chops-sh 0.1.0 → 0.2.0

package/dist/index.js

@@ -1230,9 +1230,9 @@ ${indent}`) + "'";
       start = start.replace(/\n+/g, `$&${indent}`);
     }
     const indentSize = indent ? "2" : "1";
-    let header = (startWithSpace ? indentSize : "") + chomp;
+    let header2 = (startWithSpace ? indentSize : "") + chomp;
     if (comment) {
-      header += " " + commentString(comment.replace(/ ?[\r\n]+/g, " "));
+      header2 += " " + commentString(comment.replace(/ ?[\r\n]+/g, " "));
       if (onComment)
         onComment();
     }
@@ -1248,11 +1248,11 @@ $&`).replace(/(?:^|\n)([\t ].*)(?:([\n\t ]*)\n(?![\n\t ]))?/g, "$1$2").replace(/
       }
       const body = foldFlowLines.foldFlowLines(`${start}${foldedValue}${end}`, indent, foldFlowLines.FOLD_BLOCK, foldOptions);
       if (!literalFallback)
-        return `>${header}
+        return `>${header2}
 ${indent}${body}`;
     }
     value = value.replace(/\n+/g, `$&${indent}`);
-    return `|${header}
+    return `|${header2}
 ${indent}${start}${value}${end}`;
   }
   function plainString(item, ctx, onComment, onChompKeep) {
@@ -4127,10 +4127,10 @@ var require_resolve_block_scalar = __commonJS((exports) => {
   var Scalar = require_Scalar();
   function resolveBlockScalar(ctx, scalar, onError) {
     const start = scalar.offset;
-    const header = parseBlockScalarHeader(scalar, ctx.options.strict, onError);
-    if (!header)
+    const header2 = parseBlockScalarHeader(scalar, ctx.options.strict, onError);
+    if (!header2)
       return { value: "", type: null, comment: "", range: [start, start, start] };
-    const type = header.mode === ">" ? Scalar.Scalar.BLOCK_FOLDED : Scalar.Scalar.BLOCK_LITERAL;
+    const type = header2.mode === ">" ? Scalar.Scalar.BLOCK_FOLDED : Scalar.Scalar.BLOCK_LITERAL;
     const lines = scalar.source ? splitLines(scalar.source) : [];
     let chompStart = lines.length;
     for (let i = lines.length - 1;i >= 0; --i) {
@@ -4141,27 +4141,27 @@ var require_resolve_block_scalar = __commonJS((exports) => {
         break;
     }
     if (chompStart === 0) {
-      const value2 = header.chomp === "+" && lines.length > 0 ? `
+      const value2 = header2.chomp === "+" && lines.length > 0 ? `
 `.repeat(Math.max(1, lines.length - 1)) : "";
-      let end2 = start + header.length;
+      let end2 = start + header2.length;
       if (scalar.source)
         end2 += scalar.source.length;
-      return { value: value2, type, comment: header.comment, range: [start, end2, end2] };
+      return { value: value2, type, comment: header2.comment, range: [start, end2, end2] };
     }
-    let trimIndent = scalar.indent + header.indent;
-    let offset = scalar.offset + header.length;
+    let trimIndent = scalar.indent + header2.indent;
+    let offset = scalar.offset + header2.length;
     let contentStart = 0;
     for (let i = 0;i < chompStart; ++i) {
       const [indent, content] = lines[i];
       if (content === "" || content === "\r") {
-        if (header.indent === 0 && indent.length > trimIndent)
+        if (header2.indent === 0 && indent.length > trimIndent)
           trimIndent = indent.length;
       } else {
         if (indent.length < trimIndent) {
           const message = "Block scalars with more-indented leading empty lines must use an explicit indentation indicator";
           onError(offset + indent.length, "MISSING_CHAR", message);
         }
-        if (header.indent === 0)
+        if (header2.indent === 0)
           trimIndent = indent.length;
         contentStart = i;
         if (trimIndent === 0 && !ctx.atRoot) {
@@ -4189,7 +4189,7 @@ var require_resolve_block_scalar = __commonJS((exports) => {
       if (crlf)
         content = content.slice(0, -1);
       if (content && indent.length < trimIndent) {
-        const src = header.indent ? "explicit indentation indicator" : "first line";
+        const src = header2.indent ? "explicit indentation indicator" : "first line";
         const message = `Block scalar lines must not be less indented than their ${src}`;
         onError(offset - content.length - (crlf ? 2 : 1), "BAD_INDENT", message);
         indent = "";
@@ -4225,7 +4225,7 @@ var require_resolve_block_scalar = __commonJS((exports) => {
         prevMoreIndented = false;
       }
     }
-    switch (header.chomp) {
+    switch (header2.chomp) {
       case "-":
         break;
       case "+":
@@ -4241,8 +4241,8 @@ var require_resolve_block_scalar = __commonJS((exports) => {
         value += `
 `;
     }
-    const end = start + header.length + scalar.source.length;
-    return { value, type, comment: header.comment, range: [start, end, end] };
+    const end = start + header2.length + scalar.source.length;
+    return { value, type, comment: header2.comment, range: [start, end, end] };
   }
   function parseBlockScalarHeader({ offset, props }, strict, onError) {
     if (props[0].type !== "block-scalar-header") {
@@ -5047,10 +5047,10 @@ var require_cst_scalar = __commonJS((exports) => {
           type = "QUOTE_DOUBLE";
           break;
         case "block-scalar": {
-          const header = token.props[0];
-          if (header.type !== "block-scalar-header")
+          const header2 = token.props[0];
+          if (header2.type !== "block-scalar-header")
             throw new Error("Invalid block scalar header");
-          type = header.source[0] === ">" ? "BLOCK_FOLDED" : "BLOCK_LITERAL";
+          type = header2.source[0] === ">" ? "BLOCK_FOLDED" : "BLOCK_LITERAL";
           break;
         }
         default:
@@ -5084,10 +5084,10 @@ var require_cst_scalar = __commonJS((exports) => {
     const body = source.substring(he + 1) + `
 `;
     if (token.type === "block-scalar") {
-      const header = token.props[0];
-      if (header.type !== "block-scalar-header")
+      const header2 = token.props[0];
+      if (header2.type !== "block-scalar-header")
         throw new Error("Invalid block scalar header");
-      header.source = head;
+      header2.source = head;
       token.source = body;
     } else {
       const { offset } = token;
@@ -6958,18 +6958,6 @@ var require_public_api = __commonJS((exports) => {
 import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
 
-// ../core/src/exit-codes.ts
-var EXIT_CODES = {
-  OK: 0,
-  GENERIC: 1,
-  VERIFIED_ONLY: 42,
-  VERIFICATION_WARNING: 43,
-  TEAM_POLICY_BLOCK: 44,
-  RATE_LIMITED: 45
-};
-// ../core/src/manifest.ts
-import { createHash } from "node:crypto";
-
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
@@ -10943,7 +10931,216 @@ var coerce = {
   date: (arg) => ZodDate.create({ ...arg, coerce: true })
 };
 var NEVER = INVALID;
+// ../core/src/api-auth.ts
+var apiErrorSchema = exports_external.object({
+  error: exports_external.object({
+    code: exports_external.string(),
+    message: exports_external.string(),
+    lift: exports_external.object({ action: exports_external.string(), hint: exports_external.string() }).optional(),
+    retry_after: exports_external.number().int().nonnegative().optional()
+  })
+});
+var authUserSchema = exports_external.object({
+  id: exports_external.string().uuid(),
+  email: exports_external.string().email(),
+  handle: exports_external.string().nullable()
+});
+var otpStartResponseSchema = exports_external.object({
+  ok: exports_external.literal(true),
+  dev_code: exports_external.string().optional()
+});
+var tokenPairSchema = exports_external.object({
+  access_jwt: exports_external.string().min(1),
+  refresh_token: exports_external.string().min(1),
+  expires_in: exports_external.number().int().positive()
