antpath 0.4.2 → 0.6.2

package/dist/cli.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // dist/cli.js
-import { readFile, writeFile } from "node:fs/promises";
+import { readFile as readFile2, writeFile } from "node:fs/promises";
 
 // ../shared/dist/config.js
 var DEFAULT_CAPS = {
@@ -53,6 +53,7 @@ var TERMINAL_RUN_STATUSES = [
 var terminalRunStatuses = new Set(TERMINAL_RUN_STATUSES);
 
 // ../shared/dist/blueprint.js
+var SKILL_ID_PATTERN = /^skl_[A-Za-z0-9_-]{8,128}$/;
 var SKILL_BUNDLE_LIMITS = {
   /** Compressed (.zip) ceiling. */
   maxCompressedBytes: 10 * 1024 * 1024,
@@ -69,6 +70,270 @@ var SKILL_BUNDLE_LIMITS = {
   /** Stored directory mode. */
   defaultDirMode: 493
 };
+function parseSkillRef(input, path) {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error(`${path} must be a SkillRef object`);
+  }
+  const record = input;
+  const kind = record.kind;
+  if (kind === "workspace") {
+    for (const key of Object.keys(record)) {
+      if (key !== "kind" && key !== "id") {
+        throw new Error(`${path} contains unexpected field for workspace SkillRef: ${key}`);
+      }
+    }
+    const id = record.id;
+    if (typeof id !== "string" || !SKILL_ID_PATTERN.test(id)) {
+      throw new Error(`${path}.id must match ${SKILL_ID_PATTERN.source}`);
+    }
+    return { kind: "workspace", id };
+  }
+  if (kind === "provider") {
+    for (const key of Object.keys(record)) {
+      if (key !== "kind" && key !== "vendor" && key !== "skillId" && key !== "version") {
+        throw new Error(`${path} contains unexpected field for provider SkillRef: ${key}`);
+      }
+    }
+    const vendor = record.vendor;
+    if (vendor !== "anthropic" && vendor !== "custom") {
+      throw new Error(`${path}.vendor must be 'anthropic' or 'custom'`);
+    }
+    const skillId = record.skillId;
+    if (typeof skillId !== "string" || skillId.length === 0 || skillId.length > 256) {
+      throw new Error(`${path}.skillId must be a non-empty string (<= 256 chars)`);
+    }
+    const version = record.version;
+    if (version !== void 0 && (typeof version !== "string" || version.length === 0 || version.length > 64)) {
+      throw new Error(`${path}.version, when provided, must be a non-empty string (<= 64 chars)`);
+    }
+    return {
+      kind: "provider",
+      vendor,
+      skillId,
+      ...version !== void 0 ? { version } : {}
+    };
+  }
+  throw new Error(`${path}.kind must be 'workspace' or 'provider'`);
+}
+var SkillBundleValidationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SkillBundleValidationError";
+  }
+};
+function normaliseSkillBundlePath(input) {
+  if (typeof input !== "string") {
+    throw new SkillBundleValidationError("bundle entry path must be a string");
+  }
+  if (input.length === 0 || input.trim().length === 0) {
+    throw new SkillBundleValidationError("bundle entry path must be non-empty");
+  }
+  if (input.length > SKILL_BUNDLE_LIMITS.maxPathLength) {
+    throw new SkillBundleValidationError(`bundle entry path exceeds maxPathLength (${SKILL_BUNDLE_LIMITS.maxPathLength}): ${input}`);
+  }
+  if (input.includes("\0")) {
+    throw new SkillBundleValidationError(`bundle entry path contains NUL byte: ${JSON.stringify(input)}`);
+  }
+  if (input.includes("\\")) {
+    throw new SkillBundleValidationError(`bundle entry path uses backslash separator: ${input}`);
+  }
+  if (/^[A-Za-z]:[\\/]/.test(input)) {
+    throw new SkillBundleValidationError(`bundle entry path uses a drive letter: ${input}`);
+  }
+  if (input.startsWith("/")) {
+    throw new SkillBundleValidationError(`bundle entry path must be relative: ${input}`);
+  }
+  if (input.endsWith("/")) {
+    throw new SkillBundleValidationError(`bundle entry path must not end with '/': ${input}`);
+  }
+  const segments = input.split("/");
+  for (const segment of segments) {
+    if (segment === "..") {
+      throw new SkillBundleValidationError(`bundle entry path contains '..' segment: ${input}`);
+    }
+    if (segment === "." || segment === "") {
+      throw new SkillBundleValidationError(`bundle entry path contains empty or '.' segment: ${input}`);
+    }
+  }
+  if (segments.length > SKILL_BUNDLE_LIMITS.maxDepth) {
+    throw new SkillBundleValidationError(`bundle entry path exceeds maxDepth (${SKILL_BUNDLE_LIMITS.maxDepth}): ${input}`);
+  }
+  return input;
+}
+function validateSkillBundleEntry(input) {
+  const path = normaliseSkillBundlePath(input.path);
+  if (!Number.isFinite(input.size) || !Number.isInteger(input.size) || input.size < 0) {
+    throw new SkillBundleValidationError(`bundle entry size must be a non-negative integer (${path})`);
+  }
+  if (input.size > SKILL_BUNDLE_LIMITS.maxDecompressedBytes) {
+    throw new SkillBundleValidationError(`bundle entry size exceeds maxDecompressedBytes (${SKILL_BUNDLE_LIMITS.maxDecompressedBytes}): ${path}`);
+  }
+  const mode = (input.mode ?? SKILL_BUNDLE_LIMITS.defaultFileMode) & 511;
+  if (mode !== SKILL_BUNDLE_LIMITS.defaultFileMode && mode !== SKILL_BUNDLE_LIMITS.defaultDirMode) {
+    return { path, size: input.size, mode: SKILL_BUNDLE_LIMITS.defaultFileMode };
+  }
+  return { path, size: input.size, mode };
+}
+var MCP_SERVER_NAME_PATTERN = /^[a-z][a-z0-9_-]{0,62}$/;
+function parseMcpServerRef(input, path) {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error(`${path} must be an object`);
+  }
+  const record = input;
+  for (const key of Object.keys(record)) {
+    if (key !== "name" && key !== "url") {
+      throw new Error(`${path}.${key} is not an allowed field for McpServerRef; permitted: name, url`);
+    }
+  }
+  const name = record.name;
+  if (typeof name !== "string" || !MCP_SERVER_NAME_PATTERN.test(name)) {
+    throw new Error(`${path}.name must match ${MCP_SERVER_NAME_PATTERN.source}`);
+  }
+  const url = record.url;
+  if (typeof url !== "string" || url.length === 0) {
+    throw new Error(`${path}.url must be a non-empty string`);
+  }
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+      throw new Error(`${path}.url must use http or https (got ${parsed.protocol})`);
+    }
+    if (parsed.username !== "" || parsed.password !== "") {
+      throw new Error(`${path}.url must not contain userinfo (username/password); use secrets.mcpServers[].headers for auth`);
+    }
+  } catch (cause) {
+    if (cause instanceof Error && cause.message.startsWith(path)) {
+      throw cause;
+    }
+    throw new Error(`${path}.url is not a valid URL: ${url}`);
+  }
+  return { name, url };
+}
+function parseBlueprintMcpServerRef(input, path) {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error(`${path} must be an object`);
+  }
+  const record = input;
+  for (const key of Object.keys(record)) {
+    if (key !== "name" && key !== "url" && key !== "headers") {
+      throw new Error(`${path}.${key} is not an allowed field for BlueprintMcpServer; permitted: name, url, headers`);
+    }
+  }
+  const stripped = { name: record.name, url: record.url };
+  const ref = parseMcpServerRef(stripped, path);
+  const rawHeaders = record.headers;
+  if (rawHeaders === void 0) {
+    return ref;
+  }
+  if (rawHeaders === null || typeof rawHeaders !== "object" || Array.isArray(rawHeaders)) {
+    throw new Error(`${path}.headers, when provided, must be a string-keyed object`);
+  }
+  const headers = {};
+  for (const [hk, hv] of Object.entries(rawHeaders)) {
+    if (typeof hv !== "string") {
+      throw new Error(`${path}.headers.${hk} must be a string`);
+    }
+    headers[hk] = hv;
+  }
+  return { ...ref, headers };
+}
+function parseBlueprint(input) {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error("Blueprint must be an object");
+  }
+  const record = input;
+  const allowed = /* @__PURE__ */ new Set([
+    "model",
+    "system",
+    "prompt",
+    "skills",
+    "mcpServers",
+    "environment",
+    "cleanup",
+    "proxyEndpoints",
+    "metadata"
+  ]);
+  for (const key of Object.keys(record)) {
+    if (!allowed.has(key)) {
+      throw new Error(`Blueprint contains unexpected field: ${key}`);
+    }
+  }
+  const model = record.model;
+  if (typeof model !== "string" || model.length === 0) {
+    throw new Error("Blueprint.model must be a non-empty string");
+  }
+  const system = record.system;
+  if (system !== void 0 && typeof system !== "string") {
+    throw new Error("Blueprint.system, when provided, must be a string");
+  }
+  const prompt = parseBlueprintPrompt(record.prompt);
+  const skills = parseBlueprintSkills(record.skills);
+  const mcpServers = parseBlueprintMcpServers(record.mcpServers);
+  return {
+    model,
+    ...system !== void 0 ? { system } : {},
+    prompt,
+    ...skills !== void 0 ? { skills } : {},
+    ...mcpServers !== void 0 ? { mcpServers } : {},
+    // environment / cleanup / proxyEndpoints / metadata: passed through
+    // as-is — the BFF revalidates them via `parseFlatRunSubmissionRequest`,
+    // so duplicating the heavyweight parsers here would mean two sources
+    // of truth. The CLI surfaces structural errors at submission time.
