web-identity@3.972.76/node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromWebToken.js
@@ -22984,7 +22984,7 @@ var fromWebToken = (init) => async (awsIdentityProperties) => {
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-web-identity@3.972.76/node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromTokenFile.js
 import { readFileSync as readFileSync3 } from "fs";
-var import_client17, import_config24, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE", ENV_ROLE_ARN = "AWS_ROLE_ARN", ENV_ROLE_SESSION_NAME = "AWS_ROLE_SESSION_NAME", fromTokenFile = (init = {}) => async (awsIdentityProperties) => {
+var import_client18, import_config24, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE", ENV_ROLE_ARN = "AWS_ROLE_ARN", ENV_ROLE_SESSION_NAME = "AWS_ROLE_SESSION_NAME", fromTokenFile = (init = {}) => async (awsIdentityProperties) => {
   init.logger?.debug("@aws-sdk/credential-provider-web-identity - fromTokenFile");
   const webIdentityTokenFile = init?.webIdentityTokenFile ?? process.env[ENV_TOKEN_FILE];
   const roleArn = init?.roleArn ?? process.env[ENV_ROLE_ARN];
@@ -23001,12 +23001,12 @@ var import_client17, import_config24, ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_F
     roleSessionName
   })(awsIdentityProperties);
   if (webIdentityTokenFile === process.env[ENV_TOKEN_FILE]) {
-    import_client17.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN", "h");
+    import_client18.setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN", "h");
   }
   return credentials;
 };
 var init_fromTokenFile = __esm(() => {
-  import_client17 = __toESM(require_client2(), 1);
+  import_client18 = __toESM(require_client2(), 1);
   import_config24 = __toESM(require_config(), 1);
 });
 
@@ -23021,7 +23021,7 @@ var init_dist_es8 = __esm(() => {
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveWebIdentityCredentials.js
-var import_client18, isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.web_identity_token_file === "string" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1, resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => {
+var import_client19, isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.web_identity_token_file === "string" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1, resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => {
   const { fromTokenFile: fromTokenFile2 } = await Promise.resolve().then(() => (init_dist_es8(), exports_dist_es7));
   const credentials = await fromTokenFile2({
     webIdentityTokenFile: profile.web_identity_token_file,
@@ -23033,10 +23033,10 @@ var import_client18, isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg
   })({
     callerClientConfig
   });
-  return import_client18.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN", "q");
+  return import_client19.setCredentialFeature(credentials, "CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN", "q");
 };
 var init_resolveWebIdentityCredentials = __esm(() => {
-  import_client18 = __toESM(require_client2(), 1);
+  import_client19 = __toESM(require_client2(), 1);
 });
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-ini@3.973.15/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProfileData.js
@@ -24525,7 +24525,6 @@ async function completePointerCredential(name, pointerResolution, env = process.
   });
 }
 var DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com";
-var DEFAULT_AUTHORITY_SOURCE = "default";
 function defaultFleetGatewayBaseUrl(name) {
   return `${DEFAULT_FLEET_GATEWAY_ORIGIN}/${validateAppSlug(name)}`;
 }
@@ -24644,102 +24643,6 @@ function toV1BaseUrl(apiUrl) {
   url.pathname = `${path}/v1`;
   return url.toString().replace(/\/+$/, "");
 }
-class ClientTransportConfigurationError extends Error {
-  appName;
-  sources;
-  constructor(appName, message, sources = []) {
-    super(message);
-    this.name = "ClientTransportConfigurationError";
-    this.appName = appName;
-    this.sources = Object.freeze([...sources]);
-  }
-}
-function resolveClientTransportSnapshot(name, env = process.env, options = {}) {
-  env = snapshotClientEnvironment(name, env);
-  const keys = clientTransportEnvKeys(name);
-  const definedUrlEntries = keys.apiUrlKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, raw: String(env[key]) }));
-  const blankUrl = definedUrlEntries.find((entry) => entry.raw.trim().length === 0);
-  if (blankUrl) {
-    throw new ClientTransportConfigurationError(name, `${blankUrl.key} is set but blank; public clients require an explicit HTTPS API URL and never select local storage.`, [blankUrl.key]);
-  }
-  const controlledUrl = definedUrlEntries.find((entry) => ASCII_CONTROL_PATTERN.test(entry.raw));
-  if (controlledUrl) {
-    throw new ClientTransportConfigurationError(name, `${controlledUrl.key} contains ASCII control characters.`, [controlledUrl.key]);
-  }
-  const usableUrlEntries = definedUrlEntries.map((entry) => ({ key: entry.key, value: entry.raw.trim() }));
-  if (usableUrlEntries.length > 1 && new Set(usableUrlEntries.map((entry) => entry.value)).size > 1) {
-    throw new ClientTransportConfigurationError(name, `${usableUrlEntries.map((entry) => entry.key).join(" and ")} disagree; client authority aliases must be identical or only one may be set.`, usableUrlEntries.map((entry) => entry.key));
-  }
-  const envUrlHit = usableUrlEntries[0] ?? null;
-  const keychainUrlHit = keychainConfigValue(name, env, options.credentials?.keychain);
-  const diskConfigUrlHit = appConfigDiskValue(name, env, keys.apiUrlKeys);
-  if (diskConfigUrlHit?.unusable) {
-    throw new ClientTransportConfigurationError(name, `${diskConfigUrlHit.key} in ${diskConfigUrlHit.path} is declared but blank or malformed; public clients require a valid HTTPS service authority.`, [diskConfigUrlHit.path]);
-  }
-  const urlCandidates = [
-    ...envUrlHit ? [envUrlHit] : [],
-    ...keychainUrlHit ? [{ key: keychainUrlHit.source, value: keychainUrlHit.value }] : [],
-    ...diskConfigUrlHit ? [{ key: diskConfigUrlHit.path, value: diskConfigUrlHit.value.trim() }] : []
-  ];
-  const configuredUrl = urlCandidates[0] ?? null;
-  const divergentUrls = urlCandidates.filter((candidate) => candidate.value !== configuredUrl?.value);
-  if (configuredUrl && divergentUrls.length > 0) {
-    throw new ClientTransportConfigurationError(name, `${configuredUrl.key} and ${divergentUrls.map((candidate) => candidate.key).join(" and ")} select different service authorities; refusing to send a credential written for one authority to the other.`, urlCandidates.map((candidate) => candidate.key));
-  }
-  const warnings = [];
-  if (configuredUrl && !envUrlHit) {
-    warnings.push(`No ${keys.apiUrlKeys[0]} in the environment; the server URL in ${configuredUrl.key} was used, so this client connects to the server. ` + `Keep that entry aligned with the intended service authority.`);
-  }
-  const credential = resolveCredential(name, env, options.credentials);
-  if (!credential) {
-    const diskHint = credentialDiskSourcesForMessage(name, env);
-    const lead = configuredUrl ? `${configuredUrl.key} selects the HTTP server for '${name}', but no API key could be resolved` : `${keys.apiUrlKeys[0]} is not set and no API key could be resolved for '${name}'; a credential is required before the default fleet gateway authority applies`;
-    warnings.push(`${lead}; refusing to create an unauthenticated client \u2014 public clients never fall back to SQLite or another local store. ` + `Looked in the Keychain (macOS only), then for a credential file at ${diskHint}, then for ${keys.apiKeyKeys[0]} in the environment.`);
-    throw new ClientTransportConfigurationError(name, warnings.join(" "), [configuredUrl?.key ?? keys.apiUrlKeys[0]]);
-  }
-  if (credential.warning)
-    warnings.push(credential.warning);
-  let urlHit;
-  if (configuredUrl) {
-    urlHit = configuredUrl;
-  } else {
-    try {
-      urlHit = { key: DEFAULT_AUTHORITY_SOURCE, value: defaultFleetGatewayBaseUrl(name) };
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      throw new ClientTransportConfigurationError(name, `No ${keys.apiUrlKeys[0]} is configured and the default fleet gateway authority cannot be composed for '${name}': ${message}`, [keys.apiUrlKeys[0]]);
-    }
-  }
-  const apiUrlSource = urlHit.key;
-  let baseUrl;
-  try {
-    baseUrl = toV1BaseUrl(urlHit.value);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new ClientTransportConfigurationError(name, `Invalid API URL from ${apiUrlSource}: ${message}`, [apiUrlSource]);
-  }
-  return {
-    resolution: {
-      transport: "http",
-      transportSource: urlHit.key,
-      baseUrl,
-      apiUrlSource,
-      apiKeyPresent: true,
-      apiKeySource: credential.source,
-      apiKeyTier: credential.tier,
-      misconfigured: false,
-      warning: warnings.length > 0 ? warnings.join(" ") : null
-    },
-    credential
-  };
-}
-function resolveClientTransport(name, env = process.env, options = {}) {
-  return resolveClientTransportSnapshot(name, env, options).resolution;
-}
-function credentialDiskSourcesForMessage(name, env) {
-  const paths = credentialDiskSources(name, env);
-  return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
-}
 var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
 var AUTHORITY_OVERRIDE_HEADERS = new Set([
   "host",
@@ -24749,6 +24652,94 @@ var AUTHORITY_OVERRIDE_HEADERS = new Set([
   "x-original-host"
 ]);
 
