@hasna/skills 0.4.0 → 0.5.0

package/bin/mcp.js

@@ -6932,58 +6932,14 @@ var require_dist = __commonJS((exports, module) => {
   exports.default = formatsPlugin;
 });
 
-// src/lib/remote-run-contract.ts
-function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
-  const record3 = isRecord3(payload) ? payload : {};
-  return {
-    contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
-    ...pickString(record3, "id"),
-    skill: pickStringValue(record3, "skill") ?? fallbackSkill,
-    ...pickString(record3, "requestedSlug"),
-    ...pickString(record3, "status"),
-    ...pickNumber(record3, "exitCode"),
-    ...pickString(record3, "correlationId"),
-    ...pickString(record3, "createdAt"),
-    ...pickString(record3, "startedAt"),
-    ...pickString(record3, "completedAt"),
-    ...pickNumber(record3, "durationMs"),
-    ...pickString(record3, "outputType"),
-    ...hasOwn(record3, "outputPreview") ? { outputPreview: record3.outputPreview } : {},
-    ...pickString(record3, "errorCode"),
-    ...pickString(record3, "errorMessage"),
-    ...pickString(record3, "error"),
-    ...pickString(record3, "code"),
-    ...hasOwn(record3, "details") ? { details: record3.details } : {}
-  };
-}
-function isRecord3(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function hasOwn(record3, key) {
-  return Object.prototype.hasOwnProperty.call(record3, key);
-}
-function pickString(record3, key) {
-  const value = pickStringValue(record3, key);
-  return value === undefined ? {} : { [key]: value };
-}
-function pickStringValue(record3, key) {
-  const value = record3[key];
-  return typeof value === "string" ? value : undefined;
-}
-function pickNumber(record3, key) {
-  const value = record3[key];
-  return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
-}
-var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
-
 // ../contracts/dist/client/transport.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
-import { closeSync, fstatSync, openSync, readFileSync as readFileSync11 } from "fs";
+import { closeSync, fstatSync, openSync, readFileSync as readFileSync7 } from "fs";
 import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
 import { createRequire } from "module";
 import { hostname as osHostname } from "os";
-import { isAbsolute as isAbsolute3, join as join13 } from "path";
+import { isAbsolute as isAbsolute3, join as join9 } from "path";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
 }
@@ -7013,14 +6969,14 @@ function hasnaHomeDir(env) {
   if (override)
     return override;
   const home = homeDir(env);
-  return home ? join13(home, HASNA_HOME_DIR) : null;
+  return home ? join9(home, HASNA_HOME_DIR) : null;
 }
 function appConfigDir(name, env) {
   const configRoot = absoluteOverride(env, HASNA_CONFIG_HOME_ENV_KEY);
   if (configRoot)
-    return join13(configRoot, name);
+    return join9(configRoot, name);
   const root = hasnaHomeDir(env);
-  return root ? join13(root, name, CONFIG_SUBDIR) : null;
+  return root ? join9(root, name, CONFIG_SUBDIR) : null;
 }
 function credentialDiskSourceList(name, env, profile = null) {
   if (!SAFE_APP_SLUG.test(name))
@@ -7029,7 +6985,7 @@ function credentialDiskSourceList(name, env, profile = null) {
   if (!directory)
     return [];
   const file = profile ? `${CREDENTIALS_FILE}-${profile}` : CREDENTIALS_FILE;
-  return [{ path: join13(directory, file), tier: "disk" }];
+  return [{ path: join9(directory, file), tier: "disk" }];
 }
 function credentialDiskSources(name, env) {
   return credentialDiskSourceList(name, env, null).map((s) => s.path);
@@ -7104,7 +7060,7 @@ function readAppConfigFile(path) {
       unsafe("the file is not owned by the current user");
     if (before.size > MAX_CREDENTIAL_FILE_BYTES)
       unsafe("the file exceeds the size limit");
-    const bytes = readFileSync11(fd);
+    const bytes = readFileSync7(fd);
     const after = fstatSync(fd);
     if (!configFileReadsCoherent(before, after)) {
       unsafe("the file changed while being read");
@@ -7742,12 +7698,39 @@ var init_instance_credentials = __esm(() => {
   init_transport();
 });
 
+// src/lib/local-opt-in.ts
+function isSkillsLocalOptIn(env = process.env) {
+  return SKILLS_LOCAL_OPT_IN_ENV_KEYS.some((key) => (env[key] ?? "").trim() !== "");
+}
+function skillsAuthorityEnvKeys() {
+  const keys = clientTransportEnvKeys("skills");
+  return [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey("skills"),
+    credentialPointerEnvKey("skills"),
+    CREDENTIAL_PROFILE_ENV_KEY
+  ];
+}
+function hasSkillsEnvAuthorityIntent(env = process.env) {
+  return skillsAuthorityEnvKeys().some((key) => (env[key] ?? "").trim() !== "");
+}
+function selectsSkillsLocalMode(env = process.env) {
+  return !hasSkillsEnvAuthorityIntent(env) && isSkillsLocalOptIn(env);
+}
+var SKILLS_LOCAL_OPT_IN_ENV_KEYS;
+var init_local_opt_in = __esm(() => {
+  init_transport();
+  SKILLS_LOCAL_OPT_IN_ENV_KEYS = ["HASNA_SKILLS_LOCAL", "SKILLS_LOCAL"];
+});
+
 // src/lib/fleet-credentials.ts
 var exports_fleet_credentials = {};
 __export(exports_fleet_credentials, {
   skillsCredentialOrReason: () => skillsCredentialOrReason,
   skillsCredentialFiles: () => skillsCredentialFiles,
   skillsCredentialFilePath: () => skillsCredentialFilePath,
+  selectsSkillsLocalMode: () => selectsSkillsLocalMode,
   resolveSkillsFleet: () => resolveSkillsFleet,
   resolveSkillsConnection: () => resolveSkillsConnection,
   resolveSkillsApiOrigin: () => resolveSkillsApiOrigin,
@@ -7758,8 +7741,11 @@ __export(exports_fleet_credentials, {
   requireSkillsApiKey: () => requireSkillsApiKey,
   noticeLocalSkillsMode: () => noticeLocalSkillsMode,
   normalizeSkillsApiOrigin: () => normalizeSkillsApiOrigin,
+  isSkillsLocalOptIn: () => isSkillsLocalOptIn,
+  isSkillsFleetCredentialError: () => isSkillsFleetCredentialError,
   configuredSkillsApiUrl: () => configuredSkillsApiUrl,
   SkillsFleetCredentialError: () => SkillsFleetCredentialError,
+  SKILLS_LOCAL_OPT_IN_ENV_KEYS: () => SKILLS_LOCAL_OPT_IN_ENV_KEYS,
   SKILLS_APP: () => SKILLS_APP,
   SKILLS_API_URL_ENV_KEYS: () => SKILLS_API_URL_ENV_KEYS,
   SKILLS_API_URL_ENV: () => SKILLS_API_URL_ENV,
@@ -7770,6 +7756,9 @@ __export(exports_fleet_credentials, {
 function isCredentialResolutionError(error2) {
   return error2 instanceof CredentialResolutionError || typeof error2 === "object" && error2 !== null && error2.name === "CredentialResolutionError";
 }
+function isSkillsFleetCredentialError(error2) {
+  return error2 instanceof SkillsFleetCredentialError || typeof error2 === "object" && error2 !== null && error2.name === "SkillsFleetCredentialError";
+}
 function asSkillsFleetCredentialError(error2) {
   if (!isCredentialResolutionError(error2))
     return null;
@@ -7835,7 +7824,7 @@ function noticeLocalSkillsMode(write = (line) => console.error(line)) {
   if (localNoticePrinted)
     return;
   localNoticePrinted = true;
-  write(`skills: local mode \u2014 no ${SKILLS_API_KEY_ENV} and no ${SKILLS_API_URL_ENV} resolved, ` + `so this runs on this machine against the bundled corpus. ` + `Sign in with: skills auth login`);
+  write(`skills: local mode (${SKILLS_LOCAL_OPT_IN_ENV_KEYS[0]}=1) \u2014 running on this machine against the bundled corpus.`);
 }
 function resetLocalSkillsModeNotice() {
   localNoticePrinted = false;
@@ -7875,13 +7864,16 @@ function snapshotSkillsOptions(env, options) {
   } } };
 }
 function resolveSkillsFleetOrThrow(env, options) {
+  if (selectsSkillsLocalMode(env))
+    return { mode: "local", apiOrigin: null, apiKey: null };
   const assertFilesUnchanged = captureSkillsCredentialFiles(skillsProfileCredentialFiles(env, options.credentials?.profile));
   const configured = configuredSkillsApiUrl(env, options.credentials?.keychain, options.credentials?.profile);
   const credential = resolveCredential(SKILLS_APP, env, options.credentials);
   if (!credential) {
-    if (!configured)
-      return { mode: "local", apiOrigin: null, apiKey: null };
-    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in hasna.credentials.skills.api-key, ${skillsCredentialFiles(env).join(" or ") || "no credentials file"}, and ${SKILLS_API_KEY_ENV}. Sign in with: skills auth login`);
+    if (!configured) {
+      throw new SkillsFleetCredentialError(`No API key resolved and no Skills API URL is configured \u2014 failing closed ` + `(local mode is opt-in only: set ${SKILLS_LOCAL_OPT_IN_ENV_KEYS[0]}=1 to run on this machine). ` + `Looked in ${credentialLocations(env)}. Sign in with: skills auth login`);
+    }
+    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in ${credentialLocations(env)}. Sign in with: skills auth login`);
   }
   const apiOrigin = normalizeSkillsApiOrigin(configured?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP));
   toV1BaseUrl(apiOrigin);
@@ -7903,6 +7895,10 @@ function resolveSkillsFleetOrThrow(env, options) {
   }
   return { ...base, apiKey: credential.apiKey, apiKeyPointer: null };
 }
+function credentialLocations(env) {
+  const files = skillsCredentialFiles(env).join(" or ") || "no credentials file (HOME is unset)";
+  return `hasna.credentials.${SKILLS_APP}.api-key (macOS Keychain, account HASNA_STATION or the host name), ${files}, and ${SKILLS_API_KEY_ENV}`;
+}
 function assertCredentialInstance(credential, apiOrigin, env, options) {
   let bound;
   if (credential.tier === "disk" || credential.tier === "profile") {
@@ -7956,7 +7952,7 @@ async function skillsCredentialOrReason(env = process.env, options = {}) {
     const connection = await resolveSkillsConnection(env, options);
     return connection ? { apiKey: connection.apiKey, apiOrigin: connection.apiOrigin, reason: null } : { apiKey: null, apiOrigin: null, reason: null };
   } catch (error2) {
-    if (error2 instanceof SkillsFleetCredentialError || error2?.name === "SkillsFleetCredentialError") {
+    if (isSkillsFleetCredentialError(error2)) {
       return { apiKey: null, apiOrigin: null, reason: error2.message };
     }
     throw error2;
@@ -7968,7 +7964,14 @@ function resolveSkillsApiOrigin(env = process.env, options = {}) {
     toV1BaseUrl(configured.value);
     return { origin: normalizeSkillsApiOrigin(configured.value), source: configured.source };
   }
-  const fleet = resolveSkillsFleet(env, options);
+  let fleet;
+  try {
+    fleet = resolveSkillsFleet(env, options);
+  } catch (error2) {
+    if (isSkillsFleetCredentialError(error2))
+      return null;
+    throw error2;
+  }
   return fleet.mode === "hosted" ? { origin: fleet.apiOrigin, source: fleet.apiUrlSource } : null;
 }
 function requireSkillsApiOrigin(action = "This command", env = process.env, options = {}) {
@@ -7987,6 +7990,8 @@ var SKILLS_APP = "skills", ENV_KEYS, SKILLS_API_URL_ENV_KEYS, SKILLS_API_KEY_ENV
 var init_fleet_credentials = __esm(() => {
   init_transport();
   init_instance_credentials();
+  init_local_opt_in();
+  init_local_opt_in();
   ENV_KEYS = clientTransportEnvKeys(SKILLS_APP);
   SKILLS_API_URL_ENV_KEYS = ENV_KEYS.apiUrlKeys;
   SKILLS_API_KEY_ENV_KEYS = ENV_KEYS.apiKeyKeys;
@@ -8009,6 +8014,73 @@ var init_fleet_credentials = __esm(() => {
   };
 });
 