+    ...record.environment !== void 0 ? { environment: record.environment } : {},
+    ...record.cleanup !== void 0 ? { cleanup: record.cleanup } : {},
+    ...record.proxyEndpoints !== void 0 ? { proxyEndpoints: record.proxyEndpoints } : {},
+    ...record.metadata !== void 0 ? { metadata: record.metadata } : {}
+  };
+}
+function parseBlueprintPrompt(value) {
+  if (typeof value === "string") {
+    if (value.length === 0) {
+      throw new Error("Blueprint.prompt must be a non-empty string");
+    }
+    return value;
+  }
+  if (Array.isArray(value)) {
+    const arr = [];
+    for (let i = 0; i < value.length; i++) {
+      const item = value[i];
+      if (typeof item !== "string" || item.length === 0) {
+        throw new Error(`Blueprint.prompt[${i}] must be a non-empty string`);
+      }
+      arr.push(item);
+    }
+    if (arr.length === 0) {
+      throw new Error("Blueprint.prompt must be a non-empty string or array of strings");
+    }
+    return arr;
+  }
+  throw new Error("Blueprint.prompt must be a string or array of strings");
+}
+function parseBlueprintSkills(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (!Array.isArray(value)) {
+    throw new Error("Blueprint.skills must be an array");
+  }
+  return value.map((item, index) => parseSkillRef(item, `Blueprint.skills[${index}]`));
+}
+function parseBlueprintMcpServers(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (!Array.isArray(value)) {
+    throw new Error("Blueprint.mcpServers must be an array");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return value.map((item, index) => {
+    const entry = parseBlueprintMcpServerRef(item, `Blueprint.mcpServers[${index}]`);
+    if (seen.has(entry.name)) {
+      throw new Error(`Blueprint.mcpServers duplicate name: ${entry.name}`);
+    }
+    seen.add(entry.name);
+    return entry;
+  });
+}
 
 // ../shared/dist/submission.js
 var PROXY_ENDPOINT_DEFAULTS = {
@@ -84,21 +349,6 @@ var PROXY_ENDPOINT_DEFAULTS = {
 // ../shared/dist/stable.js
 import { createHash } from "node:crypto";
 var ANTPATH_DEFAULT_BASE_URL = "https://antpath.ai";
-function stableStringify(value) {
-  return JSON.stringify(sortValue(value));
-}
-function sha256(value) {
-  return createHash("sha256").update(typeof value === "string" ? value : stableStringify(value)).digest("hex");
-}
-function sortValue(value) {
-  if (Array.isArray(value)) {
-    return value.map(sortValue);
-  }
-  if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== void 0).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, sortValue(item)]));
-  }
-  return value;
-}
 
 // ../shared/dist/sdk-secrets.js
 var SECRET_PATTERNS = [
@@ -131,12 +381,6 @@ function redactSecrets(value) {
 function redactString(input) {
   return SECRET_PATTERNS.reduce((current, pattern) => current.replace(pattern, REDACTED), input);
 }
-function containsSecretLikeValue(input) {
-  return SECRET_PATTERNS.some((pattern) => {
-    pattern.lastIndex = 0;
-    return pattern.test(input);
-  });
-}
 function isSecretKey(key) {
   return /(?:api[_-]?key|authorization|token|secret|password|credential)/i.test(key);
 }
@@ -152,11 +396,6 @@ var AntpathError = class extends Error {
     this.details = details === void 0 ? void 0 : redactSecrets(details);
   }
 };
-var TemplateValidationError = class extends AntpathError {
-  constructor(message, details) {
-    super("TEMPLATE_INVALID", message, details);
-  }
-};
 var AntpathApiError = class extends AntpathError {
   status;
   body;
@@ -167,181 +406,6 @@ var AntpathApiError = class extends AntpathError {
   }
 };
 
-// ../shared/dist/template/compiler.js
-var ESCAPED_OPEN = "\0ANTPATH_ESCAPED_OPEN\0";
-var VARIABLE_PATTERN = /{{\s*([A-Za-z_][A-Za-z0-9_]*)\s*}}/g;
-function compileTemplate(template, variables = {}) {
-  assertTemplateShape(template);
-  const values = resolveVariableValues(template, variables);
-  const resolved = {
-    name: template.name,
-    model: resolveValue(template.model, values, template.variables ?? {}),
-    system: template.system === void 0 ? void 0 : resolveValue(template.system, values, template.variables ?? {}),
-    messages: template.messages.map((message) => resolveValue(message, values, template.variables ?? {})),
-    mcpServers: resolveMcpServers(template.mcpServers ?? {}, values, template.variables ?? {}),
-    environment: resolveValue(template.environment ?? {}, values, template.variables ?? {}),
-    skills: resolveValue(template.skills ?? [], values, template.variables ?? {}),
-    outputs: {
-      recommendedPath: "/antpath/outputs",
-      ...resolveValue(template.outputs ?? {}, values, template.variables ?? {})
-    },
-    metadata: resolveValue(template.metadata ?? {}, values, template.variables ?? {}),
-    credentialRequirements: {}
-  };
-  resolved.credentialRequirements = Object.fromEntries(resolved.mcpServers.filter((server) => server.auth).map((server) => [server.key, server.auth]));
-  scanForSecrets(resolved);
-  return {
-    ...resolved,
-    hash: sha256(stableStringify(resolved))
-  };
-}
-function assertTemplateShape(template) {
-  if (!template.name?.trim()) {
-    throw new TemplateValidationError("Template name is required");
-  }
-  if (!template.model) {
-    throw new TemplateValidationError("Template model is required");
-  }
-  if (!Array.isArray(template.messages) || template.messages.length === 0) {
-    throw new TemplateValidationError("Template must define at least one user message");
-  }
-  for (const [key, server] of Object.entries(template.mcpServers ?? {})) {
-    if (!/^[A-Za-z0-9_-]+$/.test(key)) {
-      throw new TemplateValidationError(`MCP server key '${key}' must use letters, numbers, underscores, or hyphens`);
-    }
-    if (server.tools?.allow && server.tools.deny) {
-      throw new TemplateValidationError(`MCP server '${key}' cannot define both allow and deny tool policies`);
-    }
-  }
-}
-function resolveVariableValues(template, variables) {
-  const definitions = template.variables ?? {};
-  const resolved = {};
-  for (const [key, definition] of Object.entries(definitions)) {
-    const value = variables[key] ?? definition.default;
-    if (value === void 0) {
-      continue;
-    }
-    if (typeof value !== "string") {
-      throw new TemplateValidationError(`Variable '${key}' must resolve to a string`);
-    }
-    resolved[key] = value;
-  }
-  for (const key of Object.keys(variables)) {
-    if (!definitions[key]) {
-      throw new TemplateValidationError(`Unknown Template variable '${key}'`);
-    }
-  }
-  return resolved;
-}
-function resolveMcpServers(servers, values, definitions) {
-  return Object.entries(servers).map(([key, server]) => {
-    const resolved = {
-      key,
-      name: key,
-      url: resolveValue(server.url, values, definitions ?? {})
-    };
-    if (server.auth)
-      resolved.auth = server.auth;
-    if (server.tools)
-      resolved.tools = resolveValue(server.tools, values, definitions ?? {});
-    return resolved;
-  });
-}
-function resolveValue(value, variables, definitions) {
-  if (typeof value === "string") {
-    return resolveString(value, variables, definitions);
-  }
-  if (Array.isArray(value)) {
-    return value.map((item) => resolveValue(item, variables, definitions));
-  }
-  if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, resolveValue(item, variables, definitions)]));
-  }
-  return value;
-}
-function resolveString(input, variables, definitions) {
-  const protectedInput = input.replace(/\\{{/g, ESCAPED_OPEN);
-  const resolved = protectedInput.replace(VARIABLE_PATTERN, (_match, name) => {
-    if (!definitions[name]) {
-      throw new TemplateValidationError(`Unresolved Template variable '${name}'`);
-    }
-    const value = variables[name];
-    if (value === void 0) {
-      throw new TemplateValidationError(`Missing value for Template variable '${name}'`);
-    }
-    return value;
-  });
-  return resolved.replace(new RegExp(ESCAPED_OPEN, "g"), "{{");
-}
-function scanForSecrets(value) {
-  const serialized = stableStringify(value);
-  if (containsSecretLikeValue(serialized)) {
-    throw new TemplateValidationError("Template contains a secret-like value; pass secrets through typed credentials instead");
-  }
-}
-
-// ../shared/dist/template/mapper.js
-function toPlatformSubmissionTemplate(resolved) {
-  const modelId = typeof resolved.model === "string" ? resolved.model : resolved.model.id;
-  const environment = mapEnvironment(resolved.environment);
-  const metadata = filterMetadata(resolved.metadata);
-  const submission = {
-    name: resolved.name,
-    model: modelId,
-    templateHash: resolved.hash,
-    messages: resolved.messages
-  };
-  return {
-    ...submission,
-    ...resolved.system ? { system: resolved.system } : {},
-    ...metadata ? { metadata } : {},
-    ...environment ? { environment } : {}
-  };
-}
-function mapEnvironment(env) {
-  if (!env)
-    return void 0;
-  let networking;
-  if (env.network) {
-    if (env.network === "restricted") {
-      networking = { mode: "limited", allowedHosts: [] };
-    } else if (env.network === "unrestricted") {
-      networking = { mode: "open" };
-    } else if (typeof env.network === "object" && env.network.type === "limited") {
-      const allowedHosts = env.network.allowedHosts ?? [];
-      networking = { mode: "limited", allowedHosts };
-    }
-  }
-  let packages;
-  if (env.packages) {
-    const collected = [];
-    for (const [manager, list] of Object.entries(env.packages)) {
-      if (!list)
-        continue;
-      for (const item of list) {
-        collected.push({ name: `${manager}:${item}` });
-      }
-    }
-    if (collected.length > 0)
-      packages = collected;
-  }
-  if (!networking && !packages)
-    return void 0;
-  return {
-    ...networking ? { networking } : {},
-    ...packages ? { packages } : {}
-  };
-}
-function filterMetadata(metadata) {
-  if (!metadata)
-    return void 0;
-  const entries = Object.entries(metadata);
-  if (entries.length === 0)
-    return void 0;
-  return Object.fromEntries(entries);
-}
-
 // ../shared/dist/http.js
 var HttpClient = class {
   #baseUrl;
@@ -487,10 +551,11 @@ async function createSkillBundle(http, args) {
   form.append("name", args.name);
   const blobBody = toBlob(args.body, args.contentType ?? "application/zip");
   form.append("bundle", blobBody, args.filename ?? `${args.name}.zip`);
-  return http.request("/api/skills", {
+  const result = await http.request("/api/skills", {
     method: "POST",
     body: form
   });
+  return unwrapSkill(result);
 }
 async function listSkills(http) {
   const result = await http.request("/api/skills");
@@ -500,13 +565,20 @@ async function listSkills(http) {
   return result.skills;
 }
 async function getSkill(http, skillId) {
-  return http.request(`/api/skills/${encodeURIComponent(skillId)}`);
+  const result = await http.request(`/api/skills/${encodeURIComponent(skillId)}`);
+  return unwrapSkill(result);
 }
 async function deleteSkill(http, skillId) {
   await http.request(`/api/skills/${encodeURIComponent(skillId)}`, {
     method: "DELETE"
   });
 }
+function unwrapSkill(result) {
+  if (result && typeof result === "object" && "skill" in result) {
+    return result.skill;
+  }
+  return result;
+}
 function toBlob(input, contentType) {
   if (input instanceof Blob) {
     return input;
@@ -605,8 +677,14 @@ async function refuseInsideManagedRun(io2, verb) {
 Use \`antpath proxy ...\` to call your declared upstream endpoints from inside the run.
 `);
     return true;
-  } catch {
-    return false;
+  } catch (err2) {
+    const code = err2?.code;
+    if (code === "ENOENT" || code === "ENOTDIR") {
+      return false;
+    }
+    io2.stderr(`\`antpath ${verb}\` could not determine whether it is running inside a managed run container (error reading ${ANTPATH_INDEX_PATH}: ${err2.message ?? "unknown"}). Refusing to proceed.