+// src/lib/instance-credentials.ts
+import { closeSync as closeSync2, constants, fstatSync as fstatSync2, lstatSync, openSync as openSync2, readSync } from "fs";
+var SKILLS_BOUND_API_URL = "HASNA_SKILLS_BOUND_API_URL";
+function selectedSkillsProfile(env, explicit) {
+  const selected = explicit ?? env.HASNA_PROFILE;
+  if (selected === undefined)
+    return null;
+  const profile = selected.trim();
+  if (!/^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/.test(profile))
+    throw new Error("Invalid Skills credential profile");
+  return profile;
+}
+function skillsProfileCredentialFiles(env, explicit) {
+  return credentialDiskSourceList("skills", env, selectedSkillsProfile(env, explicit)).map((source) => source.path);
+}
+function fileIdentity(file) {
+  try {
+    return lstatSync(file);
+  } catch (error) {
+    if (["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
+      return null;
+    throw new Error("Cannot inspect Skills instance configuration");
+  }
+}
+function unchanged(before, after) {
+  return before === null || after === null ? before === after : ["dev", "ino", "size", "mtimeMs", "ctimeMs", "mode", "uid"].every((key) => before[key] === after[key]);
+}
+function captureSkillsCredentialFiles(files) {
+  const identities = files.map((file) => [file, fileIdentity(file)]);
+  return () => {
+    if (identities.some(([file, before]) => !unchanged(before, fileIdentity(file)))) {
+      throw new Error("Skills instance configuration changed while resolving credentials; retry without sending a credential");
+    }
+  };
+}
+function readMetadataText(file) {
+  let fd;
+  try {
+    fd = openSync2(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  } catch (error) {
+    if (["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
+      return null;
+    throw new Error("Cannot safely read Skills instance configuration");
+  }
+  try {
+    const before = fstatSync2(fd);
+    const uid = process.getuid?.() ?? process.geteuid?.();
+    if (!before.isFile() || ![256, 384].includes(before.mode & 4095) || uid !== undefined && before.uid !== uid || before.size > 64 * 1024) {
+      throw new Error("Unsafe Skills instance configuration; expected a bounded owner-only regular file");
+    }
+    const bytes = Buffer.alloc(64 * 1024 + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const count = readSync(fd, bytes, length, bytes.length - length, null);
+      if (!count)
+        break;
+      length += count;
+    }
+    if (length > 64 * 1024 || !unchanged(before, fstatSync2(fd)) || !unchanged(before, fileIdentity(file))) {
+      throw new Error("Skills instance configuration changed while reading");
+    }
+    return bytes.subarray(0, length).toString("utf8");
+  } finally {
+    closeSync2(fd);
+  }
+}
+function readSkillsInstanceMetadata(file) {
+  const text = readMetadataText(file);
+  if (text === null)
+    return {};
+  const values = new Map;
+  for (const line of text.split(/\r?\n/)) {
+    const match = /^\s*(?:export\s+)?(HASNA_SKILLS_API_URL|SKILLS_API_URL|HASNA_SKILLS_BOUND_API_URL)\s*=\s*(.*)$/.exec(line);
+    if (!match)
+      continue;
+    let value = match[2].trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))
+      value = value.slice(1, -1);
+    if (!value || /[\x00-\x20\x7f]/.test(value) || values.has(match[1]))
+      throw new Error("Invalid Skills instance configuration");
+    values.set(match[1], value);
+  }
+  const urls = [values.get("HASNA_SKILLS_API_URL"), values.get("SKILLS_API_URL")].filter(Boolean);
+  if (new Set(urls).size > 1)
+    throw new Error("Skills API URL aliases disagree");
+  return { apiUrl: urls[0], binding: values.get(SKILLS_BOUND_API_URL) };
+}
+
 // src/lib/fleet-credentials.ts
 var SKILLS_APP = "skills";
 var ENV_KEYS = clientTransportEnvKeys(SKILLS_APP);
@@ -24765,9 +24756,6 @@ class SkillsFleetCredentialError extends Error {
     this.code = code;
   }
 }
-function isClientTransportConfigurationError(error) {
-  return error instanceof ClientTransportConfigurationError || typeof error === "object" && error !== null && error.name === "ClientTransportConfigurationError";
-}
 function isCredentialResolutionError(error) {
   return error instanceof CredentialResolutionError || typeof error === "object" && error !== null && error.name === "CredentialResolutionError";
 }
@@ -24778,6 +24766,9 @@ function asSkillsFleetCredentialError(error) {
 }
 function normalizeSkillsApiOrigin(apiUrl) {
   const url = new URL(apiUrl);
+  if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) {
+    throw new SkillsFleetCredentialError("A Skills API URL must use HTTPS (or loopback HTTP), without credentials, query or fragment", "INVALID_API_URL");
+  }
   const pathname = url.pathname.replace(/\/+$/, "");
   if (pathname === "/api" || pathname === "/api/v1") {
     url.pathname = "/";
@@ -24788,11 +24779,24 @@ function normalizeSkillsApiOrigin(apiUrl) {
   }
   return url.toString().replace(/\/+$/, "");
 }
-function configuredSkillsApiUrl(env = process.env, keychain) {
-  for (const key of SKILLS_API_URL_ENV_KEYS) {
-    const value = env[key]?.trim();
-    if (value)
-      return { value, source: key };
+function configuredSkillsApiUrl(env = process.env, keychain, profile) {
+  const declared = SKILLS_API_URL_ENV_KEYS.filter((key) => env[key] !== undefined).map((key) => ({ key, value: env[key] }));
+  for (const entry of declared) {
+    if (!entry.value.trim() || /[\x00-\x1f\x7f]/.test(entry.value))
+      throw new SkillsFleetCredentialError(`${entry.key} is blank or contains control characters`, "INVALID_API_URL");
+  }
+  const normalized = declared.map((entry) => ({ value: normalizeSkillsApiOrigin(entry.value), source: entry.key }));
+  if (new Set(normalized.map((entry) => entry.value)).size > 1)
+    throw new SkillsFleetCredentialError("Skills API URL aliases disagree", "INVALID_API_URL");
+  if (normalized[0])
+    return normalized[0];
+  if (selectedSkillsProfile(env, profile)) {
+    for (const file of skillsProfileCredentialFiles(env, profile)) {
+      const metadata = readSkillsInstanceMetadata(file);
+      if (metadata.apiUrl || metadata.binding)
+        return { value: metadata.apiUrl ?? metadata.binding, source: file };
+    }
+    return { value: defaultFleetGatewayBaseUrl(SKILLS_APP), source: "default" };
   }
   const fromKeychain = keychainConfigValue(SKILLS_APP, env, keychain);
   if (fromKeychain)
@@ -24806,7 +24810,7 @@ function configuredSkillsApiUrl(env = process.env, keychain) {
   return null;
 }
 function skillsCredentialFiles(env = process.env) {
-  return credentialDiskSources(SKILLS_APP, env);
+  return skillsProfileCredentialFiles(env);
 }
 function skillsCredentialFilePath(env = process.env) {
   const paths = skillsCredentialFiles(env);
@@ -24825,7 +24829,11 @@ function noticeLocalSkillsMode(write = (line) => console.error(line)) {
 }
 function resolveSkillsFleet(env = process.env, options = {}) {
   try {
-    return resolveSkillsFleetOrThrow(env, options);
+    const snapshot = snapshotSkillsEnvironment(env);
+    const resolved = resolveSkillsFleetOrThrow(snapshot, snapshotSkillsOptions(env, options));
+    if (resolved.mode === "local" && env === process.env)
+      noticeLocalSkillsMode();
+    return resolved;
   } catch (error) {
     const translated = asSkillsFleetCredentialError(error);
     if (translated)
@@ -24833,38 +24841,46 @@ function resolveSkillsFleet(env = process.env, options = {}) {
     throw error;
   }
 }
-function resolveSkillsFleetOrThrow(env, options) {
-  let resolution;
-  try {
-    resolution = resolveClientTransport(SKILLS_APP, env, { credentials: options.credentials });
-  } catch (error) {
-    if (!isClientTransportConfigurationError(error))
-      throw error;
-    const configured2 = configuredSkillsApiUrl(env, options.credentials?.keychain);
-    const credential2 = resolveCredential(SKILLS_APP, env, options.credentials);
-    if (!configured2 && !credential2) {
-      if (env === process.env)
-        noticeLocalSkillsMode();
-      return { mode: "local", apiOrigin: null, apiKey: null };
-    }
-    if (configured2 && !credential2) {
-      throw new SkillsFleetCredentialError(`${configured2.source} points this CLI at a Skills service but no API key resolved \u2014 ` + `refusing to run locally instead. Looked in the Keychain item ` + `hasna.credentials.${SKILLS_APP}.api-key, then ${skillsCredentialFiles(env).join(" or ") || "no credentials file (no HOME)"}, ` + `then ${SKILLS_API_KEY_ENV}. Sign in with: skills auth login`);
+function snapshotSkillsEnvironment(env) {
+  const snapshot = {};
+  for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(env))) {
+    if (!("value" in descriptor)) {
+      if (/^(?:HASNA_|SKILLS_|HOME$|USER$)/.test(key))
+        throw new SkillsFleetCredentialError("Accessor-backed Skills configuration is unsupported");
+      continue;
     }
-    throw error;
+    snapshot[key] = descriptor.value;
   }
-  const configured = configuredSkillsApiUrl(env, options.credentials?.keychain);
-  const apiOrigin = configured ? normalizeSkillsApiOrigin(configured.value) : stripV1(resolution.baseUrl);
+  return Object.freeze(snapshot);
+}
+function snapshotSkillsOptions(env, options) {
+  if (env !== process.env)
+    return options;
+  return { ...options, credentials: { ...options.credentials, keychain: {
+    ...options.credentials?.keychain,
+    enabled: options.credentials?.keychain?.enabled ?? true
+  } } };
+}
+function resolveSkillsFleetOrThrow(env, options) {
+  const assertFilesUnchanged = captureSkillsCredentialFiles(skillsProfileCredentialFiles(env, options.credentials?.profile));
+  const configured = configuredSkillsApiUrl(env, options.credentials?.keychain, options.credentials?.profile);
   const credential = resolveCredential(SKILLS_APP, env, options.credentials);
   if (!credential) {
-    throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills auth login`);
+    if (!configured)
+      return { mode: "local", apiOrigin: null, apiKey: null };
+    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in hasna.credentials.skills.api-key, ${skillsCredentialFiles(env).join(" or ") || "no credentials file"}, and ${SKILLS_API_KEY_ENV}. Sign in with: skills auth login`);
   }
+  const apiOrigin = normalizeSkillsApiOrigin(configured?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP));
+  toV1BaseUrl(apiOrigin);
+  assertCredentialInstance(credential, apiOrigin, env, options);
+  assertFilesUnchanged();
   const base = {
     mode: "hosted",
     apiOrigin,
-    apiUrlSource: resolution.apiUrlSource ?? (configured?.source ?? "default"),
-    apiKeySource: resolution.apiKeySource ?? credential.source,
-    apiKeyTier: resolution.apiKeyTier,
-    warning: resolution.warning
+    apiUrlSource: configured?.source ?? "default",
+    apiKeySource: credential.source,
+    apiKeyTier: credential.tier,
+    warning: credential.warning
   };
   if (credential.tier === "pointer") {
     return { ...base, apiKey: null, apiKeyPointer: credential };
@@ -24874,19 +24890,37 @@ function resolveSkillsFleetOrThrow(env, options) {
   }
   return { ...base, apiKey: credential.apiKey, apiKeyPointer: null };
 }
+function assertCredentialInstance(credential, apiOrigin, env, options) {
+  let bound;
+  if (credential.tier === "disk" || credential.tier === "profile") {
+    const metadata = readSkillsInstanceMetadata(credential.source);
+    bound = metadata.binding ?? metadata.apiUrl ?? defaultFleetGatewayBaseUrl(SKILLS_APP);
+  } else if (credential.tier === "keychain") {
+    bound = keychainConfigValue(SKILLS_APP, env, options.credentials?.keychain)?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP);
+  }
+  if (bound && normalizeSkillsApiOrigin(bound) !== apiOrigin) {
+    throw new SkillsFleetCredentialError("The selected Skills API does not match this credential's instance. Select its profile or sign in to the new instance; no credential was sent.", "INSTANCE_CREDENTIAL_MISMATCH");
+  }
+}
 async function resolveSkillsApiKey(env = process.env, options = {}) {
-  const fleet = resolveSkillsFleet(env, options);
+  return (await resolveSkillsConnection(env, options))?.apiKey ?? null;
+}
+async function resolveSkillsConnection(env = process.env, options = {}) {
+  const snapshotEnv = snapshotSkillsEnvironment(env);
+  const fleet = resolveSkillsFleet(snapshotEnv, snapshotSkillsOptions(env, options));
+  if (fleet.mode === "local" && env === process.env)
+    noticeLocalSkillsMode();
   if (fleet.mode !== "hosted")
     return null;
   if (fleet.apiKey)
-    return fleet.apiKey;
+    return { ...fleet, apiKey: fleet.apiKey };
   const pointer = fleet.apiKeyPointer;
   if (!pointer) {
     throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills auth login`);
   }
   let completed;
   try {
-    completed = await completePointerCredential(SKILLS_APP, pointer, env);
+    completed = await completePointerCredential(SKILLS_APP, pointer, snapshotEnv);
   } catch (error) {
     const translated = asSkillsFleetCredentialError(error);
     if (translated)
@@ -24896,7 +24930,7 @@ async function resolveSkillsApiKey(env = process.env, options = {}) {
   if (!completed.apiKey?.trim()) {
     throw new SkillsFleetCredentialError(`${credentialPointerEnvKey(SKILLS_APP)} names a vault item that produced an empty Skills API key \u2014 ` + `refusing to send an unauthenticated request.`);
   }
-  return completed.apiKey;
+  return { ...fleet, apiKey: completed.apiKey, apiKeyPointer: null };
 }
 async function requireSkillsApiKey(action = "This command", env = process.env, options = {}) {
   const apiKey = await resolveSkillsApiKey(env, options);
@@ -24904,22 +24938,19 @@ async function requireSkillsApiKey(action = "This command", env = process.env, o
     throw new MissingSkillsFleetError(action);
   return apiKey;
 }
-function stripV1(baseUrl) {
-  return baseUrl.replace(/\/v1$/, "").replace(/\/+$/, "");
-}
 async function skillsCredentialOrReason(env = process.env, options = {}) {
   try {
-    const apiKey = await resolveSkillsApiKey(env, options);
-    return apiKey ? { apiKey, reason: null } : { apiKey: null, reason: null };
+    const connection = await resolveSkillsConnection(env, options);
+    return connection ? { apiKey: connection.apiKey, apiOrigin: connection.apiOrigin, reason: null } : { apiKey: null, apiOrigin: null, reason: null };
   } catch (error) {
     if (error instanceof SkillsFleetCredentialError || error?.name === "SkillsFleetCredentialError") {
-      return { apiKey: null, reason: error.message };
+      return { apiKey: null, apiOrigin: null, reason: error.message };
     }
     throw error;
   }
 }
 function resolveSkillsApiOrigin(env = process.env, options = {}) {
-  const configured = configuredSkillsApiUrl(env, options.credentials?.keychain);
+  const configured = configuredSkillsApiUrl(env, options.credentials?.keychain, options.credentials?.profile);
   if (configured) {
     toV1BaseUrl(configured.value);
     return { origin: normalizeSkillsApiOrigin(configured.value), source: configured.source };
@@ -24950,7 +24981,7 @@ class MissingSkillsFleetError extends Error {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.3.0",
+  version: "0.4.0",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -25009,8 +25040,7 @@ var package_default = {
     "verify:release": "bun run scripts/release-guard.ts",
     prepare: "bun run build:js",
     prepack: "bun run build && bun run verify:release",
-    prepublishOnly: "bun run typecheck && bun run test",
-    postinstall: "mkdir -p $HOME/.hasna/skills/custom 2>/dev/null || true"
+    prepublishOnly: "bun run typecheck && bun run test"
   },
   keywords: [
     "skills",
@@ -25860,7 +25890,7 @@ var $getFlexibleChecksumsPlugin = getFlexibleChecksumsPlugin;
 var $resolveFlexibleChecksumsConfig = resolveFlexibleChecksumsConfig;
 