+});
+var otpVerifyResponseSchema = tokenPairSchema.extend({
+  user: authUserSchema
+});
+var teamRoleSchema = exports_external.enum(["owner", "admin", "member"]);
+var teamSummarySchema = exports_external.object({
+  id: exports_external.string().uuid(),
+  slug: exports_external.string(),
+  name: exports_external.string(),
+  role: teamRoleSchema,
+  member_count: exports_external.number().int().positive()
+});
+var createTeamResponseSchema = exports_external.object({
+  team: teamSummarySchema
+});
+var meTeamsResponseSchema = exports_external.object({
+  teams: exports_external.array(teamSummarySchema)
+});
+var teamMemberSchema = exports_external.object({
+  user_id: exports_external.string().uuid(),
+  email: exports_external.string().email(),
+  handle: exports_external.string().nullable(),
+  role: teamRoleSchema,
+  joined_at: exports_external.string()
+});
+var pendingInviteSchema = exports_external.object({
+  id: exports_external.string().uuid(),
+  email: exports_external.string().email(),
+  role: teamRoleSchema,
+  invited_by: exports_external.string(),
+  expires_at: exports_external.string()
+});
+var teamMembersResponseSchema = exports_external.object({
+  members: exports_external.array(teamMemberSchema),
+  invites: exports_external.array(pendingInviteSchema).optional()
+});
+var inviteSendResultSchema = exports_external.object({
+  email: exports_external.string(),
+  status: exports_external.enum(["sent", "already_member", "invalid_email"]),
+  expires_at: exports_external.string().optional()
+});
+var sendInvitesResponseSchema = exports_external.object({
+  results: exports_external.array(inviteSendResultSchema)
+});
+var invitePreviewSchema = exports_external.object({
+  team: exports_external.object({ slug: exports_external.string(), name: exports_external.string() }),
+  inviter: exports_external.string(),
+  invited_email_masked: exports_external.string(),
+  status: exports_external.enum(["pending", "accepted", "revoked", "expired"]),
+  expires_at: exports_external.string()
+});
+var meInviteSchema = exports_external.object({
+  id: exports_external.string().uuid(),
+  team: exports_external.object({ slug: exports_external.string(), name: exports_external.string() }),
+  role: teamRoleSchema,
+  invited_by: exports_external.string(),
+  expires_at: exports_external.string()
+});
+var meInvitesResponseSchema = exports_external.object({
+  invites: exports_external.array(meInviteSchema)
+});
+var acceptInviteResponseSchema = exports_external.object({
+  team: exports_external.object({ slug: exports_external.string(), name: exports_external.string() }),
+  role: teamRoleSchema
+});
+var privateSkillSummarySchema = exports_external.object({
+  ref: exports_external.string(),
+  name: exports_external.string(),
+  description: exports_external.string().nullable(),
+  version: exports_external.number().int().positive(),
+  content_sha: exports_external.string(),
+  size_bytes: exports_external.number().int().nonnegative(),
+  published_by: exports_external.string(),
+  updated_at: exports_external.string()
+});
+var privateSkillsResponseSchema = exports_external.object({
+  skills: exports_external.array(privateSkillSummarySchema)
+});
+var privatePublishMetaSchema = exports_external.object({
+  name: exports_external.string().min(1).max(64),
+  description: exports_external.string().max(1024).nullish(),
+  content_sha: exports_external.string().regex(/^[a-f0-9]{64}$/),
+  size_bytes: exports_external.number().int().positive()
+});
+var privatePublishResponseSchema = exports_external.object({
+  ref: exports_external.string(),
+  name: exports_external.string(),
+  version: exports_external.number().int().positive(),
+  content_sha: exports_external.string(),
+  dedup: exports_external.boolean()
+});
+// ../core/src/archive.ts
+import { gzipSync } from "node:zlib";
+var BLOCK_SIZE = 512;
+function safeArchivePath(path) {
+  const normalized = path.replaceAll("\\", "/").replace(/^\.\//, "");
+  if (!normalized || normalized.startsWith("/") || normalized.split("/").some((part) => part === "" || part === "." || part === "..")) {
+    throw new Error(`unsafe archive path: ${path}`);
+  }
+  return normalized;
+}
+function writeText(target, offset, length, value) {
+  const bytes = new TextEncoder().encode(value);
+  if (bytes.length > length)
+    throw new Error(`tar header value is too long: ${value}`);
+  target.set(bytes, offset);
+}
+function octal(value, length) {
+  const body = Math.trunc(value).toString(8);
+  if (body.length > length - 1)
+    throw new Error(`tar numeric value is too large: ${value}`);
+  return `${body.padStart(length - 1, "0")}\x00`;
+}
+function splitTarPath(path) {
+  if (Buffer.byteLength(path) <= 100)
+    return { name: path, prefix: "" };
+  for (let index = path.lastIndexOf("/");index > 0; index = path.lastIndexOf("/", index - 1)) {
+    const prefix = path.slice(0, index);
+    const name = path.slice(index + 1);
+    if (Buffer.byteLength(prefix) <= 155 && Buffer.byteLength(name) <= 100) {
+      return { name, prefix };
+    }
+  }
+  throw new Error(`tar path is too long: ${path}`);
+}
+function header(entry) {
+  const path = safeArchivePath(entry.path);
+  const { name, prefix } = splitTarPath(path);
+  const block = new Uint8Array(BLOCK_SIZE);
+  const symlinkTarget = entry.symlink ? new TextDecoder().decode(entry.data) : "";
+  const size = entry.symlink ? 0 : entry.data.byteLength;
+  writeText(block, 0, 100, name);
+  writeText(block, 100, 8, octal(entry.executable ? 493 : 420, 8));
+  writeText(block, 108, 8, octal(0, 8));
+  writeText(block, 116, 8, octal(0, 8));
+  writeText(block, 124, 12, octal(size, 12));
+  writeText(block, 136, 12, octal(0, 12));
+  block.fill(32, 148, 156);
+  writeText(block, 156, 1, entry.symlink ? "2" : "0");
+  if (entry.symlink)
+    writeText(block, 157, 100, symlinkTarget);
+  writeText(block, 257, 6, "ustar\x00");
+  writeText(block, 263, 2, "00");
+  writeText(block, 345, 155, prefix);
+  const checksum = block.reduce((sum, byte) => sum + byte, 0);
+  writeText(block, 148, 8, `${checksum.toString(8).padStart(6, "0")}\x00 `);
+  return block;
+}
+function buildTarGz(entries) {
+  const chunks = [];
+  let total = BLOCK_SIZE * 2;
+  for (const entry of [...entries].sort((a, b) => a.path.localeCompare(b.path))) {
+    const block = header(entry);
+    chunks.push(block);
+    total += block.byteLength;
+    if (!entry.symlink) {
+      chunks.push(entry.data);
+      total += entry.data.byteLength;
+      const padding = (BLOCK_SIZE - entry.data.byteLength % BLOCK_SIZE) % BLOCK_SIZE;
+      if (padding) {
+        chunks.push(new Uint8Array(padding));
+        total += padding;
+      }
+    }
+  }
+  chunks.push(new Uint8Array(BLOCK_SIZE * 2));
+  const tar = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    tar.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  const compressed = Uint8Array.from(gzipSync(tar, { level: 9 }));
+  if (compressed.byteLength > 9)
+    compressed[9] = 255;
+  return compressed;
+}
+// ../core/src/exit-codes.ts
+var EXIT_CODES = {
+  OK: 0,
+  GENERIC: 1,
+  VERIFIED_ONLY: 42,
+  VERIFICATION_WARNING: 43,
+  TEAM_POLICY_BLOCK: 44,
+  RATE_LIMITED: 45
+};
 // ../core/src/manifest.ts
+import { createHash } from "node:crypto";
 var manifestSchema = exports_external.object({
   skill: exports_external.object({
     slug: exports_external.string().min(1),
@@ -10982,8 +11179,53 @@ function parseSkillSlug(input) {
   });
   return parsed.success ? parsed.data : null;
 }
+
+// ../core/src/skill-ref.ts