+`);
+    return true;
   }
 }
 function emitJsonError(io2, code, message, extra = {}) {
@@ -651,6 +729,27 @@ function collectRepeated(rest, flag) {
   }
   return { values, remaining, error: null };
 }
+function collectRepeatedKvList(rest, flag) {
+  const entries = [];
+  const remaining = [];
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === flag) {
+      const kv = rest[++i];
+      if (kv === void 0) {
+        return { entries, remaining, error: `${flag} requires a KEY=VALUE argument` };
+      }
+      const eq = kv.indexOf("=");
+      if (eq <= 0) {
+        return { entries, remaining, error: `${flag} must be in the form KEY=VALUE (got: ${kv})` };
+      }
+      entries.push([kv.slice(0, eq), kv.slice(eq + 1)]);
+      continue;
+    }
+    remaining.push(arg);
+  }
+  return { entries, remaining, error: null };
+}
 function takeFlagValue(rest, flag) {
   let value = null;
   const remaining = [];
@@ -772,13 +871,13 @@ async function runProxy(io2, rest) {
   let parsed;
   try {
     parsed = parseProxyFlags(rest);
-  } catch (err) {
-    if (err instanceof CliUsageError) {
-      io2.stderr(`${err.message}
+  } catch (err2) {
+    if (err2 instanceof CliUsageError) {
+      io2.stderr(`${err2.message}
 `);
       return USAGE_ERR;
     }
-    throw err;
+    throw err2;
   }
   if (!parsed.ok) {
     io2.stderr(`${parsed.reason}
@@ -833,8 +932,8 @@ async function runProxy(io2, rest) {
   if (f.dataSpec !== null) {
     try {
       body = await resolveBody(io2, f.dataSpec);
-    } catch (err) {
-      io2.stderr(`failed to read request body: ${err.message}
+    } catch (err2) {
+      io2.stderr(`failed to read request body: ${err2.message}
 `);
       return RUNTIME_ERR;
     }
@@ -868,10 +967,10 @@ async function runProxy(io2, rest) {
   let response;
   try {
     response = await io2.fetchImpl(url, init);
-  } catch (err) {
+  } catch (err2) {
     emitError(io2, {
       error: "upstream_error",
-      message: `proxy request failed: ${err.message}`,
+      message: `proxy request failed: ${err2.message}`,
       endpointName: f.endpointName
     });
     return RUNTIME_ERR;
@@ -921,38 +1020,8 @@ async function tryReadManifest(io2) {
   }
 }
 
-// dist/host/template.js
-import { resolve as resolvePath } from "node:path";
-import { pathToFileURL } from "node:url";
-async function loadTemplate(io2, filePath, variables) {
-  const absPath = resolvePath(io2.cwd(), filePath);
-  const lower = absPath.toLowerCase();
-  if (lower.endsWith(".json")) {
-    const text = await io2.readFile(absPath);
-    const parsed = JSON.parse(text);
-    return { resolved: ensureResolved(parsed, variables) };
-  }
-  if (lower.endsWith(".js") || lower.endsWith(".mjs") || lower.endsWith(".ts")) {
-    const mod = await import(pathToFileURL(absPath).href);
-    if (!mod.default) {
-      throw new Error(`template module ${filePath} must export a default TemplateDefinition`);
-    }
-    return { resolved: ensureResolved(mod.default, variables) };
-  }
-  throw new Error(`unsupported template extension: ${filePath}. Use .json, .js, .mjs, or .ts.`);
-}
-function ensureResolved(value, variables) {
-  if (!value || typeof value !== "object") {
-    throw new Error("template must be an object");
-  }
-  const obj = value;
-  if (typeof obj.hash === "string" && obj.hash.length > 0) {
-    return value;
-  }
-  return compileTemplate(value, variables);
-}
-
 // dist/host/run-cmd.js
+import { resolve as resolvePath } from "node:path";
 var TERMINAL_STATUSES = /* @__PURE__ */ new Set([
   "succeeded",
   "failed",
@@ -1002,88 +1071,215 @@ async function runRunCmd(io2, argv) {
   }
   const follow = takeBooleanFlag(rest, "--follow");
   rest = follow.remaining;
-  const variables = collectRepeatedKv(rest, "--var");
-  if (variables.error) {
-    io2.stderr(`${variables.error}
+  const config = takeFlagValue(rest, "--config");
+  if (config.error) {
+    io2.stderr(`${config.error}
 `);
     return USAGE_ERR;
   }
-  rest = variables.remaining;
-  const mcpServerEntries = collectRepeated(rest, "--mcp-server");
-  if (mcpServerEntries.error) {
-    io2.stderr(`${mcpServerEntries.error}
+  rest = config.remaining;
+  const modelFlag = takeFlagValue(rest, "--model");
+  if (modelFlag.error) {
+    io2.stderr(`${modelFlag.error}
 `);
     return USAGE_ERR;
   }
-  rest = mcpServerEntries.remaining;
-  const skillEntries = collectRepeated(rest, "--skill");
-  if (skillEntries.error) {
-    io2.stderr(`${skillEntries.error}
+  rest = modelFlag.remaining;
+  const systemFlag = takeFlagValue(rest, "--system");
+  if (systemFlag.error) {
+    io2.stderr(`${systemFlag.error}
 `);
     return USAGE_ERR;
   }
-  rest = skillEntries.remaining;
-  const proxyEndpointEntries = collectRepeated(rest, "--proxy-endpoint");
-  if (proxyEndpointEntries.error) {
-    io2.stderr(`${proxyEndpointEntries.error}
+  rest = systemFlag.remaining;
+  const promptFlags = collectRepeated(rest, "--prompt");
+  if (promptFlags.error) {
+    io2.stderr(`${promptFlags.error}
 `);
     return USAGE_ERR;
   }
-  rest = proxyEndpointEntries.remaining;
-  const proxyAuthEntries = collectRepeatedKv(rest, "--proxy-auth");
-  if (proxyAuthEntries.error) {
-    io2.stderr(`${proxyAuthEntries.error}
+  rest = promptFlags.remaining;
+  const skillFlags = collectRepeated(rest, "--skill");
+  if (skillFlags.error) {
+    io2.stderr(`${skillFlags.error}
 `);
     return USAGE_ERR;
   }
-  rest = proxyAuthEntries.remaining;
-  const positional = rest.filter((a) => !a.startsWith("--"));
-  const unknownFlags = rest.filter((a) => a.startsWith("--"));
-  if (unknownFlags.length > 0) {
-    io2.stderr(`unknown flag: ${unknownFlags[0]}
+  rest = skillFlags.remaining;
+  const providerSkillFlags = collectRepeated(rest, "--provider-skill");
+  if (providerSkillFlags.error) {
+    io2.stderr(`${providerSkillFlags.error}
 `);
     return USAGE_ERR;
   }
-  if (positional.length !== 1) {
-    io2.stderr("usage: antpath run <template-path> [flags]\n");
+  rest = providerSkillFlags.remaining;
+  const mcpFlags = collectRepeatedKv(rest, "--mcp");
+  if (mcpFlags.error) {
+    io2.stderr(`${mcpFlags.error}
+`);
     return USAGE_ERR;
   }
-  const templatePath = positional[0];
-  let resolved;
-  try {
-    const load = await loadTemplate(io2, templatePath, variables.entries);
-    resolved = load.resolved;
-  } catch (err) {
-    io2.stderr(`failed to load template: ${err.message}
+  rest = mcpFlags.remaining;
+  const mcpAuthFlags = collectRepeatedKvList(rest, "--mcp-auth");
+  if (mcpAuthFlags.error) {
+    io2.stderr(`${mcpAuthFlags.error}
 `);
     return USAGE_ERR;
   }
-  let mcpServers;
-  try {
-    mcpServers = mcpServerEntries.values.map((raw, i) => parseJsonOrThrow(raw, `--mcp-server[${i}]`));
-  } catch (err) {
-    io2.stderr(`${err.message}
+  rest = mcpAuthFlags.remaining;
+  const metadataFlags = collectRepeatedKv(rest, "--metadata");
+  if (metadataFlags.error) {
+    io2.stderr(`${metadataFlags.error}
 `);
     return USAGE_ERR;
   }
-  let skills;
-  try {
-    skills = skillEntries.values.map((raw, i) => parseSkillFlag(raw, i));
-  } catch (err) {
-    io2.stderr(`${err.message}
+  rest = metadataFlags.remaining;
+  const proxyEndpointFlags = collectRepeated(rest, "--proxy-endpoint");
+  if (proxyEndpointFlags.error) {
+    io2.stderr(`${proxyEndpointFlags.error}
 `);
     return USAGE_ERR;
   }
-  let proxyEndpoints;
-  try {
-    proxyEndpoints = proxyEndpointEntries.values.map((raw, i) => parseJsonOrThrow(raw, `--proxy-endpoint[${i}]`));
-  } catch (err) {
-    io2.stderr(`${err.message}
+  rest = proxyEndpointFlags.remaining;
+  const proxyAuthFlags = collectRepeatedKv(rest, "--proxy-auth");
+  if (proxyAuthFlags.error) {
+    io2.stderr(`${proxyAuthFlags.error}
+`);
+    return USAGE_ERR;
+  }
+  rest = proxyAuthFlags.remaining;
+  const positional = rest.filter((a) => !a.startsWith("--"));
+  const unknownFlags = rest.filter((a) => a.startsWith("--"));
+  if (unknownFlags.length > 0) {
+    io2.stderr(`unknown flag: ${unknownFlags[0]}
 `);
     return USAGE_ERR;
   }
+  if (positional.length > 0) {
+    io2.stderr(`antpath run takes no positional arguments (got: ${positional.join(" ")})
+`);
+    return USAGE_ERR;
+  }
+  let blueprint;
+  let mcpHeadersFromConfig = /* @__PURE__ */ new Map();
+  if (config.value) {
+    if (modelFlag.value || systemFlag.value || promptFlags.values.length || skillFlags.values.length || providerSkillFlags.values.length || Object.keys(mcpFlags.entries).length || Object.keys(metadataFlags.entries).length) {
+      io2.stderr("--config cannot be combined with --model/--system/--prompt/--skill/--provider-skill/--mcp/--metadata\n");
+      return USAGE_ERR;
+    }
+    try {
+      const absPath = resolvePath(io2.cwd(), config.value);
+      const text = await io2.readFile(absPath);
+      const raw = JSON.parse(text);
+      const { mcpHeaders, normalised } = stripMcpHeadersForParsing(raw);
+      mcpHeadersFromConfig = mcpHeaders;
+      blueprint = parseBlueprint(normalised);
+    } catch (err2) {
+      io2.stderr(`failed to load --config: ${err2.message}
+`);
+      return USAGE_ERR;
+    }
+  } else {
+    if (!modelFlag.value) {
+      io2.stderr("--model is required when --config is not provided\n");
+      return USAGE_ERR;
+    }
+    if (promptFlags.values.length === 0) {
+      io2.stderr("--prompt is required (repeatable)\n");
+      return USAGE_ERR;
+    }
+    let resolvedPrompt;
+    try {
+      resolvedPrompt = await Promise.all(promptFlags.values.map((v) => readMaybeFile(io2, v)));
+    } catch (err2) {
+      io2.stderr(`failed to read --prompt file: ${err2.message}
+`);
+      return USAGE_ERR;
+    }
+    let resolvedSystem;
+    if (systemFlag.value !== null) {
+      try {
+        resolvedSystem = await readMaybeFile(io2, systemFlag.value);
+      } catch (err2) {