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
-var import_client24 = __toESM(require_client2(), 1);
+var import_client25 = __toESM(require_client2(), 1);
 
 // ../../node_modules/.bun/@aws-sdk+middleware-sdk-s3@3.972.75/node_modules/@aws-sdk/middleware-sdk-s3/dist-cjs/submodules/s3/index.js
 var { NoOpLogger, getSmithyContext } = require_client();
@@ -26469,7 +26499,7 @@ var $resolveS3Config = resolveS3Config;
 
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
 var import_core = __toESM(require_dist_cjs2(), 1);
-var import_client25 = __toESM(require_client(), 1);
+var import_client26 = __toESM(require_client(), 1);
 var import_config29 = __toESM(require_config(), 1);
 var import_endpoints5 = __toESM(require_endpoints(), 1);
 var import_event_streams2 = __toESM(require_event_streams(), 1);
@@ -26480,11 +26510,11 @@ var import_schema2 = __toESM(require_schema(), 1);
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
 var import_httpAuthSchemes = __toESM(require_httpAuthSchemes(), 1);
 var import_signature_v4_multi_region = __toESM(require_dist_cjs4(), 1);
-var import_client3 = __toESM(require_client(), 1);
+var import_client4 = __toESM(require_client(), 1);
 var import_endpoints3 = __toESM(require_endpoints(), 1);
 
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/endpointResolver.js
-var import_client2 = __toESM(require_client2(), 1);
+var import_client3 = __toESM(require_client2(), 1);
 var import_endpoints2 = __toESM(require_endpoints(), 1);
 
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/bdd.js
@@ -28457,7 +28487,7 @@ var defaultEndpointResolver = (endpointParams, context = {}) => {
     logger: context.logger
   }));
 };
-import_endpoints2.customEndpointFunctions.aws = import_client2.awsEndpointFunctions;
+import_endpoints2.customEndpointFunctions.aws = import_client3.awsEndpointFunctions;
 
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
 var createEndpointRuleSetHttpAuthSchemeParametersProvider = (defaultHttpAuthSchemeParametersProvider) => async (config, context, input) => {
@@ -28465,7 +28495,7 @@ var createEndpointRuleSetHttpAuthSchemeParametersProvider = (defaultHttpAuthSche
     throw new Error("Could not find `input` for `defaultEndpointRuleSetHttpAuthSchemeParametersProvider`");
   }
   const defaultParameters = await defaultHttpAuthSchemeParametersProvider(config, context, input);
-  const instructionsFn = import_client3.getSmithyContext(context)?.commandInstance?.constructor?.getEndpointParameterInstructions;
+  const instructionsFn = import_client4.getSmithyContext(context)?.commandInstance?.constructor?.getEndpointParameterInstructions;
   if (!instructionsFn) {
     throw new Error(`getEndpointParameterInstructions() is not defined on '${context.commandName}'`);
   }
@@ -28474,8 +28504,8 @@ var createEndpointRuleSetHttpAuthSchemeParametersProvider = (defaultHttpAuthSche
 };
 var _defaultS3HttpAuthSchemeParametersProvider = async (config, context, input) => {
   return {
-    operation: import_client3.getSmithyContext(context).operation,
-    region: await import_client3.normalizeProvider(config.region)() || (() => {
+    operation: import_client4.getSmithyContext(context).operation,
+    region: await import_client4.normalizeProvider(config.region)() || (() => {
       throw new Error("expected `region` to be configured for `aws.auth#sigv4`");
     })()
   };
@@ -28571,12 +28601,12 @@ var resolveHttpAuthSchemeConfig = (config) => {
   const config_0 = import_httpAuthSchemes.resolveAwsSdkSigV4Config(config);
   const config_1 = import_httpAuthSchemes.resolveAwsSdkSigV4AConfig(config_0);
   return Object.assign(config_1, {
-    authSchemePreference: import_client3.normalizeProvider(config.authSchemePreference ?? [])
+    authSchemePreference: import_client4.normalizeProvider(config.authSchemePreference ?? [])
   });
 };
 
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
-var import_client4 = __toESM(require_client(), 1);
+var import_client5 = __toESM(require_client(), 1);
 var import_endpoints4 = __toESM(require_endpoints(), 1);
 
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/EndpointParameters.js
@@ -28606,7 +28636,7 @@ var commonParams = {
 };
 
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
-var command = import_client4.makeBuilder(commonParams, "AmazonS3", "S3Client", import_endpoints4.getEndpointPlugin);
+var command = import_client5.makeBuilder(commonParams, "AmazonS3", "S3Client", import_endpoints4.getEndpointPlugin);
 var _ep0 = {
   Bucket: { type: "contextParams", name: "Bucket" },
   Key: { type: "contextParams", name: "Key" }
@@ -28641,8 +28671,8 @@ var _mw11 = (Command, cs, config, o2) => [
 var import_schema = __toESM(require_schema(), 1);
 
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/models/S3ServiceException.js
-var import_client5 = __toESM(require_client(), 1);
-class S3ServiceException extends import_client5.ServiceException {
+var import_client6 = __toESM(require_client(), 1);
+class S3ServiceException extends import_client6.ServiceException {
   constructor(options) {
     super(options);
     Object.setPrototypeOf(this, S3ServiceException.prototype);
@@ -34468,7 +34498,7 @@ var package_default2 = {
 };
 
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
-var import_client20 = __toESM(require_client2(), 1);
+var import_client21 = __toESM(require_client2(), 1);
 var import_httpAuthSchemes3 = __toESM(require_httpAuthSchemes(), 1);
 
 // ../../node_modules/.bun/@aws-sdk+credential-provider-node@3.972.82/node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.js
@@ -34626,7 +34656,7 @@ var defaultProvider = (init = {}) => memoizeChain([
 var credentialsTreatedAsExpired = (credentials) => credentials?.expiration !== undefined && credentials.expiration.getTime() - Date.now() < 300000;
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var import_checksum2 = __toESM(require_checksum(), 1);
-var import_client21 = __toESM(require_client(), 1);
+var import_client22 = __toESM(require_client(), 1);
 var import_config28 = __toESM(require_config(), 1);
 var import_event_streams = __toESM(require_event_streams(), 1);
 var import_retry3 = __toESM(require_retry(), 1);
@@ -34866,7 +34896,7 @@ var $Sha1 = Sha1Node;
 var import_httpAuthSchemes2 = __toESM(require_httpAuthSchemes(), 1);
 var import_signature_v4_multi_region2 = __toESM(require_dist_cjs4(), 1);
 var import_checksum = __toESM(require_checksum(), 1);
-var import_client19 = __toESM(require_client(), 1);
+var import_client20 = __toESM(require_client(), 1);
 var import_protocols4 = __toESM(require_protocols(), 1);
 var import_serde3 = __toESM(require_serde(), 1);
 var getRuntimeConfig2 = (config) => {
@@ -34891,7 +34921,7 @@ var getRuntimeConfig2 = (config) => {
         signer: new import_httpAuthSchemes2.AwsSdkSigV4ASigner
       }
     ],
-    logger: config?.logger ?? new import_client19.NoOpLogger,
+    logger: config?.logger ?? new import_client20.NoOpLogger,
     md5: config?.md5 ?? import_checksum.Md5,
     protocol: config?.protocol ?? $S3RestXmlProtocol,
     protocolSettings: config?.protocolSettings ?? {
@@ -34916,11 +34946,11 @@ var getRuntimeConfig2 = (config) => {
 