+var PRIVATE_NAME = /^(?!-)(?!.*--)[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var TEAM_SLUG = /^(?!-)(?!.*--)[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var PERSONAL_NAMESPACE = "me";
+var RESERVED_NAMESPACES = new Set([
+  PERSONAL_NAMESPACE,
+  "admin",
+  "api",
+  "chops",
+  "docs",
+  "invites",
+  "skills",
+  "teams",
+  "www"
+]);
+function parseSkillRef(input) {
+  const trimmed = input.trim();
+  if (trimmed.startsWith("@")) {
+    const match = /^@([^/@\s]+)\/([^/@\s]+)$/.exec(trimmed);
+    if (!match)
+      return null;
+    const namespace = match[1];
+    const name = match[2];
+    if (!PRIVATE_NAME.test(name))
+      return null;
+    if (namespace === PERSONAL_NAMESPACE)
+      return { kind: "personal", name };
+    if (!TEAM_SLUG.test(namespace))
+      return null;
+    return { kind: "team", team: namespace, name };
+  }
+  const slug = parseSkillSlug(trimmed);
+  return slug ? { kind: "public", ...slug } : null;
+}
+function formatSkillRef(ref) {
+  switch (ref.kind) {
+    case "public":
+      return `${ref.owner}/${ref.repo}@${ref.skill}`;
+    case "personal":
+      return `@${PERSONAL_NAMESPACE}/${ref.name}`;
+    case "team":
+      return `@${ref.team}/${ref.name}`;
+  }
+}
 // ../core/src/search.ts
-var searchResultSchema = exports_external.object({
+var skillSummarySchema = exports_external.object({
   slug: exports_external.string().min(1),
   description: exports_external.string().nullable(),
   publisher: exports_external.object({
@@ -10995,13 +11237,21 @@ var searchResultSchema = exports_external.object({
   installs: exports_external.number().int().nonnegative(),
   last_published_at: exports_external.string().datetime(),
   pinned_sha: exports_external.string().min(1),
-  install_cmd: exports_external.string().min(1),
+  install_cmd: exports_external.string().min(1)
+});
+var searchResultSchema = skillSummarySchema.extend({
   score: exports_external.number()
 });
 var searchResponseSchema = exports_external.object({
   query: exports_external.string().min(1),
   results: exports_external.array(searchResultSchema)
 });
+var browseSortSchema = exports_external.enum(["popular", "recent"]);
+var browseResponseSchema = exports_external.object({
+  total: exports_external.number().int().nonnegative(),
+  sort: browseSortSchema,
+  results: exports_external.array(skillSummarySchema)
+});
 // ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/index.js
 var composer = require_composer();
 var Document = require_Document();
@@ -11058,17 +11308,562 @@ var frontmatterSchema = exports_external.object({
   metadata: exports_external.record(exports_external.string()).optional(),
   "allowed-tools": exports_external.string().trim().min(1).optional()
 }).passthrough();
+function splitFrontmatter(input) {
+  const text = input.startsWith("\uFEFF") ? input.slice(1) : input;
+  const lines = text.split(/\r?\n/);
+  if (lines[0]?.trim() !== "---") {
+    return {
+      ok: false,
+      error: {
+        code: "missing-frontmatter",
+        message: "SKILL.md must start with a YAML frontmatter delimiter"
+      }
+    };
+  }
+  const closing = lines.findIndex((line, index) => index > 0 && line.trim() === "---");
+  if (closing < 0) {
+    return {
+      ok: false,
+      error: {
+        code: "unterminated-frontmatter",
+        message: "SKILL.md frontmatter is missing its closing delimiter"
+      }
+    };
+  }
+  return {
+    ok: true,
+    yaml: lines.slice(1, closing).join(`
+`),
+    body: lines.slice(closing + 1).join(`
+`).trim()
+  };
+}
+function parseSkillDocument(input, options = {}) {
+  const split = splitFrontmatter(input);
+  if (!split.ok)
+    return { ok: false, errors: [split.error] };
+  const document = $parseDocument(split.yaml, {
+    prettyErrors: false,
+    uniqueKeys: true
+  });
+  if (document.errors.length > 0) {
+    return {
+      ok: false,
+      errors: document.errors.map((error) => ({
+        code: "invalid-yaml",
+        message: error.message
+      }))
+    };
+  }
+  let raw;
+  try {
+    raw = document.toJS({ maxAliasCount: 0 });
+  } catch (error) {
+    return {
+      ok: false,
+      errors: [{ code: "invalid-yaml", message: error.message }]
+    };
+  }
+  const parsed = frontmatterSchema.safeParse(raw);
+  if (!parsed.success) {
+    return {
+      ok: false,
+      errors: parsed.error.issues.map((issue) => ({
+        code: "invalid-frontmatter",
+        message: `${issue.path.join(".") || "frontmatter"}: ${issue.message}`
+      }))
+    };
+  }
+  if (options.directoryName && parsed.data.name !== options.directoryName) {
+    return {
+      ok: false,
+      errors: [
+        {
+          code: "name-directory-mismatch",
+          message: `name "${parsed.data.name}" must match directory "${options.directoryName}"`
+        }
+      ]
+    };
+  }
+  return { ok: true, value: { frontmatter: parsed.data, body: split.body } };
+}
+// src/credentials.ts
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+var emptyCredentials = (apiUrl) => ({ version: 1, apiUrl });
+async function writePrivateJson(path, value) {
+  await mkdir(dirname(path), { recursive: true });
+  const temporary = `${path}.tmp-${crypto.randomUUID()}`;
+  await writeFile(temporary, `${JSON.stringify(value, null, 2)}
+`, { flag: "wx", mode: 384 });
+  await rename(temporary, path);
+}
+async function readCredentials(paths, apiUrl) {
+  try {
+    const parsed = JSON.parse(await readFile(paths.credentials, "utf8"));
+    if (parsed.version !== 1 || typeof parsed.apiUrl !== "string")
+      return emptyCredentials(apiUrl);
+    if (parsed.apiUrl !== apiUrl)
+      return emptyCredentials(apiUrl);
+    return parsed;
+  } catch {
+    return emptyCredentials(apiUrl);
+  }
+}
+async function writeCredentials(paths, creds) {
+  await writePrivateJson(paths.credentials, creds);
+}
+async function clearAuth(paths, apiUrl) {
+  const creds = await readCredentials(paths, apiUrl);
+  delete creds.auth;
+  await writeCredentials(paths, creds);
+}
+async function ensureDeviceId(paths) {
+  try {
+    const parsed = JSON.parse(await readFile(paths.device, "utf8"));
+    if (typeof parsed.deviceId === "string" && parsed.deviceId)
+      return parsed.deviceId;
+  } catch {}
+  const identity2 = {
+    deviceId: crypto.randomUUID(),
+    createdAt: new Date().toISOString()
+  };
+  await writePrivateJson(paths.device, identity2);
+  return identity2.deviceId;
+}
+
+// src/client.ts
+class ApiError extends Error {
+  code;
+  exitCode;
+  lift;
+  retryAfter;
+  constructor(code, message, options) {
+    super(message);
+    this.code = code;
+    this.exitCode = exitCodeFor(code);
+    this.lift = options?.lift;
+    this.retryAfter = options?.retryAfter;
+  }
+}
+function exitCodeFor(code) {
+  if (code === "verified_only" || code === "auth_required")
+    return EXIT_CODES.VERIFIED_ONLY;
+  if (code.startsWith("team_policy"))
+    return EXIT_CODES.TEAM_POLICY_BLOCK;
+  if (code === "rate_limited")
+    return EXIT_CODES.RATE_LIMITED;
+  return EXIT_CODES.GENERIC;
+}
+var REFRESH_SKEW_MS = 60000;
+async function refreshAuth(ctx, auth) {
+  const doFetch = ctx.fetchImpl ?? fetch;
+  const response = await doFetch(`${ctx.apiUrl}/auth/token/refresh`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ refresh_token: auth.refreshToken })
+  });
+  if (!response.ok) {
+    await clearAuth(ctx.paths, ctx.apiUrl);
+    return null;
+  }
+  const body = await response.json();
+  const rotated = {
+    ...auth,
