@hasna/skills 0.4.0 → 0.5.1

package/bin/mcp.js

@@ -6932,58 +6932,14 @@ var require_dist = __commonJS((exports, module) => {
   exports.default = formatsPlugin;
 });
 
-// src/lib/remote-run-contract.ts
-function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
-  const record3 = isRecord3(payload) ? payload : {};
-  return {
-    contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
-    ...pickString(record3, "id"),
-    skill: pickStringValue(record3, "skill") ?? fallbackSkill,
-    ...pickString(record3, "requestedSlug"),
-    ...pickString(record3, "status"),
-    ...pickNumber(record3, "exitCode"),
-    ...pickString(record3, "correlationId"),
-    ...pickString(record3, "createdAt"),
-    ...pickString(record3, "startedAt"),
-    ...pickString(record3, "completedAt"),
-    ...pickNumber(record3, "durationMs"),
-    ...pickString(record3, "outputType"),
-    ...hasOwn(record3, "outputPreview") ? { outputPreview: record3.outputPreview } : {},
-    ...pickString(record3, "errorCode"),
-    ...pickString(record3, "errorMessage"),
-    ...pickString(record3, "error"),
-    ...pickString(record3, "code"),
-    ...hasOwn(record3, "details") ? { details: record3.details } : {}
-  };
-}
-function isRecord3(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function hasOwn(record3, key) {
-  return Object.prototype.hasOwnProperty.call(record3, key);
-}
-function pickString(record3, key) {
-  const value = pickStringValue(record3, key);
-  return value === undefined ? {} : { [key]: value };
-}
-function pickStringValue(record3, key) {
-  const value = record3[key];
-  return typeof value === "string" ? value : undefined;
-}
-function pickNumber(record3, key) {
-  const value = record3[key];
-  return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
-}
-var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
-
 // ../contracts/dist/client/transport.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
-import { closeSync, fstatSync, openSync, readFileSync as readFileSync11 } from "fs";
+import { closeSync, fstatSync, openSync, readFileSync as readFileSync7 } from "fs";
 import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
 import { createRequire } from "module";
 import { hostname as osHostname } from "os";
-import { isAbsolute as isAbsolute3, join as join13 } from "path";
+import { isAbsolute as isAbsolute3, join as join9 } from "path";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
 }
@@ -7013,14 +6969,14 @@ function hasnaHomeDir(env) {
   if (override)
     return override;
   const home = homeDir(env);
-  return home ? join13(home, HASNA_HOME_DIR) : null;
+  return home ? join9(home, HASNA_HOME_DIR) : null;
 }
 function appConfigDir(name, env) {
   const configRoot = absoluteOverride(env, HASNA_CONFIG_HOME_ENV_KEY);
   if (configRoot)
-    return join13(configRoot, name);
+    return join9(configRoot, name);
   const root = hasnaHomeDir(env);
-  return root ? join13(root, name, CONFIG_SUBDIR) : null;
+  return root ? join9(root, name, CONFIG_SUBDIR) : null;
 }
 function credentialDiskSourceList(name, env, profile = null) {
   if (!SAFE_APP_SLUG.test(name))
@@ -7029,7 +6985,7 @@ function credentialDiskSourceList(name, env, profile = null) {
   if (!directory)
     return [];
   const file = profile ? `${CREDENTIALS_FILE}-${profile}` : CREDENTIALS_FILE;
-  return [{ path: join13(directory, file), tier: "disk" }];
+  return [{ path: join9(directory, file), tier: "disk" }];
 }
 function credentialDiskSources(name, env) {
   return credentialDiskSourceList(name, env, null).map((s) => s.path);
@@ -7104,7 +7060,7 @@ function readAppConfigFile(path) {
       unsafe("the file is not owned by the current user");
     if (before.size > MAX_CREDENTIAL_FILE_BYTES)
       unsafe("the file exceeds the size limit");
-    const bytes = readFileSync11(fd);
+    const bytes = readFileSync7(fd);
     const after = fstatSync(fd);
     if (!configFileReadsCoherent(before, after)) {
       unsafe("the file changed while being read");
@@ -7742,12 +7698,39 @@ var init_instance_credentials = __esm(() => {
   init_transport();
 });
 