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var getRuntimeConfig3 = (config) => {
-  import_client21.emitWarningIfUnsupportedVersion(process.version);
+  import_client22.emitWarningIfUnsupportedVersion(process.version);
   const defaultsMode = import_config28.resolveDefaultsModeConfig(config);
-  const defaultConfigProvider = () => defaultsMode().then(import_client21.loadConfigsForDefaultMode);
+  const defaultConfigProvider = () => defaultsMode().then(import_client22.loadConfigsForDefaultMode);
   const clientSharedValues = getRuntimeConfig2(config);
-  import_client20.emitWarningIfUnsupportedVersion(process.version);
+  import_client21.emitWarningIfUnsupportedVersion(process.version);
   const loaderConfig = {
     profile: config?.profile,
     logger: clientSharedValues.logger
@@ -34933,7 +34963,7 @@ var getRuntimeConfig3 = (config) => {
     authSchemePreference: config?.authSchemePreference ?? import_config28.loadConfig(import_httpAuthSchemes3.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde4.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
-    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client20.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default2.version }),
+    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client21.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default2.version }),
     disableS3ExpressSessionAuth: config?.disableS3ExpressSessionAuth ?? import_config28.loadConfig($NODE_DISABLE_S3_EXPRESS_SESSION_AUTH_OPTIONS, loaderConfig),
     eventStreamSerdeProvider: config?.eventStreamSerdeProvider ?? import_event_streams.eventStreamSerdeProvider,
     maxAttempts: config?.maxAttempts ?? import_config28.loadConfig(import_retry3.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
@@ -34951,13 +34981,13 @@ var getRuntimeConfig3 = (config) => {
     useArnRegion: config?.useArnRegion ?? import_config28.loadConfig($NODE_USE_ARN_REGION_CONFIG_OPTIONS, loaderConfig),
     useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config28.loadConfig(import_config28.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
     useFipsEndpoint: config?.useFipsEndpoint ?? import_config28.loadConfig(import_config28.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    userAgentAppId: config?.userAgentAppId ?? import_config28.loadConfig(import_client20.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    userAgentAppId: config?.userAgentAppId ?? import_config28.loadConfig(import_client21.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
   };
 };
 
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
-var import_client22 = __toESM(require_client2(), 1);
-var import_client23 = __toESM(require_client(), 1);
+var import_client23 = __toESM(require_client2(), 1);
+var import_client24 = __toESM(require_client(), 1);
 var import_protocols5 = __toESM(require_protocols(), 1);
 
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthExtensionConfiguration.js
@@ -35001,24 +35031,24 @@ var resolveHttpAuthRuntimeConfig2 = (config) => {
 
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
 var resolveRuntimeExtensions2 = (runtimeConfig, extensions) => {
-  const extensionConfiguration = Object.assign(import_client22.getAwsRegionExtensionConfiguration(runtimeConfig), import_client23.getDefaultExtensionConfiguration(runtimeConfig), import_protocols5.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration2(runtimeConfig));
+  const extensionConfiguration = Object.assign(import_client23.getAwsRegionExtensionConfiguration(runtimeConfig), import_client24.getDefaultExtensionConfiguration(runtimeConfig), import_protocols5.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration2(runtimeConfig));
   extensions.forEach((extension) => extension.configure(extensionConfiguration));
-  return Object.assign(runtimeConfig, import_client22.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client23.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols5.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig2(extensionConfiguration));
+  return Object.assign(runtimeConfig, import_client23.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client24.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols5.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig2(extensionConfiguration));
 };
 
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
-class S3Client extends import_client25.Client {
+class S3Client extends import_client26.Client {
   config;
   constructor(...[configuration]) {
     const _config_0 = getRuntimeConfig3(configuration || {});
     super(_config_0);
     this.initConfig = _config_0;
     const _config_1 = resolveClientEndpointParameters(_config_0);
-    const _config_2 = import_client24.resolveUserAgentConfig(_config_1);
+    const _config_2 = import_client25.resolveUserAgentConfig(_config_1);
     const _config_3 = $resolveFlexibleChecksumsConfig(_config_2);
     const _config_4 = import_retry4.resolveRetryConfig(_config_3);
     const _config_5 = import_config29.resolveRegionConfig(_config_4);
-    const _config_6 = import_client24.resolveHostHeaderConfig(_config_5);
+    const _config_6 = import_client25.resolveHostHeaderConfig(_config_5);
     const _config_7 = import_endpoints5.resolveEndpointConfig(_config_6);
     const _config_8 = import_event_streams2.resolveEventStreamSerdeConfig(_config_7);
     const _config_9 = resolveHttpAuthSchemeConfig(_config_8);
@@ -35026,12 +35056,12 @@ class S3Client extends import_client25.Client {
     const _config_11 = resolveRuntimeExtensions2(_config_10, configuration?.extensions || []);
     this.config = _config_11;
     this.middlewareStack.use(import_schema2.getSchemaSerdePlugin(this.config));
-    this.middlewareStack.use(import_client24.getUserAgentPlugin(this.config));
+    this.middlewareStack.use(import_client25.getUserAgentPlugin(this.config));
     this.middlewareStack.use(import_retry4.getRetryPlugin(this.config));
     this.middlewareStack.use(import_protocols6.getContentLengthPlugin(this.config));
-    this.middlewareStack.use(import_client24.getHostHeaderPlugin(this.config));
-    this.middlewareStack.use(import_client24.getLoggerPlugin(this.config));
-    this.middlewareStack.use(import_client24.getRecursionDetectionPlugin(this.config));
+    this.middlewareStack.use(import_client25.getHostHeaderPlugin(this.config));
+    this.middlewareStack.use(import_client25.getLoggerPlugin(this.config));
+    this.middlewareStack.use(import_client25.getRecursionDetectionPlugin(this.config));
     this.middlewareStack.use(import_core.getHttpAuthSchemeEndpointRuleSetPlugin(this.config, {
       httpAuthSchemeParametersProvider: defaultS3HttpAuthSchemeParametersProvider,
       identityProviderConfigProvider: async (config) => new import_core.DefaultIdentityProviderConfig({
@@ -37821,7 +37851,7 @@ var BRACE_SOURCE_EXCLUSION = new RegExp(`^!skills/\\{(${SLUG}(?:,${SLUG})+)\\}/s
 var SINGLE_SOURCE_EXCLUSION = new RegExp(`^!skills/(${SLUG})/src$`);
 
 // src/lib/skill-validation.ts
-import { existsSync as existsSync5, lstatSync, readFileSync as readFileSync7, readdirSync as readdirSync5, statSync as statSync4 } from "fs";
+import { existsSync as existsSync5, lstatSync as lstatSync2, readFileSync as readFileSync7, readdirSync as readdirSync5, statSync as statSync4 } from "fs";
 import { isAbsolute as isAbsolute3, join as join10, normalize } from "path";
 var VALID_SKILL_KINDS = ["executable", "instruction"];
 var DOC_FILES = ["SKILL.md", "README.md", "CLAUDE.md"];
@@ -37902,6 +37932,16 @@ function isHostedMetadataSkill(skillName, frontmatter, registryMeta, packageDecl
     return true;
   return false;
 }
+function frontmatterString(raw) {
+  if (raw.startsWith('"') && raw.endsWith('"')) {
+    try {
+      const decoded = JSON.parse(raw);
+      if (typeof decoded === "string")
+        return decoded;
+    } catch {}
+  }
+  return raw.replace(/^["']|["']$/g, "");
+}
 function parseSkillFrontmatter(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!match)
@@ -37921,12 +37961,12 @@ function parseSkillFrontmatter(content) {
       const tags = [];
       while (i3 + 1 < lines.length && /^\s+-\s+/.test(lines[i3 + 1])) {
         i3++;
-        tags.push(lines[i3].replace(/^\s+-\s+/, "").trim());
+        tags.push(frontmatterString(lines[i3].replace(/^\s+-\s+/, "").trim()));
       }
       result.tags = tags;
       continue;
     }
-    const value = rawValue.replace(/^["']|["']$/g, "");
+    const value = frontmatterString(rawValue);
     if (!value)
       continue;
     if (key === "name")
@@ -37979,7 +38019,7 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     if (RESERVED_SKILL_ENTRIES.has(entry)) {
       add(issues, "skill.reserved_file", `Reserved file '${entry}' is not allowed in skill packages`);
     }
-    if (lstatSync(entryPath).isSymbolicLink()) {
+    if (lstatSync2(entryPath).isSymbolicLink()) {
       add(issues, "skill.symlink_forbidden", `Symlink '${entry}' is not allowed in skill packages`);
     }
     if (!KNOWN_TOP_LEVEL_ENTRIES.has(entry)) {
@@ -38461,7 +38501,7 @@ function validateRuntimeContract(manifest, issues, strict) {
 import {
   cpSync,
   existsSync as existsSync7,
-  lstatSync as lstatSync2,
+  lstatSync as lstatSync3,
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync9,
   realpathSync,
@@ -38559,8 +38599,8 @@ function createInstructionManifest(name, options) {
     description: options.description,
     version: PORTABLE_SKILL_DEFAULT_VERSION,
     displayName: displayName(name),
-    category: "Development Tools",
-    tags: ["custom", name],
+    category: options.category ?? "Development Tools",
+    tags: options.tags ?? ["custom", name],
     kind: "instruction",
     inputs: [],
     commands: [],
@@ -38575,16 +38615,16 @@ function writeInstructionSkillTemplate(skillPath, manifest) {
 }
 function renderInstructionSkillMd(manifest) {
   const tags = manifest.tags?.length ? `tags:
-${manifest.tags.map((tag) => `  - ${tag}`).join(`
+${manifest.tags.map((tag) => `  - ${yamlString(tag)}`).join(`
 `)}
 ` : "";
   return `---
 name: ${manifest.name}
-description: ${manifest.description}
+description: ${yamlString(manifest.description)}
 kind: instruction
 version: ${manifest.version}
 source: custom
-category: ${manifest.category ?? "Development Tools"}
+category: ${yamlString(manifest.category ?? "Development Tools")}
 ${tags}---
 
 # ${manifest.displayName ?? displayName(manifest.name)}
@@ -38605,8 +38645,8 @@ function createPortableManifest(name, options) {
     description: options.description,
     version: PORTABLE_SKILL_DEFAULT_VERSION,
     displayName: displayName(name),
-    category: "Development Tools",
-    tags: ["custom", name],
+    category: options.category ?? "Development Tools",
+    tags: options.tags ?? ["custom", name],
     inputs: DEFAULT_INPUTS,
     commands: [{
       name,
@@ -38769,7 +38809,7 @@ function ensureInstructionSkillFiles(skillPath, manifest) {
   return readPortableSkillManifest(skillPath, next.name);
 }
 function copySkillDirectory(source, destination) {
-  const resolvedSource = lstatSync2(source).isSymbolicLink() ? realpathSync(source) : source;
+  const resolvedSource = lstatSync3(source).isSymbolicLink() ? realpathSync(source) : source;
   mkdirSync4(destination, { recursive: true });
   cpSync(resolvedSource, destination, {
     recursive: true,
@@ -38782,7 +38822,7 @@ function copySkillDirectory(source, destination) {
         if (isExcludedCopyEntry(segments[i3], i3 === 0))
           return false;
       }
-      if (lstatSync2(src).isSymbolicLink())
+      if (lstatSync3(src).isSymbolicLink())
         return false;
       return true;
     }
@@ -38797,10 +38837,13 @@ function isExcludedCopyEntry(name, isFirstSegment) {
     return true;
   return false;
 }
+function yamlString(value) {
+  return JSON.stringify(value);
+}
 function renderSkillMd(manifest) {
   return `---
 name: ${manifest.name}
-description: ${manifest.description}
+description: ${yamlString(manifest.description)}
 ---
 
