@usefillo/cli 0.5.0 → 0.8.0

package/dist/index.js

@@ -1,57 +1,1907 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import {
+  chmodSync,
+  cpSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  realpathSync,
+  readdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { randomUUID } from "crypto";
 import { homedir } from "os";
-import { isAbsolute, join, resolve } from "path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "path";
 import { spawn } from "child_process";
-import { pathToFileURL } from "url";
+import { fileURLToPath, pathToFileURL } from "url";
+
+// ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/core.js
+var _a;
+// @__NO_SIDE_EFFECTS__
+function $constructor(name, initializer2, params) {
+  function init2(inst, def) {
+    if (!inst._zod) {
+      Object.defineProperty(inst, "_zod", {
+        value: {
+          def,
+          constr: _,
+          traits: /* @__PURE__ */ new Set()
+        },
+        enumerable: false
+      });
+    }
+    if (inst._zod.traits.has(name)) {
+      return;
+    }
+    inst._zod.traits.add(name);
+    initializer2(inst, def);
+    const proto = _.prototype;
+    const keys = Object.keys(proto);
+    for (let i = 0; i < keys.length; i++) {
+      const k = keys[i];
+      if (!(k in inst)) {
+        inst[k] = proto[k].bind(inst);
+      }
+    }
+  }
+  const Parent = params?.Parent ?? Object;
+  class Definition extends Parent {
+  }
+  Object.defineProperty(Definition, "name", { value: name });
+  function _(def) {
+    var _a2;
+    const inst = params?.Parent ? new Definition() : this;
+    init2(inst, def);
+    (_a2 = inst._zod).deferred ?? (_a2.deferred = []);
+    for (const fn of inst._zod.deferred) {
+      fn();
+    }
+    return inst;
+  }
+  Object.defineProperty(_, "init", { value: init2 });
+  Object.defineProperty(_, Symbol.hasInstance, {
+    value: (inst) => {
+      if (params?.Parent && inst instanceof params.Parent)
+        return true;
+      return inst?._zod?.traits?.has(name);
+    }
+  });
+  Object.defineProperty(_, "name", { value: name });
+  return _;
+}
+var $ZodAsyncError = class extends Error {
+  constructor() {
+    super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);
+  }
+};
+(_a = globalThis).__zod_globalConfig ?? (_a.__zod_globalConfig = {});
+var globalConfig = globalThis.__zod_globalConfig;
+function config(newConfig) {
+  if (newConfig)
+    Object.assign(globalConfig, newConfig);
+  return globalConfig;
+}
+
+// ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/util.js
+function getEnumValues(entries) {
+  const numericValues = Object.values(entries).filter((v) => typeof v === "number");
+  const values = Object.entries(entries).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);
+  return values;
+}
+function jsonStringifyReplacer(_, value) {
+  if (typeof value === "bigint")
+    return value.toString();
+  return value;
+}
+function cached(getter) {
+  const set = false;
+  return {
+    get value() {
+      if (!set) {
+        const value = getter();
+        Object.defineProperty(this, "value", { value });
+        return value;
+      }
+      throw new Error("cached value already set");
+    }
+  };
+}
+function nullish(input) {
+  return input === null || input === void 0;
+}
+function cleanRegex(source) {
+  const start = source.startsWith("^") ? 1 : 0;
+  const end = source.endsWith("$") ? source.length - 1 : source.length;
+  return source.slice(start, end);
+}
+var EVALUATING = /* @__PURE__ */ Symbol("evaluating");
+function defineLazy(object2, key, getter) {
+  let value = void 0;
+  Object.defineProperty(object2, key, {
+    get() {
+      if (value === EVALUATING) {
+        return void 0;
+      }
+      if (value === void 0) {
+        value = EVALUATING;
+        value = getter();
+      }
+      return value;
+    },
+    set(v) {
+      Object.defineProperty(object2, key, {
+        value: v
+        // configurable: true,
+      });
+    },
+    configurable: true
+  });
+}
+var captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {
+};
+function isObject(data) {
+  return typeof data === "object" && data !== null && !Array.isArray(data);
+}
+function isPlainObject(o) {
+  if (isObject(o) === false)
+    return false;
+  const ctor = o.constructor;
+  if (ctor === void 0)
+    return true;
+  if (typeof ctor !== "function")
+    return true;
+  const prot = ctor.prototype;
+  if (isObject(prot) === false)
+    return false;
+  if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) {
+    return false;
+  }
+  return true;
+}
+function shallowClone(o) {
+  if (isPlainObject(o))
+    return { ...o };
+  if (Array.isArray(o))
+    return [...o];
+  if (o instanceof Map)
+    return new Map(o);
+  if (o instanceof Set)
+    return new Set(o);
+  return o;
+}
+var propertyKeyTypes = /* @__PURE__ */ new Set(["string", "number", "symbol"]);
+function escapeRegex(str2) {
+  return str2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function clone(inst, def, params) {
+  const cl = new inst._zod.constr(def ?? inst._zod.def);
+  if (!def || params?.parent)
+    cl._zod.parent = inst;
+  return cl;
+}
+function normalizeParams(_params) {
+  const params = _params;
+  if (!params)
+    return {};
+  if (typeof params === "string")
+    return { error: () => params };
+  if (params?.message !== void 0) {
+    if (params?.error !== void 0)
+      throw new Error("Cannot specify both `message` and `error` params");
+    params.error = params.message;
+  }
+  delete params.message;
+  if (typeof params.error === "string")
+    return { ...params, error: () => params.error };
+  return params;
+}
+function optionalKeys(shape) {
+  return Object.keys(shape).filter((k) => {
+    return shape[k]._zod.optin === "optional" && shape[k]._zod.optout === "optional";
+  });
+}
+var NUMBER_FORMAT_RANGES = {
+  safeint: [Number.MIN_SAFE_INTEGER, Number.MAX_SAFE_INTEGER],
+  int32: [-2147483648, 2147483647],
+  uint32: [0, 4294967295],
+  float32: [-34028234663852886e22, 34028234663852886e22],
+  float64: [-Number.MAX_VALUE, Number.MAX_VALUE]
+};
+function aborted(x, startIndex = 0) {
+  if (x.aborted === true)
+    return true;
+  for (let i = startIndex; i < x.issues.length; i++) {
+    if (x.issues[i]?.continue !== true) {
+      return true;
+    }
+  }
+  return false;
+}
+function explicitlyAborted(x, startIndex = 0) {
+  if (x.aborted === true)
+    return true;
+  for (let i = startIndex; i < x.issues.length; i++) {
+    if (x.issues[i]?.continue === false) {
+      return true;
+    }
+  }
+  return false;
+}
+function prefixIssues(path, issues) {
+  return issues.map((iss) => {
+    var _a2;
+    (_a2 = iss).path ?? (_a2.path = []);
+    iss.path.unshift(path);
+    return iss;
+  });
+}
+function unwrapMessage(message) {
+  return typeof message === "string" ? message : message?.message;
+}
+function finalizeIssue(iss, ctx, config2) {
+  const message = iss.message ? iss.message : unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config2.customError?.(iss)) ?? unwrapMessage(config2.localeError?.(iss)) ?? "Invalid input";
+  const { inst: _inst, continue: _continue, input: _input, ...rest } = iss;
+  rest.path ?? (rest.path = []);
+  rest.message = message;
+  if (ctx?.reportInput) {
+    rest.input = _input;
+  }
+  return rest;
+}
+function getLengthableOrigin(input) {
+  if (Array.isArray(input))
+    return "array";
+  if (typeof input === "string")
+    return "string";
+  return "unknown";
+}
+
+// ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/errors.js
+var initializer = (inst, def) => {
+  inst.name = "$ZodError";
+  Object.defineProperty(inst, "_zod", {
+    value: inst._zod,
+    enumerable: false
+  });
+  Object.defineProperty(inst, "issues", {
+    value: def,
+    enumerable: false
+  });
+  inst.message = JSON.stringify(def, jsonStringifyReplacer, 2);
+  Object.defineProperty(inst, "toString", {
+    value: () => inst.message,
+    enumerable: false
+  });
+};
+var $ZodError = $constructor("$ZodError", initializer);
+var $ZodRealError = $constructor("$ZodError", initializer, { Parent: Error });
+
+// ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/parse.js
+var _parse = (_Err) => (schema, value, _ctx, _params) => {
+  const ctx = _ctx ? { ..._ctx, async: false } : { async: false };
+  const result = schema._zod.run({ value, issues: [] }, ctx);
+  if (result instanceof Promise) {
+    throw new $ZodAsyncError();
+  }
+  if (result.issues.length) {
+    const e = new (_params?.Err ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));
+    captureStackTrace(e, _params?.callee);
+    throw e;
+  }
+  return result.value;
+};
+var parse = /* @__PURE__ */ _parse($ZodRealError);
+var _parseAsync = (_Err) => async (schema, value, _ctx, params) => {
+  const ctx = _ctx ? { ..._ctx, async: true } : { async: true };
+  let result = schema._zod.run({ value, issues: [] }, ctx);
+  if (result instanceof Promise)
+    result = await result;
+  if (result.issues.length) {
+    const e = new (params?.Err ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));
+    captureStackTrace(e, params?.callee);
+    throw e;
+  }
+  return result.value;
+};
+var parseAsync = /* @__PURE__ */ _parseAsync($ZodRealError);
+var _safeParse = (_Err) => (schema, value, _ctx) => {
+  const ctx = _ctx ? { ..._ctx, async: false } : { async: false };
+  const result = schema._zod.run({ value, issues: [] }, ctx);
+  if (result instanceof Promise) {
+    throw new $ZodAsyncError();
+  }
+  return result.issues.length ? {
+    success: false,
+    error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
+  } : { success: true, data: result.value };
+};
+var safeParse = /* @__PURE__ */ _safeParse($ZodRealError);
+var _safeParseAsync = (_Err) => async (schema, value, _ctx) => {
+  const ctx = _ctx ? { ..._ctx, async: true } : { async: true };
+  let result = schema._zod.run({ value, issues: [] }, ctx);
+  if (result instanceof Promise)
+    result = await result;
+  return result.issues.length ? {
+    success: false,
+    error: new _Err(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
+  } : { success: true, data: result.value };
+};
+var safeParseAsync = /* @__PURE__ */ _safeParseAsync($ZodRealError);
+
+// ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/regexes.js
+var email = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
+var dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`;
+var date = /* @__PURE__ */ new RegExp(`^${dateSource}$`);
+var string = (params) => {
+  const regex = params ? `[\\s\\S]{${params?.minimum ?? 0},${params?.maximum ?? ""}}` : `[\\s\\S]*`;
+  return new RegExp(`^${regex}$`);
+};
+var number = /^-?\d+(?:\.\d+)?$/;
+
+// ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/checks.js
+var $ZodCheck = /* @__PURE__ */ $constructor("$ZodCheck", (inst, def) => {
+  var _a2;
+  inst._zod ?? (inst._zod = {});
+  inst._zod.def = def;
+  (_a2 = inst._zod).onattach ?? (_a2.onattach = []);
+});
+var numericOriginMap = {
+  number: "number",
+  bigint: "bigint",
+  object: "date"
+};
+var $ZodCheckGreaterThan = /* @__PURE__ */ $constructor("$ZodCheckGreaterThan", (inst, def) => {
+  $ZodCheck.init(inst, def);
+  const origin = numericOriginMap[typeof def.value];
+  inst._zod.onattach.push((inst2) => {
+    const bag = inst2._zod.bag;
+    const curr = (def.inclusive ? bag.minimum : bag.exclusiveMinimum) ?? Number.NEGATIVE_INFINITY;
+    if (def.value > curr) {
+      if (def.inclusive)
+        bag.minimum = def.value;
+      else
+        bag.exclusiveMinimum = def.value;
+    }
+  });
+  inst._zod.check = (payload) => {
+    if (def.inclusive ? payload.value >= def.value : payload.value > def.value) {
+      return;
+    }
+    payload.issues.push({
+      origin,
+      code: "too_small",
+      minimum: typeof def.value === "object" ? def.value.getTime() : def.value,
+      input: payload.value,
+      inclusive: def.inclusive,
+      inst,
+      continue: !def.abort
+    });
+  };
+});
+var $ZodCheckMaxLength = /* @__PURE__ */ $constructor("$ZodCheckMaxLength", (inst, def) => {
+  var _a2;
+  $ZodCheck.init(inst, def);
+  (_a2 = inst._zod.def).when ?? (_a2.when = (payload) => {
+    const val = payload.value;
+    return !nullish(val) && val.length !== void 0;
+  });
+  inst._zod.onattach.push((inst2) => {
+    const curr = inst2._zod.bag.maximum ?? Number.POSITIVE_INFINITY;
+    if (def.maximum < curr)
+      inst2._zod.bag.maximum = def.maximum;
+  });
+  inst._zod.check = (payload) => {
+    const input = payload.value;
+    const length = input.length;
+    if (length <= def.maximum)
+      return;
+    const origin = getLengthableOrigin(input);
+    payload.issues.push({