+// src/lib/auth-store.ts
+import { chmodSync, existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync11, renameSync as renameSync2, statSync as statSync7, unlinkSync, writeFileSync as writeFileSync5 } from "fs";
+function getAuthFilePath(env = process.env) {
+  return skillsCredentialFilePath(env);
+}
+function getApiUrl(action, env = process.env, options = {}) {
+  return requireSkillsApiOrigin(action, env, options);
+}
+function credentialFileMode(env = process.env) {
+  try {
+    return statSync7(skillsCredentialFilePath(env)).mode & 511;
+  } catch {
+    return null;
+  }
+}
+var init_auth_store = __esm(() => {
+  init_transport();
+  init_instance_credentials();
+  init_fleet_credentials();
+  init_transport();
+  init_fleet_credentials();
+});
+
+// src/lib/remote-run-contract.ts
+function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
+  const record3 = isRecord3(payload) ? payload : {};
+  return {
+    contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
+    ...pickString(record3, "id"),
+    skill: pickStringValue(record3, "skill") ?? fallbackSkill,
+    ...pickString(record3, "requestedSlug"),
+    ...pickString(record3, "status"),
+    ...pickNumber(record3, "exitCode"),
+    ...pickString(record3, "correlationId"),
+    ...pickString(record3, "createdAt"),
+    ...pickString(record3, "startedAt"),
+    ...pickString(record3, "completedAt"),
+    ...pickNumber(record3, "durationMs"),
+    ...pickString(record3, "outputType"),
+    ...hasOwn(record3, "outputPreview") ? { outputPreview: record3.outputPreview } : {},
+    ...pickString(record3, "errorCode"),
+    ...pickString(record3, "errorMessage"),
+    ...pickString(record3, "error"),
+    ...pickString(record3, "code"),
+    ...hasOwn(record3, "details") ? { details: record3.details } : {}
+  };
+}
+function isRecord3(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function hasOwn(record3, key) {
+  return Object.prototype.hasOwnProperty.call(record3, key);
+}
+function pickString(record3, key) {
+  const value = pickStringValue(record3, key);
+  return value === undefined ? {} : { [key]: value };
+}
+function pickStringValue(record3, key) {
+  const value = record3[key];
+  return typeof value === "string" ? value : undefined;
+}
+function pickNumber(record3, key) {
+  const value = record3[key];
+  return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
+}
+var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
+
 // src/lib/blog-article.ts
 var exports_blog_article = {};
 __export(exports_blog_article, {
@@ -8223,16 +8295,104 @@ var init_remote_files = __esm(() => {
   MAX_REMOTE_FILE_BYTES = 64 * 1024 * 1024;
 });
 
-// src/lib/auth-store.ts
-function getApiUrl(action, env = process.env, options = {}) {
-  return requireSkillsApiOrigin(action, env, options);
+// src/lib/remote-workspace.ts
+function workspaceMembersQuery(options = {}) {
+  if (!record3(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+    throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
+  const query = new URLSearchParams;
+  if (options.limit !== undefined)
+    query.set("limit", String(options.limit));
+  if (options.cursor !== undefined)
+    query.set("cursor", options.cursor);
+  return query.size ? `?${query}` : "";
 }
-var init_auth_store = __esm(() => {
-  init_transport();
-  init_instance_credentials();
-  init_fleet_credentials();
-  init_transport();
-  init_fleet_credentials();
+function timestamp(value) {
+  if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}Z$/.test(value))
+    return false;
+  const time3 = Date.parse(value);
+  return Number.isFinite(time3) && new Date(time3).toISOString().slice(0, 23) === value.slice(0, 23);
+}
+function parseMember(row, fail) {
+  if (!record3(row) || !uuid2(row.membershipId) || !uuid2(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp(row.createdAt))
+    return fail();
+  return {
+    membershipId: row.membershipId,
+    userId: row.userId,
+    email: row.email,
+    displayName: row.displayName,
+    role: row.role,
+    createdAt: row.createdAt
+  };
+}
+function mutationInput(membershipId, input, roleChange) {
+  if (typeof membershipId !== "string" || !uuid2(membershipId) || membershipId !== membershipId.toLowerCase() || !record3(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+    throw new WorkspaceMemberInputError;
+  const expectedRole = input.expectedRole, role = roleChange ? input.role : undefined;
+  if (!isRole(expectedRole) || roleChange && !isRole(role))
+    throw new WorkspaceMemberInputError;
+  return { membershipId, role, expectedRole };
+}
+function workspaceMemberRoleInput(membershipId, input) {
+  const value = mutationInput(membershipId, input, true);
+  return { membershipId: value.membershipId, body: { role: value.role, expectedRole: value.expectedRole } };
+}
+function workspaceMemberRemovalInput(membershipId, input) {
+  const value = mutationInput(membershipId, input, false);
+  return { membershipId: value.membershipId, body: { expectedRole: value.expectedRole } };
+}
+function parseWorkspaceMemberRoleResult(value, membershipId, role) {
+  const fail = () => {
+    throw new Error(invalidMemberResult);
+  };
+  if (!record3(value) || !uuid2(value.organizationId) || typeof value.changed !== "boolean")
+    return fail();
+  const member = parseMember(value.member, fail);
+  if (member.membershipId !== membershipId || member.role !== role)
+    return fail();
+  return { organizationId: value.organizationId, member, changed: value.changed };
+}
+function parseWorkspaceMemberRemovalResult(value, membershipId) {
+  if (!record3(value) || !uuid2(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+    throw new Error(invalidMemberResult);
+  return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
+}
+function workspaceMemberFailure(value, status) {
+  if (!record3(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+    return null;
+  const code = value.code;
+  return workspaceMemberFailures[code][0] === status ? code : null;
+}
+function parseWorkspaceMembersPage(value) {
+  const fail = () => {
+    throw new Error("The server returned an invalid workspace roster.");
+  };
+  if (!record3(value) || !uuid2(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+    return fail();
+  const members = value.members.map((row) => parseMember(row, fail));
+  if (new Set(members.map((row) => row.membershipId)).size !== members.length)
+    return fail();
+  return { organizationId: value.organizationId, members, nextCursor: value.nextCursor };
+}
+var record3 = (value) => !!value && typeof value === "object" && !Array.isArray(value), cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value), uuid2 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value), isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value), WorkspaceMemberInputError, invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.", workspaceMemberFailures;
+var init_remote_workspace = __esm(() => {
+  WorkspaceMemberInputError = class WorkspaceMemberInputError extends Error {
+    constructor() {
+      super("Use an unchanged lowercase membership ID and the exact role and expected-role parameters from the roster.");
+      this.name = "WorkspaceMemberInputError";
+    }
+  };
+  workspaceMemberFailures = {
+    INVALID_REQUEST: [400, "Provide the exact membership role parameters."],
+    ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required."],
+    WORKSPACE_ADMIN_REQUIRED: [403, "A current workspace owner or admin is required."],
+    MEMBERSHIP_ACTION_FORBIDDEN: [403, "Your current workspace role cannot perform this membership action."],
+    MEMBERSHIP_NOT_FOUND: [404, "Membership was not found in the current workspace."],
+    SELF_REMOVAL_UNAVAILABLE: [409, "Leaving your own workspace is not available through member removal."],
+    MEMBERSHIP_ROLE_CHANGED: [409, "The member role changed. Refresh the roster before another action."],
+    LAST_OWNER_REQUIRED: [409, "The workspace must retain at least one active owner."],
+    MEMBERSHIP_BUSY: [503, "Membership is busy. Refresh the roster before another action."]
+  };
 });
 
 // src/lib/remote-account.ts
@@ -8314,14 +8474,47 @@ var init_remote_account = __esm(() => {
   };
 });
 
+// src/lib/remote-profile.ts
+function customerNamePatch(input, field) {
+  if (!isRecord4(input) || Object.keys(input).length !== 1 || !Object.hasOwn(input, field))
+    throw new Error("Provide only the requested name field.");
+  const value = input[field];
+  if (typeof value !== "string" || /[\p{Cc}\p{Cs}\u2028\u2029]/u.test(value) || !value.trim() || [...value.trim()].length > 100) {
+    throw new Error("Use a name of 1\u2013100 characters without control characters or newlines.");
+  }
+  return { [field]: value.trim() };
+}
+function isRecord4(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function string4(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function parseUpdatedProfile(value) {
+  const user = isRecord4(value) && value.user;
+  if (!isRecord4(user) || !string4(user.id) || !string4(user.email) || !(user.displayName === null || typeof user.displayName === "string") || typeof user.role !== "string" || !["owner", "admin", "member", "viewer"].includes(user.role)) {
+    throw new Error("The server returned an invalid account profile.");
+  }
+  return { user: { id: user.id, email: user.email, displayName: user.displayName, role: user.role } };
+}
+function parseUpdatedWorkspace(value) {
+  const organization = isRecord4(value) && value.organization;
+  if (!isRecord4(organization) || !string4(organization.id) || !string4(organization.slug) || !string4(organization.name)) {
+    throw new Error("The server returned an invalid workspace.");
+  }
+  return { organization: { id: organization.id, slug: organization.slug, name: organization.name } };
+}
+
 // src/lib/remote-client.ts
 var exports_remote_client = {};
 __export(exports_remote_client, {
   createRemoteSkillsClientReadOnly: () => createRemoteSkillsClientReadOnly,
   createRemoteSkillsClient: () => createRemoteSkillsClient,
+  RemoteWorkspaceMemberError: () => RemoteWorkspaceMemberError,
   RemoteSkillsClient: () => RemoteSkillsClient,
   RemoteRouteUnsupportedError: () => RemoteRouteUnsupportedError,
-  RemoteRequestError: () => RemoteRequestError
+  RemoteRequestError: () => RemoteRequestError,
+  RemoteCapabilityUnavailableError: () => RemoteCapabilityUnavailableError
 });
 