 # ${manifest.displayName ?? displayName(manifest.name)}
@@ -39183,11 +39226,11 @@ function scaffoldPortableSkill(name, options = {}) {
   const kind = options.kind ?? "executable";
   const description = options.description ?? `${displayName(skillName)} skill`;
   if (kind === "instruction") {
-    const manifest2 = createInstructionManifest(skillName, { description });
+    const manifest2 = createInstructionManifest(skillName, { description, category: options.category, tags: options.tags });
     writeInstructionSkillTemplate(skillPath, manifest2);
     return { name: skillName, path: skillPath, manifest: manifest2, created: true };
   }
-  const manifest = createPortableManifest(skillName, { description });
+  const manifest = createPortableManifest(skillName, { description, category: options.category, tags: options.tags });
   writePortableSkillTemplate(skillPath, manifest);
   return { name: skillName, path: skillPath, manifest, created: true };
 }
@@ -47844,9 +47887,9 @@ function createReceiptService(store) {
 import { createHash as createHash11 } from "crypto";
 
 // ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
-var import_client34 = __toESM(require_client2(), 1);
+var import_client35 = __toESM(require_client2(), 1);
 var import_core2 = __toESM(require_dist_cjs2(), 1);
-var import_client35 = __toESM(require_client(), 1);
+var import_client36 = __toESM(require_client(), 1);
 var import_config39 = __toESM(require_config(), 1);
 var import_endpoints8 = __toESM(require_endpoints(), 1);
 var import_protocols10 = __toESM(require_protocols(), 1);
@@ -47855,11 +47898,11 @@ var import_schema4 = __toESM(require_schema(), 1);
 
 // ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/auth/httpAuthSchemeProvider.js
 var import_httpAuthSchemes4 = __toESM(require_httpAuthSchemes(), 1);
-var import_client26 = __toESM(require_client(), 1);
+var import_client27 = __toESM(require_client(), 1);
 var defaultECSHttpAuthSchemeParametersProvider = async (config, context, input) => {
   return {
-    operation: import_client26.getSmithyContext(context).operation,
-    region: await import_client26.normalizeProvider(config.region)() || (() => {
+    operation: import_client27.getSmithyContext(context).operation,
+    region: await import_client27.normalizeProvider(config.region)() || (() => {
       throw new Error("expected `region` to be configured for `aws.auth#sigv4`");
     })()
   };
@@ -47891,7 +47934,7 @@ var defaultECSHttpAuthSchemeProvider = (authParameters) => {
 var resolveHttpAuthSchemeConfig3 = (config) => {
   const config_0 = import_httpAuthSchemes4.resolveAwsSdkSigV4Config(config);
   return Object.assign(config_0, {
-    authSchemePreference: import_client26.normalizeProvider(config.authSchemePreference ?? [])
+    authSchemePreference: import_client27.normalizeProvider(config.authSchemePreference ?? [])
   });
 };
 
@@ -47983,9 +48026,9 @@ var package_default3 = {
 };
 
 // ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
-var import_client30 = __toESM(require_client2(), 1);
+var import_client31 = __toESM(require_client2(), 1);
 var import_httpAuthSchemes6 = __toESM(require_httpAuthSchemes(), 1);
-var import_client31 = __toESM(require_client(), 1);
+var import_client32 = __toESM(require_client(), 1);
 var import_config38 = __toESM(require_config(), 1);
 var import_retry5 = __toESM(require_retry(), 1);
 var import_serde6 = __toESM(require_serde(), 1);
@@ -47995,12 +48038,12 @@ var import_node_http_handler3 = __toESM(require_dist_cjs6(), 1);
 var import_httpAuthSchemes5 = __toESM(require_httpAuthSchemes(), 1);
 var import_protocols7 = __toESM(require_protocols2(), 1);
 var import_checksum3 = __toESM(require_checksum(), 1);
-var import_client29 = __toESM(require_client(), 1);
+var import_client30 = __toESM(require_client(), 1);
 var import_protocols8 = __toESM(require_protocols(), 1);
 var import_serde5 = __toESM(require_serde(), 1);
 
 // ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/endpointResolver.js
-var import_client27 = __toESM(require_client2(), 1);
+var import_client28 = __toESM(require_client2(), 1);
 var import_endpoints7 = __toESM(require_endpoints(), 1);
 
 // ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/endpoint/bdd.js
@@ -48097,14 +48140,14 @@ var defaultEndpointResolver3 = (endpointParams, context = {}) => {
     logger: context.logger
   }));
 };
-import_endpoints7.customEndpointFunctions.aws = import_client27.awsEndpointFunctions;
+import_endpoints7.customEndpointFunctions.aws = import_client28.awsEndpointFunctions;
 
 // ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/schemas/schemas_0.js
 var import_schema3 = __toESM(require_schema(), 1);
 
 // ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/models/ECSServiceException.js
-var import_client28 = __toESM(require_client(), 1);
-class ECSServiceException extends import_client28.ServiceException {
+var import_client29 = __toESM(require_client(), 1);
+class ECSServiceException extends import_client29.ServiceException {
   constructor(options) {
     super(options);
     Object.setPrototypeOf(this, ECSServiceException.prototype);
@@ -50908,7 +50951,7 @@ var getRuntimeConfig4 = (config) => {
         signer: new import_httpAuthSchemes5.AwsSdkSigV4Signer
       }
     ],
-    logger: config?.logger ?? new import_client29.NoOpLogger,
+    logger: config?.logger ?? new import_client30.NoOpLogger,
     protocol: config?.protocol ?? import_protocols7.AwsJson1_1Protocol,
     protocolSettings: config?.protocolSettings ?? {
       defaultNamespace: "com.amazonaws.ecs",
@@ -50927,11 +50970,11 @@ var getRuntimeConfig4 = (config) => {
 
 // ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
 var getRuntimeConfig5 = (config) => {
-  import_client31.emitWarningIfUnsupportedVersion(process.version);
+  import_client32.emitWarningIfUnsupportedVersion(process.version);
   const defaultsMode = import_config38.resolveDefaultsModeConfig(config);
-  const defaultConfigProvider = () => defaultsMode().then(import_client31.loadConfigsForDefaultMode);
+  const defaultConfigProvider = () => defaultsMode().then(import_client32.loadConfigsForDefaultMode);
   const clientSharedValues = getRuntimeConfig4(config);
-  import_client30.emitWarningIfUnsupportedVersion(process.version);
+  import_client31.emitWarningIfUnsupportedVersion(process.version);
   const loaderConfig = {
     profile: config?.profile,
     logger: clientSharedValues.logger
@@ -50944,7 +50987,7 @@ var getRuntimeConfig5 = (config) => {
     authSchemePreference: config?.authSchemePreference ?? import_config38.loadConfig(import_httpAuthSchemes6.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde6.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
-    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client30.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default3.version }),
+    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client31.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default3.version }),
     maxAttempts: config?.maxAttempts ?? import_config38.loadConfig(import_retry5.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
     region: config?.region ?? import_config38.loadConfig(import_config38.NODE_REGION_CONFIG_OPTIONS, { ...import_config38.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
     requestHandler: import_node_http_handler3.NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
@@ -50955,13 +50998,13 @@ var getRuntimeConfig5 = (config) => {
     streamCollector: config?.streamCollector ?? import_node_http_handler3.streamCollector,
     useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config38.loadConfig(import_config38.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
     useFipsEndpoint: config?.useFipsEndpoint ?? import_config38.loadConfig(import_config38.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    userAgentAppId: config?.userAgentAppId ?? import_config38.loadConfig(import_client30.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    userAgentAppId: config?.userAgentAppId ?? import_config38.loadConfig(import_client31.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
   };
 };
 
 // ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeExtensions.js
-var import_client32 = __toESM(require_client2(), 1);
-var import_client33 = __toESM(require_client(), 1);
+var import_client33 = __toESM(require_client2(), 1);
+var import_client34 = __toESM(require_client(), 1);
 var import_protocols9 = __toESM(require_protocols(), 1);
 
 // ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/auth/httpAuthExtensionConfiguration.js
@@ -51005,34 +51048,34 @@ var resolveHttpAuthRuntimeConfig3 = (config) => {
 
 // ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeExtensions.js
 var resolveRuntimeExtensions3 = (runtimeConfig, extensions) => {
-  const extensionConfiguration = Object.assign(import_client32.getAwsRegionExtensionConfiguration(runtimeConfig), import_client33.getDefaultExtensionConfiguration(runtimeConfig), import_protocols9.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration3(runtimeConfig));
+  const extensionConfiguration = Object.assign(import_client33.getAwsRegionExtensionConfiguration(runtimeConfig), import_client34.getDefaultExtensionConfiguration(runtimeConfig), import_protocols9.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration3(runtimeConfig));
   extensions.forEach((extension) => extension.configure(extensionConfiguration));
-  return Object.assign(runtimeConfig, import_client32.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client33.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols9.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig3(extensionConfiguration));
+  return Object.assign(runtimeConfig, import_client33.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client34.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols9.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig3(extensionConfiguration));
 };
 
 // ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
-class ECSClient extends import_client35.Client {
+class ECSClient extends import_client36.Client {
   config;
   constructor(...[configuration]) {
     const _config_0 = getRuntimeConfig5(configuration || {});
     super(_config_0);
     this.initConfig = _config_0;
     const _config_1 = resolveClientEndpointParameters3(_config_0);
-    const _config_2 = import_client34.resolveUserAgentConfig(_config_1);
+    const _config_2 = import_client35.resolveUserAgentConfig(_config_1);
     const _config_3 = import_retry6.resolveRetryConfig(_config_2);
     const _config_4 = import_config39.resolveRegionConfig(_config_3);
-    const _config_5 = import_client34.resolveHostHeaderConfig(_config_4);
+    const _config_5 = import_client35.resolveHostHeaderConfig(_config_4);
     const _config_6 = import_endpoints8.resolveEndpointConfig(_config_5);
     const _config_7 = resolveHttpAuthSchemeConfig3(_config_6);
     const _config_8 = resolveRuntimeExtensions3(_config_7, configuration?.extensions || []);
     this.config = _config_8;
     this.middlewareStack.use(import_schema4.getSchemaSerdePlugin(this.config));
-    this.middlewareStack.use(import_client34.getUserAgentPlugin(this.config));
+    this.middlewareStack.use(import_client35.getUserAgentPlugin(this.config));
     this.middlewareStack.use(import_retry6.getRetryPlugin(this.config));
     this.middlewareStack.use(import_protocols10.getContentLengthPlugin(this.config));
-    this.middlewareStack.use(import_client34.getHostHeaderPlugin(this.config));
-    this.middlewareStack.use(import_client34.getLoggerPlugin(this.config));
-    this.middlewareStack.use(import_client34.getRecursionDetectionPlugin(this.config));
+    this.middlewareStack.use(import_client35.getHostHeaderPlugin(this.config));
+    this.middlewareStack.use(import_client35.getLoggerPlugin(this.config));
+    this.middlewareStack.use(import_client35.getRecursionDetectionPlugin(this.config));
     this.middlewareStack.use(import_core2.getHttpAuthSchemeEndpointRuleSetPlugin(this.config, {
       httpAuthSchemeParametersProvider: defaultECSHttpAuthSchemeParametersProvider,
       identityProviderConfigProvider: async (config) => new import_core2.DefaultIdentityProviderConfig({
@@ -51047,9 +51090,9 @@ class ECSClient extends import_client35.Client {
 }
 