+      origin,
+      code: "too_big",
+      maximum: def.maximum,
+      inclusive: true,
+      input,
+      inst,
+      continue: !def.abort
+    });
+  };
+});
+var $ZodCheckMinLength = /* @__PURE__ */ $constructor("$ZodCheckMinLength", (inst, def) => {
+  var _a2;
+  $ZodCheck.init(inst, def);
+  (_a2 = inst._zod.def).when ?? (_a2.when = (payload) => {
+    const val = payload.value;
+    return !nullish(val) && val.length !== void 0;
+  });
+  inst._zod.onattach.push((inst2) => {
+    const curr = inst2._zod.bag.minimum ?? Number.NEGATIVE_INFINITY;
+    if (def.minimum > curr)
+      inst2._zod.bag.minimum = def.minimum;
+  });
+  inst._zod.check = (payload) => {
+    const input = payload.value;
+    const length = input.length;
+    if (length >= def.minimum)
+      return;
+    const origin = getLengthableOrigin(input);
+    payload.issues.push({
+      origin,
+      code: "too_small",
+      minimum: def.minimum,
+      inclusive: true,
+      input,
+      inst,
+      continue: !def.abort
+    });
+  };
+});
+var $ZodCheckStringFormat = /* @__PURE__ */ $constructor("$ZodCheckStringFormat", (inst, def) => {
+  var _a2, _b;
+  $ZodCheck.init(inst, def);
+  inst._zod.onattach.push((inst2) => {
+    const bag = inst2._zod.bag;
+    bag.format = def.format;
+    if (def.pattern) {
+      bag.patterns ?? (bag.patterns = /* @__PURE__ */ new Set());
+      bag.patterns.add(def.pattern);
+    }
+  });
+  if (def.pattern)
+    (_a2 = inst._zod).check ?? (_a2.check = (payload) => {
+      def.pattern.lastIndex = 0;
+      if (def.pattern.test(payload.value))
+        return;
+      payload.issues.push({
+        origin: "string",
+        code: "invalid_format",
+        format: def.format,
+        input: payload.value,
+        ...def.pattern ? { pattern: def.pattern.toString() } : {},
+        inst,
+        continue: !def.abort
+      });
+    });
+  else
+    (_b = inst._zod).check ?? (_b.check = () => {
+    });
+});
+
+// ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/versions.js
+var version = {
+  major: 4,
+  minor: 4,
+  patch: 3
+};
+
+// ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/schemas.js
+var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
+  var _a2;
+  inst ?? (inst = {});
+  inst._zod.def = def;
+  inst._zod.bag = inst._zod.bag || {};
+  inst._zod.version = version;
+  const checks = [...inst._zod.def.checks ?? []];
+  if (inst._zod.traits.has("$ZodCheck")) {
+    checks.unshift(inst);
+  }
+  for (const ch of checks) {
+    for (const fn of ch._zod.onattach) {
+      fn(inst);
+    }
+  }
+  if (checks.length === 0) {
+    (_a2 = inst._zod).deferred ?? (_a2.deferred = []);
+    inst._zod.deferred?.push(() => {
+      inst._zod.run = inst._zod.parse;
+    });
+  } else {
+    const runChecks = (payload, checks2, ctx) => {
+      let isAborted = aborted(payload);
+      let asyncResult;
+      for (const ch of checks2) {
+        if (ch._zod.def.when) {
+          if (explicitlyAborted(payload))
+            continue;
+          const shouldRun = ch._zod.def.when(payload);
+          if (!shouldRun)
+            continue;
+        } else if (isAborted) {
+          continue;
+        }
+        const currLen = payload.issues.length;
+        const _ = ch._zod.check(payload);
+        if (_ instanceof Promise && ctx?.async === false) {
+          throw new $ZodAsyncError();
+        }
+        if (asyncResult || _ instanceof Promise) {
+          asyncResult = (asyncResult ?? Promise.resolve()).then(async () => {
+            await _;
+            const nextLen = payload.issues.length;
+            if (nextLen === currLen)
+              return;
+            if (!isAborted)
+              isAborted = aborted(payload, currLen);
+          });
+        } else {
+          const nextLen = payload.issues.length;
+          if (nextLen === currLen)
+            continue;
+          if (!isAborted)
+            isAborted = aborted(payload, currLen);
+        }
+      }
+      if (asyncResult) {
+        return asyncResult.then(() => {
+          return payload;
+        });
+      }
+      return payload;
+    };
+    const handleCanaryResult = (canary, payload, ctx) => {
+      if (aborted(canary)) {
+        canary.aborted = true;
+        return canary;
+      }
+      const checkResult = runChecks(payload, checks, ctx);
+      if (checkResult instanceof Promise) {
+        if (ctx.async === false)
+          throw new $ZodAsyncError();
+        return checkResult.then((checkResult2) => inst._zod.parse(checkResult2, ctx));
+      }
+      return inst._zod.parse(checkResult, ctx);
+    };
+    inst._zod.run = (payload, ctx) => {
+      if (ctx.skipChecks) {
+        return inst._zod.parse(payload, ctx);
+      }
+      if (ctx.direction === "backward") {
+        const canary = inst._zod.parse({ value: payload.value, issues: [] }, { ...ctx, skipChecks: true });
+        if (canary instanceof Promise) {
+          return canary.then((canary2) => {
+            return handleCanaryResult(canary2, payload, ctx);
+          });
+        }
+        return handleCanaryResult(canary, payload, ctx);
+      }
+      const result = inst._zod.parse(payload, ctx);
+      if (result instanceof Promise) {
+        if (ctx.async === false)
+          throw new $ZodAsyncError();
+        return result.then((result2) => runChecks(result2, checks, ctx));
+      }
+      return runChecks(result, checks, ctx);
+    };
+  }
+  defineLazy(inst, "~standard", () => ({
+    validate: (value) => {
+      try {
+        const r = safeParse(inst, value);
+        return r.success ? { value: r.data } : { issues: r.error?.issues };
+      } catch (_) {
+        return safeParseAsync(inst, value).then((r) => r.success ? { value: r.data } : { issues: r.error?.issues });
+      }
+    },
+    vendor: "zod",
+    version: 1
+  }));
+});
+var $ZodString = /* @__PURE__ */ $constructor("$ZodString", (inst, def) => {
+  $ZodType.init(inst, def);
+  inst._zod.pattern = [...inst?._zod.bag?.patterns ?? []].pop() ?? string(inst._zod.bag);
+  inst._zod.parse = (payload, _) => {
+    if (def.coerce)
+      try {
+        payload.value = String(payload.value);
+      } catch (_2) {
+      }
+    if (typeof payload.value === "string")
+      return payload;
+    payload.issues.push({
+      expected: "string",
+      code: "invalid_type",
+      input: payload.value,
+      inst
+    });
+    return payload;
+  };
+});
+var $ZodStringFormat = /* @__PURE__ */ $constructor("$ZodStringFormat", (inst, def) => {
+  $ZodCheckStringFormat.init(inst, def);
+  $ZodString.init(inst, def);
+});
+var $ZodEmail = /* @__PURE__ */ $constructor("$ZodEmail", (inst, def) => {
+  def.pattern ?? (def.pattern = email);
+  $ZodStringFormat.init(inst, def);
+});
+var $ZodNumber = /* @__PURE__ */ $constructor("$ZodNumber", (inst, def) => {
+  $ZodType.init(inst, def);
+  inst._zod.pattern = inst._zod.bag.pattern ?? number;
+  inst._zod.parse = (payload, _ctx) => {
+    if (def.coerce)
+      try {
+        payload.value = Number(payload.value);
+      } catch (_) {
+      }
+    const input = payload.value;
+    if (typeof input === "number" && !Number.isNaN(input) && Number.isFinite(input)) {
+      return payload;
+    }
+    const received = typeof input === "number" ? Number.isNaN(input) ? "NaN" : !Number.isFinite(input) ? "Infinity" : void 0 : void 0;
+    payload.issues.push({
+      expected: "number",
+      code: "invalid_type",
+      input,
+      inst,
+      ...received ? { received } : {}
+    });
+    return payload;
+  };
+});
+var $ZodUnknown = /* @__PURE__ */ $constructor("$ZodUnknown", (inst, def) => {
+  $ZodType.init(inst, def);
+  inst._zod.parse = (payload) => payload;
+});
+function handleArrayResult(result, final, index) {
+  if (result.issues.length) {
+    final.issues.push(...prefixIssues(index, result.issues));
+  }
+  final.value[index] = result.value;
+}
+var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
+  $ZodType.init(inst, def);
+  inst._zod.parse = (payload, ctx) => {
+    const input = payload.value;
+    if (!Array.isArray(input)) {
+      payload.issues.push({
+        expected: "array",
+        code: "invalid_type",
+        input,
+        inst
+      });
+      return payload;
+    }
+    payload.value = Array(input.length);
+    const proms = [];
+    for (let i = 0; i < input.length; i++) {
+      const item = input[i];
+      const result = def.element._zod.run({
+        value: item,
+        issues: []
+      }, ctx);
+      if (result instanceof Promise) {
+        proms.push(result.then((result2) => handleArrayResult(result2, payload, i)));
+      } else {
+        handleArrayResult(result, payload, i);
+      }
+    }
+    if (proms.length) {
+      return Promise.all(proms).then(() => payload);
+    }
+    return payload;
+  };
+});
+function handlePropertyResult(result, final, key, input, isOptionalIn, isOptionalOut) {
+  const isPresent = key in input;
+  if (result.issues.length) {
+    if (isOptionalIn && isOptionalOut && !isPresent) {
+      return;
+    }
+    final.issues.push(...prefixIssues(key, result.issues));
+  }
+  if (!isPresent && !isOptionalIn) {
+    if (!result.issues.length) {
+      final.issues.push({
+        code: "invalid_type",
+        expected: "nonoptional",
+        input: void 0,
+        path: [key]
+      });
+    }
+    return;
+  }
+  if (result.value === void 0) {
+    if (isPresent) {
+      final.value[key] = void 0;
+    }
+  } else {
+    final.value[key] = result.value;
+  }
+}
+function normalizeDef(def) {
+  const keys = Object.keys(def.shape);
+  for (const k of keys) {
+    if (!def.shape?.[k]?._zod?.traits?.has("$ZodType")) {
+      throw new Error(`Invalid element at key "${k}": expected a Zod schema`);
+    }
+  }
+  const okeys = optionalKeys(def.shape);
+  return {
+    ...def,
+    keys,
+    keySet: new Set(keys),
+    numKeys: keys.length,
+    optionalKeys: new Set(okeys)
+  };
+}
+function handleCatchall(proms, input, payload, ctx, def, inst) {
+  const unrecognized = [];
+  const keySet = def.keySet;
+  const _catchall = def.catchall._zod;
+  const t = _catchall.def.type;
+  const isOptionalIn = _catchall.optin === "optional";
+  const isOptionalOut = _catchall.optout === "optional";
+  for (const key in input) {
+    if (key === "__proto__")
+      continue;
+    if (keySet.has(key))
+      continue;
+    if (t === "never") {
+      unrecognized.push(key);
+      continue;
+    }
+    const r = _catchall.run({ value: input[key], issues: [] }, ctx);
+    if (r instanceof Promise) {
+      proms.push(r.then((r2) => handlePropertyResult(r2, payload, key, input, isOptionalIn, isOptionalOut)));
+    } else {
+      handlePropertyResult(r, payload, key, input, isOptionalIn, isOptionalOut);
+    }
+  }
+  if (unrecognized.length) {
+    payload.issues.push({
+      code: "unrecognized_keys",
+      keys: unrecognized,
+      input,
+      inst
+    });
+  }
+  if (!proms.length)
+    return payload;
+  return Promise.all(proms).then(() => {
+    return payload;
+  });
+}
+var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
+  $ZodType.init(inst, def);
+  const desc = Object.getOwnPropertyDescriptor(def, "shape");
+  if (!desc?.get) {
+    const sh = def.shape;
+    Object.defineProperty(def, "shape", {
+      get: () => {
+        const newSh = { ...sh };
+        Object.defineProperty(def, "shape", {
+          value: newSh
+        });
+        return newSh;
+      }
+    });
+  }
+  const _normalized = cached(() => normalizeDef(def));
+  defineLazy(inst._zod, "propValues", () => {
+    const shape = def.shape;
+    const propValues = {};
+    for (const key in shape) {
+      const field2 = shape[key]._zod;
+      if (field2.values) {
+        propValues[key] ?? (propValues[key] = /* @__PURE__ */ new Set());
+        for (const v of field2.values)
+          propValues[key].add(v);
+      }
+    }
+    return propValues;
+  });
+  const isObject2 = isObject;
+  const catchall = def.catchall;
+  let value;
+  inst._zod.parse = (payload, ctx) => {
+    value ?? (value = _normalized.value);
+    const input = payload.value;
+    if (!isObject2(input)) {
+      payload.issues.push({
+        expected: "object",
+        code: "invalid_type",
+        input,
+        inst
+      });
+      return payload;
+    }
+    payload.value = {};
+    const proms = [];
+    const shape = value.shape;
+    for (const key of value.keys) {
+      const el = shape[key];
+      const isOptionalIn = el._zod.optin === "optional";
+      const isOptionalOut = el._zod.optout === "optional";
+      const r = el._zod.run({ value: input[key], issues: [] }, ctx);
+      if (r instanceof Promise) {