 class RemoteSkillsClient {
@@ -8351,9 +8544,14 @@ class RemoteSkillsClient {
       if (response.status === 404 && opts.domainNotFoundCodes?.length && await responseBodyCarriesCode(response, opts.domainNotFoundCodes)) {
         return response;
       }
+      response.body?.cancel().catch(() => {});
       throw new RemoteRouteUnsupportedError(routePath, response.status, this.apiUrl);
     }
     if (!response.ok) {
+      if (path === "/api/v1/billing/checkout" && options?.method === "POST" && response.status === 503 && await responseBodyCarriesCode(response, ["SUBSCRIPTION_CHECKOUT_UNAVAILABLE"])) {
+        throw new RemoteCapabilityUnavailableError;
+      }
+      response.body?.cancel().catch(() => {});
       throw new RemoteRequestError(routePath, response.status, response.statusText);
     }
     return response;
@@ -8437,6 +8635,58 @@ class RemoteSkillsClient {
   async getIdentity() {
     return (await this.requestNewRoute("/api/auth/whoami")).json();
   }
+  async updateProfile(input) {
+    const body = customerNamePatch(input, "displayName");
+    return parseUpdatedProfile(await (await this.requestNewRoute("/api/v1/account/profile", { method: "PATCH", body: JSON.stringify(body) })).json());
+  }
+  async updateCurrentWorkspace(input) {
+    const body = customerNamePatch(input, "name");
+    return parseUpdatedWorkspace(await (await this.requestNewRoute("/api/v1/workspaces/current", { method: "PATCH", body: JSON.stringify(body) })).json());
+  }
+  async listWorkspaceMembers(options = {}) {
+    const query = workspaceMembersQuery(options);
+    const requestedCursor = options.cursor;
+    const response = await this.requestNewRoute(`/api/v1/workspace/members${query}`);
+    let value;
+    try {
+      value = await response.json();
+    } catch {
+      throw new Error("The server returned an invalid workspace roster.");
+    }
+    const page = parseWorkspaceMembersPage(value);
+    if (requestedCursor !== undefined && page.nextCursor === requestedCursor)
+      throw new Error("The server returned an invalid workspace roster.");
+    return page;
+  }
+  async setWorkspaceMemberRole(membershipId, input) {
+    const captured = workspaceMemberRoleInput(membershipId, input);
+    const value = await this.requestWorkspaceMember(captured.membershipId, "PATCH", captured.body);
+    return parseWorkspaceMemberRoleResult(value, captured.membershipId, captured.body.role);
+  }
+  async removeWorkspaceMember(membershipId, input) {
+    const captured = workspaceMemberRemovalInput(membershipId, input);
+    return parseWorkspaceMemberRemovalResult(await this.requestWorkspaceMember(captured.membershipId, "DELETE", captured.body), captured.membershipId);
+  }
+  async requestWorkspaceMember(membershipId, method, body) {
+    const path = `/api/v1/workspace/members/${membershipId}`;
+    const response = await this.request(path, { method, body: JSON.stringify(body) });
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 64 * 1024 : 4096)));
+    } catch {
+      if (response.ok)
+        throw new Error(invalidMemberResult);
+    }
+    if (!response.ok) {
+      const code = workspaceMemberFailure(value, response.status);
+      if (code)
+        throw new RemoteWorkspaceMemberError(path, code);
+      if (response.status === 404 || response.status === 405)
+        throw new RemoteRouteUnsupportedError(path, response.status, this.apiUrl);
+      throw new RemoteRequestError(path, response.status);
+    }
+    return value;
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -8628,8 +8878,10 @@ class RemoteSkillsClient {
       return [];
     if (!response.ok)
       throw new Error(`versions request failed: ${response.status}`);
-    const body = await response.json();
-    return Array.isArray(body.versions) ? body.versions : [];
+    const body = await readSkillVersionPayload(response);
+    if (!isVersionRecord(body) || !Array.isArray(body.versions) || body.slug !== undefined && body.slug !== slug)
+      throw new Error(INVALID_SKILL_VERSION_RESPONSE);
+    return body.versions.map((entry) => normalizeSkillVersion(entry, slug));
   }
   async getSkillVersion(slug, version2) {
     const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version2)}`, undefined, { domainNotFoundCodes: ["SKILL_NOT_FOUND", "SKILL_VERSION_NOT_FOUND"] });
@@ -8637,7 +8889,7 @@ class RemoteSkillsClient {
       return null;
     if (!response.ok)
       throw new Error(`version request failed: ${response.status}`);
-    return await response.json();
+    return normalizeSkillVersion(await readSkillVersionPayload(response), slug, version2);
   }
   async listPins() {
     const response = await this.requestNewRoute("/api/v1/pins");
@@ -8685,31 +8937,47 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record3, field) {
-  if (record3[field] === undefined)
+function requireOptionalString(record4, field) {
+  if (record4[field] === undefined)
     return;
-  if (typeof record3[field] !== "string") {
+  if (typeof record4[field] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field} must be a string when present)`);
   }
-  return record3[field];
+  return record4[field];
+}
+function isVersionRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+async function readSkillVersionPayload(response) {
+  try {
+    return await response.json();
+  } catch {
+    throw new Error(INVALID_SKILL_VERSION_RESPONSE);
+  }
+}
+function normalizeSkillVersion(entry, slug, version2) {
+  if (!isVersionRecord(entry) || typeof entry.slug !== "string" || !entry.slug.trim() || entry.slug !== slug || typeof entry.version !== "string" || !entry.version.trim() || version2 !== undefined && entry.version !== version2 || typeof entry.bundleSha256 !== "string" || !/^[a-f0-9]{64}$/i.test(entry.bundleSha256) || typeof entry.bundleByteSize !== "number" || !Number.isSafeInteger(entry.bundleByteSize) || entry.bundleByteSize < 0 || typeof entry.createdAt !== "string" || !entry.createdAt.trim() || entry.current !== undefined && typeof entry.current !== "boolean" || entry.storageKind !== undefined && typeof entry.storageKind !== "string" || entry.manifest !== undefined && !isVersionRecord(entry.manifest)) {
+    throw new Error(INVALID_SKILL_VERSION_RESPONSE);
+  }
+  return entry;
 }
 function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record3 = entry;
-  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  const record4 = entry;
+  const slug = typeof record4.slug === "string" && record4.slug.trim() ? record4.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record3.metadata !== undefined) {
-    if (!record3.metadata || typeof record3.metadata !== "object" || Array.isArray(record3.metadata)) {
+  if (record4.metadata !== undefined) {
+    if (!record4.metadata || typeof record4.metadata !== "object" || Array.isArray(record4.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record3.metadata;
+    metadata = record4.metadata;
   }
-  const pinnedAt = requireOptionalString(record3, "pinnedAt");
+  const pinnedAt = requireOptionalString(record4, "pinnedAt");
   return {
     slug,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -8726,16 +8994,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record3 = entry;
-  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  const record4 = entry;
+  const slug = typeof record4.slug === "string" && record4.slug.trim() ? record4.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug,
-    ...requireOptionalString(record3, "name") !== undefined ? { name: requireOptionalString(record3, "name") } : {},
-    ...requireOptionalString(record3, "version") !== undefined ? { version: requireOptionalString(record3, "version") } : {},
-    ...requireOptionalString(record3, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record3, "updatedAt") } : {}
+    ...requireOptionalString(record4, "name") !== undefined ? { name: requireOptionalString(record4, "name") } : {},
+    ...requireOptionalString(record4, "version") !== undefined ? { version: requireOptionalString(record4, "version") } : {},
+    ...requireOptionalString(record4, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record4, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -8745,26 +9013,55 @@ function normalizeSkillSummaryList(payload) {
   return payload.map(normalizeSkillSummary);
 }
 async function responseBodyCarriesCode(response, codes) {
+  const reader = response.body?.getReader();
+  if (!reader)
+    return false;
+  const maximum = 8 * 1024;
+  let deadline;
+  const expired = new Promise((_, reject) => {
+    deadline = setTimeout(() => reject(new Error("Error response read deadline exceeded")), 1000);
+  });
   try {
-    const payload = await response.clone().json();
-    if (!payload || typeof payload !== "object")
+    const chunks = [];
+    let size = 0;
+    while (true) {
+      const next = await Promise.race([reader.read(), expired]);
+      if (next.done)
+        break;
+      size += next.value.byteLength;
+      if (size > maximum)
+        return false;
+      chunks.push(next.value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    if (!payload || typeof payload !== "object" || Array.isArray(payload) || !Object.hasOwn(payload, "code"))
       return false;
     const code = payload.code;
     return typeof code === "string" && codes.includes(code);
   } catch {
     return false;
+  } finally {
+    clearTimeout(deadline);
+    reader.cancel().catch(() => {});
+    reader.releaseLock();
   }
 }
 function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record3 = payload;
-  if (!Array.isArray(record3.skills)) {
+  const record4 = payload;
+  if (!Array.isArray(record4.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record3.skills.map(normalizeSkillSummary);
-  const nextCursor = record3.nextCursor === undefined || record3.nextCursor === null ? null : record3.nextCursor;
+  const skills = record4.skills.map(normalizeSkillSummary);
+  const nextCursor = record4.nextCursor === undefined || record4.nextCursor === null ? null : record4.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -8777,8 +9074,10 @@ async function createRemoteSkillsClient(env = process.env) {
 function createRemoteSkillsClientReadOnly(env = process.env) {
   return createRemoteSkillsClient(env);
 }
-var RemoteRouteUnsupportedError, RemoteRequestError;
+var RemoteRouteUnsupportedError, RemoteRequestError, RemoteWorkspaceMemberError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 var init_remote_client = __esm(() => {
+  init_remote_workspace();
+  init_remote_workspace();
   init_auth_store();
   init_fleet_credentials();
   init_remote_account();
@@ -8798,13 +9097,30 @@ var init_remote_client = __esm(() => {
   RemoteRequestError = class RemoteRequestError extends Error {
     path;
     status;
-    constructor(path, status, statusText) {
-      super(`Remote request to ${path} failed: HTTP ${status}${statusText ? ` ${statusText}` : ""}`);
+    constructor(path, status, _statusText) {
+      super(`Remote request to ${path} failed: HTTP ${status}`);
       this.path = path;
       this.status = status;
       this.name = "RemoteRequestError";
     }
   };
+  RemoteWorkspaceMemberError = class RemoteWorkspaceMemberError extends RemoteRequestError {
+    code;
+    constructor(path, code) {
+      super(path, workspaceMemberFailures[code][0]);
+      this.code = code;
+      this.name = "RemoteWorkspaceMemberError";
+      this.message = workspaceMemberFailures[code][1];
+    }
+  };
+  RemoteCapabilityUnavailableError = class RemoteCapabilityUnavailableError extends RemoteRequestError {
+    code = "SUBSCRIPTION_CHECKOUT_UNAVAILABLE";
+    constructor() {
+      super("/api/v1/billing/checkout", 503);
+      this.name = "RemoteCapabilityUnavailableError";
+      this.message = "Subscription checkout is unavailable on the configured Skills server. " + "Use skills credits packs to view credit packs, or skills billing portal to manage an existing subscription.";
+    }
+  };
 });
 
 // ../../node_modules/.bun/content-type@1.0.5/node_modules/content-type/index.js
@@ -8831,7 +9147,7 @@ var require_content_type = __commonJS((exports) => {
     if (!type || !TYPE_REGEXP.test(type)) {
       throw new TypeError("invalid type");
     }
-    var string4 = type;
+    var string5 = type;
     if (parameters && typeof parameters === "object") {
       var param;
       var params = Object.keys(parameters).sort();
@@ -8840,16 +9156,16 @@ var require_content_type = __commonJS((exports) => {
         if (!TOKEN_REGEXP.test(param)) {
           throw new TypeError("invalid parameter name");
         }
-        string4 += "; " + param + "=" + qstring(parameters[param]);
+        string5 += "; " + param + "=" + qstring(parameters[param]);
       }
     }
-    return string4;
+    return string5;
   }
-  function parse6(string4) {
-    if (!string4) {
+  function parse6(string5) {
+    if (!string5) {
       throw new TypeError("argument string is required");
     }
-    var header = typeof string4 === "object" ? getcontenttype(string4) : string4;
+    var header = typeof string5 === "object" ? getcontenttype(string5) : string5;
     if (typeof header !== "string") {
       throw new TypeError("argument string is required to be a string");
     }
@@ -14323,7 +14639,7 @@ class StdioServerTransport {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.4.0",
+  version: "0.5.0",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -14355,6 +14671,7 @@ var package_default = {
   files: [
     "dist/",
     "!dist/**/*.test.d.ts",
+    "!dist/**/*.fixture.d.ts",
     "!dist/test-preload.d.ts",
     "!dist/platform",
     "bin/",
@@ -14380,8 +14697,9 @@ var package_default = {
     migrate: "bun run ./src/server/migrate.ts",
     typecheck: "tsc --noEmit",
     "verify:release": "bun run scripts/release-guard.ts",
+    "verify:consumer-types": "bun run scripts/consumer-types.ts",
     prepare: "bun run build:js",
-    prepack: "bun run build && bun run verify:release",
+    prepack: "bun run build && bun run verify:release && bun run verify:consumer-types",
     prepublishOnly: "bun run typecheck && bun run test"
   },
   keywords: [
@@ -14403,6 +14721,7 @@ var package_default = {
   author: "Hasna",
   license: "Apache-2.0",
   devDependencies: {
+    "@hasna/contracts": "1.0.2",
     "@types/bun": "1.3.14",
     "@types/node": "25.2.3",
     "@types/react": "^18.2.0",
@@ -14414,8 +14733,7 @@ var package_default = {
   dependencies: {
     "@aws-sdk/client-ecs": "^3.1079.0",
     "@aws-sdk/client-s3": "^3.1079.0",
-    "@hasna/contracts": "1.0.1",
-    "@hasna/events": "0.1.16",
+    "@hasna/events": "0.1.18",
     "@modelcontextprotocol/sdk": "^1.26.0",
     chalk: "^5.3.0",
     commander: "^12.1.0",
@@ -22331,12 +22649,7 @@ import { homedir } from "os";
 import { join, resolve } from "path";
 import { homedir as pathsResolverHomedir } from "os";
 import { join as pathsResolverJoin } from "path";
-var PATHS_RESOLVER_KIND_ENV = {
-  config: "HASNA_CONFIG_HOME",
-  data: "HASNA_DATA_HOME",
-  state: "HASNA_STATE_HOME",
-  cache: "HASNA_CACHE_HOME"
-};
+var PATHS_RESOLVER_DATA_ENV = "HASNA_DATA_HOME";
 var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 function pathsResolverAssertApp(app) {
   if (typeof app !== "string" || app.length === 0) {
@@ -22346,48 +22659,19 @@ function pathsResolverAssertApp(app) {
     throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
   }
 }
-function pathsResolverAssertKind(kind) {
-  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
-    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
-  }
-}
-function pathsResolverBaseDir(kind, options) {
-  pathsResolverAssertKind(kind);
+function pathsResolverDataBaseDir(options) {
   const env = options.env ?? process.env;
-  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  const override = env[PATHS_RESOLVER_DATA_ENV];
   if (typeof override === "string" && override.length > 0)
     return override;
   const home = options.home ?? pathsResolverHomedir();
   const platform = options.platform ?? process.platform;
-  if (platform === "darwin") {
-    switch (kind) {
-      case "config":
-      case "data":
-        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
-      case "cache":
-        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
-      case "state":
-        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
-    }
-  }
-  switch (kind) {
-    case "config":
-      return pathsResolverJoin(home, ".config", "hasna");
-    case "data":
-      return pathsResolverJoin(home, ".local", "share", "hasna");
-    case "state":
-      return pathsResolverJoin(home, ".local", "state", "hasna");
-    case "cache":
-      return pathsResolverJoin(home, ".cache", "hasna");
-  }
-}
-function pathsResolverResolve(kind, options) {
-  pathsResolverAssertApp(options.app);
-  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
-  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+  return platform === "darwin" ? pathsResolverJoin(home, "Library", "Application Support", "Hasna") : pathsResolverJoin(home, ".local", "share", "hasna");
 }
 function dataDir(options) {
-  return pathsResolverResolve("data", options);
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverDataBaseDir(options), appSegment);
 }
 var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
 var HASNA_SKILLS_HOME_ENV = "HASNA_SKILLS_HOME";
@@ -23967,14 +24251,27 @@ function normalizePortableSkillName(name) {
   }
   return normalized;
 }
+function normalizeNewPortableSkillName(name) {
+  normalizePortableSkillName(name);
+  const normalized = name.trim().replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (!normalized)
+    throw new Error(`Invalid skill name '${name}'. Include letters or numbers.`);
+  return normalized;
+}
 function readPortableSkillManifest(skillPath, fallbackName = basename(skillPath)) {
+  return readManifest(skillPath, fallbackName, normalizePortableSkillName);
+}
+function readPortableSkillManifestForImport(skillPath) {
+  return readManifest(skillPath, basename(skillPath), normalizeNewPortableSkillName);
+}
+function readManifest(skillPath, fallbackName, normalizeName) {
   const skillJsonPath = join6(skillPath, "skill.json");
   const skillMdPath = join6(skillPath, "SKILL.md");
   const pkgPath = join6(skillPath, "package.json");
   const jsonManifest = existsSync6(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
   const frontmatter = existsSync6(skillMdPath) ? parseSkillFrontmatter(readFileSync5(skillMdPath, "utf-8")) ?? undefined : undefined;
   const pkg = existsSync6(pkgPath) ? readJsonObject(pkgPath) : undefined;
-  const name = normalizePortableSkillName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
+  const name = normalizeName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
   const description = stringField(jsonManifest, "description") ?? frontmatter?.description ?? stringValue(pkg?.description) ?? `${name} skill`;
   const version2 = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
   const kind = parseSkillKind(stringField(jsonManifest, "kind") ?? frontmatter?.kind);
@@ -24222,10 +24519,45 @@ function ensureInstructionSkillFiles(skillPath, manifest) {
   };
   if (!existsSync6(join6(skillPath, "SKILL.md"))) {
     writeFileSync2(join6(skillPath, "SKILL.md"), renderSkillMd(next));
+  } else {
+    const path = join6(skillPath, "SKILL.md");
+    const content = readFileSync5(path, "utf8");
+    const declaredName = parseSkillFrontmatter(content)?.name;
+    if (declaredName && declaredName !== next.name) {
+      writeFileSync2(path, renameInstructionFrontmatter(content, next.name));
+    }
+  }
+  const packagePath = join6(skillPath, "package.json");
+  if (existsSync6(packagePath)) {
+    const pkg = readJsonObject(packagePath);
+    if (typeof pkg.name === "string" && pkg.name !== next.name) {
+      writeFileSync2(packagePath, `${JSON.stringify({ ...pkg, name: next.name }, null, 2)}
+`);
+    }
   }
   writeSkillJsonWithHash(skillPath, next);
   return readPortableSkillManifest(skillPath, next.name);
 }
+function renameInstructionFrontmatter(content, name) {
+  const frontmatter = content.match(/^---\r?\n([\s\S]*?)\r?\n---(?=\r?\n|$)/);
+  const names = frontmatter?.[1]?.match(/^[ \t]*name[ \t]*:[^\r\n]*/gm) ?? [];
+  const declaration = names.length === 1 ? names[0].match(/^(name[ \t]*:[ \t]*)(.*?)([ \t]*)$/) : null;
+  const scalar = declaration?.[2] ?? "";
+  let simple = /^[a-zA-Z0-9_.@/ -]+$/.test(scalar);
+  if (scalar.startsWith('"')) {
+    try {
+      simple = typeof JSON.parse(scalar) === "string";
+    } catch {
+      simple = false;
+    }
+  } else if (scalar.startsWith("'"))
+    simple = /^'[^'\r\n]*'$/.test(scalar);
+  if (!frontmatter || !declaration || !simple) {
+    throw new Error("Cannot rename instruction SKILL.md: use one unambiguous top-level name scalar in frontmatter.");
+  }
+  const renamed = frontmatter[0].replace(/^name[ \t]*:[^\r\n]*/m, () => `${declaration[1]}${name}${declaration[3]}`);
+  return renamed + content.slice(frontmatter[0].length);
+}
 function copySkillDirectory(source, destination) {
   const resolvedSource = lstatSync2(source).isSymbolicLink() ? realpathSync(source) : source;
   mkdirSync2(destination, { recursive: true });
@@ -24624,7 +24956,7 @@ function isOfficialSkillName(name) {
   return OFFICIAL_SKILL_NAMES.has(name);
 }
 function scaffoldPortableSkill(name, options = {}) {
-  const skillName = normalizePortableSkillName(name);
+  const skillName = normalizeNewPortableSkillName(name);
   const root = getPortableSkillsRoot(options);
   const skillPath = join7(root, skillName);
   if (existsSync7(skillPath)) {
@@ -24648,9 +24980,9 @@ function portPortableSkill(sourcePath, options = {}) {
   if (!existsSync7(absoluteSource) || !statSync6(absoluteSource).isDirectory()) {
     throw new Error(`Skill source directory not found: ${sourcePath}`);
   }
-  const inferred = readPortableSkillManifest(absoluteSource, basename2(absoluteSource));
+  const inferred = readPortableSkillManifestForImport(absoluteSource);
   const explicitName = options.name != null;
-  const skillName = normalizePortableSkillName(options.name ?? inferred.name);
+  const skillName = normalizeNewPortableSkillName(options.name ?? inferred.name);
   if (isOfficialSkillName(skillName) && !options.allowShadow) {
     const sourceSlug = safeNormalizeName(basename2(absoluteSource));
     const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename2(absoluteSource)}')` : ""} matches a bundled official skill.`;
@@ -25131,44 +25463,321 @@ function mergeCustomSkills(skills) {
   return Array.from(byName.values()).sort((a, b) => a.name.localeCompare(b.name));
 }
 