+        io2.stderr(`failed to read --system file: ${err2.message}
+`);
+        return USAGE_ERR;
+      }
+    }
+    let workspaceSkills;
+    let providerSkills;
+    try {
+      workspaceSkills = skillFlags.values.map((v, i) => parseWorkspaceSkillFlag(v, i));
+      providerSkills = providerSkillFlags.values.map((v, i) => parseProviderSkillFlag(v, i));
+    } catch (err2) {
+      io2.stderr(`${err2.message}
+`);
+      return USAGE_ERR;
+    }
+    const mcpRefs = [];
+    for (const [name, url] of Object.entries(mcpFlags.entries)) {
+      mcpRefs.push({ name, url });
+    }
+    blueprint = {
+      model: modelFlag.value,
+      ...resolvedSystem ? { system: resolvedSystem } : {},
+      prompt: resolvedPrompt,
+      ...workspaceSkills.length + providerSkills.length > 0 ? { skills: [...workspaceSkills, ...providerSkills] } : {},
+      ...mcpRefs.length > 0 ? { mcpServers: mcpRefs } : {},
+      ...Object.keys(metadataFlags.entries).length > 0 ? { metadata: { ...metadataFlags.entries } } : {}
+    };
+  }
+  const mcpServersForSubmission = [...blueprint.mcpServers ?? []];
+  const mcpServerSecrets = [];
+  const mcpHeaderBag = new Map(mcpHeadersFromConfig);
+  for (const [name, headerSpec] of mcpAuthFlags.entries) {
+    const colon = headerSpec.indexOf(":");
+    if (colon <= 0 || colon >= headerSpec.length - 1) {
+      io2.stderr(`--mcp-auth ${name}: expected 'HeaderName:Value' (got: ${headerSpec})
+`);
+      return USAGE_ERR;
+    }
+    const headerName = headerSpec.slice(0, colon).trim();
+    const headerValue = headerSpec.slice(colon + 1).trim();
+    if (!headerName || !headerValue) {
+      io2.stderr(`--mcp-auth ${name}: header name and value must be non-empty
+`);
+      return USAGE_ERR;
+    }
+    const existing = mcpHeaderBag.get(name) ?? {};
+    if (Object.prototype.hasOwnProperty.call(existing, headerName)) {
+      io2.stderr(`--mcp-auth ${name}: duplicate header "${headerName}" \u2014 each header may be set only once per server
+`);
+      return USAGE_ERR;
+    }
+    existing[headerName] = headerValue;
+    mcpHeaderBag.set(name, existing);
+  }
+  for (const ref of mcpServersForSubmission) {
+    const headers = mcpHeaderBag.get(ref.name);
+    if (headers && Object.keys(headers).length > 0) {
+      mcpServerSecrets.push({ name: ref.name, url: ref.url, headers });
+    }
+  }
+  for (const name of mcpHeaderBag.keys()) {
+    if (!mcpServersForSubmission.some((m) => m.name === name)) {
+      io2.stderr(`--mcp-auth ${name}: no matching --mcp / mcpServers entry declared
+`);
+      return USAGE_ERR;
+    }
+  }
+  let proxyEndpoints = blueprint.proxyEndpoints ?? [];
+  if (proxyEndpointFlags.values.length > 0) {
+    try {
+      proxyEndpoints = proxyEndpointFlags.values.map((raw, i) => parseJsonOrThrow(raw, `--proxy-endpoint[${i}]`));
+    } catch (err2) {
+      io2.stderr(`${err2.message}
+`);
+      return USAGE_ERR;
+    }
+  }
   const proxyAuth = [];
-  for (const [name, spec] of Object.entries(proxyAuthEntries.entries)) {
+  for (const [name, spec] of Object.entries(proxyAuthFlags.entries)) {
     const parsed = parseProxyAuth(spec);
     if (!parsed.ok) {
       io2.stderr(`--proxy-auth ${name}: ${parsed.reason}
@@ -1095,31 +1291,42 @@ async function runRunCmd(io2, argv) {
   if (proxyEndpoints.length > 0) {
     try {
       validateProxyAuth(proxyEndpoints, proxyAuth);
-    } catch (err) {
-      io2.stderr(`proxy auth validation failed: ${err.message}
+    } catch (err2) {
+      io2.stderr(`proxy auth validation failed: ${err2.message}
 `);
       return USAGE_ERR;
     }
   }
+  const promptArray = Array.isArray(blueprint.prompt) ? [...blueprint.prompt] : [blueprint.prompt];
+  const skills = blueprint.skills ? [...blueprint.skills] : [];
+  const submission = {
+    model: blueprint.model,
+    ...blueprint.system ? { system: blueprint.system } : {},
+    prompt: promptArray,
+    skills,
+    mcpServers: mcpServersForSubmission,
+    ...blueprint.environment ? { environment: blueprint.environment } : {},
+    ...blueprint.metadata ? { metadata: blueprint.metadata } : {}
+  };
   const secrets = {
     anthropic: { apiKey: anthropicKey.value },
-    ...mcpServers.length ? { mcpServers } : {},
-    ...skills.length ? { skills } : {},
-    ...proxyAuth.length ? { proxyEndpointAuth: proxyAuth } : {}
+    ...mcpServerSecrets.length > 0 ? { mcpServers: mcpServerSecrets } : {},
+    ...proxyAuth.length > 0 ? { proxyEndpointAuth: proxyAuth } : {}
   };
-  const submission = {
+  const request = {
     idempotencyKey: idempotency.value ?? generateIdempotencyKey(),
-    template: toPlatformSubmissionTemplate(resolved),
+    submission,
     secrets,
     ...cleanup.value ? { cleanup: { session: cleanup.value } } : {},
-    ...proxyEndpoints.length ? { proxyEndpoints } : {}
+    ...blueprint.cleanup && !cleanup.value ? { cleanup: blueprint.cleanup } : {},
+    ...proxyEndpoints.length > 0 ? { proxyEndpoints } : {}
   };
   const http = makeHttpClient(io2, common.flags);
   let run;
   try {
-    run = await operations_exports.submitRun(http, submission);
-  } catch (err) {
-    return emitJsonError(io2, "submit_failed", err.message ?? "submission failed");
+    run = await operations_exports.submitRunFlat(http, request);
+  } catch (err2) {
+    return emitJsonError(io2, "submit_failed", err2.message ?? "submission failed");
   }
   io2.stdout(JSON.stringify(run) + "\n");
   if (!follow.present)
@@ -1134,15 +1341,15 @@ async function runRunCmd(io2, argv) {
         io2.stdout(JSON.stringify(events[i]) + "\n");
       }
       emittedEventCount = events.length;
-    } catch (err) {
-      io2.stderr(`(transient) event poll failed: ${err.message}
+    } catch (err2) {
+      io2.stderr(`(transient) event poll failed: ${err2.message}
 `);
     }
     try {
       const updated = await operations_exports.getRun(http, run.id);
       currentStatus = updated.status;
-    } catch (err) {
-      io2.stderr(`(transient) status poll failed: ${err.message}
+    } catch (err2) {
+      io2.stderr(`(transient) status poll failed: ${err2.message}
 `);
     }
   }
@@ -1150,8 +1357,8 @@ async function runRunCmd(io2, argv) {
     const final = await operations_exports.getRun(http, run.id);
     io2.stdout(JSON.stringify(final) + "\n");
     return final.status === "succeeded" ? SUCCESS : RUNTIME_ERR;
-  } catch (err) {
-    io2.stderr(`final status fetch failed: ${err.message}
+  } catch (err2) {
+    io2.stderr(`final status fetch failed: ${err2.message}
 `);
     return RUNTIME_ERR;
   }
@@ -1162,55 +1369,103 @@ function parseProxyAuth(spec) {
     return { ok: false, reason: `expected '<type>:<value>' (got: ${spec})` };
   }
   const type = spec.slice(0, idx);
-  const rest = spec.slice(idx + 1);
+  const restValue = spec.slice(idx + 1);
   switch (type) {
     case "bearer":
-      if (!rest)
+      if (!restValue)
         return { ok: false, reason: "bearer requires a token value" };
-      return { ok: true, value: { type: "bearer", token: rest } };
+      return { ok: true, value: { type: "bearer", token: restValue } };
     case "header":
-      if (!rest)
+      if (!restValue)
         return { ok: false, reason: "header requires a value" };
-      return { ok: true, value: { type: "header", value: rest } };
+      return { ok: true, value: { type: "header", value: restValue } };
     case "query":
-      if (!rest)
+      if (!restValue)
         return { ok: false, reason: "query requires a value" };
-      return { ok: true, value: { type: "query", value: rest } };
+      return { ok: true, value: { type: "query", value: restValue } };
     case "basic": {
-      const sep = rest.indexOf(":");
-      if (sep <= 0 || sep >= rest.length - 1) {
+      const sep2 = restValue.indexOf(":");
+      if (sep2 <= 0 || sep2 >= restValue.length - 1) {
         return { ok: false, reason: "basic requires <username>:<password>" };
       }
       return {
         ok: true,
-        value: { type: "basic", username: rest.slice(0, sep), password: rest.slice(sep + 1) }
+        value: { type: "basic", username: restValue.slice(0, sep2), password: restValue.slice(sep2 + 1) }
       };
     }
     default:
       return { ok: false, reason: `unknown auth type '${type}' (expected bearer|basic|header|query)` };
   }
 }
-function parseSkillFlag(raw, idx) {
-  if (raw.trim().startsWith("{")) {
-    return parseJsonOrThrow(raw, `--skill[${idx}]`);
-  }
-  const sep = raw.indexOf(":");
-  if (sep === -1) {
-    return { skillId: raw };
-  }
-  const skillId = raw.slice(0, sep);
-  const version = raw.slice(sep + 1);
-  if (!skillId || !version) {
-    throw new Error(`--skill[${idx}] must be 'skillId' or 'skillId:version' (got: ${raw})`);
-  }
-  return { skillId, version };
-}
 function parseJsonOrThrow(raw, label) {
   try {
     return JSON.parse(raw);
-  } catch (err) {
-    throw new Error(`${label} is not valid JSON: ${err.message}`);
+  } catch (err2) {
+    throw new Error(`${label} is not valid JSON: ${err2.message}`);
+  }
+}
+function parseWorkspaceSkillFlag(raw, idx) {
+  if (!raw) {
+    throw new Error(`--skill[${idx}] must be a non-empty skill id`);
+  }
+  return { kind: "workspace", id: raw };
+}
+function parseProviderSkillFlag(raw, idx) {
+  const parts = raw.split(":");
+  if (parts.length < 2 || parts.length > 3) {
+    throw new Error(`--provider-skill[${idx}] must be 'vendor:skillId[:version]' (got: ${raw})`);
+  }
+  const vendor = parts[0];
+  const skillId = parts[1];
+  const version = parts[2];
+  if (vendor !== "anthropic" && vendor !== "custom") {
+    throw new Error(`--provider-skill[${idx}] vendor must be 'anthropic' or 'custom' (got: ${vendor})`);
+  }
+  if (!skillId) {
+    throw new Error(`--provider-skill[${idx}] skillId is required`);
+  }
+  return version ? { kind: "provider", vendor, skillId, version } : { kind: "provider", vendor, skillId };
+}