 // ../../node_modules/.bun/@aws-sdk+client-ecs@3.1126.0/node_modules/@aws-sdk/client-ecs/dist-es/commandBuilder.js
-var import_client36 = __toESM(require_client(), 1);
+var import_client37 = __toESM(require_client(), 1);
 var import_endpoints9 = __toESM(require_endpoints(), 1);
-var command3 = import_client36.makeBuilder(commonParams3, "AmazonEC2ContainerServiceV20141113", "ECSClient", import_endpoints9.getEndpointPlugin);
+var command3 = import_client37.makeBuilder(commonParams3, "AmazonEC2ContainerServiceV20141113", "ECSClient", import_endpoints9.getEndpointPlugin);
 var _ep03 = {};
 var _mw03 = (Command, cs, config, o2) => [];
 
@@ -51603,6 +51646,733 @@ function createOfflineGate(options) {
     }
   };
 }
+// src/lib/auth-store.ts
+function getApiUrl(action, env = process.env, options = {}) {
+  return requireSkillsApiOrigin(action, env, options);
+}
+
+// src/lib/remote-account.ts
+class RemoteCreditApprovalError extends Error {
+  requiredCredits;
+  maximumCredits;
+  code = "CREDIT_APPROVAL_REQUIRED";
+  constructor(requiredCredits, maximumCredits) {
+    super(`This run requires ${requiredCredits} credits; the approved maximum is ${maximumCredits}. Quote the run and explicitly approve its cost.`);
+    this.requiredCredits = requiredCredits;
+    this.maximumCredits = maximumCredits;
+    this.name = "RemoteCreditApprovalError";
+  }
+}
+function creditCount(value) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0 || value > 2147483647) {
+    throw new Error("The Skills server returned an invalid credit count");
+  }
+  return value;
+}
+function parseRemoteRunQuote(value) {
+  const quote = object(value);
+  const pricing = object(quote.pricing);
+  if (typeof quote.skill !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(quote.skill))
+    throw new Error("Invalid quoted skill");
+  const costCents = creditCount(pricing.costCredits ?? pricing.costCents);
+  if (pricing.costCredits !== undefined && pricing.costCents !== undefined && pricing.costCents !== costCents)
+    throw new Error("Inconsistent quoted credit count");
+  if (quote.availability && object(quote.availability).status !== "available")
+    throw new Error("This skill is unavailable for remote execution");
+  return { ...quote, skill: quote.skill, pricing: { ...pricing, costCredits: costCents, costCents, formattedCost: `${costCents} credits` } };
+}
+function parseRemoteCreditPacks(value) {
+  if (!Array.isArray(value))
+    throw new Error("Invalid credit pack response");
+  const ids = new Set;
+  return value.map((value2) => {
+    const row = object(value2);
+    const counts = [row.credits, row.creditsCents, row.amountCents].filter((value3) => value3 !== undefined).map(creditCount);
+    if (!counts.length || counts[0] === 0 || counts.some((count) => count !== counts[0]))
+      throw new Error("Inconsistent credit pack counts");
+    const credits = counts[0];
+    const id = row.id ?? `credits_${credits}`;
+    if (typeof id !== "string" || !/^[a-z0-9][a-z0-9_-]{0,99}$/.test(id) || ids.has(id))
+      throw new Error("Invalid credit pack ID");
+    if (id.startsWith("credits_") && id !== `credits_${credits}`)
+      throw new Error("Inconsistent credit pack ID");
+    ids.add(id);
+    return { id, credits, ...row.expiresInDays === undefined ? {} : { expiresInDays: creditCount(row.expiresInDays) } };
+  });
+}
+function parseRemoteBillingStatus(value) {
+  const row = object(value);
+  const counts = [row.creditBalance, row.balanceCents].filter((value2) => value2 !== undefined).map(creditCount);
+  if (!counts.length || counts.some((count) => count !== counts[0]))
+    throw new Error("Inconsistent credit balance");
+  return {
+    creditBalance: counts[0],
+    formattedCreditBalance: `${counts[0]} credits`,
+    ...typeof row.plan === "string" ? { plan: row.plan } : {},
+    ...typeof row.hasPaymentMethod === "boolean" ? { hasPaymentMethod: row.hasPaymentMethod } : {}
+  };
+}
+function parseRemoteCheckout(value) {
+  const row = object(value);
+  if (typeof row.url !== "string")
+    throw new Error("Invalid checkout URL");
+  const url = new URL(row.url);
+  if (url.protocol !== "https:" || url.username || url.password)
+    throw new Error("Invalid checkout URL");
+  return { url: row.url };
+}
+function object(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Invalid Skills server response");
+  return value;
+}
+
+// src/lib/remote-files.ts
+import { createHash as createHash12 } from "crypto";
+var MAX_REMOTE_FILE_BYTES = 64 * 1024 * 1024;
+function describeRemoteFiles(files) {
+  if (files.length > 10)
+    throw new Error("At most 10 input files are supported");
+  const names = new Set;
+  let total = 0;
+  return files.map((file) => {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(file.name) || file.name === "." || file.name === ".." || names.has(file.name))
+      throw new Error("Input file names must be unique safe basenames");
+    names.add(file.name);
+    total += file.bytes.byteLength;
+    if (file.bytes.byteLength > 20 * 1024 * 1024 || total > 50 * 1024 * 1024)
+      throw new Error("Input files exceed the supported size limit");
+    return { name: file.name, sizeBytes: file.bytes.byteLength, sha256: sha256(file.bytes), contentType: file.contentType ?? "application/octet-stream" };
+  });
+}
+function sha256(bytes) {
+  return createHash12("sha256").update(bytes).digest("hex");
+}
+async function readBoundedResponse(response, maximum) {
+  if (!Number.isSafeInteger(maximum) || maximum < 0 || maximum > MAX_REMOTE_FILE_BYTES)
+    throw new Error("Invalid artifact size limit");
+  const length = response.headers.get("content-length");
+  if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
+    await response.body?.cancel();
+    throw new Error("Artifact exceeds its declared size limit");
+  }
+  const reader = response.body?.getReader();
+  if (!reader)
+    return new Uint8Array;
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const next = await reader.read();
+      if (next.done)
+        break;
+      size += next.value.byteLength;
+      if (size > maximum)
+        throw new Error("Artifact exceeds its declared size limit");
+      chunks.push(next.value);
+    }
+  } catch (error) {
+    await reader.cancel().catch(() => {});
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}
+
+// src/lib/remote-client.ts
+class RemoteRouteUnsupportedError extends Error {
+  path;
+  status;
+  instance;
+  constructor(path, status, instance) {
+    super(`The configured Skills instance does not support ${path} (HTTP ${status}). ` + `The instance at ${instance} predates this client feature \u2014 upgrade the server, or ` + `use a client version that matches it.`);
+    this.path = path;
+    this.status = status;
+    this.instance = instance;
+    this.name = "RemoteRouteUnsupportedError";
+  }
+}
+
+class RemoteRequestError extends Error {
+  path;
+  status;
+  constructor(path, status, statusText) {
+    super(`Remote request to ${path} failed: HTTP ${status}${statusText ? ` ${statusText}` : ""}`);
+    this.path = path;
+    this.status = status;
+    this.name = "RemoteRequestError";
+  }
+}
+
+class RemoteSkillsClient {
+  apiUrl;
+  apiKey;
+  capabilities;
+  constructor(apiKey, apiUrl = getApiUrl()) {
+    this.apiKey = apiKey;
+    this.apiUrl = normalizeSkillsApiOrigin(apiUrl);
+  }
+  async request(path, options) {
+    return fetch(`${this.apiUrl}${path}`, {
+      ...options,
+      redirect: "error",
+      signal: options?.signal ?? AbortSignal.timeout(15000),
+      headers: {
+        Authorization: `Bearer ${this.apiKey}`,
+        "Content-Type": "application/json",
+        ...options?.headers
+      }
+    });
+  }
+  async requestNewRoute(path, options, opts = {}) {
+    const response = await this.request(path, options);
+    const routePath = path.split("?")[0];
+    if (response.status === 404 || response.status === 405) {
+      if (response.status === 404 && opts.domainNotFoundCodes?.length && await responseBodyCarriesCode(response, opts.domainNotFoundCodes)) {
+        return response;
+      }
+      throw new RemoteRouteUnsupportedError(routePath, response.status, this.apiUrl);
+    }
+    if (!response.ok) {
+      throw new RemoteRequestError(routePath, response.status, response.statusText);
+    }
+    return response;
+  }
+  async listSkills() {
+    return this.arrayResponse("/api/v1/skills");
+  }
+  async getSkillMd(slug) {
+    const res = await this.request(`/api/v1/skills/${slug}/skill.md`);
+    if (!res.ok)
+      return null;
+    return res.text();
+  }
+  async getSkill(slug) {
+    const res = await this.request(`/api/v1/skills/${slug}`);
+    if (!res.ok)
+      return null;
+    return res.json();
+  }
+  async getSkillStatus(slug) {
+    const res = await this.request(`/api/v1/skills/${encodeURIComponent(slug)}`, { method: "GET" });
+    let body = null;
+    try {
+      body = await res.json();
+    } catch {}
+    return { status: res.status, body };
+  }
+  async submitRun(slug, input, args, approval = {}) {
+    if (approval.idempotencyKey !== undefined && !/^[A-Za-z0-9._:-]{1,128}$/.test(approval.idempotencyKey))
+      throw new Error("Idempotency key must be 1-128 URL-safe characters");
+    if (approval.maxCostCents !== undefined)
+      creditCount(approval.maxCostCents);
+    if (approval.maxCredits !== undefined)
+      creditCount(approval.maxCredits);
+    if (approval.maxCredits !== undefined && approval.maxCostCents !== undefined && approval.maxCredits !== approval.maxCostCents)
+      throw new Error("Credit approval fields disagree");
+    const res = await this.request(`/api/v1/runs/${encodeURIComponent(slug)}`, {
+      method: "POST",
+      body: JSON.stringify({
+        input,
+        args,
+        ...approval.maxCredits !== undefined ? { maxCredits: approval.maxCredits } : {},
+        ...approval.maxCostCents !== undefined ? { maxCostCents: approval.maxCostCents } : {},
+        ...approval.idempotencyKey !== undefined ? { idempotencyKey: approval.idempotencyKey } : {},
+        ...approval.inputFiles !== undefined ? { files: approval.inputFiles } : {}
+      })
+    });
+    return normalizeRemoteSkillRunContract(await res.json(), slug);
+  }
+  async quoteRun(slug, input = {}, args = []) {
+    const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/quote`, {
+      method: "POST",
+      body: JSON.stringify({ input, args })
+    });
+    return parseRemoteRunQuote(await response.json());
+  }
+  getCapabilities() {
+    if (!this.capabilities)
+      this.capabilities = (async () => {
+        const value = await (await this.requestNewRoute("/api/v1/capabilities")).json();