-// src/lib/installer.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8, rmSync as rmSync2 } from "fs";
-import { dirname as dirname4, join as join10 } from "path";
-import { homedir as homedir2 } from "os";
-import { fileURLToPath } from "url";
-// src/lib/utils.ts
-function normalizeSkillName(name) {
-  return name;
-}
+// src/lib/read-access.ts
+init_fleet_credentials();
 
-// src/lib/project-state.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
-import { join as join9 } from "path";
-var VALID_PIN_SOURCES = [
-  "official",
-  "custom",
-  "remote",
-  "private",
-  "private-hosted",
-  "upstream",
-  "extension",
-  "local"
-];
-var SKILLS_PROJECT_DIR = ".skills";
-var PROJECT_CONFIG_FILE = "project.json";
-var DEFAULT_EXPORT_DIR = ".skills/exports";
-function getProjectStateDir(targetDir = process.cwd()) {
-  return join9(targetDir, SKILLS_PROJECT_DIR);
-}
-function getProjectConfigPath(targetDir = process.cwd()) {
-  return join9(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
+// src/lib/api-url.ts
+init_fleet_credentials();
+init_fleet_credentials();
+var API_URL_ENV_VAR = SKILLS_API_URL_ENV;
+var MISSING_API_URL_HINT = `run: skills auth login, or set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
+function resolveApiUrl(env = process.env, options = {}) {
+  const fleet = resolveSkillsFleet(env, options);
+  return fleet.mode === "hosted" ? fleet.apiOrigin : undefined;
 }
-function loadProjectConfig(targetDir = process.cwd()) {
-  const path = getProjectConfigPath(targetDir);
-  if (!existsSync9(path))
-    return null;
+
+// src/lib/remote-registry.ts
+init_fleet_credentials();
+
+// src/lib/discovery.ts
+var VENDOR_TERMS = [
+  "Google Gemini",
+  "OpenAI Sora",
+  "MiniMax Hailuo",
+  "Claude Code",
+  "Claude Vision",
+  "DALL-E 3",
+  "GPT-4o Mini",
+  "Cerebras",
+  "OpenRouter",
+  "Firecrawl",
+  "ElevenLabs",
+  "Anthropic",
+  "OpenAI",
+  "Minimax",
+  "MiniMax",
+  "Gemini",
+  "Claude",
+  "Whisper",
+  "Seedance",
+  "Lyria",
+  "Sora",
+  "Veo",
+  "Exa.ai",
+  "Exa",
+  "XAI",
+  "xAI"
+];
+var VENDOR_TAGS = new Set([
+  "anthropic",
+  "cerebras",
+  "claude",
+  "exa",
+  "firecrawl",
+  "gemini",
+  "google",
+  "minimax",
+  "openai",
+  "openrouter",
+  "seedance",
+  "whisper",
+  "xai"
+]);
+var vendorPattern = new RegExp(`\\b(${VENDOR_TERMS.map(escapeRegExp).join("|")})\\b`, "gi");
+function getCompactSkillDiscovery(skill) {
+  return {
+    name: skill.name,
+    category: skill.category,
+    description: sanitizePublicDiscoveryText(skill.description)
+  };
+}
+function getPublicSkillDiscovery(skill) {
+  return {
+    ...skill,
+    description: sanitizePublicDiscoveryText(skill.description),
+    tags: publicDiscoveryTags(skill.tags)
+  };
+}
+function publicDiscoveryTags(tags) {
+  return tags.filter((tag) => !VENDOR_TAGS.has(tag.toLowerCase()));
+}
+function sanitizePublicDiscoveryText(text) {
+  let sanitized = text.replace(vendorPattern, "hosted AI").replace(/\bLLM\b/g, "AI").replace(/\s{2,}/g, " ");
+  let previous;
+  do {
+    previous = sanitized;
+    sanitized = sanitized.replace(/\bhosted AI(?: providers)?\s*,\s*hosted AI(?: providers)?\b/gi, "hosted AI providers").replace(/\bhosted AI(?: providers)?\s*,?\s*and\s*hosted AI(?: providers)?\b/gi, "hosted AI providers").replace(/\bhosted AI(?: providers)?\s+or\s+hosted AI(?: providers)?\b/gi, "hosted AI providers").replace(/\bhosted AI providers\s+hosted AI\b/gi, "hosted AI providers").replace(/\bhosted AI providers\s+providers\b/gi, "hosted AI providers");
+  } while (sanitized !== previous);
+  return sanitized.trim();
+}
+function publicDiscoveryEnvVars(_skillName, envVars) {
+  return envVars;
+}
+function publicDiscoveryDependencies(_skillName, dependencies) {
+  return dependencies;
+}
+function publicDiscoveryDocumentation(_skill, documentation) {
+  return documentation;
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// src/lib/remote-registry.ts
+var remoteAvailabilitySchema = exports_external.object({
+  status: exports_external.enum(["available", "unavailable"]),
+  code: exports_external.string().optional(),
+  message: exports_external.string().optional(),
+  details: exports_external.array(exports_external.string()).optional()
+}).passthrough();
+var remoteSkillSchema = exports_external.object({
+  name: exports_external.string().min(1).optional(),
+  slug: exports_external.string().min(1).optional(),
+  displayName: exports_external.string().optional(),
+  description: exports_external.string().optional(),
+  category: exports_external.string().optional(),
+  tags: exports_external.array(exports_external.string()).optional(),
+  dependencies: exports_external.array(exports_external.string()).optional(),
+  version: exports_external.string().optional(),
+  availability: remoteAvailabilitySchema.optional()
+}).passthrough().refine((skill) => skill.name || skill.slug, {
+  message: "Remote skill requires name or slug"
+});
+var secretValuePatterns = [
+  /\bsk-[A-Za-z0-9_-]{8,}\b/g,
+  /\bgh[opsur]_[A-Za-z0-9_]{8,}\b/g,
+  /\bgithub_pat_[A-Za-z0-9_]{8,}\b/g,
+  /\bnpm_[A-Za-z0-9_]{8,}\b/g,
+  /\bAKIA[A-Z0-9]{12,}\b/g,
+  /\bAIza[A-Za-z0-9_-]{10,}\b/g,
+  new RegExp("\\bsecret" + "-token:\\s*[A-Za-z0-9._-]+", "gi"),
+  /\bctx7sk\-[A-Za-z0-9_-]{8,}\b/g,
+  /\bxai\-[A-Za-z0-9_-]{8,}\b/g
+];
+var remoteSkillDetailSchema = exports_external.union([
+  remoteSkillSchema,
+  exports_external.object({ skill: remoteSkillSchema }),
+  exports_external.object({ data: remoteSkillSchema })
+]);
+var remoteRegistrySchema = exports_external.union([
+  exports_external.array(remoteSkillSchema),
+  exports_external.object({ skills: exports_external.array(remoteSkillSchema) }),
+  exports_external.object({ data: exports_external.array(remoteSkillSchema) })
+]);
+function getConfiguredApiUrl(env = process.env) {
+  return resolveApiUrl(env);
+}
+function buildSkillsApiUrl(apiUrl, endpoint = "/skills") {
+  const url = new URL(apiUrl);
+  const cleanEndpoint = endpoint.startsWith("/") ? endpoint : `/${endpoint}`;
+  const pathname = url.pathname.replace(/\/+$/, "");
+  const apiBase = /\/api(?:\/v1)?\/skills$/.test(pathname) ? pathname.slice(0, -"/skills".length) : pathname;
+  if (/\/api(?:\/v1)?$/.test(apiBase)) {
+    url.pathname = `${apiBase}${cleanEndpoint}`;
+    return url.toString();
+  }
+  url.pathname = `${apiBase}/api/v1${cleanEndpoint}`.replace(/\/{2,}/g, "/");
+  return url.toString();
+}
+function titleize(name) {
+  return name.replace(/-/g, " ").replace(/\b\w/g, (char) => char.toUpperCase());
+}
+function normalizeRemoteSkill(skill) {
+  const name = skill.name || skill.slug;
+  if (!name)
+    throw new Error("Remote skill requires name or slug");
+  return {
+    name,
+    displayName: skill.displayName || titleize(name),
+    description: skill.description || "",
+    category: skill.category || "Remote",
+    tags: skill.tags || ["remote"],
+    dependencies: skill.dependencies,
+    ...skill.version ? { version: skill.version } : {},
+    availability: normalizeRemoteAvailability(skill.availability),
+    source: "remote"
+  };
+}
+function normalizeRemoteAvailability(availability) {
+  if (!availability)
+    return { status: "available" };
+  if (availability.status === "available")
+    return { status: "available" };
+  return {
+    status: availability.status,
+    ...safeAvailabilityCode(availability.code) ? { code: safeAvailabilityCode(availability.code) } : {},
+    ...availability.message ? { message: sanitizeAvailabilityText(availability.message) } : {},
+    ...availability.details ? { details: availability.details.map(sanitizeAvailabilityText).filter(Boolean) } : {}
+  };
+}
+function safeAvailabilityCode(code) {
+  if (!code)
+    return;
+  return /^[A-Z0-9_]+$/.test(code) ? code : undefined;
+}
+function sanitizeAvailabilityText(text) {
+  return secretValuePatterns.reduce((value, pattern) => value.replace(pattern, "credential"), sanitizePublicDiscoveryText(text).replace(/\b[A-Z0-9_]*(?:API_KEY|SECRET|TOKEN|CREDENTIAL)[A-Z0-9_]*\b/g, "credential")).replace(/\s{2,}/g, " ").trim();
+}
+function parseRemoteRegistryPayload(payload) {
+  const parsed = parseRemoteContract(remoteRegistrySchema, payload, "Remote registry payload did not match the expected skills contract");
+  const rawSkills = Array.isArray(parsed) ? parsed : ("skills" in parsed) ? parsed.skills : parsed.data;
+  return rawSkills.map(normalizeRemoteSkill);
+}
+function parseRemoteContract(schema, payload, message) {
+  try {
+    return schema.parse(payload);
+  } catch (error2) {
+    if (error2 instanceof exports_external.ZodError)
+      throw new Error(message, { cause: error2 });
+    throw error2;
+  }
+}
+async function remoteRequestHeaders(options) {
+  const headers = new Headers({ Accept: "application/json" });
+  const token = options.authToken !== undefined ? options.authToken : await ambientTokenFor(options.apiUrl);
+  const trimmed = token?.trim();
+  if (trimmed)
+    headers.set("Authorization", `Bearer ${trimmed}`);
+  return headers;
+}
+async function ambientTokenFor(callerApiUrl) {
+  const connection = await resolveSkillsConnection();
+  if (!connection)
+    return null;
+  if (callerApiUrl !== undefined && normalizeSkillsApiOrigin(callerApiUrl) !== connection.apiOrigin) {
+    throw new SkillsFleetCredentialError(`The Skills credential resolved for ${connection.apiOrigin} is never sent to a caller-supplied apiUrl ` + `(${normalizeSkillsApiOrigin(callerApiUrl)}). Pass an explicit authToken for that instance, or authToken: null ` + `for an unauthenticated read; no credential was sent.`, "INSTANCE_CREDENTIAL_MISMATCH");
+  }
+  return connection.apiKey;
+}
+async function fetchRemoteJson(url, options) {
+  const fetchImpl = options.fetchImpl || fetch;
+  const headers = await remoteRequestHeaders(options);
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 1e4);
+  try {
+    const response = await fetchImpl(url, {
+      headers,
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      throw new Error(`Remote registry request failed: ${response.status} ${response.statusText}`);
+    }
+    return response.json();
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function loadRemoteRegistry(options = {}) {
+  const apiUrl = options.apiUrl || getConfiguredApiUrl();
+  if (!apiUrl) {
+    throw new Error(`Remote registry requires a Skills credential (${SKILLS_API_KEY_ENV}, the Keychain item, or ~/.hasna/skills/config/credentials) and, for your own instance, ${SKILLS_API_URL_ENV}`);
+  }
+  const url = buildSkillsApiUrl(apiUrl, options.endpoint);
+  return parseRemoteRegistryPayload(await fetchRemoteJson(url, options));
+}
+async function mergeRemoteRegistry(local, options = {}) {
+  const apiUrl = options.apiUrl || getConfiguredApiUrl();
+  if (!apiUrl)
+    return local;
+  if (options.authToken !== undefined && !options.authToken?.trim())
+    return local;
+  const remote = await loadRemoteRegistry({ ...options, apiUrl });
+  return mergeSkillRegistryLists(local, remote);
+}
+
+// src/lib/read-access.ts
+async function requireSkillsReadAccess(env = process.env, options = {}) {
+  const connection = await resolveSkillsConnection(env, options);
+  return connection ? { mode: "hosted", apiOrigin: connection.apiOrigin } : { mode: "local" };
+}
+async function getBrowseRegistry(options = {}) {
+  const profile = options.all ? "all" : "basic";
+  const local = loadRegistryProfile(profile);
+  if (options.remote) {
+    const remote = await loadRemoteRegistry();
+    return mergeSkillRegistryLists(local, remote);
+  }
+  return mergeRemoteRegistry(local);
+}
+
+// src/lib/installer.ts
+import { existsSync as existsSync10, readFileSync as readFileSync9, rmSync as rmSync2 } from "fs";
+import { dirname as dirname4, join as join11 } from "path";
+import { homedir as homedir2 } from "os";
+import { fileURLToPath } from "url";
+// src/lib/utils.ts
+function normalizeSkillName(name) {
+  return name;
+}
+
+// src/lib/project-state.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
+import { join as join10 } from "path";
+var VALID_PIN_SOURCES = [
+  "official",
+  "custom",
+  "remote",
+  "private",
+  "private-hosted",
+  "upstream",
+  "extension",
+  "local"
+];
+var SKILLS_PROJECT_DIR = ".skills";
+var PROJECT_CONFIG_FILE = "project.json";
+var DEFAULT_EXPORT_DIR = ".skills/exports";
+function getProjectStateDir(targetDir = process.cwd()) {
+  return join10(targetDir, SKILLS_PROJECT_DIR);
+}
+function getProjectConfigPath(targetDir = process.cwd()) {
+  return join10(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
+}
+function loadProjectConfig(targetDir = process.cwd()) {
+  const path = getProjectConfigPath(targetDir);
+  if (!existsSync9(path))
+    return null;
   try {
-    return normalizeProjectConfig(JSON.parse(readFileSync7(path, "utf-8")));
+    return normalizeProjectConfig(JSON.parse(readFileSync8(path, "utf-8")));
   } catch {
     return null;
   }
@@ -25267,12 +25876,12 @@ var __dirname2 = dirname4(fileURLToPath(import.meta.url));
 function findSkillsDir() {
   let dir = __dirname2;
   for (let i = 0;i < 5; i++) {
-    const candidate = join10(dir, "skills");
+    const candidate = join11(dir, "skills");
     if (existsSync10(candidate) && !dir.includes(".skills"))
       return candidate;
     dir = dirname4(dir);
   }
-  return join10(__dirname2, "..", "skills");
+  return join11(__dirname2, "..", "skills");
 }
 var SKILLS_DIR = findSkillsDir();
 function getSkillPath(name) {
@@ -25280,13 +25889,13 @@ function getSkillPath(name) {
   const portable = findPortableSkill(skillName);
   if (portable)
     return portable.path;
-  const legacyCustomPath = join10(getDataDir(), "custom", skillName);
+  const legacyCustomPath = join11(getDataDir(), "custom", skillName);
   if (existsSync10(legacyCustomPath))
     return legacyCustomPath;
   const extensionPath = findExtensionSkillPath(skillName);
   if (extensionPath)
     return extensionPath;
-  return join10(SKILLS_DIR, skillName);
+  return join11(SKILLS_DIR, skillName);
 }
 function getCanonicalSkillName(name) {
   return getSkill(name)?.name ?? resolveSkillAlias(normalizeSkillSlug(name));
@@ -25350,11 +25959,11 @@ function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const base = projectDir || process.cwd();
   switch (agent) {
     case "pi":
-      return scope === "project" ? join10(base, ".pi", "skills") : join10(homedir2(), ".pi", "agent", "skills");
+      return scope === "project" ? join11(base, ".pi", "skills") : join11(homedir2(), ".pi", "agent", "skills");
     case "opencode":
-      return scope === "project" ? join10(base, ".opencode", "skills") : join10(homedir2(), ".config", "opencode", "skills");
+      return scope === "project" ? join11(base, ".opencode", "skills") : join11(homedir2(), ".config", "opencode", "skills");
     default:
-      return scope === "project" ? join10(base, `.${agent}`, "skills") : join10(homedir2(), `.${agent}`, "skills");
+      return scope === "project" ? join11(base, `.${agent}`, "skills") : join11(homedir2(), `.${agent}`, "skills");
   }
 }
 function warnMissingDependencies(name, targetDir) {
@@ -25369,11 +25978,11 @@ function warnMissingDependencies(name, targetDir) {
   }
 }
 function readBundledSkillVersion(name) {
-  const pkgPath = join10(getSkillPath(name), "package.json");
+  const pkgPath = join11(getSkillPath(name), "package.json");
   if (!existsSync10(pkgPath))
     return "unknown";
   try {
-    const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
     return pkg.version || "unknown";
   } catch {
     return "unknown";
@@ -25381,16 +25990,16 @@ function readBundledSkillVersion(name) {
 }
 