+    ...body.user ? { userId: body.user.id, email: body.user.email, handle: body.user.handle } : {},
+    accessJwt: body.access_jwt,
+    refreshToken: body.refresh_token,
+    accessExpiresAt: new Date(Date.now() + body.expires_in * 1000).toISOString()
+  };
+  const creds = await readCredentials(ctx.paths, ctx.apiUrl);
+  creds.auth = rotated;
+  await writeCredentials(ctx.paths, creds);
+  return rotated;
+}
+async function currentAuth(ctx) {
+  const creds = await readCredentials(ctx.paths, ctx.apiUrl);
+  if (!creds.auth)
+    return null;
+  const expiresAt = Date.parse(creds.auth.accessExpiresAt);
+  if (Number.isFinite(expiresAt) && expiresAt - Date.now() > REFRESH_SKEW_MS)
+    return creds.auth;
+  return refreshAuth(ctx, creds.auth);
+}
+var signedOutError = () => new ApiError("auth_required", "not signed in — run: chops auth start <email>", {
+  lift: { action: "verify_email", hint: "chops auth start <email>" }
+});
+async function apiFetch(ctx, path, init = {}, options = {}) {
+  const doFetch = ctx.fetchImpl ?? fetch;
+  const authMode = options.auth ?? "none";
+  const deviceId = await ensureDeviceId(ctx.paths);
+  let auth = authMode === "none" ? null : await currentAuth(ctx);
+  if (authMode === "required" && !auth)
+    throw signedOutError();
+  const send = (token) => {
+    const headers = new Headers(init.headers);
+    headers.set("x-chops-device", deviceId);
+    if (!headers.has("content-type") && typeof init.body === "string") {
+      headers.set("content-type", "application/json");
+    }
+    if (token)
+      headers.set("authorization", `Bearer ${token}`);
+    return doFetch(`${ctx.apiUrl}${path}`, { ...init, headers });
+  };
+  let response = await send(auth?.accessJwt ?? null);
+  if (response.status === 401 && auth) {
+    auth = await refreshAuth(ctx, auth);
+    if (!auth) {
+      if (authMode === "required")
+        throw signedOutError();
+    } else {
+      response = await send(auth.accessJwt);
+    }
+  }
+  if (!response.ok)
+    throw await toApiError(response);
+  return response;
+}
+async function toApiError(response) {
+  const fallback = new ApiError("failed", `request failed (${response.status})`);
+  try {
+    const parsed = apiErrorSchema.safeParse(await response.json());
+    if (!parsed.success)
+      return fallback;
+    const { code, message, lift, retry_after } = parsed.data.error;
+    return new ApiError(code, message, {
+      ...lift ? { lift } : {},
+      ...retry_after !== undefined ? { retryAfter: retry_after } : {}
+    });
+  } catch {
+    return fallback;
+  }
+}
+
+// src/commands/auth.ts
+async function authCommand(ctx, io, sub, positionals, flags) {
+  if (sub === "start")
+    return authStart(ctx, io, positionals[0]);
+  if (sub === "verify")
+    return authVerify(ctx, io, positionals[0], flags.email);
+  if (sub === "status")
+    return authStatus(ctx, io);
+  if (sub === "logout")
+    return authLogout(ctx, io);
+  throw new Error("usage: chops auth <start|verify|status|logout>");
+}
+async function authStart(ctx, io, email) {
+  if (!email)
+    throw new Error("usage: chops auth start <email>");
+  const response = await apiFetch(ctx, "/auth/otp/start", {
+    method: "POST",
+    body: JSON.stringify({ email })
+  });
+  const body = await response.json();
+  const creds = await readCredentials(ctx.paths, ctx.apiUrl);
+  creds.pendingAuth = { email: email.trim().toLowerCase(), startedAt: new Date().toISOString() };
+  await writeCredentials(ctx.paths, creds);
+  if (io.json) {
+    io.emit({
+      ok: true,
+      email: creds.pendingAuth.email,
+      expires_in: 600,
+      next: "chops auth verify <code>",
+      ...body.dev_code ? { dev_code: body.dev_code } : {}
+    });
+  } else {
+    io.emit(`Code sent to ${creds.pendingAuth.email} (expires in 10 minutes).
+Run: chops auth verify <code>`);
+    if (body.dev_code)
+      io.emit(`dev code: ${body.dev_code}`);
+  }
+  return EXIT_CODES.OK;
+}
+async function authVerify(ctx, io, code, emailFlag) {
+  if (!code)
+    throw new Error("usage: chops auth verify <code>");
+  const creds = await readCredentials(ctx.paths, ctx.apiUrl);
+  const email = emailFlag?.trim().toLowerCase() ?? creds.pendingAuth?.email;
+  if (!email) {
+    throw new Error("no pending sign-in — run: chops auth start <email> (or pass --email)");
+  }
+  const response = await apiFetch(ctx, "/auth/otp/verify", {
+    method: "POST",
+    body: JSON.stringify({ email, code, scope: "cli" })
+  });
+  const body = await response.json();
+  creds.auth = {
+    email: body.user.email,
+    userId: body.user.id,
+    handle: body.user.handle,
+    accessJwt: body.access_jwt,
+    refreshToken: body.refresh_token,
+    accessExpiresAt: new Date(Date.now() + body.expires_in * 1000).toISOString()
+  };
+  delete creds.pendingAuth;
+  await writeCredentials(ctx.paths, creds);
+  if (io.json)
+    io.emit({ ok: true, user: body.user });
+  else
+    io.emit(`Verified as ${body.user.email}.`);
+  return EXIT_CODES.OK;
+}
+async function authStatus(ctx, io) {
+  const creds = await readCredentials(ctx.paths, ctx.apiUrl);
+  if (!creds.auth) {
+    if (io.json)
+      io.emit({ authenticated: false, api_url: ctx.apiUrl });
+    else
+      io.emit("Not signed in. Run: chops auth start <email>");
+    return EXIT_CODES.OK;
+  }
+  if (io.json) {
+    io.emit({
+      authenticated: true,
+      email: creds.auth.email,
+      user_id: creds.auth.userId,
+      handle: creds.auth.handle,
+      access_expires_at: creds.auth.accessExpiresAt,
+      api_url: ctx.apiUrl
+    });
+  } else {
+    io.emit(`Signed in as ${creds.auth.email} (${ctx.apiUrl})`);
+  }
+  return EXIT_CODES.OK;
+}
+async function authLogout(ctx, io) {
+  const auth = await currentAuth(ctx).catch(() => null);
+  let revoked = false;
+  if (auth) {
+    try {
+      await Promise.race([
+        apiFetch(ctx, "/auth/revoke", { method: "POST", body: JSON.stringify({ refresh_token: auth.refreshToken }) }, { auth: "required" }),
+        new Promise((_, reject) => setTimeout(() => reject(new Error("timeout")), 2000))
+      ]);
+      revoked = true;
+    } catch {
+      revoked = false;
+    }
+  }
+  await clearAuth(ctx.paths, ctx.apiUrl);
+  if (io.json)
+    io.emit({ ok: true, revoked });
+  else
+    io.emit("Signed out.");
+  return EXIT_CODES.OK;
+}
+
+// src/commands/publish.ts
+import { lstat, readdir, readFile as readFile2 } from "node:fs/promises";
+import { basename, join, relative, resolve } from "node:path";
+
+// src/commands/team.ts
+async function teamCommand(ctx, io, sub, positionals, flags) {
+  if (sub === "create")
+    return teamCreate(ctx, io, positionals[0], flags);
+  if (sub === "list")
+    return teamList(ctx, io);
+  if (sub === "invite")
+    return teamInvite(ctx, io, positionals, flags);
+  if (sub === "join")
+    return teamJoin(ctx, io, positionals[0], flags);
+  if (sub === "members")
+    return teamMembers(ctx, io, flags);
+  throw new Error("usage: chops team <create|list|invite|join|members>");
+}
+async function myTeams(ctx) {
+  const response = await apiFetch(ctx, "/me/teams", {}, { auth: "required" });
+  return meTeamsResponseSchema.parse(await response.json()).teams;
+}
+async function resolveTeamSlug(ctx, flag) {
+  if (flag)
+    return flag.toLowerCase();
+  const teams = await myTeams(ctx);
+  if (teams.length === 1)
+    return teams[0].slug;
+  if (teams.length === 0)
+    throw new Error("you are not in any team — run: chops team create <slug>");
+  throw new Error(`you are in several teams — pass --team <slug> (${teams.map((t) => t.slug).join(", ")})`);