+        proms.push(r.then((r2) => handlePropertyResult(r2, payload, key, input, isOptionalIn, isOptionalOut)));
+      } else {
+        handlePropertyResult(r, payload, key, input, isOptionalIn, isOptionalOut);
+      }
+    }
+    if (!catchall) {
+      return proms.length ? Promise.all(proms).then(() => payload) : payload;
+    }
+    return handleCatchall(proms, input, payload, ctx, _normalized.value, inst);
+  };
+});
+var $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
+  $ZodType.init(inst, def);
+  inst._zod.parse = (payload, ctx) => {
+    const input = payload.value;
+    if (!isPlainObject(input)) {
+      payload.issues.push({
+        expected: "record",
+        code: "invalid_type",
+        input,
+        inst
+      });
+      return payload;
+    }
+    const proms = [];
+    const values = def.keyType._zod.values;
+    if (values) {
+      payload.value = {};
+      const recordKeys = /* @__PURE__ */ new Set();
+      for (const key of values) {
+        if (typeof key === "string" || typeof key === "number" || typeof key === "symbol") {
+          recordKeys.add(typeof key === "number" ? key.toString() : key);
+          const keyResult = def.keyType._zod.run({ value: key, issues: [] }, ctx);
+          if (keyResult instanceof Promise) {
+            throw new Error("Async schemas not supported in object keys currently");
+          }
+          if (keyResult.issues.length) {
+            payload.issues.push({
+              code: "invalid_key",
+              origin: "record",
+              issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
+              input: key,
+              path: [key],
+              inst
+            });
+            continue;
+          }
+          const outKey = keyResult.value;
+          const result = def.valueType._zod.run({ value: input[key], issues: [] }, ctx);
+          if (result instanceof Promise) {
+            proms.push(result.then((result2) => {
+              if (result2.issues.length) {
+                payload.issues.push(...prefixIssues(key, result2.issues));
+              }
+              payload.value[outKey] = result2.value;
+            }));
+          } else {
+            if (result.issues.length) {
+              payload.issues.push(...prefixIssues(key, result.issues));
+            }
+            payload.value[outKey] = result.value;
+          }
+        }
+      }
+      let unrecognized;
+      for (const key in input) {
+        if (!recordKeys.has(key)) {
+          unrecognized = unrecognized ?? [];
+          unrecognized.push(key);
+        }
+      }
+      if (unrecognized && unrecognized.length > 0) {
+        payload.issues.push({
+          code: "unrecognized_keys",
+          input,
+          inst,
+          keys: unrecognized
+        });
+      }
+    } else {
+      payload.value = {};
+      for (const key of Reflect.ownKeys(input)) {
+        if (key === "__proto__")
+          continue;
+        if (!Object.prototype.propertyIsEnumerable.call(input, key))
+          continue;
+        let keyResult = def.keyType._zod.run({ value: key, issues: [] }, ctx);
+        if (keyResult instanceof Promise) {
+          throw new Error("Async schemas not supported in object keys currently");
+        }
+        const checkNumericKey = typeof key === "string" && number.test(key) && keyResult.issues.length;
+        if (checkNumericKey) {
+          const retryResult = def.keyType._zod.run({ value: Number(key), issues: [] }, ctx);
+          if (retryResult instanceof Promise) {
+            throw new Error("Async schemas not supported in object keys currently");
+          }
+          if (retryResult.issues.length === 0) {
+            keyResult = retryResult;
+          }
+        }
+        if (keyResult.issues.length) {
+          if (def.mode === "loose") {
+            payload.value[key] = input[key];
+          } else {
+            payload.issues.push({
+              code: "invalid_key",
+              origin: "record",
+              issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
+              input: key,
+              path: [key],
+              inst
+            });
+          }
+          continue;
+        }
+        const result = def.valueType._zod.run({ value: input[key], issues: [] }, ctx);
+        if (result instanceof Promise) {
+          proms.push(result.then((result2) => {
+            if (result2.issues.length) {
+              payload.issues.push(...prefixIssues(key, result2.issues));
+            }
+            payload.value[keyResult.value] = result2.value;
+          }));
+        } else {
+          if (result.issues.length) {
+            payload.issues.push(...prefixIssues(key, result.issues));
+          }
+          payload.value[keyResult.value] = result.value;
+        }
+      }
+    }
+    if (proms.length) {
+      return Promise.all(proms).then(() => payload);
+    }
+    return payload;
+  };
+});
+var $ZodEnum = /* @__PURE__ */ $constructor("$ZodEnum", (inst, def) => {
+  $ZodType.init(inst, def);
+  const values = getEnumValues(def.entries);
+  const valuesSet = new Set(values);
+  inst._zod.values = valuesSet;
+  inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex(o) : o.toString()).join("|")})$`);
+  inst._zod.parse = (payload, _ctx) => {
+    const input = payload.value;
+    if (valuesSet.has(input)) {
+      return payload;
+    }
+    payload.issues.push({
+      code: "invalid_value",
+      values,
+      input,
+      inst
+    });
+    return payload;
+  };
+});
+var $ZodLiteral = /* @__PURE__ */ $constructor("$ZodLiteral", (inst, def) => {
+  $ZodType.init(inst, def);
+  if (def.values.length === 0) {
+    throw new Error("Cannot create literal schema with no valid values");
+  }
+  const values = new Set(def.values);
+  inst._zod.values = values;
+  inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o)).join("|")})$`);
+  inst._zod.parse = (payload, _ctx) => {
+    const input = payload.value;
+    if (values.has(input)) {
+      return payload;
+    }
+    payload.issues.push({
+      code: "invalid_value",
+      values: def.values,
+      input,
+      inst
+    });
+    return payload;
+  };
+});
+function handleOptionalResult(result, input) {
+  if (input === void 0 && (result.issues.length || result.fallback)) {
+    return { issues: [], value: void 0 };
+  }
+  return result;
+}
+var $ZodOptional = /* @__PURE__ */ $constructor("$ZodOptional", (inst, def) => {
+  $ZodType.init(inst, def);
+  inst._zod.optin = "optional";
+  inst._zod.optout = "optional";
+  defineLazy(inst._zod, "values", () => {
+    return def.innerType._zod.values ? /* @__PURE__ */ new Set([...def.innerType._zod.values, void 0]) : void 0;
+  });
+  defineLazy(inst._zod, "pattern", () => {
+    const pattern = def.innerType._zod.pattern;
+    return pattern ? new RegExp(`^(${cleanRegex(pattern.source)})?$`) : void 0;
+  });
+  inst._zod.parse = (payload, ctx) => {
+    if (def.innerType._zod.optin === "optional") {
+      const input = payload.value;
+      const result = def.innerType._zod.run(payload, ctx);
+      if (result instanceof Promise)
+        return result.then((r) => handleOptionalResult(r, input));
+      return handleOptionalResult(result, input);
+    }
+    if (payload.value === void 0) {
+      return payload;
+    }
+    return def.innerType._zod.run(payload, ctx);
+  };
+});
+var $ZodDefault = /* @__PURE__ */ $constructor("$ZodDefault", (inst, def) => {
+  $ZodType.init(inst, def);
+  inst._zod.optin = "optional";
+  defineLazy(inst._zod, "values", () => def.innerType._zod.values);
+  inst._zod.parse = (payload, ctx) => {
+    if (ctx.direction === "backward") {
+      return def.innerType._zod.run(payload, ctx);
+    }
+    if (payload.value === void 0) {
+      payload.value = def.defaultValue;
+      return payload;
+    }
+    const result = def.innerType._zod.run(payload, ctx);
+    if (result instanceof Promise) {
+      return result.then((result2) => handleDefaultResult(result2, def));
+    }
+    return handleDefaultResult(result, def);
+  };
+});
+function handleDefaultResult(payload, def) {
+  if (payload.value === void 0) {
+    payload.value = def.defaultValue;
+  }
+  return payload;
+}
+
+// ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/api.js
+// @__NO_SIDE_EFFECTS__
+function _string(Class, params) {
+  return new Class({
+    type: "string",
+    ...normalizeParams(params)
+  });
+}
+// @__NO_SIDE_EFFECTS__
+function _email(Class, params) {
+  return new Class({
+    type: "string",
+    format: "email",
+    check: "string_format",
+    abort: false,
+    ...normalizeParams(params)
+  });
+}
+// @__NO_SIDE_EFFECTS__
+function _number(Class, params) {
+  return new Class({
+    type: "number",
+    checks: [],
+    ...normalizeParams(params)
+  });
+}
+// @__NO_SIDE_EFFECTS__
+function _unknown(Class) {
+  return new Class({
+    type: "unknown"
+  });
+}
+// @__NO_SIDE_EFFECTS__
+function _gte(value, params) {
+  return new $ZodCheckGreaterThan({
+    check: "greater_than",
+    ...normalizeParams(params),
+    value,
+    inclusive: true
+  });
+}
+// @__NO_SIDE_EFFECTS__
+function _nonnegative(params) {
+  return /* @__PURE__ */ _gte(0, params);
+}
+// @__NO_SIDE_EFFECTS__
+function _maxLength(maximum, params) {
+  const ch = new $ZodCheckMaxLength({
+    check: "max_length",
+    ...normalizeParams(params),
+    maximum
+  });
+  return ch;
+}
+// @__NO_SIDE_EFFECTS__
+function _minLength(minimum, params) {
+  return new $ZodCheckMinLength({
+    check: "min_length",
+    ...normalizeParams(params),
+    minimum
+  });
+}
+
+// ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/mini/schemas.js
+var ZodMiniType = /* @__PURE__ */ $constructor("ZodMiniType", (inst, def) => {
+  if (!inst._zod)
+    throw new Error("Uninitialized schema in ZodMiniType.");
+  $ZodType.init(inst, def);
+  inst.def = def;
+  inst.type = def.type;
+  inst.parse = (data, params) => parse(inst, data, params, { callee: inst.parse });
+  inst.safeParse = (data, params) => safeParse(inst, data, params);
+  inst.parseAsync = async (data, params) => parseAsync(inst, data, params, { callee: inst.parseAsync });
+  inst.safeParseAsync = async (data, params) => safeParseAsync(inst, data, params);
+  inst.check = (...checks) => {
+    return inst.clone({
+      ...def,
+      checks: [
+        ...def.checks ?? [],
+        ...checks.map((ch) => typeof ch === "function" ? {
+          _zod: { check: ch, def: { check: "custom" }, onattach: [] }
+        } : ch)
+      ]
+    }, { parent: true });
+  };
+  inst.with = inst.check;
+  inst.clone = (_def, params) => clone(inst, _def, params);
+  inst.brand = () => inst;
+  inst.register = ((reg, meta2) => {
+    reg.add(inst, meta2);
+    return inst;
+  });
+  inst.apply = (fn) => fn(inst);
+});
+var ZodMiniString = /* @__PURE__ */ $constructor("ZodMiniString", (inst, def) => {
+  $ZodString.init(inst, def);
+  ZodMiniType.init(inst, def);
+});
+// @__NO_SIDE_EFFECTS__
+function string2(params) {
+  return _string(ZodMiniString, params);
+}
+var ZodMiniStringFormat = /* @__PURE__ */ $constructor("ZodMiniStringFormat", (inst, def) => {
+  $ZodStringFormat.init(inst, def);
+  ZodMiniString.init(inst, def);
+});
+var ZodMiniEmail = /* @__PURE__ */ $constructor("ZodMiniEmail", (inst, def) => {
+  $ZodEmail.init(inst, def);
+  ZodMiniStringFormat.init(inst, def);
+});
+// @__NO_SIDE_EFFECTS__
+function email2(params) {
+  return _email(ZodMiniEmail, params);
+}
+var ZodMiniNumber = /* @__PURE__ */ $constructor("ZodMiniNumber", (inst, def) => {
+  $ZodNumber.init(inst, def);
+  ZodMiniType.init(inst, def);
+});
+// @__NO_SIDE_EFFECTS__
+function number2(params) {
+  return _number(ZodMiniNumber, params);
+}
+var ZodMiniUnknown = /* @__PURE__ */ $constructor("ZodMiniUnknown", (inst, def) => {
+  $ZodUnknown.init(inst, def);
+  ZodMiniType.init(inst, def);
+});
+// @__NO_SIDE_EFFECTS__
+function unknown() {
+  return _unknown(ZodMiniUnknown);
+}
+var ZodMiniArray = /* @__PURE__ */ $constructor("ZodMiniArray", (inst, def) => {
+  $ZodArray.init(inst, def);
+  ZodMiniType.init(inst, def);
+});
+// @__NO_SIDE_EFFECTS__
+function array(element, params) {
+  return new ZodMiniArray({
+    type: "array",
+    element,
+    ...normalizeParams(params)
+  });
+}
+var ZodMiniObject = /* @__PURE__ */ $constructor("ZodMiniObject", (inst, def) => {
+  $ZodObject.init(inst, def);
+  ZodMiniType.init(inst, def);
+  defineLazy(inst, "shape", () => def.shape);
+});
+// @__NO_SIDE_EFFECTS__
+function object(shape, params) {
+  const def = {
+    type: "object",
+    shape: shape ?? {},
+    ...normalizeParams(params)
+  };
+  return new ZodMiniObject(def);
+}