 // src/lib/skillinfo.ts
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
+import { join as join12 } from "path";
 function isInstructionSkillDir(skillPath, meta) {
   if (meta?.kind === "instruction")
     return true;
-  const skillMdPath = join11(skillPath, "SKILL.md");
+  const skillMdPath = join12(skillPath, "SKILL.md");
   if (!existsSync11(skillMdPath))
     return false;
   try {
-    return parseSkillFrontmatter(readFileSync9(skillMdPath, "utf-8"))?.kind === "instruction";
+    return parseSkillFrontmatter(readFileSync10(skillMdPath, "utf-8"))?.kind === "instruction";
   } catch {
     return false;
   }
@@ -25416,9 +26025,9 @@ function getSkillDocs(name) {
   if (!existsSync11(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join11(skillPath, "SKILL.md")),
-    readme: readIfExists(join11(skillPath, "README.md")),
-    claudeMd: readIfExists(join11(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join12(skillPath, "SKILL.md")),
+    readme: readIfExists(join12(skillPath, "README.md")),
+    claudeMd: readIfExists(join12(skillPath, "CLAUDE.md"))
   };
 }
 function getSkillBestDoc(name) {
@@ -25433,7 +26042,7 @@ function getSkillRequirements(name) {
     return null;
   const texts = [];
   for (const file of ["SKILL.md", "README.md", "CLAUDE.md", ".env.example", ".env.local.example"]) {
-    const content = readIfExists(join11(skillPath, file));
+    const content = readIfExists(join12(skillPath, file));
     if (content)
       texts.push(content);
   }
@@ -25473,10 +26082,10 @@ function getSkillRequirements(name) {
   const skillName = normalizeSkillName(name);
   let cliCommand = `skills run ${skillName}`;
   let dependencies = {};
-  const pkgPath = join11(skillPath, "package.json");
+  const pkgPath = join12(skillPath, "package.json");
   if (existsSync11(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
+      const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
       dependencies = pkg.dependencies || {};
     } catch {}
   }
@@ -25503,13 +26112,13 @@ async function runSkill(name, args, options = {}) {
       error: `Skill '${name}' is an instruction skill (kind: instruction) and is not runnable. Instruction skills are consumed by coding agents via SKILL.md, not executed with 'skills run'.`
     };
   }
-  const pkgPath = join11(skillPath, "package.json");
+  const pkgPath = join12(skillPath, "package.json");
   if (!existsSync11(pkgPath)) {
     return { exitCode: 1, error: `No package.json in skill '${name}'` };
   }
   let entryPoint;
   try {
-    const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
     if (pkg.bin) {
       const binValues = Object.values(pkg.bin);
       entryPoint = binValues[0];
@@ -25523,11 +26132,11 @@ async function runSkill(name, args, options = {}) {
   } catch {
     return { exitCode: 1, error: `Failed to parse package.json for skill '${name}'` };
   }
-  const entryPath = join11(skillPath, entryPoint);
+  const entryPath = join12(skillPath, entryPoint);
   if (!existsSync11(entryPath)) {
     return { exitCode: 1, error: `Entry point '${entryPoint}' not found in skill '${name}'` };
   }
-  const nodeModules = join11(skillPath, "node_modules");
+  const nodeModules = join12(skillPath, "node_modules");
   if (!existsSync11(nodeModules)) {
     const install = Bun.spawn(["bun", "install", "--no-save"], {
       cwd: skillPath,
@@ -25538,7 +26147,7 @@ async function runSkill(name, args, options = {}) {
   }
   const proc = Bun.spawn(["bun", "run", entryPath, ...args], {
     cwd: skillPath,
-    stdout: options.stdio === "pipe" ? "pipe" : "inherit",
+    stdout: options.stdio === "pipe" ? "pipe" : options.stdio === "stderr" ? 2 : "inherit",
     stderr: options.stdio === "pipe" ? "pipe" : "inherit",
     stdin: "inherit",
     env: { ...process.env, ...options.env }
@@ -25555,7 +26164,7 @@ async function runSkill(name, args, options = {}) {
   return { exitCode };
 }
 function detectProjectSkills(cwd = process.cwd()) {
-  const pkgPath = join11(cwd, "package.json");
+  const pkgPath = join12(cwd, "package.json");
   if (!existsSync11(pkgPath)) {
     const alwaysRecommend = ["market-research-report", "repo-onboarding-report", "blog-article"];
     const recommended2 = alwaysRecommend.map((name) => loadRegistry().find((s) => s.name === name)).filter((s) => s !== undefined);
@@ -25563,7 +26172,7 @@ function detectProjectSkills(cwd = process.cwd()) {
   }
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
+    pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
   } catch {
     const alwaysRecommend = ["market-research-report", "repo-onboarding-report", "blog-article"];
     const recommended2 = alwaysRecommend.map((name) => loadRegistry().find((s) => s.name === name)).filter((s) => s !== undefined);
@@ -25653,7 +26262,7 @@ function extractEnvVars(text) {
 function readIfExists(path) {
   try {
     if (existsSync11(path)) {
-      return readFileSync9(path, "utf-8");
+      return readFileSync10(path, "utf-8");
     }
   } catch {}
   return null;
@@ -26068,6 +26677,104 @@ var toolContracts = [
       dependencies: objectSchema({}, [], "Package dependencies.", true)
     })
   },
+  {
+    name: "update_account_profile",
+    title: "Update Account Display Name",
+    description: "Update your display name with fresh email verification on the configured server.",
+    params: ["name", "email", "code"],
+    category: "execution",
+    sideEffects: "local-process-or-remote-run",
+    stable: true,
+    inputSchema: objectSchema({ name: stringSchema("Display name, 1\u2013100 characters"), email: { type: "string", format: "email" }, code: { type: "string", pattern: "^\\d{6}$" } }, ["name", "email", "code"]),
+    outputSchema: objectSchema({ user: objectSchema({ id: stringSchema("Account identifier."), email: stringSchema("Account email."), displayName: stringSchema("Display name."), role: stringSchema("Current workspace role.") }, ["id", "email", "displayName", "role"]) }, ["user"])
+  },
+  {
+    name: "update_workspace_name",
+    title: "Update Workspace Name",
+    description: "Update the current workspace name as an owner/admin with fresh email verification.",
+    params: ["name", "email", "code"],
+    category: "execution",
+    sideEffects: "local-process-or-remote-run",
+    stable: true,
+    inputSchema: objectSchema({ name: stringSchema("Workspace name, 1\u2013100 characters"), email: { type: "string", format: "email" }, code: { type: "string", pattern: "^\\d{6}$" } }, ["name", "email", "code"]),
+    outputSchema: objectSchema({ organization: objectSchema({ id: stringSchema("Workspace identifier."), slug: stringSchema("Stable workspace slug."), name: stringSchema("Workspace name.") }, ["id", "slug", "name"]) }, ["organization"])
+  },
+  {
+    name: "set_workspace_member_role",
+    title: "Set Current Workspace Member Role",
+    description: "Set an exact membership incarnation's role with its observed expectedRole and fresh verification; no automatic retry.",
+    params: ["membershipId", "role", "expectedRole", "email", "code"],
+    category: "execution",
+    sideEffects: "local-process-or-remote-run",
+    stable: true,
+    inputSchema: objectSchema({
+      membershipId: { type: "string", pattern: "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$" },
+      role: { type: "string", enum: ["owner", "admin", "member", "viewer"] },
+      expectedRole: { type: "string", enum: ["owner", "admin", "member", "viewer"] },
+      email: { type: "string", format: "email" },
+      code: { type: "string", pattern: "^\\d{6}$" }
+    }, ["membershipId", "role", "expectedRole", "email", "code"]),
+    outputSchema: objectSchema({
+      organizationId: stringSchema("Current workspace identifier."),
+      changed: { type: "boolean" },
+      member: objectSchema({
+        membershipId: stringSchema("Membership incarnation."),
+        userId: stringSchema("Account identifier."),
+        email: stringSchema("Member email."),
+        displayName: { oneOf: [{ type: "string" }, { type: "null" }] },
+        role: { type: "string", enum: ["owner", "admin", "member", "viewer"] },
+        createdAt: stringSchema("Exact server timestamp including microseconds.")
+      }, ["membershipId", "userId", "email", "displayName", "role", "createdAt"])
+    }, ["organizationId", "member", "changed"])
+  },
+  {
+    name: "remove_workspace_member",
+    title: "Remove Current Workspace Member",
+    description: "Remove exactly this membership incarnation using its observed expectedRole and fresh verification; self-removal is unavailable.",
+    params: ["membershipId", "expectedRole", "email", "code"],
+    category: "execution",
+    sideEffects: "local-process-or-remote-run",
+    stable: true,
+    inputSchema: objectSchema({
+      membershipId: { type: "string", pattern: "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$" },
+      expectedRole: { type: "string", enum: ["owner", "admin", "member", "viewer"] },
+      email: { type: "string", format: "email" },
+      code: { type: "string", pattern: "^\\d{6}$" }
+    }, ["membershipId", "expectedRole", "email", "code"]),
+    outputSchema: objectSchema({
+      organizationId: stringSchema("Current workspace identifier."),
+      membershipId: stringSchema("Removed membership incarnation."),
+      removed: { type: "boolean", const: true },
+      alreadyRemoved: { type: "boolean" }
+    }, ["organizationId", "membershipId", "removed", "alreadyRemoved"])
+  },
+  {
+    name: "list_workspace_members",
+    title: "List Current Workspace Members",
+    description: "Read one current-workspace roster page with fresh owner/admin email verification; saved credentials stay unchanged.",
+    params: ["email", "code", "limit?", "cursor?"],
+    category: "execution",
+    sideEffects: "local-process-or-remote-run",
+    stable: true,
+    inputSchema: objectSchema({
+      email: { type: "string", format: "email" },
+      code: { type: "string", pattern: "^\\d{6}$" },
+      limit: { type: "integer", minimum: 1, maximum: 100 },
+      cursor: { type: "string", pattern: "^[A-Za-z0-9_-]{1,512}$" }
+    }, ["email", "code"]),
+    outputSchema: objectSchema({
+      organizationId: stringSchema("Current workspace identifier."),
+      members: arraySchema(objectSchema({
+        membershipId: stringSchema("Membership incarnation."),
+        userId: stringSchema("Account identifier."),
+        email: stringSchema("Member email."),
+        displayName: { oneOf: [{ type: "string" }, { type: "null" }] },
+        role: { type: "string", enum: ["owner", "admin", "member", "viewer"] },
+        createdAt: stringSchema("Exact server timestamp including microseconds.")
+      }, ["membershipId", "userId", "email", "displayName", "role", "createdAt"])),
+      nextCursor: { oneOf: [{ type: "string" }, { type: "null" }] }
+    }, ["organizationId", "members", "nextCursor"])
+  },
   {
     name: "list_api_keys",
     title: "List API Keys",
@@ -26577,90 +27284,6 @@ function clone2(value) {
   return JSON.parse(JSON.stringify(value));
 }
 