+}
+async function teamCreate(ctx, io, slug, flags) {
+  if (!slug)
+    throw new Error("usage: chops team create <slug> [--name <display name>]");
+  const response = await apiFetch(ctx, "/teams", { method: "POST", body: JSON.stringify({ slug, ...flags.name ? { name: flags.name } : {} }) }, { auth: "required" });
+  const { team } = createTeamResponseSchema.parse(await response.json());
+  if (io.json)
+    io.emit({ ok: true, team });
+  else {
+    io.emit(`Team ${team.slug} ready (${team.name}). You are the owner.`);
+    io.emit(`Invite teammates with: chops team invite <email> --team ${team.slug}`);
+  }
+  return EXIT_CODES.OK;
+}
+async function teamList(ctx, io) {
+  const teams = await myTeams(ctx);
+  if (io.json)
+    io.emit({ teams });
+  else if (teams.length === 0)
+    io.emit("No teams yet. Run: chops team create <slug>");
+  else {
+    for (const team of teams) {
+      io.emit(`${team.slug.padEnd(20)} ${team.role.padEnd(8)} ${team.member_count} member(s)  ${team.name}`);
+    }
+  }
+  return EXIT_CODES.OK;
+}
+async function teamInvite(ctx, io, emails, flags) {
+  if (emails.length === 0) {
+    throw new Error("usage: chops team invite <email> [<email>...] [--team <slug>] [--role member|admin]");
+  }
+  const role = flags.role ?? "member";
+  if (role !== "member" && role !== "admin")
+    throw new Error("--role must be member or admin");
+  const slug = await resolveTeamSlug(ctx, flags.team);
+  const response = await apiFetch(ctx, `/teams/${encodeURIComponent(slug)}/invites`, { method: "POST", body: JSON.stringify({ emails, role }) }, { auth: "required" });
+  const { results } = sendInvitesResponseSchema.parse(await response.json());
+  if (io.json)
+    io.emit({ ok: true, team: slug, invites: results });
+  else {
+    for (const result of results) {
+      io.emit(result.status === "sent" ? `Invited ${result.email} to ${slug} (expires ${result.expires_at ?? "in 7 days"}).` : `${result.email}: ${result.status.replaceAll("_", " ")}`);
+    }
+  }
+  return EXIT_CODES.OK;
+}
+async function teamJoin(ctx, io, token, flags) {
+  let body;
+  if (token) {
+    body = { token };
+  } else {
+    const response2 = await apiFetch(ctx, "/me/invites", {}, { auth: "required" });
+    const { invites } = meInvitesResponseSchema.parse(await response2.json());
+    const candidates = flags.team ? invites.filter((invite) => invite.team.slug === flags.team.toLowerCase()) : invites;
+    if (candidates.length === 0) {
+      throw new Error(flags.team ? `no pending invite for team ${flags.team}` : "no pending invites for your email");
+    }
+    if (candidates.length > 1) {
+      throw new Error(`several pending invites — pass --team <slug> (${candidates.map((i) => i.team.slug).join(", ")})`);
+    }
+    body = { invite_id: candidates[0].id };
+  }
+  const response = await apiFetch(ctx, "/invites/accept", { method: "POST", body: JSON.stringify(body) }, { auth: "required" });
+  const accepted = acceptInviteResponseSchema.parse(await response.json());
+  if (io.json)
+    io.emit({ ok: true, team: accepted.team, role: accepted.role });
+  else
+    io.emit(`Joined ${accepted.team.name} (${accepted.team.slug}) as ${accepted.role}.`);
+  return EXIT_CODES.OK;
+}
+async function teamMembers(ctx, io, flags) {
+  const slug = await resolveTeamSlug(ctx, flags.team);
+  const response = await apiFetch(ctx, `/teams/${encodeURIComponent(slug)}/members`, {}, { auth: "required" });
+  const parsed = teamMembersResponseSchema.parse(await response.json());
+  if (io.json)
+    io.emit({ team: slug, ...parsed });
+  else {
+    for (const member of parsed.members) {
+      io.emit(`${member.email.padEnd(36)} ${member.role.padEnd(8)} joined ${member.joined_at.slice(0, 10)}`);
+    }
+    for (const invite of parsed.invites ?? []) {
+      io.emit(`${invite.email.padEnd(36)} ${invite.role.padEnd(8)} invited (expires ${invite.expires_at.slice(0, 10)})`);
+    }
+  }
+  return EXIT_CODES.OK;
+}
+
+// src/commands/publish.ts
+var MAX_ENTRIES = 2000;
+var MAX_TOTAL_BYTES = 25 * 1024 * 1024;
+var EXCLUDED_DIRS = new Set([".git", "node_modules"]);
+async function packSkillDirectory(path) {
+  const root = resolve(path);
+  const skillPath = join(root, "SKILL.md");
+  const content = await readFile2(skillPath, "utf8").catch(() => {
+    throw new Error(`no SKILL.md found in ${root}`);
+  });
+  const document = parseSkillDocument(content, { directoryName: basename(root) });
+  if (!document.ok) {
+    throw new Error(`invalid SKILL.md:
+${document.errors.map((e) => `  - ${e.message}`).join(`
+`)}`);
+  }
+  const entries = [];
+  let totalBytes = 0;
+  const walk = async (directory) => {
+    for (const dirent of await readdir(directory, { withFileTypes: true })) {
+      const absolute = join(directory, dirent.name);
+      if (dirent.isSymbolicLink()) {
+        throw new Error(`symlinks are not allowed in skills: ${relative(root, absolute)}`);
+      }
+      if (dirent.isDirectory()) {
+        if (!EXCLUDED_DIRS.has(dirent.name))
+          await walk(absolute);
+        continue;
+      }
+      if (!dirent.isFile())
+        continue;
+      const data = new Uint8Array(await readFile2(absolute));
+      totalBytes += data.byteLength;
+      if (entries.length + 1 > MAX_ENTRIES)
+        throw new Error("skill has too many files (max 2000)");
+      if (totalBytes > MAX_TOTAL_BYTES)
+        throw new Error("skill is too large (max 25 MiB)");
+      const stats = await lstat(absolute);
+      entries.push({
+        path: relative(root, absolute).replaceAll("\\", "/"),
+        data,
+        ...(stats.mode & 73) !== 0 ? { executable: true } : {}
+      });
+    }
+  };
+  await walk(root);
+  const tarball = buildTarGz(entries);
+  return {
+    name: document.value.frontmatter.name,
+    description: document.value.frontmatter.description,
+    tarball,
+    contentSha: tarballSha256(tarball)
+  };
+}
+async function publishCommand(ctx, io, path, flags) {
+  if (!path)
+    throw new Error("usage: chops publish <path> [--team <slug>]");
+  const packed = await packSkillDirectory(path);
+  const teamSlug = flags.team ? await resolveTeamSlug(ctx, flags.team) : null;
+  const endpoint = teamSlug ? `/teams/${encodeURIComponent(teamSlug)}/skills` : "/me/skills";
+  const form = new FormData;
+  form.set("meta", JSON.stringify({
+    name: packed.name,
+    description: packed.description,
+    content_sha: packed.contentSha,
+    size_bytes: packed.tarball.byteLength
+  }));
+  form.set("tarball", new File([packed.tarball.slice().buffer], `${packed.name}.tgz`, {
+    type: "application/gzip"
+  }));
+  const response = await apiFetch(ctx, endpoint, { method: "POST", body: form }, { auth: "required" });
+  const result = privatePublishResponseSchema.parse(await response.json());
+  if (io.json) {
+    io.emit({ ...result, ok: true, install_cmd: `chops add ${result.ref}` });
+  } else if (result.dedup) {
+    io.emit(`Already published — ${result.ref} v${result.version} matches this content.`);
+  } else {
+    io.emit(`Published ${result.ref} v${result.version} (sha ${result.content_sha.slice(0, 7)}).`);
+    io.emit(teamSlug ? `Team members install it with: chops add ${result.ref}` : `Install it anywhere you're signed in with: chops add ${result.ref}`);
+  }
+  return EXIT_CODES.OK;
+}
+
 // src/install.ts
-import { lstat, mkdir as mkdir2, readFile, rename, rm, symlink as symlink2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname2, join } from "node:path";