+// @__NO_SIDE_EFFECTS__
+function looseObject(shape, params) {
+  return new ZodMiniObject({
+    type: "object",
+    shape,
+    catchall: /* @__PURE__ */ unknown(),
+    ...normalizeParams(params)
+  });
+}
+var ZodMiniRecord = /* @__PURE__ */ $constructor("ZodMiniRecord", (inst, def) => {
+  $ZodRecord.init(inst, def);
+  ZodMiniType.init(inst, def);
+});
+// @__NO_SIDE_EFFECTS__
+function record(keyType, valueType, params) {
+  if (!valueType || !valueType._zod) {
+    return new ZodMiniRecord({
+      type: "record",
+      keyType: /* @__PURE__ */ string2(),
+      valueType: keyType,
+      ...normalizeParams(valueType)
+    });
+  }
+  return new ZodMiniRecord({
+    type: "record",
+    keyType,
+    valueType,
+    ...normalizeParams(params)
+  });
+}
+var ZodMiniEnum = /* @__PURE__ */ $constructor("ZodMiniEnum", (inst, def) => {
+  $ZodEnum.init(inst, def);
+  ZodMiniType.init(inst, def);
+  inst.options = Object.values(def.entries);
+});
+// @__NO_SIDE_EFFECTS__
+function _enum(values, params) {
+  const entries = Array.isArray(values) ? Object.fromEntries(values.map((v) => [v, v])) : values;
+  return new ZodMiniEnum({
+    type: "enum",
+    entries,
+    ...normalizeParams(params)
+  });
+}
+var ZodMiniLiteral = /* @__PURE__ */ $constructor("ZodMiniLiteral", (inst, def) => {
+  $ZodLiteral.init(inst, def);
+  ZodMiniType.init(inst, def);
+});
+// @__NO_SIDE_EFFECTS__
+function literal(value, params) {
+  return new ZodMiniLiteral({
+    type: "literal",
+    values: Array.isArray(value) ? value : [value],
+    ...normalizeParams(params)
+  });
+}
+var ZodMiniOptional = /* @__PURE__ */ $constructor("ZodMiniOptional", (inst, def) => {
+  $ZodOptional.init(inst, def);
+  ZodMiniType.init(inst, def);
+});
+// @__NO_SIDE_EFFECTS__
+function optional(innerType) {
+  return new ZodMiniOptional({
+    type: "optional",
+    innerType
+  });
+}
+var ZodMiniDefault = /* @__PURE__ */ $constructor("ZodMiniDefault", (inst, def) => {
+  $ZodDefault.init(inst, def);
+  ZodMiniType.init(inst, def);
+});
+// @__NO_SIDE_EFFECTS__
+function _default(innerType, defaultValue) {
+  return new ZodMiniDefault({
+    type: "default",
+    innerType,
+    get defaultValue() {
+      return typeof defaultValue === "function" ? defaultValue() : shallowClone(defaultValue);
+    }
+  });
+}
+
+// ../core/dist/index.js
+var C = (iso2, name, dialCode, lengths = [], groups = [], example = "") => ({ iso2, name, dialCode, lengths, groups, example });
+var PHONE_COUNTRIES = [
+  C("US", "United States", "1", [10], [3, 3, 4], "2015550123"),
+  C("CA", "Canada", "1", [10], [3, 3, 4], "5145550123"),
+  C("GB", "United Kingdom", "44", [10], [4, 6], "7400123456"),
+  C("AU", "Australia", "61", [9], [3, 3, 3], "412345678"),
+  C("DE", "Germany", "49", [10, 11], [4, 7], "15123456789"),
+  C("FR", "France", "33", [9], [1, 2, 2, 2, 2], "612345678"),
+  C("IN", "India", "91", [10], [5, 5], "8123456789"),
+  C("DK", "Denmark", "45", [8], [2, 2, 2, 2], "32123456"),
+  C("SE", "Sweden", "46", [9], [2, 3, 4], "701234567"),
+  C("NO", "Norway", "47", [8], [3, 2, 3], "40612345"),
+  C("FI", "Finland", "358", [9, 10], [2, 3, 4], "412345678"),
+  C("NL", "Netherlands", "31", [9], [1, 4, 4], "612345678"),
+  C("BE", "Belgium", "32", [9], [3, 2, 2, 2], "470123456"),
+  C("ES", "Spain", "34", [9], [3, 3, 3], "612345678"),
+  C("IT", "Italy", "39", [9, 10], [3, 3, 4], "3123456789"),
+  C("PT", "Portugal", "351", [9], [3, 3, 3], "912345678"),
+  C("IE", "Ireland", "353", [9], [2, 3, 4], "851234567"),
+  C("CH", "Switzerland", "41", [9], [2, 3, 2, 2], "781234567"),
+  C("AT", "Austria", "43", [10, 11], [3, 7], "6641234567"),
+  C("PL", "Poland", "48", [9], [3, 3, 3], "512345678"),
+  C("CZ", "Czechia", "420", [9], [3, 3, 3], "601123456"),
+  C("GR", "Greece", "30", [10], [3, 3, 4], "6912345678"),
+  C("RO", "Romania", "40", [9], [3, 3, 3], "712345678"),
+  C("HU", "Hungary", "36", [9], [2, 3, 4], "201234567"),
+  C("UA", "Ukraine", "380", [9], [2, 3, 2, 2], "501234567"),
+  C("RU", "Russia", "7", [10], [3, 3, 2, 2], "9123456789"),
+  C("TR", "Turkey", "90", [10], [3, 3, 2, 2], "5012345678"),
+  C("IL", "Israel", "972", [9], [2, 3, 4], "501234567"),
+  C("AE", "United Arab Emirates", "971", [9], [2, 3, 4], "501234567"),
+  C("SA", "Saudi Arabia", "966", [9], [2, 3, 4], "512345678"),
+  C("ZA", "South Africa", "27", [9], [2, 3, 4], "711234567"),
+  C("NG", "Nigeria", "234", [10], [3, 3, 4], "8021234567"),
+  C("KE", "Kenya", "254", [9], [3, 3, 3], "712123456"),
+  C("EG", "Egypt", "20", [10], [3, 3, 4], "1001234567"),
+  C("BR", "Brazil", "55", [10, 11], [2, 5, 4], "11961234567"),
+  C("MX", "Mexico", "52", [10], [3, 3, 4], "2221234567"),
+  C("AR", "Argentina", "54", [10], [4, 6], "1123456789"),
+  C("CL", "Chile", "56", [9], [1, 4, 4], "221234567"),
+  C("CO", "Colombia", "57", [10], [3, 3, 4], "3211234567"),
+  C("PE", "Peru", "51", [9], [3, 3, 3], "912345678"),
+  C("CN", "China", "86", [11], [3, 4, 4], "13123456789"),
+  C("JP", "Japan", "81", [10], [2, 4, 4], "9012345678"),
+  C("KR", "South Korea", "82", [9, 10], [2, 4, 4], "1023456789"),
+  C("SG", "Singapore", "65", [8], [4, 4], "81234567"),
+  C("HK", "Hong Kong", "852", [8], [4, 4], "51234567"),
+  C("TW", "Taiwan", "886", [9], [3, 3, 3], "912345678"),
+  C("MY", "Malaysia", "60", [9, 10], [2, 3, 4], "123456789"),
+  C("ID", "Indonesia", "62", [10, 11], [3, 4, 4], "81234567890"),
+  C("TH", "Thailand", "66", [9], [2, 3, 4], "812345678"),
+  C("PH", "Philippines", "63", [10], [3, 3, 4], "9171234567"),
+  C("VN", "Vietnam", "84", [9], [3, 3, 3], "912345678"),
+  C("PK", "Pakistan", "92", [10], [3, 3, 4], "3012345678"),
+  C("BD", "Bangladesh", "880", [10], [2, 4, 4], "1812345678"),
+  C("NZ", "New Zealand", "64", [9, 10], [2, 3, 4], "211234567"),
+  C("SK", "Slovakia", "421", [9], [3, 3, 3], "912123456"),
+  C("BG", "Bulgaria", "359", [9], [2, 3, 4], "481234567"),
+  C("HR", "Croatia", "385", [8, 9], [2, 3, 4], "921234567"),
+  C("RS", "Serbia", "381", [8, 9], [2, 3, 4], "601234567"),
+  C("SI", "Slovenia", "386", [8], [2, 3, 3], "31234567"),
+  C("LT", "Lithuania", "370", [8], [3, 2, 3], "61234567"),
+  C("LV", "Latvia", "371", [8], [2, 3, 3], "21234567"),
+  C("EE", "Estonia", "372", [7, 8], [3, 4], "51234567"),
+  C("IS", "Iceland", "354", [7], [3, 4], "6111234"),
+  C("LU", "Luxembourg", "352", [9], [3, 3, 3], "628123456"),
+  C("MA", "Morocco", "212", [9], [3, 3, 3], "650123456"),
+  C("CR", "Costa Rica", "506", [8], [4, 4], "83123456"),
+  C("EC", "Ecuador", "593", [9], [2, 3, 4], "991234567"),
+  C("UY", "Uruguay", "598", [8], [1, 3, 4], "94231234"),
+  C("QA", "Qatar", "974", [8], [4, 4], "33123456"),
+  C("KW", "Kuwait", "965", [8], [4, 4], "50012345")
+];
+var byIso = new Map(PHONE_COUNTRIES.map((c) => [c.iso2, c]));
+var fileValueSchema = object({
+  fileId: string2().check(_minLength(1)),
+  name: string2(),
+  size: number2().check(_nonnegative()),
+  mime: string2(),
+  url: optional(string2())
+});
+var FIELD_KINDS = [
+  "short_text",
+  "long_text",
+  "email",
+  "url",
+  "phone",
+  "number",
+  "select",
+  "multi_select",
+  "dropdown",
+  "checkbox",
+  "rating",
+  "linear_scale",
+  "ranking",
+  "matrix",
+  "signature",
+  "date",
+  "file_upload",
+  "hidden",
+  "custom"
+];
+var CONTENT_KINDS2 = ["heading", "paragraph", "divider"];
+var ALL_KINDS = [...FIELD_KINDS, ...CONTENT_KINDS2];
+var idSchema = string2().check(_minLength(1), _maxLength(128));
+var optionSchema = looseObject({
+  id: idSchema,
+  label: string2().check(_maxLength(1e3)),
+  icon: optional(unknown())
+});
+var blockSchema = looseObject({
+  id: idSchema,
+  kind: _enum(ALL_KINDS),
+  label: optional(string2().check(_maxLength(2e3))),
+  options: optional(array(optionSchema).check(_maxLength(200))),
+  rows: optional(array(optionSchema).check(_maxLength(200))),
+  columns: optional(array(optionSchema).check(_maxLength(200)))
+});
+var pageSchema = object({
+  id: idSchema,
+  title: optional(string2().check(_maxLength(500))),
+  blocks: array(blockSchema).check(_maxLength(500))
+});
+var schemaShape = object({
+  version: literal(1),
+  title: _default(optional(string2().check(_maxLength(2e3))), ""),
+  description: optional(string2().check(_maxLength(5e3))),
+  pages: array(pageSchema).check(_minLength(1), _maxLength(50)),
+  settings: _default(optional(record(string2(), unknown())), {})
+});
+var MAX_SCHEMA_VERSION = 1;
+var FILLO_SCHEMA_VERSION = 1;
+var FILLO_SDK_VERSION = true ? "0.8.0" : "0.0.0-dev";
+function str(value, max, fallback = "") {
+  return typeof value === "string" ? value.trim().slice(0, max) : fallback;
+}
+function optionalStr(value, max) {
+  const s = str(value, max);
+  return s === "" ? void 0 : s;
+}
+function bool(value) {
+  return typeof value === "boolean" ? value : void 0;
+}
+function finite(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function int(value, min, max, fallback) {
+  const n = finite(value);
+  if (n === void 0) return fallback;
+  return Math.max(min, Math.min(max, Math.round(n)));
+}
+function options(value, max = 200) {
+  if (!Array.isArray(value)) return [];
+  return value.slice(0, max).flatMap((item) => {
+    if (!item || typeof item !== "object") return [];
+    const rec = item;
+    const id = str(rec.id, 128);
+    const label = str(rec.label, 1e3);
+    const icon = rec.icon === "thumbs_up" || rec.icon === "thumbs_down" ? rec.icon : void 0;
+    return id && label ? [cleanObject({ id, label, icon })] : [];
+  });
+}
+function duplicateOptionId(items) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const { id } of items) {
+    if (ids.has(id)) return id;
+    ids.add(id);
+  }
+  return void 0;
+}
+function conditions(value) {
+  if (!Array.isArray(value)) return void 0;
+  const normalized = value.slice(0, 20).flatMap((item) => {
+    if (!item || typeof item !== "object") return [];
+    const rec = item;
+    const op = rec.op;
+    if (op !== "eq" && op !== "neq" && op !== "contains" && op !== "gt" && op !== "lt" && op !== "answered" && op !== "not_answered") {
+      return [];
+    }
+    const fieldId = str(rec.fieldId, 128);
+    if (!fieldId) return [];
+    const raw = rec.value;
+    const value2 = typeof raw === "string" || typeof raw === "number" || typeof raw === "boolean" ? raw : void 0;
+    return [{ fieldId, op, ...value2 !== void 0 ? { value: value2 } : {} }];
+  });
+  return normalized.length ? normalized : void 0;
+}
+function baseBlock(rec) {
+  return {
+    id: str(rec.id, 128),
+    visibleIf: conditions(rec.visibleIf)
+  };
+}
+function baseField(rec, kind) {
+  const base = baseBlock(rec);
+  return {
+    ...base,
+    kind,
+    label: str(rec.label, 2e3, "Untitled field"),
+    description: optionalStr(rec.description, 5e3),
+    required: bool(rec.required),
+    placeholder: optionalStr(rec.placeholder, 500)
+  };
+}
+function normalizeUrl(value) {
+  const raw = optionalStr(value, 2e3);
+  if (!raw) return void 0;
+  try {
+    const url = new URL(raw);
+    return url.protocol === "http:" || url.protocol === "https:" ? raw : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function normalizeResponseLimit(value) {
+  if (!value || typeof value !== "object") return void 0;
+  const rec = value;
+  const by = rec.by === "browser" || rec.by === "field" || rec.by === "identify" ? rec.by : void 0;
+  if (!by) return void 0;
+  const field2 = by === "field" ? optionalStr(rec.field, 128) : void 0;
+  if (by === "field" && !field2) return void 0;
+  const scopeField = optionalStr(rec.scopeField, 128);
+  const onRepeat = rec.onRepeat === "update" && by === "identify" ? "update" : "keep";
+  return {
+    by,
+    ...field2 ? { field: field2 } : {},
+    ...scopeField ? { scopeField } : {},
+    onRepeat
+  };
+}
+function normalizeSettings(value) {
+  const rec = value && typeof value === "object" ? value : {};
+  const submitMode = rec.submitMode === "button" || rec.submitMode === "auto" ? rec.submitMode : void 0;
+  return {
+    submitMode,
+    submitLabel: optionalStr(rec.submitLabel, 100),
+    successTitle: optionalStr(rec.successTitle, 200),
+    successMessage: optionalStr(rec.successMessage, 5e3),
+    redirectUrl: normalizeUrl(rec.redirectUrl),
+    showProgress: bool(rec.showProgress),
+    responseLimit: normalizeResponseLimit(rec.responseLimit),
+    notifyEmail: email2().check(_maxLength(254)).safeParse(rec.notifyEmail).success ? rec.notifyEmail : void 0,
+    sendReceipt: bool(rec.sendReceipt),
+    saveProgress: bool(rec.saveProgress),
+    draftAnswersVisible: bool(rec.draftAnswersVisible),
+    resumeEmails: bool(rec.resumeEmails),
+    resumeUrl: normalizeUrl(rec.resumeUrl),
+    draftDigest: bool(rec.draftDigest)
+  };
+}