+function stripMcpHeadersForParsing(input) {
+  const mcpHeaders = /* @__PURE__ */ new Map();
+  if (input === null || typeof input !== "object" || Array.isArray(input)) {
+    return { normalised: input, mcpHeaders };
+  }
+  const record = input;
+  if (!Array.isArray(record.mcpServers)) {
+    return { normalised: input, mcpHeaders };
+  }
+  const stripped = record.mcpServers.map((entry, i) => {
+    if (!entry || typeof entry !== "object")
+      return entry;
+    const r = entry;
+    if (r.headers && typeof r.headers === "object" && !Array.isArray(r.headers)) {
+      const name = typeof r.name === "string" ? r.name : `__index_${i}__`;
+      const headerObj = {};
+      for (const [k, v] of Object.entries(r.headers)) {
+        if (typeof v !== "string") {
+          throw new Error(`mcpServers[${i}].headers["${k}"] must be a string`);
+        }
+        headerObj[k] = v;
+      }
+      mcpHeaders.set(name, headerObj);
+      const { headers: _omit, ...rest } = r;
+      void _omit;
+      return rest;
+    }
+    return r;
+  });
+  return { normalised: { ...record, mcpServers: stripped }, mcpHeaders };
+}
+async function readMaybeFile(io2, value) {
+  if (value.startsWith("@@")) {
+    return value.slice(1);
+  }
+  if (value.startsWith("@")) {
+    const path = resolvePath(io2.cwd(), value.slice(1));
+    return io2.readFile(path);
   }
+  return value;
 }
 function generateIdempotencyKey() {
   const c = globalThis.crypto;
@@ -1222,6 +1477,1000 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+// dist/host/skills-cmd.js
+import { readFile, readdir, stat } from "node:fs/promises";
+import { basename, join, posix, relative, resolve as resolvePath2, sep } from "node:path";
+
+// ../../node_modules/.pnpm/fflate@0.8.2/node_modules/fflate/esm/index.mjs
+import { createRequire } from "module";
+var require2 = createRequire("/");
+var Worker;
+try {
+  Worker = require2("worker_threads").Worker;
+} catch (e) {
+}
+var u8 = Uint8Array;
+var u16 = Uint16Array;
+var i32 = Int32Array;
+var fleb = new u8([
+  0,
+  0,
+  0,
+  0,
+  0,
+  0,
+  0,
+  0,
+  1,
+  1,
+  1,
+  1,
+  2,
+  2,
+  2,
+  2,
+  3,
+  3,
+  3,
+  3,
+  4,
+  4,
+  4,
+  4,
+  5,
+  5,
+  5,
+  5,
+  0,
+  /* unused */
+  0,
+  0,
+  /* impossible */
+  0
+]);
+var fdeb = new u8([
+  0,
+  0,
+  0,
+  0,
+  1,
+  1,
+  2,
+  2,
+  3,
+  3,
+  4,
+  4,
+  5,
+  5,
+  6,
+  6,
+  7,
+  7,
+  8,
+  8,
+  9,
+  9,
+  10,
+  10,
+  11,
+  11,
+  12,
+  12,
+  13,
+  13,
+  /* unused */
+  0,
+  0
+]);
+var clim = new u8([16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15]);
+var freb = function(eb, start) {
+  var b = new u16(31);
+  for (var i = 0; i < 31; ++i) {
+    b[i] = start += 1 << eb[i - 1];
+  }
+  var r = new i32(b[30]);
+  for (var i = 1; i < 30; ++i) {
+    for (var j = b[i]; j < b[i + 1]; ++j) {
+      r[j] = j - b[i] << 5 | i;
+    }
+  }
+  return { b, r };
+};
+var _a = freb(fleb, 2);
+var fl = _a.b;
+var revfl = _a.r;
+fl[28] = 258, revfl[258] = 28;
+var _b = freb(fdeb, 0);
+var fd = _b.b;
+var revfd = _b.r;
+var rev = new u16(32768);
+for (i = 0; i < 32768; ++i) {
+  x = (i & 43690) >> 1 | (i & 21845) << 1;
+  x = (x & 52428) >> 2 | (x & 13107) << 2;
+  x = (x & 61680) >> 4 | (x & 3855) << 4;
+  rev[i] = ((x & 65280) >> 8 | (x & 255) << 8) >> 1;
+}
+var x;
+var i;
+var hMap = (function(cd, mb, r) {
+  var s = cd.length;
+  var i = 0;
+  var l = new u16(mb);
+  for (; i < s; ++i) {
+    if (cd[i])
+      ++l[cd[i] - 1];
+  }
+  var le = new u16(mb);
+  for (i = 1; i < mb; ++i) {
+    le[i] = le[i - 1] + l[i - 1] << 1;
+  }
+  var co;
+  if (r) {
+    co = new u16(1 << mb);
+    var rvb = 15 - mb;
+    for (i = 0; i < s; ++i) {
+      if (cd[i]) {
+        var sv = i << 4 | cd[i];
+        var r_1 = mb - cd[i];
+        var v = le[cd[i] - 1]++ << r_1;
+        for (var m = v | (1 << r_1) - 1; v <= m; ++v) {
+          co[rev[v] >> rvb] = sv;
+        }
+      }
+    }
+  } else {
+    co = new u16(s);
+    for (i = 0; i < s; ++i) {
+      if (cd[i]) {
+        co[i] = rev[le[cd[i] - 1]++] >> 15 - cd[i];
+      }
+    }
+  }
+  return co;
+});
+var flt = new u8(288);
+for (i = 0; i < 144; ++i)
+  flt[i] = 8;
+var i;
+for (i = 144; i < 256; ++i)
+  flt[i] = 9;
+var i;
+for (i = 256; i < 280; ++i)
+  flt[i] = 7;
+var i;
+for (i = 280; i < 288; ++i)
+  flt[i] = 8;
+var i;
+var fdt = new u8(32);
+for (i = 0; i < 32; ++i)
+  fdt[i] = 5;
+var i;
+var flm = /* @__PURE__ */ hMap(flt, 9, 0);
+var fdm = /* @__PURE__ */ hMap(fdt, 5, 0);
+var shft = function(p) {
+  return (p + 7) / 8 | 0;
+};
+var slc = function(v, s, e) {
+  if (s == null || s < 0)
+    s = 0;
+  if (e == null || e > v.length)
+    e = v.length;
+  return new u8(v.subarray(s, e));
+};
+var ec = [
+  "unexpected EOF",
+  "invalid block type",
+  "invalid length/literal",
+  "invalid distance",
+  "stream finished",
+  "no stream handler",
+  ,
+  "no callback",
+  "invalid UTF-8 data",
+  "extra field too long",
+  "date not in range 1980-2099",
+  "filename too long",
+  "stream finishing",
+  "invalid zip data"
+  // determined by unknown compression method
+];
+var err = function(ind, msg, nt) {
+  var e = new Error(msg || ec[ind]);
+  e.code = ind;
+  if (Error.captureStackTrace)
+    Error.captureStackTrace(e, err);
+  if (!nt)
+    throw e;
+  return e;
+};
+var wbits = function(d, p, v) {
+  v <<= p & 7;
+  var o = p / 8 | 0;
+  d[o] |= v;
+  d[o + 1] |= v >> 8;
+};
+var wbits16 = function(d, p, v) {
+  v <<= p & 7;
+  var o = p / 8 | 0;
+  d[o] |= v;
+  d[o + 1] |= v >> 8;
+  d[o + 2] |= v >> 16;
+};
+var hTree = function(d, mb) {
+  var t = [];
+  for (var i = 0; i < d.length; ++i) {
+    if (d[i])
+      t.push({ s: i, f: d[i] });
+  }
+  var s = t.length;
+  var t2 = t.slice();
+  if (!s)
+    return { t: et, l: 0 };
+  if (s == 1) {
+    var v = new u8(t[0].s + 1);
+    v[t[0].s] = 1;
+    return { t: v, l: 1 };
+  }
+  t.sort(function(a, b) {
+    return a.f - b.f;
+  });
+  t.push({ s: -1, f: 25001 });
+  var l = t[0], r = t[1], i0 = 0, i1 = 1, i2 = 2;
+  t[0] = { s: -1, f: l.f + r.f, l, r };
+  while (i1 != s - 1) {
+    l = t[t[i0].f < t[i2].f ? i0++ : i2++];
+    r = t[i0 != i1 && t[i0].f < t[i2].f ? i0++ : i2++];
+    t[i1++] = { s: -1, f: l.f + r.f, l, r };
+  }
+  var maxSym = t2[0].s;
+  for (var i = 1; i < s; ++i) {
+    if (t2[i].s > maxSym)
+      maxSym = t2[i].s;
+  }
+  var tr = new u16(maxSym + 1);
+  var mbt = ln(t[i1 - 1], tr, 0);
+  if (mbt > mb) {
+    var i = 0, dt = 0;
+    var lft = mbt - mb, cst = 1 << lft;
+    t2.sort(function(a, b) {
+      return tr[b.s] - tr[a.s] || a.f - b.f;
+    });
+    for (; i < s; ++i) {
+      var i2_1 = t2[i].s;
+      if (tr[i2_1] > mb) {
+        dt += cst - (1 << mbt - tr[i2_1]);
+        tr[i2_1] = mb;
+      } else
+        break;
+    }
+    dt >>= lft;
+    while (dt > 0) {
+      var i2_2 = t2[i].s;
+      if (tr[i2_2] < mb)
+        dt -= 1 << mb - tr[i2_2]++ - 1;
+      else
+        ++i;
+    }
+    for (; i >= 0 && dt; --i) {
+      var i2_3 = t2[i].s;
+      if (tr[i2_3] == mb) {
+        --tr[i2_3];
+        ++dt;
+      }
+    }
+    mbt = mb;
+  }
+  return { t: new u8(tr), l: mbt };
+};
+var ln = function(n, l, d) {
+  return n.s == -1 ? Math.max(ln(n.l, l, d + 1), ln(n.r, l, d + 1)) : l[n.s] = d;
+};
+var lc = function(c) {
+  var s = c.length;
+  while (s && !c[--s])
+    ;
+  var cl = new u16(++s);
+  var cli = 0, cln = c[0], cls = 1;
+  var w = function(v) {
+    cl[cli++] = v;
+  };
+  for (var i = 1; i <= s; ++i) {
+    if (c[i] == cln && i != s)
+      ++cls;
+    else {
+      if (!cln && cls > 2) {
+        for (; cls > 138; cls -= 138)
+          w(32754);
+        if (cls > 2) {
+          w(cls > 10 ? cls - 11 << 5 | 28690 : cls - 3 << 5 | 12305);
+          cls = 0;
+        }
+      } else if (cls > 3) {
+        w(cln), --cls;
+        for (; cls > 6; cls -= 6)
+          w(8304);
+        if (cls > 2)
+          w(cls - 3 << 5 | 8208), cls = 0;
+      }
+      while (cls--)
+        w(cln);
+      cls = 1;
+      cln = c[i];
+    }
+  }
+  return { c: cl.subarray(0, cli), n: s };
+};
+var clen = function(cf, cl) {
+  var l = 0;
+  for (var i = 0; i < cl.length; ++i)
+    l += cf[i] * cl[i];
+  return l;
+};
+var wfblk = function(out, pos, dat) {
+  var s = dat.length;
+  var o = shft(pos + 2);
+  out[o] = s & 255;
+  out[o + 1] = s >> 8;
+  out[o + 2] = out[o] ^ 255;
+  out[o + 3] = out[o + 1] ^ 255;
+  for (var i = 0; i < s; ++i)
+    out[o + i + 4] = dat[i];
+  return (o + 4 + s) * 8;
+};
+var wblk = function(dat, out, final, syms, lf, df, eb, li, bs, bl, p) {
+  wbits(out, p++, final);
+  ++lf[256];
+  var _a2 = hTree(lf, 15), dlt = _a2.t, mlb = _a2.l;
+  var _b2 = hTree(df, 15), ddt = _b2.t, mdb = _b2.l;
+  var _c = lc(dlt), lclt = _c.c, nlc = _c.n;
+  var _d = lc(ddt), lcdt = _d.c, ndc = _d.n;
+  var lcfreq = new u16(19);
+  for (var i = 0; i < lclt.length; ++i)
+    ++lcfreq[lclt[i] & 31];
+  for (var i = 0; i < lcdt.length; ++i)
+    ++lcfreq[lcdt[i] & 31];
+  var _e = hTree(lcfreq, 7), lct = _e.t, mlcb = _e.l;
+  var nlcc = 19;
+  for (; nlcc > 4 && !lct[clim[nlcc - 1]]; --nlcc)
+    ;
+  var flen = bl + 5 << 3;
+  var ftlen = clen(lf, flt) + clen(df, fdt) + eb;
+  var dtlen = clen(lf, dlt) + clen(df, ddt) + eb + 14 + 3 * nlcc + clen(lcfreq, lct) + 2 * lcfreq[16] + 3 * lcfreq[17] + 7 * lcfreq[18];
+  if (bs >= 0 && flen <= ftlen && flen <= dtlen)
+    return wfblk(out, p, dat.subarray(bs, bs + bl));
+  var lm, ll, dm, dl;
+  wbits(out, p, 1 + (dtlen < ftlen)), p += 2;
+  if (dtlen < ftlen) {
+    lm = hMap(dlt, mlb, 0), ll = dlt, dm = hMap(ddt, mdb, 0), dl = ddt;
+    var llm = hMap(lct, mlcb, 0);
+    wbits(out, p, nlc - 257);
+    wbits(out, p + 5, ndc - 1);
+    wbits(out, p + 10, nlcc - 4);
+    p += 14;
+    for (var i = 0; i < nlcc; ++i)
+      wbits(out, p + 3 * i, lct[clim[i]]);
+    p += 3 * nlcc;
+    var lcts = [lclt, lcdt];