+import { lstat as lstat2, mkdir as mkdir3, readFile as readFile3, rename as rename2, rm, symlink as symlink2, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname3, join as join2 } from "node:path";
 
 // src/archive.ts
-import { mkdir, chmod, symlink, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, posix, resolve, sep } from "node:path";
+import { mkdir as mkdir2, chmod, symlink, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname2, isAbsolute, posix, resolve as resolve2, sep } from "node:path";
 import { gunzipSync } from "node:zlib";
 var BLOCK = 512;
 var MAX_UNCOMPRESSED_BYTES = 25 * 1024 * 1024;
-var MAX_ENTRIES = 2000;
+var MAX_ENTRIES2 = 2000;
 function text(bytes) {
   const zero = bytes.indexOf(0);
   return new TextDecoder().decode(zero >= 0 ? bytes.slice(0, zero) : bytes).trim();
@@ -11086,17 +11881,17 @@ function parseTar(archive) {
     throw new Error("archive expands past 25 MiB");
   const entries = [];
   for (let offset = 0;offset + BLOCK <= tar.byteLength; ) {
-    const header = tar.slice(offset, offset + BLOCK);
-    if (header.every((byte) => byte === 0))
+    const header2 = tar.slice(offset, offset + BLOCK);
+    if (header2.every((byte) => byte === 0))
       break;
-    const name = text(header.slice(0, 100));
-    const prefix = text(header.slice(345, 500));
+    const name = text(header2.slice(0, 100));
+    const prefix = text(header2.slice(345, 500));
     const path = safePath(prefix ? `${prefix}/${name}` : name);
-    const mode = Number.parseInt(text(header.slice(100, 108)) || "644", 8);
-    const size = Number.parseInt(text(header.slice(124, 136)) || "0", 8);
+    const mode = Number.parseInt(text(header2.slice(100, 108)) || "644", 8);
+    const size = Number.parseInt(text(header2.slice(124, 136)) || "0", 8);
     if (!Number.isSafeInteger(size) || size < 0)
       throw new Error(`invalid tar size for ${path}`);
-    const typeFlag = text(header.slice(156, 157)) || "0";
+    const typeFlag = text(header2.slice(156, 157)) || "0";
     offset += BLOCK;
     if (offset + size > tar.byteLength)
       throw new Error(`truncated tar entry: ${path}`);
@@ -11107,7 +11902,7 @@ function parseTar(archive) {
     else if (typeFlag === "5")
       entries.push({ path, type: "directory", mode, data });
     else if (typeFlag === "2") {
-      const linkTarget = text(header.slice(157, 257));
+      const linkTarget = text(header2.slice(157, 257));
       const resolved = posix.normalize(posix.join(posix.dirname(path), linkTarget));
       if (!linkTarget || linkTarget.startsWith("/") || resolved === ".." || resolved.startsWith("../")) {
         throw new Error(`unsafe symlink in archive: ${path}`);
@@ -11116,35 +11911,35 @@ function parseTar(archive) {
     } else {
       throw new Error(`unsupported tar entry type ${typeFlag} for ${path}`);
     }
-    if (entries.length > MAX_ENTRIES)
+    if (entries.length > MAX_ENTRIES2)
       throw new Error("archive contains too many entries");
   }
   return entries;
 }
 function destinationPath(root, path) {
-  const target = resolve(root, ...path.split("/"));
+  const target = resolve2(root, ...path.split("/"));
   const prefix = root.endsWith(sep) ? root : `${root}${sep}`;
   if (target !== root && !target.startsWith(prefix))
     throw new Error(`archive path escapes root: ${path}`);
   return target;
 }
 async function extractTarGz(archive, destination) {
-  const root = resolve(destination);
+  const root = resolve2(destination);
   const entries = parseTar(archive);
-  await mkdir(root, { recursive: true });
+  await mkdir2(root, { recursive: true });
   for (const entry of entries.filter((item) => item.type !== "symlink")) {
     const target = destinationPath(root, entry.path);
     if (entry.type === "directory") {
-      await mkdir(target, { recursive: true });
+      await mkdir2(target, { recursive: true });
       continue;
     }
-    await mkdir(dirname(target), { recursive: true });
-    await writeFile(target, entry.data, { flag: "wx" });
+    await mkdir2(dirname2(target), { recursive: true });
+    await writeFile2(target, entry.data, { flag: "wx" });
     await chmod(target, entry.mode & 73 ? 493 : 420);
   }
   for (const entry of entries.filter((item) => item.type === "symlink")) {
     const target = destinationPath(root, entry.path);
-    await mkdir(dirname(target), { recursive: true });
+    await mkdir2(dirname2(target), { recursive: true });
     await symlink(entry.linkTarget, target);
   }
 }
@@ -11153,12 +11948,19 @@ async function extractTarGz(archive, destination) {
 function chopsPaths(home = process.env.HOME) {
   if (!home)
     throw new Error("HOME is not set");
-  const root = join(home, ".chops");
-  return { home, root, store: join(root, "store"), lockfile: join(root, "chops.lock") };
+  const root = join2(home, ".chops");
+  return {
+    home,
+    root,
+    store: join2(root, "store"),
+    lockfile: join2(root, "chops.lock"),
+    credentials: join2(root, "credentials.json"),
+    device: join2(root, "device.json")
+  };
 }
 async function exists(path) {
   try {
-    await lstat(path);
+    await lstat2(path);
     return true;
   } catch (error) {
     if (error.code === "ENOENT")
@@ -11168,7 +11970,7 @@ async function exists(path) {
 }
 async function readLockfile(paths) {
   try {
-    const parsed = JSON.parse(await readFile(paths.lockfile, "utf8"));
+    const parsed = JSON.parse(await readFile3(paths.lockfile, "utf8"));
     if (parsed.version !== 1 || !parsed.skills || typeof parsed.skills !== "object") {
       throw new Error("unsupported lockfile format");
     }
@@ -11180,23 +11982,23 @@ async function readLockfile(paths) {
   }
 }
 async function writeLockfile(paths, lockfile) {
-  await mkdir2(dirname2(paths.lockfile), { recursive: true });
+  await mkdir3(dirname3(paths.lockfile), { recursive: true });
   const temporary = `${paths.lockfile}.tmp-${crypto.randomUUID()}`;
-  await writeFile2(temporary, `${JSON.stringify(lockfile, null, 2)}
+  await writeFile3(temporary, `${JSON.stringify(lockfile, null, 2)}
 `, { flag: "wx", mode: 384 });
-  await rename(temporary, paths.lockfile);
+  await rename2(temporary, paths.lockfile);
 }
 async function agentTargets(paths, explicit = []) {
   const requested = new Set(explicit.map((agent) => agent.toLowerCase()));
   const targets = [];
   if (requested.size === 0 || requested.has("codex") || requested.has("agents")) {
-    targets.push({ agent: "agents", directory: join(paths.home, ".agents", "skills") });
+    targets.push({ agent: "agents", directory: join2(paths.home, ".agents", "skills") });
   }
-  if (requested.has("claude-code") || requested.size === 0 && await exists(join(paths.home, ".claude"))) {
-    targets.push({ agent: "claude-code", directory: join(paths.home, ".claude", "skills") });
+  if (requested.has("claude-code") || requested.size === 0 && await exists(join2(paths.home, ".claude"))) {
+    targets.push({ agent: "claude-code", directory: join2(paths.home, ".claude", "skills") });
   }
   if (requested.has("cursor")) {
-    targets.push({ agent: "cursor", directory: join(paths.home, ".cursor", "skills") });
+    targets.push({ agent: "cursor", directory: join2(paths.home, ".cursor", "skills") });
   }
   if (targets.length === 0)
     throw new Error("no supported agent targets were selected");
@@ -11209,24 +12011,36 @@ async function fetchManifest(apiUrl, slug) {
     throw new Error(`manifest request failed (${response.status})`);
   return manifestSchema.parse(payload);
 }
+function storePathFor(paths, ref, sha) {
+  switch (ref.kind) {
+    case "public":