+function cleanObject(obj) {
+  return Object.fromEntries(Object.entries(obj).filter(([, value]) => value !== void 0));
+}
+function normalizeBlock(input) {
+  if (!input || typeof input !== "object") return null;
+  const rec = input;
+  const kind = rec.kind;
+  const base = baseBlock(rec);
+  if (!base.id || typeof kind !== "string") return null;
+  switch (kind) {
+    case "heading":
+      return cleanObject({ ...base, kind, text: str(rec.text, 2e3, "Section") });
+    case "paragraph":
+      return cleanObject({ ...base, kind, text: str(rec.text, 5e3) });
+    case "divider":
+      return cleanObject({ ...base, kind });
+    case "short_text":
+    case "email":
+    case "url":
+      return cleanObject({
+        ...baseField(rec, kind),
+        maxLength: finite(rec.maxLength) === void 0 ? void 0 : int(rec.maxLength, 1, 2e3, 2e3)
+      });
+    case "phone": {
+      const cc = optionalStr(rec.defaultCountry, 2)?.toUpperCase();
+      return cleanObject({
+        ...baseField(rec, kind),
+        defaultCountry: cc && /^[A-Z]{2}$/.test(cc) ? cc : void 0
+      });
+    }
+    case "long_text":
+      return cleanObject({
+        ...baseField(rec, kind),
+        maxLength: finite(rec.maxLength) === void 0 ? void 0 : int(rec.maxLength, 1, 2e4, 2e4)
+      });
+    case "number":
+      return cleanObject({ ...baseField(rec, kind), min: finite(rec.min), max: finite(rec.max) });
+    case "select":
+    case "multi_select":
+    case "dropdown": {
+      const opts = options(rec.options);
+      if (opts.length === 0) return null;
+      return cleanObject({
+        ...baseField(rec, kind),
+        options: opts,
+        allowOther: bool(rec.allowOther),
+        shuffleOptions: bool(rec.shuffleOptions)
+      });
+    }
+    case "checkbox": {
+      const appearance = rec.appearance === "toggle" ? "toggle" : void 0;
+      return cleanObject({
+        ...baseField(rec, kind),
+        appearance
+      });
+    }
+    case "signature":
+    case "date":
+      return cleanObject(baseField(rec, kind));
+    case "rating": {
+      const max = int(rec.max, 1, 10, 5);
+      return cleanObject({
+        ...baseField(rec, kind),
+        max,
+        insightsMetric: rec.insightsMetric === "csat" && max === 5 ? "csat" : void 0
+      });
+    }
+    case "linear_scale": {
+      const min = int(rec.min, 0, 9, 1);
+      const max = int(rec.max, min + 1, 10, 10);
+      const insightsMetric = rec.insightsMetric === "nps" && min === 0 && max === 10 ? "nps" : rec.insightsMetric === "csat" && min === 1 && max === 5 ? "csat" : void 0;
+      return cleanObject({
+        ...baseField(rec, kind),
+        min,
+        max,
+        minLabel: optionalStr(rec.minLabel, 100),
+        maxLabel: optionalStr(rec.maxLabel, 100),
+        insightsMetric
+      });
+    }
+    case "ranking": {
+      const opts = options(rec.options);
+      if (opts.length < 2) return null;
+      return cleanObject({ ...baseField(rec, kind), options: opts });
+    }
+    case "matrix": {
+      const rows = options(rec.rows);
+      const columns = options(rec.columns);
+      if (rows.length === 0 || columns.length === 0) return null;
+      return cleanObject({ ...baseField(rec, kind), rows, columns });
+    }
+    case "hidden":
+      return cleanObject({
+        ...baseField(rec, kind),
+        // Hidden fields render nothing, so a required one with no matching URL
+        // param / default would be permanently unsubmittable — never required.
+        required: false,
+        paramName: optionalStr(rec.paramName, 128),
+        defaultValue: optionalStr(rec.defaultValue, 1e3)
+      });
+    case "file_upload":
+      return cleanObject({
+        ...baseField(rec, kind),
+        maxFiles: int(rec.maxFiles, 1, 20, 1),
+        maxFileSizeMb: int(rec.maxFileSizeMb, 1, 5e3, 500),
+        accept: Array.isArray(rec.accept) ? rec.accept.flatMap((v) => {
+          const item = optionalStr(v, 100);
+          return item ? [item] : [];
+        }).slice(0, 50) : void 0
+      });
+    case "custom":
+      return cleanObject({
+        ...baseField(rec, kind),
+        component: str(rec.component, 128),
+        config: rec.config && typeof rec.config === "object" && !Array.isArray(rec.config) ? rec.config : void 0
+      });
+    default:
+      return null;
+  }
+}
+function normalizeFormSchema(input) {
+  const parsed = schemaShape.safeParse(input);
+  if (!parsed.success) {
+    const first = parsed.error.issues[0];
+    const path = first?.path.join(".");
+    return { ok: false, error: first ? `${path ? `${path}: ` : ""}${first.message}` : "Invalid schema" };
+  }
+  if (parsed.data.version > MAX_SCHEMA_VERSION) {
+    return { ok: false, error: `Unsupported schema version: ${parsed.data.version}` };
+  }
+  const pages = parsed.data.pages.map((page) => {
+    const blocks = page.blocks.flatMap((raw) => {
+      const block = normalizeBlock(raw);
+      return block ? [block] : [];
+    });
+    return cleanObject({
+      id: str(page.id, 128),
+      title: optionalStr(page.title, 500),
+      blocks
+    });
+  });
+  const pageIds = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Set();
+  for (const page of pages) {
+    if (!page.id) return { ok: false, error: "Page ids cannot be blank" };
+    if (pageIds.has(page.id)) return { ok: false, error: `Duplicate page id: ${page.id}` };
+    pageIds.add(page.id);
+    for (const block of page.blocks) {
+      if (seen.has(block.id)) return { ok: false, error: `Duplicate block id: ${block.id}` };
+      seen.add(block.id);
+      if (block.kind === "number" && block.min !== void 0 && block.max !== void 0 && block.min > block.max) {
+        return { ok: false, error: `Field ${block.id} has min greater than max` };
+      }
+      if (block.kind === "select" || block.kind === "multi_select" || block.kind === "dropdown" || block.kind === "ranking") {
+        const duplicate = duplicateOptionId(block.options);
+        if (duplicate) {
+          return { ok: false, error: `Duplicate option id in field ${block.id}: ${duplicate}` };
+        }
+      } else if (block.kind === "matrix") {
+        const duplicateRow = duplicateOptionId(block.rows);
+        if (duplicateRow) {
+          return { ok: false, error: `Duplicate matrix row id in field ${block.id}: ${duplicateRow}` };
+        }
+        const duplicateColumn = duplicateOptionId(block.columns);
+        if (duplicateColumn) {
+          return {
+            ok: false,
+            error: `Duplicate matrix column id in field ${block.id}: ${duplicateColumn}`
+          };
+        }
+      }
+    }
+  }
+  if (pages.every((page) => page.blocks.length === 0)) {
+    return { ok: false, error: "Schema must contain at least one valid block" };
+  }
+  const schema = {
+    version: FILLO_SCHEMA_VERSION,
+    title: str(parsed.data.title, 2e3),
+    pages,
+    settings: normalizeSettings(parsed.data.settings)
+  };
+  const description = optionalStr(parsed.data.description, 5e3);
+  if (description) schema.description = description;
+  return { ok: true, schema };
+}
+function validateFormSchema(input) {
+  try {
+    return normalizeFormSchema(input);
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : "Invalid schema" };
+  }
+}
+var ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+var MASK = 256 - 256 % ALPHABET.length;
+var S3_PART_TIMEOUT_MS = 5 * 6e4;
+var UPLOAD_CONTROL_TIMEOUT_MS = 10 * 6e4;
+var CLIENT_HEADER = { "X-Fillo-Client": `@usefillo/core@${FILLO_SDK_VERSION}` };
+var FilloJsxError = class extends Error {
+  constructor(code, message) {
+    super(`[fillo] ${message} \u2014 https://fillo.so/docs/troubleshooting#jsx-${code.toLowerCase()}`);
+    this.code = code;
+    this.name = "FilloJsxError";
+  }
+  code;
+};
+var BRAND = /* @__PURE__ */ Symbol.for("fillo.block");
+var FIELD_BASE = ["label", "description", "required", "placeholder"];
+var field = (name, kind, extra, opts = {}) => ({
+  name,
+  kind,
+  props: [...FIELD_BASE, ...extra],
+  ...opts
+});
+var content = (name, kind, textChildren) => ({
+  name,
+  kind,
+  props: textChildren ? ["text"] : [],
+  textChildren,
+  content: true
+});
+var CHOICE_EXTRA = ["options", "allowOther", "shuffleOptions"];
+var JSX_BLOCK_SPECS = [
+  field("Text", "short_text", ["maxLength"]),
+  field("LongText", "long_text", ["maxLength"]),
+  field("Email", "email", ["maxLength"]),
+  field("Url", "url", ["maxLength"]),
+  field("Phone", "phone", ["defaultCountry"]),
+  field("Number", "number", ["min", "max"]),
+  field("Select", "select", CHOICE_EXTRA, { optionChildren: true }),
+  field("MultiSelect", "multi_select", CHOICE_EXTRA, { optionChildren: true }),
+  field("Dropdown", "dropdown", CHOICE_EXTRA, { optionChildren: true }),
+  field("Checkbox", "checkbox", ["appearance"]),
+  field("Rating", "rating", ["max", "insightsMetric"]),
+  field("Scale", "linear_scale", ["min", "max", "minLabel", "maxLabel", "insightsMetric"]),
+  field("Ranking", "ranking", ["options"], { optionChildren: true }),
+  field("Matrix", "matrix", ["rows", "columns"]),
+  field("Signature", "signature", []),
+  field("Date", "date", []),
+  field("FileUpload", "file_upload", ["maxFiles", "maxFileSizeMb", "accept"]),
+  field("Hidden", "hidden", ["paramName", "defaultValue"]),
+  field("Custom", "custom", ["component", "config"]),
+  content("Heading", "heading", true),
+  content("Paragraph", "paragraph", true),
+  { name: "Divider", kind: "divider", props: [], content: true }
+];
+var PAGE_SPEC = { name: "Page", kind: "__page", props: ["title"] };
+var OPTION_SPEC = { name: "Option", kind: "__option", props: ["label", "icon"] };
+function makeInert(spec) {
+  const component = () => {
+    throw new FilloJsxError(
+      "RENDERED_INERT",
+      `<Fillo.${spec.name}> was rendered by React. Fillo fields are schema declarations, valid only inside <Fillo.Form> or Fillo.defineForm(). If this form lives in a server component, move it to a client module ("use client")`
+    );
+  };
+  component[BRAND] = spec;
+  return component;
+}
+var JSX_BLOCK_COMPONENTS = Object.fromEntries([
+  ...JSX_BLOCK_SPECS.map((spec) => [spec.name, makeInert(spec)]),
+  ["Page", makeInert(PAGE_SPEC)],
+  ["Option", makeInert(OPTION_SPEC)]
+]);
+
+// src/index.ts
 var API = (process.env.FILLO_API ?? "https://fillo.so").replace(/\/$/, "");
 var CONFIG_DIR = join(homedir(), ".fillo");
 var CONFIG_PATH = join(CONFIG_DIR, "config.json");
-var bold = (s) => `\x1B[1m${s}\x1B[0m`;
-var dim = (s) => `\x1B[2m${s}\x1B[0m`;
+var BUNDLED_SKILL_DIR = fileURLToPath(new URL("./skill/build-with-fillo", import.meta.url));
+var REQUEST_TIMEOUT_MS = 3e4;
+var MAX_STDIN_SCHEMA_BYTES = 1024 * 1024;
+var SYNC_TOKEN_ENV = "FILLO_SYNC_TOKEN";
+function terminalText(value) {
+  return value.replace(/\b(?:fcli|fsync)_[A-Za-z0-9._~-]+\b/g, "[redacted]").replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").replace(/\s+/g, " ").trim();
+}
+var bold = (s) => `\x1B[1m${terminalText(s)}\x1B[0m`;
+var dim = (s) => `\x1B[2m${terminalText(s)}\x1B[0m`;
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function die(msg) {
-  console.error(`\x1B[31m\u2717\x1B[0m ${msg}`);
+  console.error(`\x1B[31m\u2717\x1B[0m ${terminalText(msg)}`);
   process.exit(1);
 }
 function readConfig() {
   try {
-    return JSON.parse(readFileSync(CONFIG_PATH, "utf8"));
+    const parsed = JSON.parse(readFileSync(CONFIG_PATH, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    const record2 = parsed;
+    return {
+      ...typeof record2.token === "string" ? { token: record2.token } : {},
+      ...typeof record2.tokenApi === "string" ? { tokenApi: record2.tokenApi } : {},
+      ...typeof record2.pk === "string" ? { pk: record2.pk } : {},
+      ...typeof record2.claimUrl === "string" ? { claimUrl: record2.claimUrl } : {}
+    };
   } catch {
     return {};
   }
 }
 function writeConfig(c) {
   mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+  try {
+    chmodSync(CONFIG_DIR, 448);
+  } catch {
+  }
   writeFileSync(CONFIG_PATH, JSON.stringify(c, null, 2), { mode: 384 });
   try {
     chmodSync(CONFIG_PATH, 384);
   } catch {
   }
 }
+function requireTokenFor(apiBase) {
+  const config2 = readConfig();
+  if (typeof config2.token !== "string" || !config2.token) {
+    die("Not logged in. Run `fillo login` first.");
+  }
+  if (typeof config2.tokenApi !== "string" || !config2.tokenApi) {
+    die("This login cannot be used safely. Run `fillo login` again, then retry.");
+  }
+  const tokenApi = config2.tokenApi.replace(/\/$/, "");
+  if (apiBase.replace(/\/$/, "") !== tokenApi) {
+    die(
+      `This login belongs to ${terminalText(tokenApi)}. Log in to the requested Fillo deployment, then try again.`