+    for (var it = 0; it < 2; ++it) {
+      var clct = lcts[it];
+      for (var i = 0; i < clct.length; ++i) {
+        var len = clct[i] & 31;
+        wbits(out, p, llm[len]), p += lct[len];
+        if (len > 15)
+          wbits(out, p, clct[i] >> 5 & 127), p += clct[i] >> 12;
+      }
+    }
+  } else {
+    lm = flm, ll = flt, dm = fdm, dl = fdt;
+  }
+  for (var i = 0; i < li; ++i) {
+    var sym = syms[i];
+    if (sym > 255) {
+      var len = sym >> 18 & 31;
+      wbits16(out, p, lm[len + 257]), p += ll[len + 257];
+      if (len > 7)
+        wbits(out, p, sym >> 23 & 31), p += fleb[len];
+      var dst = sym & 31;
+      wbits16(out, p, dm[dst]), p += dl[dst];
+      if (dst > 3)
+        wbits16(out, p, sym >> 5 & 8191), p += fdeb[dst];
+    } else {
+      wbits16(out, p, lm[sym]), p += ll[sym];
+    }
+  }
+  wbits16(out, p, lm[256]);
+  return p + ll[256];
+};
+var deo = /* @__PURE__ */ new i32([65540, 131080, 131088, 131104, 262176, 1048704, 1048832, 2114560, 2117632]);
+var et = /* @__PURE__ */ new u8(0);
+var dflt = function(dat, lvl, plvl, pre, post, st) {
+  var s = st.z || dat.length;
+  var o = new u8(pre + s + 5 * (1 + Math.ceil(s / 7e3)) + post);
+  var w = o.subarray(pre, o.length - post);
+  var lst = st.l;
+  var pos = (st.r || 0) & 7;
+  if (lvl) {
+    if (pos)
+      w[0] = st.r >> 3;
+    var opt = deo[lvl - 1];
+    var n = opt >> 13, c = opt & 8191;
+    var msk_1 = (1 << plvl) - 1;
+    var prev = st.p || new u16(32768), head = st.h || new u16(msk_1 + 1);
+    var bs1_1 = Math.ceil(plvl / 3), bs2_1 = 2 * bs1_1;
+    var hsh = function(i2) {
+      return (dat[i2] ^ dat[i2 + 1] << bs1_1 ^ dat[i2 + 2] << bs2_1) & msk_1;
+    };
+    var syms = new i32(25e3);
+    var lf = new u16(288), df = new u16(32);
+    var lc_1 = 0, eb = 0, i = st.i || 0, li = 0, wi = st.w || 0, bs = 0;
+    for (; i + 2 < s; ++i) {
+      var hv = hsh(i);
+      var imod = i & 32767, pimod = head[hv];
+      prev[imod] = pimod;
+      head[hv] = imod;
+      if (wi <= i) {
+        var rem = s - i;
+        if ((lc_1 > 7e3 || li > 24576) && (rem > 423 || !lst)) {
+          pos = wblk(dat, w, 0, syms, lf, df, eb, li, bs, i - bs, pos);
+          li = lc_1 = eb = 0, bs = i;
+          for (var j = 0; j < 286; ++j)
+            lf[j] = 0;
+          for (var j = 0; j < 30; ++j)
+            df[j] = 0;
+        }
+        var l = 2, d = 0, ch_1 = c, dif = imod - pimod & 32767;
+        if (rem > 2 && hv == hsh(i - dif)) {
+          var maxn = Math.min(n, rem) - 1;
+          var maxd = Math.min(32767, i);
+          var ml = Math.min(258, rem);
+          while (dif <= maxd && --ch_1 && imod != pimod) {
+            if (dat[i + l] == dat[i + l - dif]) {
+              var nl = 0;
+              for (; nl < ml && dat[i + nl] == dat[i + nl - dif]; ++nl)
+                ;
+              if (nl > l) {
+                l = nl, d = dif;
+                if (nl > maxn)
+                  break;
+                var mmd = Math.min(dif, nl - 2);
+                var md = 0;
+                for (var j = 0; j < mmd; ++j) {
+                  var ti = i - dif + j & 32767;
+                  var pti = prev[ti];
+                  var cd = ti - pti & 32767;
+                  if (cd > md)
+                    md = cd, pimod = ti;
+                }
+              }
+            }
+            imod = pimod, pimod = prev[imod];
+            dif += imod - pimod & 32767;
+          }
+        }
+        if (d) {
+          syms[li++] = 268435456 | revfl[l] << 18 | revfd[d];
+          var lin = revfl[l] & 31, din = revfd[d] & 31;
+          eb += fleb[lin] + fdeb[din];
+          ++lf[257 + lin];
+          ++df[din];
+          wi = i + l;
+          ++lc_1;
+        } else {
+          syms[li++] = dat[i];
+          ++lf[dat[i]];
+        }
+      }
+    }
+    for (i = Math.max(i, wi); i < s; ++i) {
+      syms[li++] = dat[i];
+      ++lf[dat[i]];
+    }
+    pos = wblk(dat, w, lst, syms, lf, df, eb, li, bs, i - bs, pos);
+    if (!lst) {
+      st.r = pos & 7 | w[pos / 8 | 0] << 3;
+      pos -= 7;
+      st.h = head, st.p = prev, st.i = i, st.w = wi;
+    }
+  } else {
+    for (var i = st.w || 0; i < s + lst; i += 65535) {
+      var e = i + 65535;
+      if (e >= s) {
+        w[pos / 8 | 0] = lst;
+        e = s;
+      }
+      pos = wfblk(w, pos + 1, dat.subarray(i, e));
+    }
+    st.i = s;
+  }
+  return slc(o, 0, pre + shft(pos) + post);
+};
+var crct = /* @__PURE__ */ (function() {
+  var t = new Int32Array(256);
+  for (var i = 0; i < 256; ++i) {
+    var c = i, k = 9;
+    while (--k)
+      c = (c & 1 && -306674912) ^ c >>> 1;
+    t[i] = c;
+  }
+  return t;
+})();
+var crc = function() {
+  var c = -1;
+  return {
+    p: function(d) {
+      var cr = c;
+      for (var i = 0; i < d.length; ++i)
+        cr = crct[cr & 255 ^ d[i]] ^ cr >>> 8;
+      c = cr;
+    },
+    d: function() {
+      return ~c;
+    }
+  };
+};
+var dopt = function(dat, opt, pre, post, st) {
+  if (!st) {
+    st = { l: 1 };
+    if (opt.dictionary) {
+      var dict = opt.dictionary.subarray(-32768);
+      var newDat = new u8(dict.length + dat.length);
+      newDat.set(dict);
+      newDat.set(dat, dict.length);
+      dat = newDat;
+      st.w = dict.length;
+    }
+  }
+  return dflt(dat, opt.level == null ? 6 : opt.level, opt.mem == null ? st.l ? Math.ceil(Math.max(8, Math.min(13, Math.log(dat.length))) * 1.5) : 20 : 12 + opt.mem, pre, post, st);
+};
+var mrg = function(a, b) {
+  var o = {};
+  for (var k in a)
+    o[k] = a[k];
+  for (var k in b)
+    o[k] = b[k];
+  return o;
+};
+var wbytes = function(d, b, v) {
+  for (; v; ++b)
+    d[b] = v, v >>>= 8;
+};
+function deflateSync(data, opts) {
+  return dopt(data, opts || {}, 0, 0);
+}
+var fltn = function(d, p, t, o) {
+  for (var k in d) {
+    var val = d[k], n = p + k, op = o;
+    if (Array.isArray(val))
+      op = mrg(o, val[1]), val = val[0];
+    if (val instanceof u8)
+      t[n] = [val, op];
+    else {
+      t[n += "/"] = [new u8(0), op];
+      fltn(val, n, t, o);
+    }
+  }
+};
+var te = typeof TextEncoder != "undefined" && /* @__PURE__ */ new TextEncoder();
+var td = typeof TextDecoder != "undefined" && /* @__PURE__ */ new TextDecoder();
+var tds = 0;
+try {
+  td.decode(et, { stream: true });
+  tds = 1;
+} catch (e) {
+}
+function strToU8(str, latin1) {
+  if (latin1) {
+    var ar_1 = new u8(str.length);
+    for (var i = 0; i < str.length; ++i)
+      ar_1[i] = str.charCodeAt(i);
+    return ar_1;
+  }
+  if (te)
+    return te.encode(str);
+  var l = str.length;
+  var ar = new u8(str.length + (str.length >> 1));
+  var ai = 0;
+  var w = function(v) {
+    ar[ai++] = v;
+  };
+  for (var i = 0; i < l; ++i) {
+    if (ai + 5 > ar.length) {
+      var n = new u8(ai + 8 + (l - i << 1));
+      n.set(ar);
+      ar = n;
+    }
+    var c = str.charCodeAt(i);
+    if (c < 128 || latin1)
+      w(c);
+    else if (c < 2048)
+      w(192 | c >> 6), w(128 | c & 63);
+    else if (c > 55295 && c < 57344)
+      c = 65536 + (c & 1023 << 10) | str.charCodeAt(++i) & 1023, w(240 | c >> 18), w(128 | c >> 12 & 63), w(128 | c >> 6 & 63), w(128 | c & 63);
+    else
+      w(224 | c >> 12), w(128 | c >> 6 & 63), w(128 | c & 63);
+  }
+  return slc(ar, 0, ai);
+}
+var exfl = function(ex) {
+  var le = 0;
+  if (ex) {
+    for (var k in ex) {
+      var l = ex[k].length;
+      if (l > 65535)
+        err(9);
+      le += l + 4;
+    }
+  }
+  return le;
+};
+var wzh = function(d, b, f, fn, u, c, ce, co) {
+  var fl2 = fn.length, ex = f.extra, col = co && co.length;
+  var exl = exfl(ex);
+  wbytes(d, b, ce != null ? 33639248 : 67324752), b += 4;
+  if (ce != null)
+    d[b++] = 20, d[b++] = f.os;
+  d[b] = 20, b += 2;
+  d[b++] = f.flag << 1 | (c < 0 && 8), d[b++] = u && 8;
+  d[b++] = f.compression & 255, d[b++] = f.compression >> 8;
+  var dt = new Date(f.mtime == null ? Date.now() : f.mtime), y = dt.getFullYear() - 1980;
+  if (y < 0 || y > 119)
+    err(10);
+  wbytes(d, b, y << 25 | dt.getMonth() + 1 << 21 | dt.getDate() << 16 | dt.getHours() << 11 | dt.getMinutes() << 5 | dt.getSeconds() >> 1), b += 4;
+  if (c != -1) {
+    wbytes(d, b, f.crc);
+    wbytes(d, b + 4, c < 0 ? -c - 2 : c);
+    wbytes(d, b + 8, f.size);
+  }
+  wbytes(d, b + 12, fl2);
+  wbytes(d, b + 14, exl), b += 16;
+  if (ce != null) {
+    wbytes(d, b, col);
+    wbytes(d, b + 6, f.attrs);
+    wbytes(d, b + 10, ce), b += 14;
+  }
+  d.set(fn, b);
+  b += fl2;
+  if (exl) {
+    for (var k in ex) {
+      var exf = ex[k], l = exf.length;
+      wbytes(d, b, +k);
+      wbytes(d, b + 2, l);
+      d.set(exf, b + 4), b += 4 + l;
+    }
+  }
+  if (col)
+    d.set(co, b), b += col;
+  return b;
+};
+var wzf = function(o, b, c, d, e) {
+  wbytes(o, b, 101010256);
+  wbytes(o, b + 8, c);
+  wbytes(o, b + 10, c);
+  wbytes(o, b + 12, d);
+  wbytes(o, b + 16, e);
+};
+function zipSync(data, opts) {
+  if (!opts)
+    opts = {};
+  var r = {};
+  var files = [];
+  fltn(data, "", r, opts);
+  var o = 0;
+  var tot = 0;
+  for (var fn in r) {
+    var _a2 = r[fn], file = _a2[0], p = _a2[1];
+    var compression = p.level == 0 ? 0 : 8;
+    var f = strToU8(fn), s = f.length;
+    var com = p.comment, m = com && strToU8(com), ms = m && m.length;
+    var exl = exfl(p.extra);
+    if (s > 65535)
+      err(11);
+    var d = compression ? deflateSync(file, p) : file, l = d.length;
+    var c = crc();
+    c.p(file);
+    files.push(mrg(p, {
+      size: file.length,
+      crc: c.d(),
+      c: d,
+      f,
+      m,
+      u: s != fn.length || m && com.length != ms,
+      o,
+      compression
+    }));
+    o += 30 + s + exl + l;
+    tot += 76 + 2 * (s + exl) + (ms || 0) + l;
+  }
+  var out = new u8(tot + 22), oe = o, cdl = tot - o;
+  for (var i = 0; i < files.length; ++i) {
+    var f = files[i];
+    wzh(out, f.o, f, f.f, f.u, f.c.length);