+        if (value.contractVersion !== 1 || value.apiVersion !== 1 || !Array.isArray(value.capabilities) || value.capabilities.some((item) => typeof item !== "string"))
+          throw new Error("Unsupported Skills server capability contract");
+        const billing = value.billing;
+        return { contractVersion: 1, apiVersion: 1, capabilities: value.capabilities, ...billing ? { billing } : {} };
+      })();
+    return this.capabilities;
+  }
+  async submitQuotedRun(slug, input = {}, args = [], approval = {}) {
+    const maximum = creditCount(approval.maxCredits ?? approval.maxCostCents ?? 0);
+    if (approval.maxCostCents !== undefined && approval.maxCostCents !== maximum)
+      throw new Error("Credit approval fields disagree");
+    const quote = await this.quoteRun(slug, input, args);
+    if (quote.pricing.costCents > maximum)
+      throw new RemoteCreditApprovalError(quote.pricing.costCents, maximum);
+    const capabilities = await this.getCapabilities();
+    if (!capabilities.capabilities.includes("runs.submit") || capabilities.billing?.boundedRunApproval !== true || capabilities.billing.unit !== "credits") {
+      throw new Error("The configured server does not support bounded credit approval; refusing remote submission");
+    }
+    return this.submitRun(quote.skill, input, args, { ...approval, maxCredits: maximum, maxCostCents: maximum });
+  }
+  async getIdentity() {
+    return (await this.requestNewRoute("/api/auth/whoami")).json();
+  }
+  async listApiKeys() {
+    return this.arrayResponse("/api/auth/keys");
+  }
+  async createApiKey(name, scopes) {
+    if (!name.trim() || name.length > 100)
+      throw new Error("API key name must be 1-100 characters");
+    const value = await (await this.requestNewRoute("/api/auth/keys", { method: "POST", body: JSON.stringify({ name, ...scopes ? { scopes } : {} }) })).json();
+    if (!value || typeof value.key !== "string" || !value.key.trim())
+      throw new Error("The server did not return a created API key");
+    return value;
+  }
+  async revokeApiKey(keyId) {
+    return (await this.requestNewRoute(`/api/auth/keys/${encodeURIComponent(keyId)}`, { method: "DELETE" })).json();
+  }
+  async getBillingStatus() {
+    return parseRemoteBillingStatus(await (await this.requestNewRoute("/api/v1/billing/status")).json());
+  }
+  async listCreditPacks() {
+    return parseRemoteCreditPacks(await (await this.requestNewRoute("/api/v1/billing/credits")).json());
+  }
+  async createCreditCheckout(packId) {
+    const packs = await this.listCreditPacks();
+    if (!packs.some((pack) => pack.id === packId))
+      throw new Error("Choose a credit pack returned by skills credits packs");
+    return parseRemoteCheckout(await (await this.requestNewRoute("/api/v1/billing/credits", {
+      method: "POST",
+      body: JSON.stringify({ packId })
+    })).json());
+  }
+  async getUsage() {
+    return this.arrayResponse("/api/v1/billing/usage");
+  }
+  async listInvoices() {
+    return this.arrayResponse("/api/v1/billing/invoices");
+  }
+  async createBillingCheckout() {
+    return this.checkoutResponse("/api/v1/billing/checkout");
+  }
+  async createBillingPortal() {
+    return this.checkoutResponse("/api/v1/billing/portal");
+  }
+  async cancelRun(runId2) {
+    return this.controlRun(runId2, "cancel");
+  }
+  async resumeRun(runId2) {
+    return this.controlRun(runId2, "resume");
+  }
+  async controlRun(runId2, action) {
+    const response = await this.requestNewRoute(`/api/v1/runs/${encodeURIComponent(runId2)}/${action}`, { method: "POST", body: "{}" });
+    return normalizeRemoteSkillRunContract(await response.json());
+  }
+  async checkoutResponse(path) {
+    return parseRemoteCheckout(await (await this.requestNewRoute(path, { method: "POST", body: "{}" })).json());
+  }
+  async arrayResponse(path) {
+    const rows = await (await this.requestNewRoute(path)).json();
+    if (!Array.isArray(rows) || rows.some((row) => !row || typeof row !== "object" || Array.isArray(row)))
+      throw new Error("Invalid Skills server list response");
+    return rows;
+  }
+  async getRun(runId2) {
+    const path = `/api/v1/runs/${encodeURIComponent(runId2)}`;
+    const res = await this.request(path);
+    if (res.status === 404)
+      return null;
+    if (!res.ok)
+      throw new RemoteRequestError(path, res.status, res.statusText);
+    return normalizeRemoteSkillRunContract(await res.json());
+  }
+  async getRunLogs(runId2) {
+    return this.arrayResponse(`/api/v1/runs/${encodeURIComponent(runId2)}/logs`);
+  }
+  async listRuns(limit = 20) {
+    if (!Number.isInteger(limit) || limit < 1 || limit > 100)
+      throw new Error("Run limit must be an integer from 1 to 100");
+    return this.arrayResponse(`/api/v1/runs?limit=${limit}`);
+  }
+  async getRunArtifacts(runId2) {
+    return this.arrayResponse(`/api/v1/runs/${encodeURIComponent(runId2)}/artifacts`);
+  }
+  async downloadRunArtifact(runId2, artifactId2) {
+    return this.request(`/api/v1/runs/${encodeURIComponent(runId2)}/artifacts/${encodeURIComponent(artifactId2)}/download`, {
+      method: "GET"
+    });
+  }
+  async getVerifiedRunArtifact(runId2, artifactId2, maximumBytes = MAX_REMOTE_FILE_BYTES) {
+    const artifacts = await this.getRunArtifacts(runId2);
+    const artifact = artifacts.find((row) => row.id === artifactId2);
+    if (!artifact)
+      throw new Error("Run artifact not found");
+    if (!Number.isSafeInteger(artifact.byteSize) || artifact.byteSize < 0 || artifact.byteSize > maximumBytes || typeof artifact.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(artifact.sha256))
+      throw new Error("The server does not provide valid artifact integrity metadata");
+    const response = await this.downloadRunArtifact(runId2, artifactId2);
+    if (!response.ok)
+      throw new RemoteRequestError("artifact download", response.status, response.statusText);
+    const bytes = await readBoundedResponse(response, artifact.byteSize);
+    if (bytes.byteLength !== artifact.byteSize || sha256(bytes) !== artifact.sha256)
+      throw new Error("Artifact integrity verification failed");
+    return { id: artifactId2, fileName: String(artifact.fileName ?? artifactId2), bytes, byteSize: bytes.byteLength, sha256: artifact.sha256 };
+  }
+  async submitQuotedRunWithFiles(slug, input, args, files, approval = {}) {
+    const inputFiles = describeRemoteFiles(files);
+    if (files.length && !(await this.getCapabilities()).capabilities.includes("runs.uploads"))
+      throw new Error("The configured server does not support input uploads");
+    const run = await this.submitQuotedRun(slug, input, args, { ...approval, inputFiles });
+    if (run.error || !run.id || !files.length)
+      return run;
+    const pastUploads = (status) => typeof status === "string" && [
+      "running",
+      "completed",
+      "failed",
+      "cancelled",
+      "expired",
+      "pending_approval",
+      "approved",
+      "waiting"
+    ].includes(status);
+    if (pastUploads(run.status))
+      return run;
+    try {
+      await this.uploadRunFiles(run.id, files);
+    } catch {
+      try {
+        const current = await this.getRun(run.id);
+        if (current && pastUploads(current.status))
+          return current;
+      } catch {}
+      let cancellationRequested = false;
+      try {
+        await this.cancelRun(run.id);
+        cancellationRequested = true;
+      } catch {}
+      throw new Error(`Input upload failed for run ${run.id}; ${cancellationRequested ? "cancellation requested" : "check its status and cancel the run"}`);
+    }
+    return run;
+  }
+  async uploadRunFiles(runId2, files) {
+    const descriptors = describeRemoteFiles(files);
+    const response = await this.requestNewRoute(`/api/v1/runs/${encodeURIComponent(runId2)}/uploads`, { method: "POST", body: JSON.stringify({ files: descriptors }) });
+    const payload = await response.json();
+    if (!Array.isArray(payload.files) || payload.files.length !== files.length || new Set(payload.files.map((file) => file.name)).size !== files.length)
+      throw new Error("Invalid input upload response");
+    for (const file of files) {
+      const upload = payload.files.find((row) => row.name === file.name);
+      if (!upload)
+        throw new Error("Missing input upload URL");
+      const url = new URL(upload.uploadUrl);
+      if (url.username || url.password || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+        throw new Error("Unsafe input upload URL");
+      const uploaded = await fetch(url, { method: "PUT", body: file.bytes, headers: { "Content-Type": file.contentType ?? "application/octet-stream" }, redirect: "error", signal: AbortSignal.timeout(60000) });
+      if (!uploaded.ok)
+        throw new Error("Input upload failed");
+      await uploaded.body?.cancel();
+    }
+  }
+  async publishSkill(manifest, bundle, ifMatch) {
+    const form = new FormData;
+    form.set("manifest", JSON.stringify(manifest));
+    if (bundle) {
+      form.set("bundle", new Blob([bundle], { type: "application/gzip" }), `${String(manifest.slug ?? "skill")}.tar.gz`);
+    }
+    const headers = { Authorization: `Bearer ${this.apiKey}` };
+    if (ifMatch)
+      headers["If-Match"] = ifMatch;
+    return fetch(`${this.apiUrl}/api/v1/skills`, {
+      method: "POST",
+      headers,
+      body: form,
+      redirect: "error",
+      signal: AbortSignal.timeout(15000)
+    });
+  }
+  async deleteSkill(slug) {
+    return this.request(`/api/v1/skills/${encodeURIComponent(slug)}`, { method: "DELETE" });
+  }
+  async downloadSkillBundle(slug) {
+    return this.request(`/api/v1/skills/${encodeURIComponent(slug)}/bundle`, { method: "GET" });
+  }
+  async getBundle(slug, version2) {
+    const path = version2 ? `/api/v1/skills/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version2)}/bundle` : `/api/v1/skills/${encodeURIComponent(slug)}/bundle`;
+    const response = await this.request(path, { method: "GET" });
+    if (response.status === 404)
+      return null;
+    return response;
+  }
+  async listSkillVersions(slug) {
+    const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/versions`, undefined, { domainNotFoundCodes: ["SKILL_NOT_FOUND"] });
+    if (response.status === 404)
+      return [];
+    if (!response.ok)
+      throw new Error(`versions request failed: ${response.status}`);
+    const body = await response.json();
+    return Array.isArray(body.versions) ? body.versions : [];
+  }
+  async getSkillVersion(slug, version2) {
+    const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version2)}`, undefined, { domainNotFoundCodes: ["SKILL_NOT_FOUND", "SKILL_VERSION_NOT_FOUND"] });
+    if (response.status === 404)
+      return null;
+    if (!response.ok)