-// src/lib/discovery.ts
-var VENDOR_TERMS = [
-  "Google Gemini",
-  "OpenAI Sora",
-  "MiniMax Hailuo",
-  "Claude Code",
-  "Claude Vision",
-  "DALL-E 3",
-  "GPT-4o Mini",
-  "Cerebras",
-  "OpenRouter",
-  "Firecrawl",
-  "ElevenLabs",
-  "Anthropic",
-  "OpenAI",
-  "Minimax",
-  "MiniMax",
-  "Gemini",
-  "Claude",
-  "Whisper",
-  "Seedance",
-  "Lyria",
-  "Sora",
-  "Veo",
-  "Exa.ai",
-  "Exa",
-  "XAI",
-  "xAI"
-];
-var VENDOR_TAGS = new Set([
-  "anthropic",
-  "cerebras",
-  "claude",
-  "exa",
-  "firecrawl",
-  "gemini",
-  "google",
-  "minimax",
-  "openai",
-  "openrouter",
-  "seedance",
-  "whisper",
-  "xai"
-]);
-var vendorPattern = new RegExp(`\\b(${VENDOR_TERMS.map(escapeRegExp).join("|")})\\b`, "gi");
-function getCompactSkillDiscovery(skill) {
-  return {
-    name: skill.name,
-    category: skill.category,
-    description: sanitizePublicDiscoveryText(skill.description)
-  };
-}
-function getPublicSkillDiscovery(skill) {
-  return {
-    ...skill,
-    description: sanitizePublicDiscoveryText(skill.description),
-    tags: publicDiscoveryTags(skill.tags)
-  };
-}
-function publicDiscoveryTags(tags) {
-  return tags.filter((tag) => !VENDOR_TAGS.has(tag.toLowerCase()));
-}
-function sanitizePublicDiscoveryText(text) {
-  let sanitized = text.replace(vendorPattern, "hosted AI").replace(/\bLLM\b/g, "AI").replace(/\s{2,}/g, " ");
-  let previous;
-  do {
-    previous = sanitized;
-    sanitized = sanitized.replace(/\bhosted AI(?: providers)?\s*,\s*hosted AI(?: providers)?\b/gi, "hosted AI providers").replace(/\bhosted AI(?: providers)?\s*,?\s*and\s*hosted AI(?: providers)?\b/gi, "hosted AI providers").replace(/\bhosted AI(?: providers)?\s+or\s+hosted AI(?: providers)?\b/gi, "hosted AI providers").replace(/\bhosted AI providers\s+hosted AI\b/gi, "hosted AI providers").replace(/\bhosted AI providers\s+providers\b/gi, "hosted AI providers");
-  } while (sanitized !== previous);
-  return sanitized.trim();
-}
-function publicDiscoveryEnvVars(_skillName, envVars) {
-  return envVars;
-}
-function publicDiscoveryDependencies(_skillName, dependencies) {
-  return dependencies;
-}
-function publicDiscoveryDocumentation(_skill, documentation) {
-  return documentation;
-}
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
 // src/lib/tool-primitives.ts
 var TOOL_PRIMITIVE_SCHEMA_VERSION = 1;
 var TOOL_PRIMITIVES = [
@@ -27119,22 +27742,20 @@ function compactRemoteRun(run) {
 }
 
 // src/mcp/helpers.ts
+init_fleet_credentials();
+async function readSurface(body) {
+  try {
+    return await body();
+  } catch (error2) {
+    if (isSkillsFleetCredentialError(error2))
+      return mcpError("AUTH_REQUIRED", error2.message, ["skills auth login"]);
+    throw error2;
+  }
+}
 function stripNulls(obj) {
   return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== null && v !== undefined && !(Array.isArray(v) && v.length === 0)));
 }
 var searchCache = new Map;
-var CACHE_MAX = 100;
-function cacheGet(key) {
-  return searchCache.get(key);
-}
-function cacheSet(key, value) {
-  if (searchCache.size >= CACHE_MAX) {
-    const first = searchCache.keys().next().value;
-    if (first !== undefined)
-      searchCache.delete(first);
-  }
-  searchCache.set(key, value);
-}
 function cacheClear() {
   searchCache.clear();
 }
@@ -27174,9 +27795,10 @@ function registerDiscoveryTools(server) {
       limit: exports_external.number().optional(),
       offset: exports_external.number().optional()
     }
-  }, async ({ category, profile, detail, limit, offset }) => {
+  }, async ({ category, profile, detail, limit, offset }) => readSurface(async () => {
     const selectedProfile = profile || "basic";
-    const skills = category ? loadRegistryProfile(selectedProfile).filter((s) => s.category === category) : loadRegistryProfile(selectedProfile);
+    const registry2 = await getBrowseRegistry({ all: selectedProfile === "all" });
+    const skills = category ? registry2.filter((s) => s.category === category) : registry2;
     const mapped = detail ? skills.map(getPublicSkillDiscovery) : skills.map(getCompactSkillDiscovery);
     const page = paginate(mapped, {
       limit: parsePageLimit(limit, DEFAULT_MCP_LIMIT, { max: 100 }),
@@ -27192,7 +27814,7 @@ function registerDiscoveryTools(server) {
       nextArguments: page.hasMore ? { profile: selectedProfile, category, detail: Boolean(detail), limit: page.limit, offset: page.nextOffset } : null,
       detailHint: detail ? undefined : "Set detail:true for full public skill objects, or call get_skill_info for one skill."
     });
-  });
+  }));
   server.registerTool("list_pinned_skills", {
     title: "List Pinned Skills",
     description: "List skills pinned in the current project's .skills/project.json.",
@@ -27216,13 +27838,9 @@ function registerDiscoveryTools(server) {
       limit: exports_external.number().optional(),
       offset: exports_external.number().optional()
     }
-  }, async ({ query, profile, detail, limit, offset }) => {
+  }, async ({ query, profile, detail, limit, offset }) => readSurface(async () => {
     const selectedProfile = profile || "basic";
-    const cacheKey = `${selectedProfile}:${query}:${detail ?? false}`;
-    const cached2 = cacheGet(cacheKey);
-    const results = cached2 ? cached2 : searchSkills(query, loadRegistryProfile(selectedProfile));
-    if (!cached2)
-      cacheSet(cacheKey, results);
+    const results = searchSkills(query, await getBrowseRegistry({ all: selectedProfile === "all" }));
     const out = detail ? results.map(getPublicSkillDiscovery) : results.map(getCompactSkillDiscovery);
     const page = paginate(out, {
       limit: parsePageLimit(limit, DEFAULT_MCP_LIMIT, { max: 100 }),
@@ -27238,14 +27856,15 @@ function registerDiscoveryTools(server) {
       nextArguments: page.hasMore ? { query, profile: selectedProfile, detail: Boolean(detail), limit: page.limit, offset: page.nextOffset } : null,
       detailHint: detail ? undefined : "Set detail:true for full public skill objects, or call get_skill_info for one skill."
     });
-  });
+  }));
   server.registerTool("get_skill_info", {
     title: "Get Skill Info",
     description: "Get skill metadata, env vars, and dependencies.",
     inputSchema: {
       name: exports_external.string()
     }
-  }, async ({ name }) => {
+  }, async ({ name }) => readSurface(async () => {
+    await requireSkillsReadAccess();
     const skill = getSkill(name);
     if (!skill) {
       return mcpError("SKILL_NOT_FOUND", `Skill '${name}' not found`, findSimilarSkills(name));
@@ -27265,20 +27884,21 @@ function registerDiscoveryTools(server) {
     return {
       content: [{ type: "text", text: JSON.stringify(result) }]
     };
-  });
+  }));
   server.registerTool("get_skill_docs", {
     title: "Get Skill Docs",
     description: "Get skill documentation (SKILL.md > README.md > CLAUDE.md).",
     inputSchema: {
       name: exports_external.string()
     }
-  }, async ({ name }) => {
+  }, async ({ name }) => readSurface(async () => {
+    await requireSkillsReadAccess();
     const doc2 = getSkillBestDoc(name);
     if (!doc2) {
       return mcpError("NO_DOCS", `No documentation found for '${name}'`);
     }
     return { content: [{ type: "text", text: doc2 }] };
-  });
+  }));
   server.registerTool("list_tool_primitives", {
     title: "List Tool Primitives",
     description: "List primitive tools that skills depend on across CLI, MCP, API, and hosted worker execution.",
@@ -27324,25 +27944,74 @@ function registerDiscoveryTools(server) {
 }
 