+    var badd = 30 + f.f.length + exfl(f.extra);
+    out.set(f.c, f.o + badd);
+    wzh(out, o, f, f.f, f.u, f.c.length, f.o, f.m), o += 16 + badd + (f.m ? f.m.length : 0);
+  }
+  wzf(out, o, files.length, cdl, oe);
+  return out;
+}
+
+// dist/host/skills-cmd.js
+async function runSkillsCmd(io2, argv) {
+  if (await refuseInsideManagedRun(io2, "skills"))
+    return USAGE_ERR;
+  const [verb, ...rest] = argv;
+  if (!verb) {
+    io2.stderr("usage: antpath skills <upload|list|get|delete> [flags]\n");
+    return USAGE_ERR;
+  }
+  switch (verb) {
+    case "upload":
+      return runSkillsUpload(io2, rest);
+    case "list":
+      return runSkillsList(io2, rest);
+    case "get":
+      return runSkillsGet(io2, rest);
+    case "delete":
+      return runSkillsDelete(io2, rest);
+    default:
+      io2.stderr(`unknown skills verb: ${verb}
+`);
+      return USAGE_ERR;
+  }
+}
+async function runSkillsUpload(io2, argv) {
+  const common = parseCommonHostFlags(argv);
+  if (!common.ok) {
+    io2.stderr(`${common.reason}
+`);
+    return USAGE_ERR;
+  }
+  let rest = common.rest;
+  const nameFlag = takeFlagValue(rest, "--name");
+  if (nameFlag.error) {
+    io2.stderr(`${nameFlag.error}
+`);
+    return USAGE_ERR;
+  }
+  rest = nameFlag.remaining;
+  if (!nameFlag.value) {
+    io2.stderr("--name is required\n");
+    return USAGE_ERR;
+  }
+  const fromPath = takeFlagValue(rest, "--from-path");
+  if (fromPath.error) {
+    io2.stderr(`${fromPath.error}
+`);
+    return USAGE_ERR;
+  }
+  rest = fromPath.remaining;
+  const fileFlags = collectRepeated(rest, "--file");
+  if (fileFlags.error) {
+    io2.stderr(`${fileFlags.error}
+`);
+    return USAGE_ERR;
+  }
+  rest = fileFlags.remaining;
+  const unknown = rest.filter((a) => a.startsWith("--"));
+  if (unknown.length > 0) {
+    io2.stderr(`unknown flag: ${unknown[0]}
+`);
+    return USAGE_ERR;
+  }
+  if (fromPath.value && fileFlags.values.length > 0 || !fromPath.value && fileFlags.values.length === 0) {
+    io2.stderr("antpath skills upload requires exactly one of: --from-path <dir> | --file <path> [--file ...]\n");
+    return USAGE_ERR;
+  }
+  let zip;
+  try {
+    if (fromPath.value) {
+      zip = await zipDirectory(resolvePath2(io2.cwd(), fromPath.value));
+    } else {
+      zip = await zipFiles(io2.cwd(), fileFlags.values);
+    }
+  } catch (err2) {
+    io2.stderr(`failed to build skill bundle: ${err2.message}
+`);
+    return USAGE_ERR;
+  }
+  const http = makeHttpClient(io2, common.flags);
+  try {
+    const skill = await operations_exports.createSkillBundle(http, {
+      name: nameFlag.value,
+      body: zip,
+      contentType: "application/zip",
+      filename: `${nameFlag.value}.zip`
+    });
+    io2.stdout(JSON.stringify(skill) + "\n");
+    return SUCCESS;
+  } catch (err2) {
+    return emitJsonError(io2, "skill_upload_failed", err2.message ?? "upload failed");
+  }
+}
+async function runSkillsList(io2, argv) {
+  const common = parseCommonHostFlags(argv);
+  if (!common.ok) {
+    io2.stderr(`${common.reason}
+`);
+    return USAGE_ERR;
+  }
+  const positional = common.rest.filter((a) => !a.startsWith("--"));
+  const unknown = common.rest.filter((a) => a.startsWith("--"));
+  if (unknown.length > 0) {
+    io2.stderr(`unknown flag: ${unknown[0]}
+`);
+    return USAGE_ERR;
+  }
+  if (positional.length > 0) {
+    io2.stderr(`antpath skills list takes no positional arguments
+`);
+    return USAGE_ERR;
+  }
+  const http = makeHttpClient(io2, common.flags);
+  try {
+    const skills = await operations_exports.listSkills(http);
+    for (const s of skills)
+      io2.stdout(JSON.stringify(s) + "\n");
+    return SUCCESS;
+  } catch (err2) {
+    return emitJsonError(io2, "skills_list_failed", err2.message ?? "list failed");
+  }
+}
+async function runSkillsGet(io2, argv) {
+  const common = parseCommonHostFlags(argv);
+  if (!common.ok) {
+    io2.stderr(`${common.reason}
+`);
+    return USAGE_ERR;
+  }
+  const positional = common.rest.filter((a) => !a.startsWith("--"));
+  const unknown = common.rest.filter((a) => a.startsWith("--"));
+  if (unknown.length > 0) {
+    io2.stderr(`unknown flag: ${unknown[0]}
+`);
+    return USAGE_ERR;
+  }
+  if (positional.length !== 1) {
+    io2.stderr("usage: antpath skills get <skill-id>\n");
+    return USAGE_ERR;
+  }
+  const skillId = positional[0];
+  const http = makeHttpClient(io2, common.flags);
+  try {
+    const skill = await operations_exports.getSkill(http, skillId);
+    io2.stdout(JSON.stringify(skill) + "\n");
+    return SUCCESS;
+  } catch (err2) {
+    return emitJsonError(io2, "skill_get_failed", err2.message ?? "get failed");
+  }
+}
+async function runSkillsDelete(io2, argv) {
+  const common = parseCommonHostFlags(argv);
+  if (!common.ok) {
+    io2.stderr(`${common.reason}
+`);
+    return USAGE_ERR;
+  }
+  const positional = common.rest.filter((a) => !a.startsWith("--"));
+  const unknown = common.rest.filter((a) => a.startsWith("--"));
+  if (unknown.length > 0) {
+    io2.stderr(`unknown flag: ${unknown[0]}
+`);
+    return USAGE_ERR;
+  }
+  if (positional.length !== 1) {
+    io2.stderr("usage: antpath skills delete <skill-id>\n");
+    return USAGE_ERR;
+  }
+  const skillId = positional[0];
+  const http = makeHttpClient(io2, common.flags);
+  try {
+    await operations_exports.deleteSkill(http, skillId);
+    io2.stdout(JSON.stringify({ skillId, deleted: true }) + "\n");
+    return SUCCESS;
+  } catch (err2) {
+    return emitJsonError(io2, "skill_delete_failed", err2.message ?? "delete failed");
+  }
+}
+var ZIP_EPOCH = new Date(Date.UTC(1980, 0, 1));
+function zipEntryFor(bytes) {
+  return [bytes, { mtime: ZIP_EPOCH }];
+}
+async function zipDirectory(rootDir) {
+  const rootStat = await stat(rootDir);
+  if (!rootStat.isDirectory()) {
+    throw new Error(`${rootDir} is not a directory`);
+  }
+  const collected = /* @__PURE__ */ new Map();
+  let totalDecompressed = 0;
+  let hasSkillMd = false;
+  await walk(rootDir, rootDir, async (relPathPosix, bytes) => {
+    const entry = validateSkillBundleEntry({ path: relPathPosix, size: bytes.byteLength });
+    if (entry.path === "SKILL.md")
+      hasSkillMd = true;
+    totalDecompressed += bytes.byteLength;
+    if (totalDecompressed > SKILL_BUNDLE_LIMITS.maxDecompressedBytes) {
+      throw new Error(`skill bundle exceeds decompressed cap of ${SKILL_BUNDLE_LIMITS.maxDecompressedBytes} bytes`);
+    }
+    if (collected.has(entry.path)) {
+      throw new Error(`skill bundle contains duplicate path: ${entry.path}`);
+    }
+    if (collected.size >= SKILL_BUNDLE_LIMITS.maxFiles) {
+      throw new Error(`skill bundle exceeds ${SKILL_BUNDLE_LIMITS.maxFiles} file limit`);
+    }
+    collected.set(entry.path, bytes);
+  });
+  if (collected.size === 0) {
+    throw new Error(`${rootDir} contains no regular files`);
+  }
+  if (!hasSkillMd) {
+    throw new Error('skill bundle must contain a "SKILL.md" file at the root');
+  }
+  const sorted = [...collected.entries()].sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0);
+  const zippable = {};
+  for (const [path, bytes] of sorted)
+    zippable[path] = zipEntryFor(bytes);
+  const out = zipSync(zippable, { level: 6 });
+  if (out.byteLength > SKILL_BUNDLE_LIMITS.maxCompressedBytes) {
+    throw new Error(`skill bundle exceeds compressed cap of ${SKILL_BUNDLE_LIMITS.maxCompressedBytes} bytes (got ${out.byteLength})`);
+  }
+  return out;
+}
+async function zipFiles(cwd, paths) {
+  if (paths.length > SKILL_BUNDLE_LIMITS.maxFiles) {
+    throw new Error(`skill bundle exceeds ${SKILL_BUNDLE_LIMITS.maxFiles} file limit`);
+  }
+  const collected = /* @__PURE__ */ new Map();
+  let totalDecompressed = 0;
+  let hasSkillMd = false;
+  for (const p of paths) {
+    const abs = resolvePath2(cwd, p);
+    const bytes = await readFile(abs);
+    const name = basename(p);
+    const entry = validateSkillBundleEntry({ path: name, size: bytes.byteLength });
+    if (entry.path === "SKILL.md")
+      hasSkillMd = true;
+    totalDecompressed += bytes.byteLength;
+    if (totalDecompressed > SKILL_BUNDLE_LIMITS.maxDecompressedBytes) {
+      throw new Error(`skill bundle exceeds decompressed cap of ${SKILL_BUNDLE_LIMITS.maxDecompressedBytes} bytes`);
+    }
+    if (collected.has(entry.path)) {
+      throw new Error(`skill bundle contains duplicate path (basenames must be unique): ${entry.path}`);
+    }
+    collected.set(entry.path, bytes);
+  }
+  if (!hasSkillMd) {
+    throw new Error('skill bundle must contain a "SKILL.md" file at the root');
+  }
+  const sorted = [...collected.entries()].sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0);
+  const zippable = {};
+  for (const [path, bytes] of sorted)
+    zippable[path] = zipEntryFor(bytes);
+  const out = zipSync(zippable, { level: 6 });
+  if (out.byteLength > SKILL_BUNDLE_LIMITS.maxCompressedBytes) {
+    throw new Error(`skill bundle exceeds compressed cap of ${SKILL_BUNDLE_LIMITS.maxCompressedBytes} bytes`);
+  }
+  return out;
+}
+async function walk(rootDir, currentDir, visit) {
+  const entries = await readdir(currentDir, { withFileTypes: true });
+  for (const dirent of entries) {
+    const full = join(currentDir, dirent.name);
+    if (dirent.isSymbolicLink())
+      continue;
+    if (dirent.isDirectory()) {
+      await walk(rootDir, full, visit);
+      continue;
+    }
+    if (!dirent.isFile())
+      continue;
+    const rel = relative(rootDir, full);
+    const posixPath = sep === "/" ? rel : rel.split(sep).join(posix.sep);
+    const bytes = await readFile(full);
+    await visit(posixPath, bytes);
+  }
+}
+
 // dist/host/status.js
 async function runStatusCmd(io2, argv) {
   if (await refuseInsideManagedRun(io2, "status"))
@@ -1243,8 +2492,8 @@ async function runStatusCmd(io2, argv) {
     const run = await operations_exports.getRun(http, runId);