+      throw new Error(`version request failed: ${response.status}`);
+    return await response.json();
+  }
+  async listPins() {
+    const response = await this.requestNewRoute("/api/v1/pins");
+    return normalizePinList(await response.json());
+  }
+  async pin(slug, metadata) {
+    const path = `/api/v1/pins/${encodeURIComponent(slug)}`;
+    const response = await this.requestNewRoute(path, {
+      method: "PUT",
+      body: JSON.stringify({ ...metadata ? { metadata } : {} })
+    });
+    return normalizePin(await response.json());
+  }
+  async unpin(slug) {
+    const path = `/api/v1/pins/${encodeURIComponent(slug)}`;
+    const response = await this.requestNewRoute(path, { method: "DELETE" }, { domainNotFoundCodes: ["PIN_NOT_FOUND"] });
+    return response.status !== 404;
+  }
+  async listTags() {
+    const response = await this.requestNewRoute("/api/v1/tags");
+    const payload = await response.json();
+    if (!Array.isArray(payload)) {
+      throw new Error("Remote tags payload did not match the expected contract (expected an array of tag names)");
+    }
+    const isName = (value) => typeof value === "string" && value.trim().length > 0;
+    if (payload.every(isName))
+      return payload;
+    if (payload.every((tag) => tag !== null && typeof tag === "object" && !Array.isArray(tag) && isName(tag.name) && Number.isSafeInteger(tag.count) && tag.count >= 0)) {
+      return payload.map((tag) => tag.name);
+    }
+    throw new Error("Remote tags payload did not match the expected contract (every element must be a non-empty tag name, or every element must be a counted tag record)");
+  }
+  async skillsByTag(tag) {
+    const path = `/api/v1/tags/${encodeURIComponent(tag)}/skills`;
+    const response = await this.requestNewRoute(path);
+    return normalizeSkillSummaryList(await response.json());
+  }
+  async listUpdatedSince(since, options = {}) {
+    const params = new URLSearchParams({ since });
+    if (options.cursor)
+      params.set("cursor", options.cursor);
+    if (options.limit !== undefined)
+      params.set("limit", String(options.limit));
+    const response = await this.requestNewRoute(`/api/v1/skills/updated?${params.toString()}`);
+    return normalizeUpdatedSincePage(await response.json());
+  }
+}
+function requireOptionalString(record, field) {
+  if (record[field] === undefined)
+    return;
+  if (typeof record[field] !== "string") {
+    throw new Error(`Remote payload did not match the expected contract (${field} must be a string when present)`);
+  }
+  return record[field];
+}
+function normalizePin(entry) {
+  if (!entry || typeof entry !== "object") {
+    throw new Error("Remote pin payload did not match the expected contract (expected an object)");
+  }
+  const record = entry;
+  const slug = typeof record.slug === "string" && record.slug.trim() ? record.slug.trim() : undefined;
+  if (!slug) {
+    throw new Error("Remote pin payload did not match the expected contract (missing slug)");
+  }
+  let metadata;
+  if (record.metadata !== undefined) {
+    if (!record.metadata || typeof record.metadata !== "object" || Array.isArray(record.metadata)) {
+      throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
+    }
+    metadata = record.metadata;
+  }
+  const pinnedAt = requireOptionalString(record, "pinnedAt");
+  return {
+    slug,
+    ...pinnedAt !== undefined ? { pinnedAt } : {},
+    ...metadata ? { metadata } : {}
+  };
+}
+function normalizePinList(payload) {
+  if (!Array.isArray(payload)) {
+    throw new Error("Remote pins payload did not match the expected contract (expected an array of pins)");
+  }
+  return payload.map(normalizePin);
+}
+function normalizeSkillSummary(entry) {
+  if (!entry || typeof entry !== "object") {
+    throw new Error("Remote skill payload did not match the expected contract (expected an object)");
+  }
+  const record = entry;
+  const slug = typeof record.slug === "string" && record.slug.trim() ? record.slug.trim() : undefined;
+  if (!slug) {
+    throw new Error("Remote skill payload did not match the expected contract (missing slug)");
+  }
+  return {
+    slug,
+    ...requireOptionalString(record, "name") !== undefined ? { name: requireOptionalString(record, "name") } : {},
+    ...requireOptionalString(record, "version") !== undefined ? { version: requireOptionalString(record, "version") } : {},
+    ...requireOptionalString(record, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record, "updatedAt") } : {}
+  };
+}
+function normalizeSkillSummaryList(payload) {
+  if (!Array.isArray(payload)) {
+    throw new Error("Remote skills payload did not match the expected contract (expected an array of skills)");
+  }
+  return payload.map(normalizeSkillSummary);
+}
+async function responseBodyCarriesCode(response, codes) {
+  try {
+    const payload = await response.clone().json();
+    if (!payload || typeof payload !== "object")
+      return false;
+    const code = payload.code;
+    return typeof code === "string" && codes.includes(code);
+  } catch {
+    return false;
+  }
+}
+function normalizeUpdatedSincePage(payload) {
+  if (!payload || typeof payload !== "object") {
+    throw new Error("Updated-since payload did not match the expected contract (expected an object)");
+  }
+  const record = payload;
+  if (!Array.isArray(record.skills)) {
+    throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
+  }
+  const skills = record.skills.map(normalizeSkillSummary);
+  const nextCursor = record.nextCursor === undefined || record.nextCursor === null ? null : record.nextCursor;
+  if (nextCursor !== null && typeof nextCursor !== "string") {
+    throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
+  }
+  return { skills, nextCursor };
+}
+async function createRemoteSkillsClient(env = process.env) {
+  const connection = await resolveSkillsConnection(env);
+  return connection ? new RemoteSkillsClient(connection.apiKey, connection.apiOrigin) : null;
+}
+// src/lib/remote-auth.ts
+var MAX_ERROR_DETAIL_LENGTH = 200;
+
+class HostedApiError extends Error {
+  status;
+  code;
+  detail;
+  endpoint;
+  apiUrl;
+  constructor(message, options = {}) {
+    super(message);
+    this.name = "HostedApiError";
+    this.status = options.status;
+    this.code = options.code;
+    this.detail = options.detail;
+    this.endpoint = options.endpoint;
+    this.apiUrl = options.apiUrl;
+  }
+}
+async function requestAuthApi(instance, path, options) {
+  const url = normalizeSkillsApiOrigin(instance);
+  const safeUrl = url;
+  const endpoint = `${(options?.method || "GET").toUpperCase()} ${safeUrl}${path}`;
+  let res;
+  try {
+    res = await fetch(`${url}${path}`, {
+      ...options,
+      redirect: "error",
+      signal: options?.signal ?? AbortSignal.timeout(15000),
+      headers: { "Content-Type": "application/json", ...options?.headers }
+    });
+  } catch (err) {
+    throw new HostedApiError(`Unable to reach the Skills API: ${err.message}`, {
+      endpoint,
+      apiUrl: safeUrl
+    });
+  }
+  const text = await res.text();
+  const body = text ? parseJsonBody(text) : {};
+  if (!res.ok) {
+    const record = isRecord5(body) ? body : {};
+    const detail = typeof record.detail === "string" ? record.detail : undefined;
+    const error = typeof record.error === "string" ? record.error : undefined;
+    const code = typeof record.code === "string" ? record.code : undefined;
+    throw new HostedApiError(detail || error || `${res.status} ${res.statusText}`, {
+      status: res.status,
+      code,
+      detail,
+      endpoint,
+      apiUrl: safeUrl
+    });
+  }
+  return body;
+}
+function parseJsonBody(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { detail: condenseErrorBody(text) };
+  }
+}
+function condenseErrorBody(text) {
+  const stripped = /<[a-z!/]/i.test(text) ? text.replace(/<(script|style)[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]*>/g, " ") : text;
+  const collapsed = stripped.replace(/\s+/g, " ").trim();
+  if (collapsed.length <= MAX_ERROR_DETAIL_LENGTH)
+    return collapsed;
+  return `${collapsed.slice(0, MAX_ERROR_DETAIL_LENGTH - 1).trimEnd()}\u2026`;
+}
+function isRecord5(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+
+class RemoteSkillsAuthClient {
+  apiOrigin;
+  constructor(apiUrl) {
+    this.apiOrigin = normalizeSkillsApiOrigin(apiUrl);
+  }
+  requestCode(email) {
+    return this.request("/api/auth/login", { method: "POST", body: JSON.stringify({ email }) });
+  }
+  verifyCode(email, code) {
+    return this.request("/api/auth/verify", { method: "POST", body: JSON.stringify({ email, code }) });
+  }
+  startDevice() {
+    return this.request("/api/auth/device/start", { method: "POST", body: JSON.stringify({ client: "skills-sdk" }) });
+  }
+  pollDevice(deviceCode) {
+    return this.request("/api/auth/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) });
+  }
+  async sessionClient(email, code) {
+    if (!email.includes("@") || !/^\d{6}$/.test(code))
+      throw new Error("Fresh email and six-digit verification code are required to manage API keys");
+    const login = await this.verifyCode(email, code);
+    if (!login || typeof login.token !== "string" || !login.token)
+      throw new Error("The server did not return an authorized account session");
+    return new RemoteSkillsClient(login.token, this.apiOrigin);
+  }
+  async createApiKey(email, code, name, scopes) {
+    return (await this.sessionClient(email, code)).createApiKey(name, scopes);
+  }
+  async listApiKeys(email, code) {
+    return (await this.sessionClient(email, code)).listApiKeys();
+  }
+  async revokeApiKey(email, code, keyId) {
+    return (await this.sessionClient(email, code)).revokeApiKey(keyId);
+  }
+  request(path, options) {
+    if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
+      throw new Error("Unsupported authentication operation");
+    return requestAuthApi(this.apiOrigin, path, options);
+  }
+}
 export {
   validateRunLifecycleEvent,
   startedByFor,
@@ -51656,6 +52426,7 @@ export {
   createRunStateMachine,
   createRunService,
   createRunEventEmitter,
+  createRemoteSkillsClient,
   createReceiptService,
   createOfflineGate,
   createImageProfileRegistry,
@@ -51680,6 +52451,11 @@ export {
   SKILLS_APP,
   SKILLS_API_URL_ENV,
   SKILLS_API_KEY_ENV,
+  RemoteSkillsClient,
+  RemoteSkillsAuthClient,
+  RemoteRouteUnsupportedError,
+  RemoteRequestError,
+  RemoteCreditApprovalError,
   RUN_PROTOCOL_VERSION,
   RUN_PROTOCOL_STATES,
   RUN_LIFECYCLE_EVENT_TYPES,
@@ -51693,6 +52469,7 @@ export {
   MemoryGovernanceStore,
   LEGAL_TRANSITIONS,
   ImageProfileResolutionError,
+  HostedApiError,
   GovernanceError,
   GOVERNANCE_ERROR_CODES,
   EcsDispatcher,