+      return join2(paths.store, ref.owner, ref.repo, `${ref.skill}@${sha}`);
+    case "personal":
+      return join2(paths.store, "_me", `${ref.name}@${sha}`);
+    case "team":
+      return join2(paths.store, "_teams", ref.team, `${ref.name}@${sha}`);
+  }
+}
 async function installSkill(options) {
   const paths = options.paths ?? chopsPaths();
-  const parsedSlug = parseSkillSlug(options.slug);
-  if (!parsedSlug)
-    throw new Error(`invalid skill slug: ${options.slug}`);
-  const manifest = await fetchManifest(options.apiUrl, options.slug);
-  const response = await fetch(manifest.tarball_url);
+  const ref = parseSkillRef(options.slug);
+  if (!ref)
+    throw new Error(`invalid skill reference: ${options.slug}`);
+  const manifest = options.manifest ?? await fetchManifest(options.apiUrl, options.slug);
+  const response = await fetch(manifest.tarball_url, {
+    ...options.tarballHeaders ? { headers: options.tarballHeaders } : {}
+  });
   if (!response.ok)
     throw new Error(`tarball download failed (${response.status})`);
   const archive = new Uint8Array(await response.arrayBuffer());
   if (!verifyTarballSha256(archive, manifest.sha256)) {
     throw new Error("tarball sha256 does not match the manifest");
   }
-  const storePath = join(paths.store, parsedSlug.owner, parsedSlug.repo, `${parsedSlug.skill}@${manifest.version.content_sha}`);
+  const storePath = storePathFor(paths, ref, manifest.version.content_sha);
   const temporary = `${storePath}.tmp-${crypto.randomUUID()}`;
   const storeAlreadyExists = await exists(storePath);
   const targets = await agentTargets(paths, options.agents);
-  const links = targets.map((target) => join(target.directory, manifest.skill.name));
+  const links = targets.map((target) => join2(target.directory, manifest.skill.name));
   for (const link of links) {
     if (await exists(link))
       throw new Error(`install target already exists: ${link}`);
@@ -11235,11 +12049,11 @@ async function installSkill(options) {
   try {
     if (!storeAlreadyExists) {
       await extractTarGz(archive, temporary);
-      await mkdir2(dirname2(storePath), { recursive: true });
-      await rename(temporary, storePath);
+      await mkdir3(dirname3(storePath), { recursive: true });
+      await rename2(temporary, storePath);
     }
     for (const link of links) {
-      await mkdir2(dirname2(link), { recursive: true });
+      await mkdir3(dirname3(link), { recursive: true });
       await symlink2(storePath, link, process.platform === "win32" ? "junction" : "dir");
       createdLinks.push(link);
     }
@@ -11248,7 +12062,9 @@ async function installSkill(options) {
       sha: manifest.version.content_sha,
       tarballSha256: manifest.sha256,
       agents: targets.map((target) => target.agent),
-      installedAt: new Date().toISOString()
+      installedAt: new Date().toISOString(),
+      ...ref.kind === "personal" ? { scope: "personal" } : {},
+      ...ref.kind === "team" ? { scope: "team", team: ref.team } : {}
     };
     await writeLockfile(paths, lockfile);
     return { manifest, storePath, links };
@@ -11266,20 +12082,21 @@ async function removeSkill(options) {
   const entry = lockfile.skills[options.slug];
   if (!entry)
     return { removed: false, links: [] };
-  const parsed = parseSkillSlug(options.slug);
-  if (!parsed)
-    throw new Error(`invalid skill slug in lockfile: ${options.slug}`);
+  const ref = parseSkillRef(options.slug);
+  if (!ref)
+    throw new Error(`invalid skill reference in lockfile: ${options.slug}`);
+  const name = ref.kind === "public" ? ref.skill : ref.name;
   const links = entry.agents.flatMap((agent) => {
     if (agent === "claude-code")
-      return [join(paths.home, ".claude", "skills", parsed.skill)];
+      return [join2(paths.home, ".claude", "skills", name)];
     if (agent === "cursor")
-      return [join(paths.home, ".cursor", "skills", parsed.skill)];
+      return [join2(paths.home, ".cursor", "skills", name)];
     if (agent === "agents")
-      return [join(paths.home, ".agents", "skills", parsed.skill)];
+      return [join2(paths.home, ".agents", "skills", name)];
     return [];
   });
   await Promise.all(links.map((link) => rm(link, { recursive: true, force: true })));
-  const storePath = join(paths.store, parsed.owner, parsed.repo, `${parsed.skill}@${entry.sha}`);
+  const storePath = storePathFor(paths, ref, entry.sha);
   await rm(storePath, { recursive: true, force: true });
   delete lockfile.skills[options.slug];
   await writeLockfile(paths, lockfile);
@@ -11287,7 +12104,7 @@ async function removeSkill(options) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.1.0";
+var CLI_VERSION = "0.2.0";
 
 // src/main.ts
 function parseArgs(argv) {
@@ -11295,30 +12112,42 @@ function parseArgs(argv) {
   let command;
   let json = false;
   let yes = false;
-  let apiUrl = process.env.CHOPS_API_URL ?? "https://chops-api-staging.fly.dev";
+  let apiUrl = process.env.CHOPS_API_URL ?? "https://api.chops.sh";
   const agents = [];
+  let team;
+  let role;
+  let name;
+  let email;
+  const valueFlag = (argv2, index, flag) => {
+    const value = argv2[index];
+    if (!value)
+      throw new Error(`${flag} requires a value`);
+    return value;
+  };
   for (let index = 0;index < argv.length; index++) {
     const arg = argv[index];
     if (arg === "--json")
       json = true;
     else if (arg === "--yes" || arg === "-y")
       yes = true;
-    else if (arg === "--api-url") {
-      const value = argv[++index];
-      if (!value)
-        throw new Error("--api-url requires a value");
-      apiUrl = value.replace(/\/$/, "");
-    } else if (arg === "--agent") {
-      const value = argv[++index];
-      if (!value)
-        throw new Error("--agent requires a value");
-      agents.push(...value.split(",").filter(Boolean));
-    } else if (!command)
+    else if (arg === "--api-url")
+      apiUrl = valueFlag(argv, ++index, arg).replace(/\/$/, "");
+    else if (arg === "--agent")
+      agents.push(...valueFlag(argv, ++index, arg).split(",").filter(Boolean));
+    else if (arg === "--team")
+      team = valueFlag(argv, ++index, arg);
+    else if (arg === "--role")
+      role = valueFlag(argv, ++index, arg);
+    else if (arg === "--name")
+      name = valueFlag(argv, ++index, arg);
+    else if (arg === "--email")
+      email = valueFlag(argv, ++index, arg);
+    else if (!command)
       command = arg;
     else
       positionals.push(arg);
   }
-  return { command, positionals, json, yes, apiUrl, agents };
+  return { command, positionals, json, yes, apiUrl, agents, team, role, name, email };
 }
 function emit(value, json) {
   if (json)
@@ -11338,6 +12167,27 @@ async function confirmInstall(slug) {
     rl.close();
   }
 }
+var HELP = `Usage: chops <command> [args]
+
+Registry
+  find <query>                        search public skills
+  add <ref> [--yes] [--agent a,b]     install a skill (owner/repo@name, @me/name, @team/name)
+  list                                installed skills
+  remove <ref>                        uninstall a skill
+
+Account
+  auth start <email>                  email a one-time sign-in code
+  auth verify <code> [--email e]      finish signing in
+  auth status | auth logout
+
+Teams & private skills
+  team create <slug> [--name n]       create a team
+  team invite <email>... [--team t] [--role member|admin]
+  team join [token] [--team t]        accept a pending invite
+  team list | team members [--team t]
+  publish <path> [--team t]           publish a private skill (@me/... or @team/...)