     io2.stdout(JSON.stringify(run) + "\n");
     return SUCCESS;
-  } catch (err) {
-    return emitJsonError(io2, "status_failed", err.message ?? "status fetch failed", { runId });
+  } catch (err2) {
+    return emitJsonError(io2, "status_failed", err2.message ?? "status fetch failed", { runId });
   }
 }
 
@@ -1281,8 +2530,8 @@ async function runEventsCmd(io2, argv) {
         io2.stdout(JSON.stringify(event) + "\n");
       }
       return SUCCESS;
-    } catch (err) {
-      return emitJsonError(io2, "events_failed", err.message ?? "event fetch failed", { runId });
+    } catch (err2) {
+      return emitJsonError(io2, "events_failed", err2.message ?? "event fetch failed", { runId });
     }
   }
   let emittedCount = 0;
@@ -1290,8 +2539,8 @@ async function runEventsCmd(io2, argv) {
     let events;
     try {
       events = await operations_exports.listRunEvents(http, runId);
-    } catch (err) {
-      io2.stderr(`(transient) event poll failed: ${err.message}
+    } catch (err2) {
+      io2.stderr(`(transient) event poll failed: ${err2.message}
 `);
       await sleep2(2e3);
       continue;
@@ -1305,8 +2554,8 @@ async function runEventsCmd(io2, argv) {
       if (TERMINAL_STATUSES2.has(run.status)) {
         return SUCCESS;
       }
-    } catch (err) {
-      io2.stderr(`(transient) status poll failed: ${err.message}
+    } catch (err2) {
+      io2.stderr(`(transient) status poll failed: ${err2.message}
 `);
     }
     await sleep2(2e3);
@@ -1339,13 +2588,13 @@ async function runOutputsCmd(io2, argv) {
       io2.stdout(JSON.stringify(out) + "\n");
     }
     return SUCCESS;
-  } catch (err) {
-    return emitJsonError(io2, "outputs_failed", err.message ?? "outputs fetch failed", { runId });
+  } catch (err2) {
+    return emitJsonError(io2, "outputs_failed", err2.message ?? "outputs fetch failed", { runId });
   }
 }
 
 // dist/host/download.js
-import { resolve as resolvePath2, basename } from "node:path";
+import { resolve as resolvePath3, basename as basename2 } from "node:path";
 async function runDownloadCmd(io2, argv) {
   if (await refuseInsideManagedRun(io2, "download"))
     return USAGE_ERR;
@@ -1372,14 +2621,14 @@ async function runDownloadCmd(io2, argv) {
   let link;
   try {
     link = await operations_exports.createOutputLink(http, runId, outputId);
-  } catch (err) {
-    return emitJsonError(io2, "link_failed", err.message ?? "create link failed", { runId, outputId });
+  } catch (err2) {
+    return emitJsonError(io2, "link_failed", err2.message ?? "create link failed", { runId, outputId });
   }
   let response;
   try {
     response = await io2.fetchImpl(link.url, { method: "GET", redirect: "follow" });
-  } catch (err) {
-    return emitJsonError(io2, "download_failed", `download fetch failed: ${err.message}`, { runId, outputId });
+  } catch (err2) {
+    return emitJsonError(io2, "download_failed", `download fetch failed: ${err2.message}`, { runId, outputId });
   }
   if (!response.ok) {
     return emitJsonError(io2, "download_failed", `download HTTP ${response.status}`, { runId, outputId });
@@ -1388,25 +2637,25 @@ async function runDownloadCmd(io2, argv) {
   const destination = resolveDestination(io2, outFlag.value, outputId, link.url);
   try {
     await io2.writeFile(destination, buffer);
-  } catch (err) {
-    return emitJsonError(io2, "write_failed", `failed to write output: ${err.message}`, { destination });
+  } catch (err2) {
+    return emitJsonError(io2, "write_failed", `failed to write output: ${err2.message}`, { destination });
   }
   io2.stdout(JSON.stringify({ runId, outputId, path: destination, bytes: buffer.byteLength }) + "\n");
   return SUCCESS;
 }
 function resolveDestination(io2, out, outputId, signedUrl) {
   if (out) {
-    return resolvePath2(io2.cwd(), out);
+    return resolvePath3(io2.cwd(), out);
   }
   let fileName = `${outputId}`;
   try {
     const url = new URL(signedUrl);
-    const tail = basename(url.pathname);
+    const tail = basename2(url.pathname);
     if (tail)
       fileName = tail;
   } catch {
   }
-  return resolvePath2(io2.cwd(), fileName);
+  return resolvePath3(io2.cwd(), fileName);
 }
 
 // dist/host/cancel.js
@@ -1430,8 +2679,8 @@ async function runCancelCmd(io2, argv) {
     await operations_exports.cancelRun(http, runId);
     io2.stdout(JSON.stringify({ runId, status: "cancel_requested" }) + "\n");
     return SUCCESS;
-  } catch (err) {
-    return emitJsonError(io2, "cancel_failed", err.message ?? "cancel failed", { runId });
+  } catch (err2) {
+    return emitJsonError(io2, "cancel_failed", err2.message ?? "cancel failed", { runId });
   }
 }
 
@@ -1456,8 +2705,8 @@ async function runDeleteCmd(io2, argv) {
     await operations_exports.deleteRun(http, runId);
     io2.stdout(JSON.stringify({ runId, deleted: true }) + "\n");
     return SUCCESS;
-  } catch (err) {
-    return emitJsonError(io2, "delete_failed", err.message ?? "delete failed", { runId });
+  } catch (err2) {
+    return emitJsonError(io2, "delete_failed", err2.message ?? "delete failed", { runId });
   }
 }
 
@@ -1481,8 +2730,8 @@ async function runWhoamiCmd(io2, argv) {
     const me = await operations_exports.whoami(http);
     io2.stdout(JSON.stringify(me) + "\n");
     return SUCCESS;
-  } catch (err) {
-    return emitJsonError(io2, "whoami_failed", err.message ?? "whoami failed");
+  } catch (err2) {
+    return emitJsonError(io2, "whoami_failed", err2.message ?? "whoami failed");
   }
 }
 
@@ -1492,8 +2741,8 @@ async function runCli(io2) {
   try {
     const exit = await dispatch(io2, args);
     io2.exit(exit.code);
-  } catch (err) {
-    const body = { error: "internal_error", message: err.message ?? "unknown error" };
+  } catch (err2) {
+    const body = { error: "internal_error", message: err2.message ?? "unknown error" };
     io2.stderr(JSON.stringify(body) + "\n");
     io2.exit(RUNTIME_ERR.code);
   }
@@ -1509,6 +2758,8 @@ async function dispatch(io2, args) {
       return runProxy(io2, rest);
     case "run":
       return runRunCmd(io2, rest);
+    case "skills":
+      return runSkillsCmd(io2, rest);
     case "status":
       return runStatusCmd(io2, rest);
     case "events":
@@ -1553,7 +2804,13 @@ Protocol version: ${manifest.protocolVersion}
   }
   io2.stdout("antpath \u2014 unified CLI for the antpath platform (mirrors the SDK 1:1)\n\n");
   io2.stdout("Usage:\n");
-  io2.stdout("  antpath run <template-path> --api-token T [flags]\n");
+  io2.stdout("  antpath run --config <run.json> --anthropic-api-key K --api-token T [flags]\n");
+  io2.stdout("  antpath run --model M --prompt P [--system S] [--skill ID ...] [--mcp name=url ...] --anthropic-api-key K --api-token T [flags]\n");
+  io2.stdout("  antpath skills upload --name N --from-path <dir> --api-token T\n");
+  io2.stdout("  antpath skills upload --name N --file <path> [--file <path> ...] --api-token T\n");
+  io2.stdout("  antpath skills list --api-token T\n");
+  io2.stdout("  antpath skills get <skill-id> --api-token T\n");
+  io2.stdout("  antpath skills delete <skill-id> --api-token T\n");
   io2.stdout("  antpath status <run-id> --api-token T\n");
   io2.stdout("  antpath events <run-id> [--follow] --api-token T\n");
   io2.stdout("  antpath outputs <run-id> --api-token T\n");
@@ -1565,23 +2822,28 @@ Protocol version: ${manifest.protocolVersion}
   io2.stdout("Common flags on every host subcommand:\n");
   io2.stdout("  --api-token <token>         REQUIRED \u2014 antpath SDK API token (workspace is derived from it)\n");
   io2.stdout("  --dashboard-url <url>       Optional; defaults to https://antpath.ai (set for self-hosted)\n\n");
-  io2.stdout("Submit flags (antpath run):\n");
+  io2.stdout("antpath run flags:\n");
   io2.stdout("  --anthropic-api-key <key>   REQUIRED \u2014 provider key (never stored)\n");
-  io2.stdout("  --var name=value            Template variable (repeatable)\n");
-  io2.stdout("  --mcp-server '<json>'       PlatformMcpServerSecret JSON (repeatable)\n");
-  io2.stdout("  --skill <skillId>[:<ver>]   Skill reference (repeatable)\n");
+  io2.stdout("  --config <path>             JSON Blueprint (mutually exclusive with the flat --model/--prompt flags)\n");
+  io2.stdout("  --model <model-id>          Anthropic model id (required in flat mode)\n");
+  io2.stdout("  --system @file | <text>     System message; @-prefix reads from file\n");
+  io2.stdout("  --prompt @file | <text>     User message; @-prefix reads from file (repeatable)\n");
+  io2.stdout("  --skill <skl_id>            Workspace skill (repeatable)\n");
+  io2.stdout("  --provider-skill v:s[:ver]  Provider built-in skill (vendor:skillId[:version], repeatable)\n");
+  io2.stdout("  --mcp name=url              MCP server entry (repeatable)\n");
+  io2.stdout("  --mcp-auth name=Hdr:Val     Auth header on the matching --mcp; routed into vaulted secrets (repeatable)\n");
+  io2.stdout("  --metadata key=value        Submission metadata entry (repeatable)\n");
   io2.stdout("  --proxy-endpoint '<json>'   PlatformProxyEndpoint JSON (repeatable)\n");
   io2.stdout("  --proxy-auth name=<spec>    bearer:tok | basic:u:p | header:v | query:v (repeatable)\n");
   io2.stdout("  --cleanup retain|delete     Session cleanup policy\n");
   io2.stdout("  --idempotency-key <key>     Optional; defaults to a fresh UUID\n");
-  io2.stdout("  --follow                    Poll events to stdout until the run terminates\n\n");
-  io2.stdout("Template formats: .json, .js, .mjs, .ts (default export must be a TemplateDefinition).\n");
+  io2.stdout("  --follow                    Poll events to stdout until the run terminates\n");
   return SUCCESS;
 }
 
 // dist/cli.js
 var io = {
-  readFile: (path) => readFile(path, "utf8"),
+  readFile: (path) => readFile2(path, "utf8"),
   writeFile: (path, data) => writeFile(path, data),
   fetchImpl: fetch,
   stdout: (chunk) => process.stdout.write(chunk),