+    );
+  }
+  return config2.token;
+}
 function requireToken() {
-  const t = readConfig().token;
-  if (!t) die("Not logged in. Run `fillo login` first.");
-  return t;
+  return requireTokenFor(API);
 }
 function openBrowser(url) {
-  if (!/^https?:\/\//i.test(url)) return;
+  let safeUrl;
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return;
+    safeUrl = parsed.toString();
+  } catch {
+    return;
+  }
   try {
     if (process.platform === "win32") {
-      spawn("cmd", ["/c", "start", "", url], { stdio: "ignore", detached: true }).unref();
+      const child = spawn("cmd", ["/c", "start", "", safeUrl], { stdio: "ignore", detached: true });
+      child.on("error", () => {
+      });
+      child.unref();
     } else {
       const cmd = process.platform === "darwin" ? "open" : "xdg-open";
-      spawn(cmd, [url], { stdio: "ignore", detached: true }).unref();
+      const child = spawn(cmd, [safeUrl], { stdio: "ignore", detached: true });
+      child.on("error", () => {
+      });
+      child.unref();
     }
   } catch {
   }
 }
-async function api(path, init2 = {}) {
+async function api(path, init2 = {}, apiBase = API) {
   const { token, ...rest } = init2;
-  return fetch(`${API}/api/v1${path}`, {
+  return fetch(`${apiBase}/api/v1${path}`, {
     ...rest,
+    signal: rest.signal ?? AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     headers: {
       "Content-Type": "application/json",
       ...token ? { Authorization: `Bearer ${token}` } : {},
@@ -59,13 +1909,39 @@ async function api(path, init2 = {}) {
     }
   });
 }
-async function login() {
-  const res = await api("/device/code", { method: "POST" });
+async function readJson(res) {
+  const text = await res.text();
+  try {
+    return text ? JSON.parse(text) : {};
+  } catch {
+    die(`Unexpected non-JSON response from ${API} (${res.status}).`);
+  }
+}
+async function login(flags) {
+  const apiBase = flagString(flags, "api")?.replace(/\/$/, "") ?? API;
+  const run = flagString(flags, "run");
+  const progressToken = flagString(flags, "token");
+  if (Boolean(run) !== Boolean(progressToken)) {
+    die("--run and --token must be provided together for an agent handoff login.");
+  }
+  const res = await api(
+    "/device/code",
+    {
+      method: "POST",
+      ...run ? {
+        body: JSON.stringify({
+          agent_run_id: run,
+          agent_run_token: progressToken
+        })
+      } : {}
+    },
+    apiBase
+  );
   if (!res.ok) die(`Couldn't start login (${res.status}).`);
-  const d = await res.json();
+  const d = await readJson(res);
   console.log(`
   Your code:  ${bold(d.user_code)}`);
-  console.log(`  Approve it at ${d.verification_uri} \u2014 opening your browser\u2026
+  console.log(`  Approve it at ${terminalText(d.verification_uri)} \u2014 opening your browser\u2026
 `);
   openBrowser(d.verification_uri_complete);
   const deadline = Date.now() + d.expires_in * 1e3;
@@ -74,18 +1950,28 @@ async function login() {
   while (Date.now() < deadline) {
     await sleep(interval);
     process.stdout.write(".");
-    const r = await api("/device/token", {
-      method: "POST",
-      body: JSON.stringify({ device_code: d.device_code })
-    });
-    const body = await r.json();
+    const r = await api(
+      "/device/token",
+      {
+        method: "POST",
+        body: JSON.stringify({ device_code: d.device_code })
+      },
+      apiBase
+    );
+    const body = await readJson(r);
+    if (!r.ok && !body.error) die(`
+Login failed (${r.status}).`);
     if (body.access_token) {
-      writeConfig({ token: body.access_token });
+      writeConfig({ ...readConfig(), token: body.access_token, tokenApi: apiBase });
       console.log("\n");
-      await whoami();
-      console.log(`
+      await whoami(apiBase);
+      console.log(
+        run ? `
+  ${dim("Return to the Fillo setup prompt and run its next command.")}
+` : `
   ${dim("Now run:")} fillo push form.json
-`);
+`
+      );
       return;
     }
     if (body.error === "slow_down") interval += 2e3;
@@ -94,23 +1980,49 @@ Login failed: ${body.error}`);
   }
   die("\nLogin timed out \u2014 run `fillo login` again.");
 }
-async function whoami() {
-  const res = await api("/cli/whoami", { token: requireToken() });
+async function whoami(apiBase = API) {
+  const res = await api("/cli/whoami", { token: requireTokenFor(apiBase) }, apiBase);
   if (res.status === 401) die("Token invalid \u2014 run `fillo login` again.");
   if (!res.ok) die(`whoami failed (${res.status}).`);
-  const me = await res.json();
-  console.log(`  \x1B[32m\u2713\x1B[0m ${bold(me.email)}  ${dim("\xB7")}  ${me.workspace}`);
+  const me = await readJson(res);
+  if (typeof me.workspace !== "string" || !terminalText(me.workspace)) {
+    die("Fillo returned an invalid workspace identity.");
+  }
+  console.log(`  \x1B[32m\u2713\x1B[0m Connected to ${bold(terminalText(me.workspace))}`);
 }
 async function list() {
   const res = await api("/cli/forms", { token: requireToken() });
   if (!res.ok) die(`list failed (${res.status}).`);
-  const { forms } = await res.json();
+  const { forms } = await readJson(res);
   if (!forms.length) return console.log("  No forms yet.");
   for (const f of forms) {
-    console.log(`  ${f.status === "published" ? "\x1B[32m\u25CF\x1B[0m" : "\u25CB"} ${f.name}  ${dim(f.id)}`);
+    console.log(
+      `  ${f.status === "published" ? "\x1B[32m\u25CF\x1B[0m" : "\u25CB"} ${terminalText(f.name)}  ${dim(f.id)}`
+    );
   }
 }
 async function loadSchema(file, allowCode) {
+  if (file === "-") {
+    try {
+      const chunks = [];
+      let bytes = 0;
+      for await (const chunk of process.stdin) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        bytes += buffer.byteLength;
+        if (bytes > MAX_STDIN_SCHEMA_BYTES) {
+          die("The schema on stdin is too large (maximum 1 MB).");
+        }
+        chunks.push(buffer);
+      }
+      const input = Buffer.concat(chunks).toString("utf8");
+      if (!input.trim()) die("stdin is empty - pipe one JSON form schema to `fillo push -`.");
+      const parsed = JSON.parse(input);
+      if (parsed == null) die("stdin must contain a form schema.");
+      return parsed;
+    } catch (error) {
+      die(`Couldn't read the schema from stdin: ${error.message}`);
+    }
+  }
   const abs = isAbsolute(file) ? file : resolve(process.cwd(), file);
   if (!abs.endsWith(".json") && !allowCode) {
     die(
@@ -118,9 +2030,19 @@ async function loadSchema(file, allowCode) {
     );
   }
   try {
-    if (abs.endsWith(".json")) return JSON.parse(readFileSync(abs, "utf8"));
+    if (abs.endsWith(".json")) {
+      const parsed = JSON.parse(readFileSync(abs, "utf8"));
+      if (parsed == null) die(`${file} is empty \u2014 it must contain a form schema.`);
+      return parsed;
+    }
     const mod = await import(pathToFileURL(abs).href);
-    return mod.default ?? mod.schema ?? mod.form ?? mod.forms ?? mod.MARKETING_FORMS;
+    const schema = mod.default ?? mod.schema ?? mod.form ?? mod.forms ?? mod.MARKETING_FORMS;
+    if (schema == null) {
+      die(
+        `${file} doesn't export a form schema \u2014 default-export it (or export \`schema\`/\`form\`/\`forms\`) and push again.`
+      );
+    }
+    return schema;
   } catch (e) {
     die(`Couldn't read ${file}: ${e.message}`);
   }
@@ -130,6 +2052,7 @@ function isRecord(value) {
 }
 function toPushItems(value, handle) {
   const values = Array.isArray(value) ? value : [value];
+  if (values.length === 0) die("The schema file contains no forms to push.");
   return values.map((item, index) => {
     if (isRecord(item) && "schema" in item) {
       const ownHandle = typeof item.id === "string" ? item.id : void 0;
@@ -141,81 +2064,198 @@ function toPushItems(value, handle) {
     return { handle, schema: item };
   });
 }
-function printPushed(formId, url, updated, staged) {
+function printPushed(formId, url, updated, draft = false) {
+  const label = draft ? "Created draft" : updated ? "Updated" : "Created";
   console.log(`
-  \x1B[32m\u2713\x1B[0m ${updated ? "Updated" : "Created"} ${bold(formId)}`);
-  if (staged) console.log(`  ${dim("Staged as a draft \u2014 publish it from the dashboard.")}`);
-  else if (url) console.log(`  Live at ${url}`);
-  console.log(`  Embed:  <FilloForm formId="${formId}" />
+  \x1B[32m\u2713\x1B[0m ${label} ${bold(formId)}`);
+  if (draft) console.log(`  ${dim("Review and publish it from the Fillo dashboard.")}`);
+  else if (url) console.log(`  Live at ${terminalText(url)}`);
+  console.log(`  Embed:  <FilloForm formId="${terminalText(formId)}" />
 `);
 }
+function syncError(response, body, credential) {
+  const code = body.syncError?.code ?? body.code;
+  const serverMessage = body.syncError?.message ?? body.error;
+  if (code === "trusted_sync_required") {
+    return `This workspace accepts schema changes only from an authenticated CLI or sync token. Run \`fillo login\`, then retry with \`fillo push <file> --handle <id> --stage\`, or set ${SYNC_TOKEN_ENV} from Settings > Developers.`;
+  }
+  if (response.status === 401 && credential === "sync_token") {
+    return `${SYNC_TOKEN_ENV} was rejected. Create a replacement in Settings > Developers, update the CI secret, and retry.`;
+  }
+  if (response.status === 401 && credential === "account") {
+    return "Your CLI login was rejected. Run `fillo login` again, then retry the staged push.";
+  }
+  return serverMessage ?? `push failed (${response.status}).`;
+}
+function readSyncToken() {
+  const raw = process.env[SYNC_TOKEN_ENV];
+  if (raw === void 0) return void 0;
+  const token = raw.trim();
+  if (!token.startsWith("fsync_") || token.length < 16 || token.length > 512 || /\s/.test(token)) {
+    die(`${SYNC_TOKEN_ENV} must contain a valid fsync_ token from Settings > Developers.`);
+  }
+  return token;
+}
+function requireStableHandle(item) {
+  if (item.handle) return item.handle;
+  die("Staging needs a stable form id. Add --handle <name> or an id beside schema in the input.");
+}
+function printSynced(body, requestedStage) {
+  const formId = body.formId;
+  const changed = body.staged === true || body.status === "draft";
+  const label = changed ? body.status === "draft" ? "Draft ready" : "Staged changes" : requestedStage ? "Checked" : "Synced";
+  console.log(`
+  \x1B[32m\u2713\x1B[0m ${label} for ${bold(formId)}`);
+  if (changed) {
+    console.log(`  ${dim("Review and publish it from the Fillo dashboard.")}`);
+  } else if (requestedStage && body.status === "published") {
+    console.log(`  ${dim("Nothing to stage - the published version already matches.")}`);
+  } else if (body.slug) {
+    console.log(`  Live at ${terminalText(`${API}/f/${body.slug}`)}`);
+  }
+  if (body.warning) console.log(`  ${dim(`Before publishing: ${body.warning}`)}`);
+  console.log(`  Embed:  <FilloForm formId="${terminalText(formId)}" />
+`);
+}
+async function pushWithSync(items, credential, requestedStage) {
+  for (const item of items) {
+    const handle = requireStableHandle(item);
+    const validation = validateFormSchema(item.schema);
+    if (!validation.ok) {
+      die(`Invalid schema for "${handle}" \u2014 ${validation.error ?? "schema is not valid"}`);
+    }
+    const res = await api("/forms/sync", {
+      method: "POST",
+      ...credential.token ? { token: credential.token } : {},
+      body: JSON.stringify({
+        ...credential.key ? { key: credential.key } : {},
+        id: handle,
+        schema: item.schema,
+        theme: item.theme ?? null
+      })
+    });
+    const body = await readJson(res);
+    if (!res.ok || body.syncError || !body.formId) {
+      die(syncError(res, body, credential.kind));
+    }
+    printSynced(body, requestedStage);
+  }
+}
 async function push(file, flags) {
-  if (!file) die("Usage: fillo push <form.json> [--handle name] [--draft] [--allow-code]");
+  if (!file) {
+    die("Usage: fillo push <form.json|-> [--handle name] [--stage] [--allow-code]");
+  }
+  const cfg = readConfig();
+  const explicitStage = flags.stage === true;
+  const legacyDraft = flags.draft === true;
+  const stage = explicitStage || legacyDraft;
+  const syncToken = readSyncToken();
+  if (syncToken && !stage) {
+    die(`${SYNC_TOKEN_ENV} can only stage changes. Add --stage to this push.`);
+  }
+  const accountToken = !syncToken && cfg.token ? requireToken() : void 0;
+  if (!syncToken && !accountToken && stage && cfg.pk) {
+    die(
+      "This local setup is an unclaimed preview, where publishable-key sync applies changes immediately. Omit --stage for the preview, or claim it and run `fillo login` before staging for review."