 // src/mcp/operation-tools.ts
-import { existsSync as existsSync13, readdirSync as readdirSync8, statSync as statSync8 } from "fs";
+import { existsSync as existsSync14, readdirSync as readdirSync8, statSync as statSync9 } from "fs";
 import { join as join14 } from "path";
 
+// src/lib/credential-state.ts
+init_auth_store();
+init_fleet_credentials();
+function describeCredentialState() {
+  let credentialsFile = null;
+  let mode = null;
+  try {
+    credentialsFile = getAuthFilePath();
+    const bits = credentialFileMode();
+    mode = bits === null ? null : `0${bits.toString(8).padStart(3, "0")}`;
+  } catch {}
+  try {
+    const fleet = resolveSkillsFleet();
+    if (fleet.mode === "hosted") {
+      return {
+        mode: "hosted",
+        apiUrl: fleet.apiOrigin,
+        apiUrlSource: fleet.apiUrlSource,
+        apiKeySource: fleet.apiKeySource,
+        apiKeyTier: fleet.apiKeyTier,
+        credentialsFile,
+        credentialsFileMode: mode,
+        error: null
+      };
+    }
+    return {
+      mode: "local",
+      apiUrl: null,
+      apiUrlSource: null,
+      apiKeySource: null,
+      apiKeyTier: null,
+      credentialsFile,
+      credentialsFileMode: mode,
+      error: null
+    };
+  } catch (error2) {
+    return {
+      mode: "misconfigured",
+      apiUrl: null,
+      apiUrlSource: null,
+      apiKeySource: null,
+      apiKeyTier: null,
+      credentialsFile,
+      credentialsFileMode: mode,
+      error: error2.message
+    };
+  }
+}
+
 // src/lib/run-state.ts
 import { createHash as createHash2, randomBytes } from "crypto";
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync10, readdirSync as readdirSync7, statSync as statSync7, writeFileSync as writeFileSync5 } from "fs";
-import { extname, join as join12, relative as relative2 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync6, readFileSync as readFileSync12, readdirSync as readdirSync7, statSync as statSync8, writeFileSync as writeFileSync6 } from "fs";
+import { extname, join as join13, relative as relative2 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now = new Date;
   const id = createRunId(now);
   const day = now.toISOString().slice(0, 10);
   const skillName = normalizeSkillName(params.skill);
   const root = getProjectStateDir(targetDir);
-  const runDir = join12(root, "runs", day, id);
-  const logsDir = join12(runDir, "logs");
-  const exportDir = join12(root, "exports", skillName, id);
-  mkdirSync5(logsDir, { recursive: true });
-  mkdirSync5(exportDir, { recursive: true });
-  mkdirSync5(join12(root, "tmp"), { recursive: true });
+  const runDir = join13(root, "runs", day, id);
+  const logsDir = join13(runDir, "logs");
+  const exportDir = join13(root, "exports", skillName, id);
+  mkdirSync6(logsDir, { recursive: true });
+  mkdirSync6(exportDir, { recursive: true });
+  mkdirSync6(join13(root, "tmp"), { recursive: true });
   const record3 = {
     id,
     skill: skillName,
@@ -27394,22 +28063,22 @@ function updateSkillRun(context, patch) {
   return context.record;
 }
 function writeRunLogs(context, stdout = "", stderr = "") {
-  writeFileSync5(join12(context.logsDir, "stdout.log"), stdout);
-  writeFileSync5(join12(context.logsDir, "stderr.log"), stderr);
+  writeFileSync6(join13(context.logsDir, "stdout.log"), stdout);
+  writeFileSync6(join13(context.logsDir, "stderr.log"), stderr);
 }
 function appendRunEvent(context, event, data = {}) {
   const line = JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + `
 `;
-  const path = join12(context.runDir, "events.ndjson");
-  const previous = existsSync12(path) ? readFileSync10(path, "utf-8") : "";
-  writeFileSync5(path, previous + line);
+  const path = join13(context.runDir, "events.ndjson");
+  const previous = existsSync13(path) ? readFileSync12(path, "utf-8") : "";
+  writeFileSync6(path, previous + line);
 }
 function findSkillRun(runId, targetDir = process.cwd()) {
-  const runsRoot = join12(getProjectStateDir(targetDir), "runs");
-  if (!existsSync12(runsRoot))
+  const runsRoot = join13(getProjectStateDir(targetDir), "runs");
+  if (!existsSync13(runsRoot))
     return null;
   for (const day of readdirSync7(runsRoot)) {
-    const record3 = readRunRecord(join12(runsRoot, day, runId));
+    const record3 = readRunRecord(join13(runsRoot, day, runId));
     if (record3)
       return record3;
   }
@@ -27426,20 +28095,20 @@ function skillRunEnv(context) {
   };
 }
 function writeRunRecord(context) {
-  writeFileSync5(join12(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
+  writeFileSync6(join13(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
 `);
 }
 function writeArtifactsManifest(context, artifacts) {
-  writeFileSync5(join12(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
+  writeFileSync6(join13(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
 `);
 }
 function collectRunArtifacts(context) {
-  if (!existsSync12(context.exportDir))
+  if (!existsSync13(context.exportDir))
     return [];
   const artifacts = [];
   for (const path of walkFiles(context.exportDir)) {
-    const stat = statSync7(path);
-    const bytes = readFileSync10(path);
+    const stat = statSync8(path);
+    const bytes = readFileSync12(path);
     artifacts.push({
       path: toProjectRelative(context.targetDir, path),
       mime: mimeForPath(path),
@@ -27450,11 +28119,11 @@ function collectRunArtifacts(context) {
   return artifacts.sort((a, b) => a.path.localeCompare(b.path));
 }
 function readRunRecord(runDir) {
-  const path = join12(runDir, "run.json");
-  if (!existsSync12(path))
+  const path = join13(runDir, "run.json");
+  if (!existsSync13(path))
     return null;
   try {
-    return JSON.parse(readFileSync10(path, "utf-8"));
+    return JSON.parse(readFileSync12(path, "utf-8"));
   } catch {
     return null;
   }
@@ -27462,8 +28131,8 @@ function readRunRecord(runDir) {
 function walkFiles(dir) {
   const files = [];
   for (const entry of readdirSync7(dir)) {
-    const full = join12(dir, entry);
-    if (statSync7(full).isDirectory())
+    const full = join13(dir, entry);
+    if (statSync8(full).isDirectory())
       files.push(...walkFiles(full));
     else
       files.push(full);
@@ -27536,17 +28205,20 @@ async function resolveConfiguredRunRouting(skill, env = process.env) {
   try {
     connection = await resolveSkillsConnection(env);
   } catch (error2) {
-    const isMissingCredential = (error2 instanceof SkillsFleetCredentialError || error2?.name === "SkillsFleetCredentialError") && error2.code === "MISSING_API_CREDENTIAL";
+    const isMissingCredential = isSkillsFleetCredentialError2(error2) && error2.code === "MISSING_API_CREDENTIAL";
     if (!isMissingCredential)
       throw error2;
     return {
       route: "error",
       code: "REMOTE_REQUIRES_CREDENTIAL",
-      error: `${skill.name} is a server-owned skill. ${error2.message}`
+      error: skill.serverOwned ? `${skill.name} is a server-owned skill. ${error2.message}` : `${skill.name} cannot run: ${error2.message}`
     };
   }
   return resolveRunRouting(skill, connection?.apiKey, connection?.apiOrigin);
 }
+function isSkillsFleetCredentialError2(error2) {
+  return typeof error2 === "object" && error2 !== null && error2.name === "SkillsFleetCredentialError";
+}
 
 // src/mcp/operation-tools.ts
 function registerOperationTools(server) {
@@ -27709,39 +28381,42 @@ function registerOperationTools(server) {
   server.registerTool("list_categories", {
     title: "List Categories",
     description: "List all 17 skill categories with skill counts."
-  }, async () => {
-    const cats = CATEGORIES.map((category) => ({
+  }, async () => readSurface(async () => {
+    const registry2 = await getBrowseRegistry({ all: true });
+    const extras = Array.from(new Set(registry2.map((skill) => skill.category))).filter((category) => !CATEGORIES.includes(category)).sort();
+    const cats = [...CATEGORIES, ...extras].map((category) => ({
       name: category,
-      count: getSkillsByCategory(category).length
+      count: registry2.filter((skill) => skill.category === category).length
     }));
     return { content: [{ type: "text", text: JSON.stringify(cats, null, 2) }] };
-  });
+  }));
   server.registerTool("list_tags", {
     title: "List Tags",
     description: "List all unique skill tags with occurrence counts."
-  }, async () => {
+  }, async () => readSurface(async () => {
     const tagCounts = new Map;
-    for (const skill of loadRegistry()) {
+    for (const skill of await getBrowseRegistry({ all: true })) {
       for (const tag of skill.tags) {
         tagCounts.set(tag, (tagCounts.get(tag) ?? 0) + 1);
       }
     }
     const sorted = Array.from(tagCounts.entries()).sort(([a], [b]) => a.localeCompare(b)).map(([name, count]) => ({ name, count }));
     return { content: [{ type: "text", text: JSON.stringify(sorted, null, 2) }] };
-  });
+  }));
   server.registerTool("get_requirements", {
     title: "Get Requirements",
     description: "Get env vars, system deps, and npm dependencies for a skill.",
     inputSchema: {
       name: exports_external.string()
     }
-  }, async ({ name }) => {
+  }, async ({ name }) => readSurface(async () => {
+    await requireSkillsReadAccess();
     const reqs = getSkillRequirements(name);
     if (!reqs) {
       return mcpError("SKILL_NOT_FOUND", `Skill '${name}' not found`, findSimilarSkills(name));
     }
     return { content: [{ type: "text", text: JSON.stringify(reqs, null, 2) }] };
-  });
+  }));
   server.registerTool("run_skill", {
     title: "Run Skill",
     description: "Run a skill by name with optional arguments.",
@@ -27783,20 +28458,16 @@ function registerOperationTools(server) {
     } catch (error2) {
       return mcpError("INVALID_INPUT_FILES", error2.message);
     }
+    if (routing.route === "error") {
+      const suggestions = routing.code === "REMOTE_REQUIRES_ORIGIN" ? ["skills setup --api-url <url>", "skills auth login"] : ["skills auth login"];
+      return mcpError(routing.code, routing.error, suggestions);
+    }
     const runContext = createSkillRun({
       skill: skillName,
       args: runArgs,
       remote: routing.route === "remote",
       ...routing.route === "remote" ? { remoteApiOrigin: routing.apiOrigin } : {}
     });
-    if (routing.route === "error") {
-      const error2 = routing.error;
-      writeRunLogs(runContext, "", error2 + `
-`);
-      const run = completeSkillRun(runContext, { status: "failed", error: error2 });
-      const suggestions = routing.code === "REMOTE_REQUIRES_ORIGIN" ? ["skills setup --api-url <url>", "skills auth login"] : ["skills auth login"];
-      return mcpError(routing.code, `${error2}. Local run metadata: ${run.paths.runDir}/run.json`, suggestions);
-    }
     if (routing.route === "remote") {
       try {
         const { RemoteSkillsClient: RemoteSkillsClient2 } = await Promise.resolve().then(() => (init_remote_client(), exports_remote_client));
@@ -27953,21 +28624,22 @@ function registerOperationTools(server) {
   });
   server.registerTool("whoami", {
     title: "Skills Whoami",
-    description: "Show setup summary: version, pinned skills, agent configs, cwd."
+    description: "Show setup summary: version, pinned skills, agent configs, cwd, and the credential/transport SOURCES (never values)."
   }, async () => {
     const version2 = package_default.version;
     const cwd = process.cwd();
+    const credential = describeCredentialState();
     const installed = getInstalledSkills();
     const agents = [];
     for (const agent of AGENT_TARGETS) {
       const agentSkillsPath = getAgentSkillsDir(agent, "global");
-      const exists = existsSync13(agentSkillsPath);
+      const exists = existsSync14(agentSkillsPath);
       let skillCount = 0;
       if (exists) {
         try {
           skillCount = readdirSync8(agentSkillsPath).filter((f) => {
             const full = join14(agentSkillsPath, f);
-            return !f.startsWith(".") && statSync8(full).isDirectory();
+            return !f.startsWith(".") && statSync9(full).isDirectory();
           }).length;
         } catch {}
       }
@@ -27980,7 +28652,8 @@ function registerOperationTools(server) {
       installed,
       agents,
       skillsDir,
-      cwd
+      cwd,
+      credential
     };
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
@@ -28012,29 +28685,17 @@ function compactRunToolPayload(payload, detailHint) {
 }
 