+
+Flags: --json  machine-readable output   --api-url <url>   -y/--yes`;
 async function main(argv = process.argv.slice(2)) {
   let parsed;
   try {
@@ -11346,15 +12196,36 @@ async function main(argv = process.argv.slice(2)) {
     console.error(`chops: ${error.message}`);
     return EXIT_CODES.GENERIC;
   }
+  const ctx = { apiUrl: parsed.apiUrl, paths: chopsPaths() };
+  const io = { emit: (value) => emit(value, parsed.json), json: parsed.json };
   try {
     if (parsed.command === "--version" || parsed.command === "-v") {
       emit(CLI_VERSION, parsed.json);
       return EXIT_CODES.OK;
     }
     if (parsed.command === "--help" || parsed.command === "help") {
-      emit("Usage: chops <find|add|list|remove> [args] [--json] [--yes]", parsed.json);
+      emit(HELP, parsed.json);
       return EXIT_CODES.OK;
     }
+    if (parsed.command === "auth") {
+      return await authCommand(ctx, io, parsed.positionals[0], parsed.positionals.slice(1), {
+        email: parsed.email
+      });
+    }
+    if (parsed.command === "team") {
+      return await teamCommand(ctx, io, parsed.positionals[0], parsed.positionals.slice(1), {
+        team: parsed.team,
+        role: parsed.role,
+        name: parsed.name,
+        yes: parsed.yes
+      });
+    }
+    if (parsed.command === "publish") {
+      return await publishCommand(ctx, io, parsed.positionals[0], {
+        team: parsed.team,
+        yes: parsed.yes
+      });
+    }
     if (parsed.command === "find") {
       const query = parsed.positionals.join(" ").trim();
       if (!query)
@@ -11377,38 +12248,84 @@ async function main(argv = process.argv.slice(2)) {
     if (parsed.command === "add") {
       const slug = parsed.positionals[0];
       if (!slug)
-        throw new Error("add requires owner/repo@skill");
+        throw new Error("add requires a skill reference (owner/repo@name or @scope/name)");
+      const ref = parseSkillRef(slug);
+      if (!ref)
+        throw new Error(`invalid skill reference: ${slug}`);
       if (!parsed.yes && !await confirmInstall(slug))
         return EXIT_CODES.OK;
-      const result = await installSkill({
-        apiUrl: parsed.apiUrl,
-        slug,
-        ...parsed.agents.length ? { agents: parsed.agents } : {}
-      });
+      let result;
+      if (ref.kind === "public") {
+        result = await installSkill({
+          apiUrl: parsed.apiUrl,
+          slug,
+          ...parsed.agents.length ? { agents: parsed.agents } : {}
+        });
+      } else {
+        const manifestPath = ref.kind === "personal" ? `/me/skills/${encodeURIComponent(ref.name)}/manifest` : `/teams/${encodeURIComponent(ref.team)}/skills/${encodeURIComponent(ref.name)}/manifest`;
+        const response = await apiFetch(ctx, manifestPath, {}, { auth: "required" });
+        const manifest = manifestSchema.parse(await response.json());
+        const auth = await currentAuth(ctx);
+        result = await installSkill({
+          apiUrl: parsed.apiUrl,
+          slug: formatSkillRef(ref),
+          manifest,
+          ...auth ? { tarballHeaders: { authorization: `Bearer ${auth.accessJwt}` } } : {},
+          ...parsed.agents.length ? { agents: parsed.agents } : {}
+        });
+      }
       emit({
         ok: true,
         slug: result.manifest.skill.slug,
         sha: result.manifest.version.content_sha,
         store: result.storePath,
-        links: result.links
+        links: result.links,
+        ...ref.kind !== "public" ? { scope: ref.kind } : {},
+        ...ref.kind === "team" ? { team: ref.team } : {}
       }, parsed.json);
       return EXIT_CODES.OK;
     }
     if (parsed.command === "list") {
       const lockfile = await readLockfile(chopsPaths());
-      emit({ skills: lockfile.skills }, parsed.json);
+      if (parsed.json)
+        emit({ skills: lockfile.skills }, true);
+      else if (Object.keys(lockfile.skills).length === 0)
+        emit("No skills installed.", false);
+      else {
+        for (const [slug, entry] of Object.entries(lockfile.skills)) {
+          const scope = entry.scope === "personal" ? "private" : entry.scope === "team" ? `team ${entry.team ?? ""}`.trim() : "public";
+          emit(`${slug.padEnd(44)} ${scope.padEnd(16)} sha ${entry.sha.slice(0, 7)}`, false);
+        }
+      }
       return EXIT_CODES.OK;
     }
     if (parsed.command === "remove") {
       const slug = parsed.positionals[0];
       if (!slug)
-        throw new Error("remove requires owner/repo@skill");
+        throw new Error("remove requires a skill reference");
       const result = await removeSkill({ slug });
       emit({ ok: true, slug, removed: result.removed, links: result.links }, parsed.json);
       return EXIT_CODES.OK;
     }
     throw new Error(`unknown command ${parsed.command ?? "(none)"}`);
   } catch (error) {
+    if (error instanceof ApiError) {
+      if (parsed.json) {
+        emit({
+          error: {
+            code: error.code,
+            message: error.message,
+            ...error.lift ? { lift: error.lift } : {},
+            ...error.retryAfter !== undefined ? { retry_after: error.retryAfter } : {}
+          }
+        }, true);
+      } else {
+        console.error(`chops: ${error.message}`);
+        if (error.lift)
+          console.error(`  hint: ${error.lift.hint}`);
+      }
+      return error.exitCode;
+    }
     const message = error.message;
     if (parsed.json)
       console.log(JSON.stringify({ error: { code: "failed", message } }));