+    );
+  }
+  if (!syncToken && !accountToken && stage) {
+    die(`To stage changes, run \`fillo login\` or set ${SYNC_TOKEN_ENV} from Settings > Developers.`);
+  }
   const handle = typeof flags.handle === "string" ? flags.handle : void 0;
   const items = toPushItems(await loadSchema(file, flags["allow-code"] === true), handle);
   if (items.length > 1 && handle) die("--handle can only be used when pushing one form.");
-  const cfg = readConfig();
-  if (cfg.token) {
+  if (syncToken) {
+    await pushWithSync(items, { kind: "sync_token", token: syncToken }, true);
+    return;
+  }
+  if (accountToken) {
+    if (stage) {
+      for (const item of items) {
+        if (item.handle || explicitStage || !legacyDraft) {
+          await pushWithSync([item], { kind: "account", token: accountToken }, true);
+          continue;
+        }
+        const res = await api("/cli/forms", {
+          method: "POST",
+          token: accountToken,
+          body: JSON.stringify({
+            schema: item.schema,
+            theme: item.theme ?? null,
+            publish: false
+          })
+        });
+        const body = await readJson(res);
+        if (!res.ok || !body.formId) die(body.error ?? `push failed (${res.status}).`);
+        printPushed(body.formId, body.url, !!body.updated, true);
+      }
+      return;
+    }
     for (const item of items) {
       const res = await api("/cli/forms", {
         method: "POST",
-        token: cfg.token,
+        token: accountToken,
         body: JSON.stringify({
           schema: item.schema,
           theme: item.theme ?? null,
           handle: item.handle,
-          publish: !flags.draft
+          publish: true
         })
       });
-      const body = await res.json();
+      const body = await readJson(res);
       if (!res.ok || !body.formId) die(body.error ?? `push failed (${res.status}).`);
-      printPushed(body.formId, body.url, !!body.updated, !!flags.draft);
+      printPushed(body.formId, body.url, !!body.updated);
     }
     return;
   }
   if (cfg.pk) {
-    for (const item of items) {
-      if (!item.handle) die("Pushing with a provisioned key needs --handle <name> or form.id.");
-      const res = await api("/forms/sync", {
-        method: "POST",
-        body: JSON.stringify({
-          key: cfg.pk,
-          id: item.handle,
-          schema: item.schema,
-          theme: item.theme ?? null
-        })
-      });
-      const body = await res.json();
-      if (!res.ok || !body.formId) die(body.error ?? `push failed (${res.status}).`);
-      printPushed(body.formId, body.slug ? `${API}/f/${body.slug}` : void 0, false, !!body.staged);
-    }
+    await pushWithSync(items, { kind: "publishable_key", key: cfg.pk }, false);
     return;
   }
-  die("Not set up yet. Run `fillo init` (no account needed) or `fillo login`.");
+  die("Not set up yet. Run `fillo init --email you@company.com` or `fillo login`.");
 }
 async function init(flags) {
-  const email = typeof flags.email === "string" ? flags.email : void 0;
+  const email3 = typeof flags.email === "string" ? flags.email.trim() : "";
+  if (!email3) {
+    die("Usage: fillo init --email you@company.com (or run `fillo login` for an existing account).");
+  }
   const res = await api("/workspaces/provision", {
     method: "POST",
-    body: JSON.stringify({ email, source: "cli" })
+    body: JSON.stringify({ email: email3, source: "cli" })
   });
-  const body = await res.json();
+  const body = await readJson(res);
   if (!res.ok || !body.key) die(body.error ?? `init failed (${res.status}).`);
-  writeConfig({ ...readConfig(), pk: body.key, claimUrl: body.claim?.url ?? void 0 });
+  const { claimUrl: _legacyWorkspaceLink, ...current } = readConfig();
+  writeConfig({ ...current, pk: body.key });
   console.log(`
-  \x1B[32m\u2713\x1B[0m Workspace ready \u2014 no signup needed.`);
+  \x1B[32m\u2713\x1B[0m Workspace ready. A workspace link was sent to ${bold(terminalText(email3))}.`);
   if (body.limits) {
-    const days = Math.max(1, Math.round((Date.parse(body.limits.expiresAt) - Date.now()) / 864e5));
-    console.log(`  ${dim(`Preview: up to ${body.limits.responses} responses for ~${days} days.`)}`);
+    const expiry = Date.parse(body.limits.expiresAt);
+    if (Number.isFinite(expiry)) {
+      const days = Math.max(1, Math.round((expiry - Date.now()) / 864e5));
+      console.log(`  ${dim(`Preview: up to ${body.limits.responses} responses for ~${days} days.`)}`);
+    }
   }
   console.log(`
   ${bold("Next:")} fillo push form.json --handle my-form`);
-  if (body.claim?.url) {
-    console.log(`
-  ${dim("Keep your responses \u2014 claim it (signup, one click):")}`);
-    console.log(`  ${body.claim.url}
+  console.log(`  ${dim("Open the emailed link whenever you want to save it to an account.")}
 `);
+}
+var AGENT_ACTIONS = ["claim_required", "storage_required", "publish_required"];
+var FORM_STATUSES = ["draft", "published"];
+function enumFlag(flags, key, allowed) {
+  const value = flags[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || !allowed.includes(value)) {
+    die(`--${key} must be one of: ${allowed.join(", ")}`);
   }
+  return value;
+}
+function optionalStringFlag(flags, key) {
+  const value = flags[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || !value.trim()) die(`--${key} requires a value.`);
+  return value;
 }
 async function agent(subcommand, flags) {
   const apiBase = flagString(flags, "api")?.replace(/\/$/, "") ?? API;
@@ -227,36 +2267,231 @@ async function agent(subcommand, flags) {
   if (!run || !token) {
     die("Usage: fillo agent <connect|event> --run <id> --token <token> [--api <url>]");
   }
+  if (flags.account !== void 0 && flags.account !== true) {
+    die("--account does not take a value.");
+  }
   if (subcommand === "connect") {
+    const account = flags.account === true ? await attachAgentAccount(apiBase, run, token) : void 0;
     await postAgentEvent(apiBase, run, token, {
       status: "connected",
       message: "Agent connected. Reading the app now."