 // src/lib/feedback.ts
-import { appendFileSync, existsSync as existsSync14, mkdirSync as mkdirSync6 } from "fs";
+import { appendFileSync, existsSync as existsSync15, mkdirSync as mkdirSync7 } from "fs";
 import { dirname as dirname5, join as join15 } from "path";
 import { Database } from "bun:sqlite";
-
-// src/lib/api-url.ts
-init_fleet_credentials();
-init_fleet_credentials();
-var API_URL_ENV_VAR = SKILLS_API_URL_ENV;
-var MISSING_API_URL_HINT = `run: skills auth login, or set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
-function resolveApiUrl(env = process.env, options = {}) {
-  const fleet = resolveSkillsFleet(env, options);
-  return fleet.mode === "hosted" ? fleet.apiOrigin : undefined;
-}
-
-// src/lib/feedback.ts
 function getFeedbackDbPath() {
   return join15(getDataDir(), "skills.db");
 }
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
   const dir = dirname5(dbPath);
-  if (!existsSync14(dir))
-    mkdirSync6(dir, { recursive: true });
+  if (!existsSync15(dir))
+    mkdirSync7(dir, { recursive: true });
   const db = new Database(dbPath);
   db.exec("PRAGMA journal_mode = WAL");
   db.exec([
@@ -28062,8 +28723,8 @@ function saveFeedback(input) {
   if (isApiMode()) {
     const path = join15(getDataDir(), "feedback.jsonl");
     const dir = dirname5(path);
-    if (!existsSync14(dir))
-      mkdirSync6(dir, { recursive: true });
+    if (!existsSync15(dir))
+      mkdirSync7(dir, { recursive: true });
     appendFileSync(path, JSON.stringify({ message, category, email: input.email ?? null, agent: input.agent ?? null, version: input.version ?? null, createdAt: new Date().toISOString() }) + `
 `);
     return { saved: true, category, path };
@@ -28208,16 +28869,16 @@ function registerResourceMetaTools(server) {
 }
 
 // src/lib/scheduler.ts
-import { existsSync as existsSync15, readFileSync as readFileSync12, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync13, writeFileSync as writeFileSync7, mkdirSync as mkdirSync8 } from "fs";
 import { join as join16 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
   return join16(targetDir, ".skills", "schedules.json");
 }
 function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  if (existsSync15(path)) {
+  if (existsSync16(path)) {
     try {
-      return JSON.parse(readFileSync12(path, "utf-8"));
+      return JSON.parse(readFileSync13(path, "utf-8"));
     } catch {}
   }
   return { version: 1, schedules: [] };
@@ -28225,9 +28886,9 @@ function loadSchedules(targetDir = process.cwd()) {
 function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
   const dir = join16(targetDir, ".skills");
-  if (!existsSync15(dir))
-    mkdirSync7(dir, { recursive: true });
-  writeFileSync6(path, JSON.stringify(data, null, 2));
+  if (!existsSync16(dir))
+    mkdirSync8(dir, { recursive: true });
+  writeFileSync7(path, JSON.stringify(data, null, 2));
 }
 function validateCronField(expr, min, max, label) {
   for (const part of expr.split(",")) {
@@ -28487,12 +29148,12 @@ function registerScheduleTools(server) {
 // src/lib/native-storage.ts
 import { createHash as createHash4, createHmac } from "crypto";
 import {
-  existsSync as existsSync16,
-  mkdirSync as mkdirSync8,
-  readFileSync as readFileSync13,
+  existsSync as existsSync17,
+  mkdirSync as mkdirSync9,
+  readFileSync as readFileSync14,
   readdirSync as readdirSync9,
-  statSync as statSync9,
-  writeFileSync as writeFileSync7
+  statSync as statSync10,
+  writeFileSync as writeFileSync8
 } from "fs";
 import { dirname as dirname6, join as join17, normalize as normalize3, relative as relative3, sep as sep2 } from "path";
 var SKILLS_STORAGE_TABLES = [
@@ -28590,9 +29251,9 @@ function getStorageStatus(options = {}) {
 function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
   const projectStateDir = getProjectStateDir(targetDir);
   const files = [];
-  if (existsSync16(projectStateDir)) {
+  if (existsSync17(projectStateDir)) {
     for (const filePath of walkFiles2(projectStateDir)) {
-      const bytes = readFileSync13(filePath);
+      const bytes = readFileSync14(filePath);
       const relativePath = toPosix(relative3(targetDir, filePath));
       files.push({
         path: relativePath,
@@ -28675,7 +29336,7 @@ function walkFiles2(dir) {
   const files = [];
   for (const entry of readdirSync9(dir)) {
     const full = join17(dir, entry);
-    const stats = statSync9(full);
+    const stats = statSync10(full);
     if (stats.isDirectory())
       files.push(...walkFiles2(full));
     else
@@ -28730,6 +29391,8 @@ function registerStorageTools(server) {
 }
 
 // src/lib/remote-auth.ts
+init_remote_workspace();
+init_remote_workspace();
 init_remote_client();
 init_fleet_credentials();
 var MAX_ERROR_DETAIL_LENGTH = 200;
@@ -28771,10 +29434,10 @@ async function requestAuthApi(instance, path, options) {
   const text = await res.text();
   const body = text ? parseJsonBody(text) : {};
   if (!res.ok) {
-    const record3 = isRecord4(body) ? body : {};
-    const detail = typeof record3.detail === "string" ? record3.detail : undefined;
-    const error2 = typeof record3.error === "string" ? record3.error : undefined;
-    const code = typeof record3.code === "string" ? record3.code : undefined;
+    const record4 = isRecord5(body) ? body : {};
+    const detail = typeof record4.detail === "string" ? record4.detail : undefined;
+    const error2 = typeof record4.error === "string" ? record4.error : undefined;
+    const code = typeof record4.code === "string" ? record4.code : undefined;
     throw new HostedApiError(detail || error2 || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -28799,7 +29462,7 @@ function condenseErrorBody(text) {
     return collapsed;
   return `${collapsed.slice(0, MAX_ERROR_DETAIL_LENGTH - 1).trimEnd()}\u2026`;
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 
@@ -28821,12 +29484,13 @@ class RemoteSkillsAuthClient {
     return this.request("/api/auth/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) });
   }
   async sessionClient(email2, code) {
+    const apiOrigin = this.apiOrigin;
     if (!email2.includes("@") || !/^\d{6}$/.test(code))
-      throw new Error("Fresh email and six-digit verification code are required to manage API keys");
+      throw new Error("Fresh email and six-digit verification code are required to manage this account");
     const login = await this.verifyCode(email2, code);
     if (!login || typeof login.token !== "string" || !login.token)
       throw new Error("The server did not return an authorized account session");
-    return new RemoteSkillsClient(login.token, this.apiOrigin);
+    return new RemoteSkillsClient(login.token, apiOrigin);
   }
   async createApiKey(email2, code, name, scopes) {
     return (await this.sessionClient(email2, code)).createApiKey(name, scopes);
@@ -28837,6 +29501,26 @@ class RemoteSkillsAuthClient {
   async revokeApiKey(email2, code, keyId) {
     return (await this.sessionClient(email2, code)).revokeApiKey(keyId);
   }
+  async updateProfile(email2, code, input) {
+    customerNamePatch(input, "displayName");
+    return (await this.sessionClient(email2, code)).updateProfile(input);
+  }
+  async updateCurrentWorkspace(email2, code, input) {
+    customerNamePatch(input, "name");
+    return (await this.sessionClient(email2, code)).updateCurrentWorkspace(input);
+  }
+  async listWorkspaceMembers(email2, code, options = {}) {
+    workspaceMembersQuery(options);
+    return (await this.sessionClient(email2, code)).listWorkspaceMembers(options);
+  }
+  async setWorkspaceMemberRole(email2, code, membershipId, input) {
+    const captured = workspaceMemberRoleInput(membershipId, input);
+    return (await this.sessionClient(email2, code)).setWorkspaceMemberRole(captured.membershipId, captured.body);
+  }
+  async removeWorkspaceMember(email2, code, membershipId, input) {
+    const captured = workspaceMemberRemovalInput(membershipId, input);
+    return (await this.sessionClient(email2, code)).removeWorkspaceMember(captured.membershipId, captured.body);
+  }
   request(path, options) {
     if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
       throw new Error("Unsupported authentication operation");
@@ -28848,6 +29532,65 @@ class RemoteSkillsAuthClient {
 init_auth_store();
 init_remote_client();
 function registerRemoteCustomerTools(server) {
+  const memberRole = exports_external.enum(["owner", "admin", "member", "viewer"]);
+  const memberInput = {
+    membershipId: exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/),
+    expectedRole: memberRole,
+    email: exports_external.string().email(),
+    code: exports_external.string().regex(/^\d{6}$/)
+  };
+  server.registerTool("set_workspace_member_role", {
+    title: "Set Current Workspace Member Role",
+    description: "Change exactly this membership incarnation with its observed expectedRole and fresh verification. The server enforces owner/admin policy. No automatic refresh or retry; saved credentials stay unchanged.",
+    inputSchema: exports_external.object({ ...memberInput, role: memberRole }).strict()
+  }, async ({ membershipId, role, expectedRole, email: email2, code }) => {
+    try {
+      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("Set workspace member role")).setWorkspaceMemberRole(email2, code, membershipId, { role, expectedRole }));
+    } catch (error2) {
+      return memberError(error2);
+    }
+  });
+  server.registerTool("remove_workspace_member", {
+    title: "Remove Current Workspace Member",
+    description: "Remove exactly this membership incarnation using its observed expectedRole and fresh verification. Self-removal is unavailable. A retry cannot remove a later replacement membership; saved credentials stay unchanged.",
+    inputSchema: exports_external.object(memberInput).strict()
+  }, async ({ membershipId, expectedRole, email: email2, code }) => {
+    try {
+      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("Remove workspace member")).removeWorkspaceMember(email2, code, membershipId, { expectedRole }));
+    } catch (error2) {
+      return memberError(error2);
+    }
+  });
+  server.registerTool("list_workspace_members", {
+    title: "List Current Workspace Members",
+    description: "Read one roster page on the selected Skills server using fresh owner/admin email verification. Saved credentials are unchanged. This does not invite, change or switch members/workspaces.",
+    inputSchema: exports_external.object({
+      email: exports_external.string().email(),
+      code: exports_external.string().regex(/^\d{6}$/),
+      limit: exports_external.number().int().min(1).max(100).optional(),
+      cursor: exports_external.string().regex(/^[A-Za-z0-9_-]{1,512}$/).optional()
+    }).strict()
+  }, async ({ email: email2, code, limit, cursor: cursor2 }) => {
+    try {
+      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("List workspace members")).listWorkspaceMembers(email2, code, { limit, cursor: cursor2 }));
+    } catch {
+      return mcpError("WORKSPACE_MEMBERS_FAILED", "Unable to list workspace members. Check the selected server, owner/admin permissions, pagination and fresh verification code.");
+    }
+  });
+  for (const kind of ["profile", "workspace"]) {
+    server.registerTool(kind === "profile" ? "update_account_profile" : "update_workspace_name", {
+      title: kind === "profile" ? "Update Account Display Name" : "Update Workspace Name",
+      description: "Update only the name on the explicitly selected Skills server using fresh email OTP. Workspace changes require an owner/admin. Saved credentials are unchanged.",
+      inputSchema: exports_external.object({ name: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }).strict()
+    }, async ({ name, email: email2, code }) => {
+      try {
+        const client = new RemoteSkillsAuthClient(getApiUrl("Update customer name"));
+        return mcpJson(kind === "profile" ? await client.updateProfile(email2, code, { displayName: name }) : await client.updateCurrentWorkspace(email2, code, { name }));
+      } catch {
+        return mcpError("NAME_UPDATE_FAILED", "Unable to update the name. Check the selected server, name, permissions and fresh verification code.");
+      }
+    });
+  }
   for (const operation of REMOTE_CUSTOMER_OPERATIONS) {
     const inputSchema = {};
     if (operation.parameter)
@@ -28906,6 +29649,9 @@ function registerRemoteCustomerTools(server) {
     return { ...metadata, base64: Buffer.from(bytes).toString("base64") };
   }));
 }
+function memberError(error2) {
+  return error2 instanceof RemoteWorkspaceMemberError ? mcpError(error2.code, error2.message) : mcpError("WORKSPACE_MEMBER_FAILED", "Unable to manage workspace member. Check the selected server and fresh verification, then refresh the roster before another action.");
+}
 async function callRemote(action) {
   try {
     const client = await createRemoteSkillsClient();
@@ -28913,6 +29659,9 @@ async function callRemote(action) {
       return mcpError("AUTH_REQUIRED", "Configure a Skills API and sign in with skills auth login");
     return mcpJson(await action(client));
   } catch (error2) {
+    if (error2 instanceof RemoteCapabilityUnavailableError) {
+      return { ...mcpJson({ code: error2.code, message: error2.message, status: error2.status }), isError: true };
+    }
     return mcpError("REMOTE_REQUEST_FAILED", error2 instanceof Error ? error2.message : "Skills server request failed");
   }
 }
@@ -30383,6 +31132,7 @@ async function startSkillsMcpHttpServer(options = {}) {
 }
 
 // src/mcp/index.ts
+init_fleet_credentials();
 var args = process.argv.slice(2);
 function printHelp() {
   console.log(`Usage: skills-mcp [options]
@@ -30404,7 +31154,18 @@ if (args.includes("--version") || args.includes("-V")) {
   console.log(package_default.version);
   process.exit(0);
 }
+function assertSkillsMcpConfigured(env = process.env) {
+  try {
+    resolveSkillsFleet(env);
+  } catch (error2) {
+    if (!isSkillsFleetCredentialError(error2))
+      throw error2;
+    console.error(error2.message);
+    process.exit(1);
+  }
+}
 async function startMcpStdio() {
+  assertSkillsMcpConfigured();
   const server2 = buildServer();
   await server2.connect(new StdioServerTransport);
 }
@@ -30413,6 +31174,7 @@ async function main() {
     await startMcpStdio();
     return;
   }
+  assertSkillsMcpConfigured();
   const port = parseMcpHttpPort(args);
   await startSkillsMcpHttpServer({ port, hostname: "127.0.0.1" });
 }
@@ -30424,5 +31186,6 @@ if (import.meta.main) {
 }
 export {
   startMcpStdio,
-  buildServer
+  buildServer,
+  assertSkillsMcpConfigured
 };