     });
     console.log(`  \x1B[32m\u2713\x1B[0m Live progress connected.`);
+    if (account) {
+      console.log(`  \x1B[32m\u2713\x1B[0m ${bold(account.workspace)}`);
+      console.log(`  ${dim("Publishable key:")} ${account.publishableKey}`);
+    }
     console.log(`  ${dim("Report next steps with:")}`);
     console.log(
-      `  fillo agent event --api ${apiBase} --run ${run} --token <same-token> --status editing --message "Editing the form screen"`
+      `  fillo agent event --api ${terminalText(apiBase)} --run ${terminalText(run)} --token <same-token> --status editing --message "Editing the form screen"`
     );
     return;
   }
+  if (flags.account === true) {
+    die("--account can only be used with `fillo agent connect`.");
+  }
   if (subcommand === "event") {
     const status = flagString(flags, "status");
     const message = flagString(flags, "message");
     if (!status) die("Usage: fillo agent event --status <status> --message <short update>");
+    const action = enumFlag(flags, "action", AGENT_ACTIONS);
+    const formStatus = enumFlag(flags, "form-status", FORM_STATUSES);
+    const formId = optionalStringFlag(flags, "form-id");
+    if ((status === "done" || status === "needs_action") && !formId) {
+      die(`--form-id is required when --status is ${status}.`);
+    }
+    if (status === "needs_action" && !action) {
+      die("--action is required when --status is needs_action.");
+    }
     await postAgentEvent(apiBase, run, token, {
       status,
       message,
-      claimUrl: flagString(flags, "claim-url"),
-      dashboardUrl: flagString(flags, "dashboard-url"),
       appUrl: flagString(flags, "app-url"),
-      formId: flagString(flags, "form-id"),
-      formName: flagString(flags, "form-name")
+      action,
+      formId,
+      formName: flagString(flags, "form-name"),
+      formStatus
     });
     console.log(`  \x1B[32m\u2713\x1B[0m Progress sent.`);
     return;
   }
   die(`Unknown agent command: ${subcommand}`);
 }
+var SKILL_AGENTS = [
+  "agents",
+  "codex",
+  "claude",
+  "cursor",
+  "copilot",
+  "gemini"
+];
+function isSkillAgent(value) {
+  return SKILL_AGENTS.some((agent2) => agent2 === value);
+}
+function findProjectRoot(start) {
+  let current = resolve(start);
+  while (true) {
+    if (existsSync(join(current, ".git"))) return current;
+    const parent = dirname(current);
+    if (parent === current) return resolve(start);
+    current = parent;
+  }
+}
+function detectSkillAgent() {
+  if (process.env.CLAUDECODE === "1" || process.env.CLAUDE_CODE === "1") {
+    return "claude";
+  }
+  return "agents";
+}
+function parseSkillAgent(flags) {
+  if (flags.agent === true || flags.agent === "") {
+    die(`--agent requires one of: ${SKILL_AGENTS.join(", ")}`);
+  }
+  const value = flagString(flags, "agent") ?? detectSkillAgent();
+  if (isSkillAgent(value)) return value;
+  die(`--agent must be one of: ${SKILL_AGENTS.join(", ")}`);
+}
+function skillFiles(root, relative2 = "") {
+  const directory = join(root, relative2);
+  const files = [];
+  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+    const next = join(relative2, entry.name);
+    if (entry.isDirectory()) files.push(...skillFiles(root, next));
+    else if (entry.isFile()) files.push(next);
+  }
+  return files.sort();
+}
+function sameSkillBundle(source, target) {
+  try {
+    const sourceFiles = skillFiles(source);
+    const targetFiles = skillFiles(target);
+    if (sourceFiles.length !== targetFiles.length) return false;
+    return sourceFiles.every(
+      (file, index) => file === targetFiles[index] && readFileSync(join(source, file)).equals(readFileSync(join(target, file)))
+    );
+  } catch {
+    return false;
+  }
+}
+function pathEntryExists(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+var MANAGED_SKILL_MARKER = ".fillo-managed.json";
+function isCliManagedFilloSkill(target) {
+  try {
+    const marker = JSON.parse(
+      readFileSync(join(target, MANAGED_SKILL_MARKER), "utf8")
+    );
+    return marker.managedBy === "@usefillo/cli" && marker.skill === "build-with-fillo" && marker.format === 1 && marker.allowAutomaticUpdates === true;
+  } catch {
+    return false;
+  }
+}
+function assertSafeSkillDestination(scopeRoot, parts) {
+  const realScopeRoot = realpathSync(scopeRoot);
+  let current = scopeRoot;
+  for (const part of parts) {
+    current = join(current, part);
+    if (!pathEntryExists(current)) return;
+    if (lstatSync(current).isSymbolicLink()) {
+      throw new Error(`Refusing to install through symlinked path ${current}.`);
+    }
+    const resolved = realpathSync(current);
+    const fromScope = relative(realScopeRoot, resolved);
+    if (fromScope === ".." || fromScope.startsWith(`..${sep}`) || isAbsolute(fromScope)) {
+      throw new Error(`Refusing to install outside ${scopeRoot}.`);
+    }
+  }
+}
+function moveSkillIntoPlace(staging, target) {
+  if (!pathEntryExists(target)) {
+    renameSync(staging, target);
+    return;
+  }
+  const backup = `${target}.backup-${randomUUID()}`;
+  renameSync(target, backup);
+  try {
+    renameSync(staging, target);
+  } catch (error) {
+    try {
+      renameSync(backup, target);
+    } catch {
+      throw new Error(`Skill install failed. The previous copy is preserved at ${backup}.`);
+    }
+    throw error;
+  }
+  try {
+    rmSync(backup, { recursive: true, force: true });
+  } catch {
+    console.warn(`  ${dim(`Previous skill copy could not be removed: ${backup}`)}`);
+  }
+}
+function installSkill(flags) {
+  if (flags.global === true && flags.project === true) {
+    die("Choose either --project or --global, not both.");
+  }
+  const agent2 = parseSkillAgent(flags);
+  const global = flags.global === true;
+  const agentDirectory = agent2 === "claude" ? ".claude" : ".agents";
+  const scopeRoot = global ? homedir() : findProjectRoot(process.cwd());
+  const skillsRoot = join(scopeRoot, agentDirectory, "skills");
+  const target = join(skillsRoot, "build-with-fillo");
+  const destinationParts = [agentDirectory, "skills", "build-with-fillo"];
+  if (!existsSync(BUNDLED_SKILL_DIR)) {
+    die("This CLI package is missing its bundled Fillo skill. Reinstall @usefillo/cli@latest.");
+  }
+  assertSafeSkillDestination(scopeRoot, destinationParts);
+  const targetExists = pathEntryExists(target);
+  const updatingManagedSkill = targetExists && isCliManagedFilloSkill(target);
+  if (targetExists) {
+    if (sameSkillBundle(BUNDLED_SKILL_DIR, target)) {
+      console.log(`
+  \x1B[32m\u2713\x1B[0m Fillo skill is already installed.`);
+      console.log(`  ${dim(target)}
+`);
+      return;
+    }
+    if (!updatingManagedSkill && flags.force !== true) {
+      die(`A different skill already exists at ${target}. Re-run with --force to replace it.`);
+    }
+  }
+  mkdirSync(skillsRoot, { recursive: true });
+  assertSafeSkillDestination(scopeRoot, destinationParts.slice(0, 2));
+  const staging = join(skillsRoot, `.build-with-fillo.install-${randomUUID()}`);
+  try {
+    cpSync(BUNDLED_SKILL_DIR, staging, { recursive: true, errorOnExist: true });
+    assertSafeSkillDestination(scopeRoot, destinationParts);
+    if (!targetExists && pathEntryExists(target)) {
+      throw new Error(`Skill destination changed during install: ${target}`);
+    }
+    moveSkillIntoPlace(staging, target);
+  } finally {
+    if (pathEntryExists(staging)) rmSync(staging, { recursive: true, force: true });
+  }
+  console.log(
+    `
+  \x1B[32m\u2713\x1B[0m ${updatingManagedSkill ? "Updated" : "Installed"} ${bold("Build with Fillo")} for ${agent2}.`
+  );
+  console.log(`  ${dim(target)}`);
+  console.log(
+    `
+  Ask your agent to read ${terminalText(join(target, "SKILL.md"))} and add a Fillo form.
+`
+  );
+}
+function skill(subcommand, flags) {
+  if (!subcommand || subcommand === "help" || subcommand === "--help" || subcommand === "-h") {
+    return skillHelp();
+  }
+  if (subcommand === "install") return installSkill(flags);
+  die(`Unknown skill command: ${subcommand}`);
+}
 async function postAgentEvent(apiBase, run, token, body) {
   const res = await fetch(`${apiBase}/api/v1/agent-runs/${encodeURIComponent(run)}/events`, {
     method: "POST",
@@ -264,44 +2499,150 @@ async function postAgentEvent(apiBase, run, token, body) {
       Authorization: `Bearer ${token}`,
       "Content-Type": "application/json"
     },
-    body: JSON.stringify(body)
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
   });
   const payload = await res.json().catch(() => ({}));
   if (!res.ok) die(payload.error ?? `agent progress failed (${res.status}).`);
 }
+async function attachAgentAccount(apiBase, run, progressToken) {
+  const accountToken = requireTokenFor(apiBase);
+  const res = await fetch(
+    `${apiBase}/api/v1/agent-runs/${encodeURIComponent(run)}/account`,
+    {
+      method: "POST",
+      redirect: "error",
+      headers: {
+        Authorization: `Bearer ${accountToken}`,
+        "X-Fillo-Agent-Run-Token": progressToken
+      },
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    }
+  );
+  const payload = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const hint = res.status === 401 ? " Run `fillo login` and try again." : "";
+    die(`${payload.error ?? `account connection failed (${res.status}).`}${hint}`);
+  }
+  if (typeof payload.workspace !== "string" || !terminalText(payload.workspace) || typeof payload.publishableKey !== "string" || !/^pk_[A-Za-z0-9_-]{1,125}$/.test(payload.publishableKey)) {
+    die("Fillo returned an invalid workspace connection.");
+  }
+  return { workspace: terminalText(payload.workspace), publishableKey: payload.publishableKey };
+}
 function agentHelp() {
   console.log(`
   ${bold("fillo agent")} \u2014 report live progress back to a Fillo prompt modal
 
   ${bold("Commands")}
     agent connect       Connect a coding-agent run to the open browser modal
+                       ${dim("--account   attach the workspace from `fillo login`")}
     agent event         Send a short progress update
-                       ${dim("--status <created|connected|asking|planning|installing|editing|checking|done|error>")}
+                       ${dim("--status <created|connected|asking|planning|installing|editing|checking|needs_action|done|error>")}
                        ${dim('--message "Short update"')}
-                       ${dim("--claim-url <url> --app-url <url> --form-name <name>")}
+                       ${dim("--form-id <id> --form-status <draft|published> --form-name <name>")}
+                       ${dim("--action <claim_required|storage_required|publish_required>")}
+                       ${dim("--app-url <localhost-url>")}
                        ${dim("--run <id> --token <token> --api <url>")}
 `);
 }
+function skillHelp() {
+  console.log(`
+  ${bold("fillo skill")} \u2014 install the Build with Fillo Agent Skill
+
+  ${bold("Commands")}
+    skill install       Install into this project (default)
+                       ${dim("--agent <agents|codex|claude|cursor|copilot|gemini>")}
+                       ${dim("--global   install for the current user")}
+                       ${dim("--force    replace a different existing copy")}
+
+  ${dim("Codex, Cursor, Copilot, and Gemini use shared .agents/skills; Claude Code uses .claude/skills.")}
+`);
+}
+function printVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    console.log(pkg.version);
+  } catch {
+    console.log("unknown");
+  }
+}
 function help() {
   console.log(`
   ${bold("fillo")} \u2014 create Fillo forms from your terminal
 
   ${bold("Commands")}
-    init               Provision a workspace with NO signup \u2014 instant, for first runs
-                       ${dim("--email <addr>   optional: also mail a claim link as backup")}
+    init               Start a new workspace and email its workspace link
+                       ${dim("--email <addr>   required")}
     login              Connect to an existing account (opens the browser)
+                       ${dim("--run <id> --token <token>   bind a fresh agent handoff login")}
     logout             Forget the stored credentials
-    whoami             Show the signed-in account + workspace
-    push <file>        Create/update a form from a JSON schema
+    whoami             Show the signed-in workspace
+    push <file|->      Create/update a form from JSON (file or stdin)
                        ${dim("--handle <name>  idempotent id for re-pushes")}
-                       ${dim("--draft          stage as a draft instead of publishing")}
+                       ${dim("--stage          stage beside the live form for dashboard review")}
+                       ${dim("--draft          alias with a handle; legacy one-off draft without")}
                        ${dim("--allow-code     allow a .mjs/.js schema (executes the file)")}
     list               List the workspace's forms
     agent <cmd>        Report live progress to a Fillo prompt modal
+    skill install      Install the Build with Fillo Agent Skill
 
   ${dim(`API: ${API}  \xB7  set FILLO_API to override`)}
+  ${dim(`${SYNC_TOKEN_ENV}: stage-only server/CI credential; requires --stage`)}
 `);
 }
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
+  "account",
+  "allow-code",
+  "draft",
+  "stage",
+  "force",
+  "global",
+  "help",
+  "h",
+  "project",
+  "version",
+  "v"
+]);
+var GLOBAL_FLAGS = /* @__PURE__ */ new Set(["help", "h", "version", "v"]);
+var FLAGS_BY_COMMAND = {
+  init: ["email"],
+  login: ["api", "run", "token"],
+  logout: [],
+  whoami: [],
+  push: ["handle", "stage", "draft", "allow-code"],
+  list: [],
+  ls: [],
+  agent: [
+    "run",
+    "token",
+    "api",
+    "account",
+    "status",
+    "message",
+    "app-url",
+    "action",
+    "form-id",
+    "form-name",
+    "form-status"
+  ],
+  skill: ["agent", "global", "project", "force"],
+  help: [],
+  version: []
+};
+function validateFlags(command, flags) {
+  const allowed = /* @__PURE__ */ new Set([
+    ...GLOBAL_FLAGS,
+    ...command ? FLAGS_BY_COMMAND[command] ?? [] : []
+  ]);
+  for (const [key, value] of Object.entries(flags)) {
+    if (!allowed.has(key)) die(`Unknown flag for ${command ?? "fillo"}: --${key}`);
+    if (BOOLEAN_FLAGS.has(key)) {
+      if (value !== true) die(`--${key} does not take a value.`);
+    } else if (typeof value !== "string" || value.length === 0) {
+      die(`--${key} requires a value.`);
+    }
+  }
+}
 function flagString(flags, key) {
   const value = flags[key];
   return typeof value === "string" && value ? value : void 0;
@@ -311,6 +2652,14 @@ function parseFlags(args) {
   const positional = [];
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
+    if (a === "--") {
+      positional.push(...args.slice(i + 1));
+      break;
+    }
+    if (a === "-h" || a === "-v") {
+      flags[a.slice(1)] = true;
+      continue;
+    }
     if (!a.startsWith("--")) {
       positional.push(a);
       continue;
@@ -321,6 +2670,10 @@ function parseFlags(args) {
       continue;
     }
     const key = a.slice(2);
+    if (BOOLEAN_FLAGS.has(key)) {
+      flags[key] = true;
+      continue;
+    }
     const next = args[i + 1];
     if (next !== void 0 && !next.startsWith("--")) {
       flags[key] = next;
@@ -332,17 +2685,25 @@ function parseFlags(args) {
 async function main() {
   const [cmd, ...rest] = process.argv.slice(2);
   const { positional, flags } = parseFlags(rest);
+  validateFlags(cmd, flags);
+  if (cmd === "version" || cmd === "--version" || cmd === "-v" || flags.version === true || flags.v === true) {
+    return printVersion();
+  }
   if (flags.help === true || flags.h === true) {
-    return cmd === "agent" ? agentHelp() : help();
+    if (cmd === "agent") return agentHelp();
+    if (cmd === "skill") return skillHelp();
+    return help();
   }
   switch (cmd) {
     case "init":
       return init(flags);
     case "login":
-      return login();
-    case "logout":
-      writeConfig({});
+      return login(flags);
+    case "logout": {
+      const { token, tokenApi, ...rest2 } = readConfig();
+      writeConfig(rest2);
       return console.log("  Logged out.");
+    }
     case "whoami":
       return whoami();
     case "push":
@@ -352,14 +2713,17 @@ async function main() {
       return list();
     case "agent":
       return agent(positional[0], flags);
+    case "skill":
+      return skill(positional[0], flags);
     case void 0:
     case "help":
     case "--help":
     case "-h":
       return help();
     default:
-      console.error(`Unknown command: ${cmd}`);
-      return help();
+      console.error(`Unknown command: ${terminalText(cmd)}`);
+      help();
+      return process.exit(2);
   }
 }
 main().catch((e) => die(e instanceof Error ? e.message : String(e)));