+// src/lib/local-opt-in.ts
+function isSkillsLocalOptIn(env = process.env) {
+  return SKILLS_LOCAL_OPT_IN_ENV_KEYS.some((key) => (env[key] ?? "").trim() !== "");
+}
+function skillsAuthorityEnvKeys() {
+  const keys = clientTransportEnvKeys("skills");
+  return [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey("skills"),
+    credentialPointerEnvKey("skills"),
+    CREDENTIAL_PROFILE_ENV_KEY
+  ];
+}
+function hasSkillsEnvAuthorityIntent(env = process.env) {
+  return skillsAuthorityEnvKeys().some((key) => (env[key] ?? "").trim() !== "");
+}
+function selectsSkillsLocalMode(env = process.env) {
+  return !hasSkillsEnvAuthorityIntent(env) && isSkillsLocalOptIn(env);
+}
+var SKILLS_LOCAL_OPT_IN_ENV_KEYS;
+var init_local_opt_in = __esm(() => {
+  init_transport();
+  SKILLS_LOCAL_OPT_IN_ENV_KEYS = ["HASNA_SKILLS_LOCAL", "SKILLS_LOCAL"];
+});
+
 // src/lib/fleet-credentials.ts
 var exports_fleet_credentials = {};
 __export(exports_fleet_credentials, {
   skillsCredentialOrReason: () => skillsCredentialOrReason,
   skillsCredentialFiles: () => skillsCredentialFiles,
   skillsCredentialFilePath: () => skillsCredentialFilePath,
+  selectsSkillsLocalMode: () => selectsSkillsLocalMode,
   resolveSkillsFleet: () => resolveSkillsFleet,
   resolveSkillsConnection: () => resolveSkillsConnection,
   resolveSkillsApiOrigin: () => resolveSkillsApiOrigin,
@@ -7758,8 +7741,11 @@ __export(exports_fleet_credentials, {
   requireSkillsApiKey: () => requireSkillsApiKey,
   noticeLocalSkillsMode: () => noticeLocalSkillsMode,
   normalizeSkillsApiOrigin: () => normalizeSkillsApiOrigin,
+  isSkillsLocalOptIn: () => isSkillsLocalOptIn,
+  isSkillsFleetCredentialError: () => isSkillsFleetCredentialError,
   configuredSkillsApiUrl: () => configuredSkillsApiUrl,
   SkillsFleetCredentialError: () => SkillsFleetCredentialError,
+  SKILLS_LOCAL_OPT_IN_ENV_KEYS: () => SKILLS_LOCAL_OPT_IN_ENV_KEYS,
   SKILLS_APP: () => SKILLS_APP,
   SKILLS_API_URL_ENV_KEYS: () => SKILLS_API_URL_ENV_KEYS,
   SKILLS_API_URL_ENV: () => SKILLS_API_URL_ENV,
@@ -7770,6 +7756,9 @@ __export(exports_fleet_credentials, {
 function isCredentialResolutionError(error2) {
   return error2 instanceof CredentialResolutionError || typeof error2 === "object" && error2 !== null && error2.name === "CredentialResolutionError";
 }
+function isSkillsFleetCredentialError(error2) {
+  return error2 instanceof SkillsFleetCredentialError || typeof error2 === "object" && error2 !== null && error2.name === "SkillsFleetCredentialError";
+}
 function asSkillsFleetCredentialError(error2) {
   if (!isCredentialResolutionError(error2))
     return null;
@@ -7835,7 +7824,7 @@ function noticeLocalSkillsMode(write = (line) => console.error(line)) {
   if (localNoticePrinted)
     return;
   localNoticePrinted = true;
-  write(`skills: local mode \u2014 no ${SKILLS_API_KEY_ENV} and no ${SKILLS_API_URL_ENV} resolved, ` + `so this runs on this machine against the bundled corpus. ` + `Sign in with: skills auth login`);
+  write(`skills: local mode (${SKILLS_LOCAL_OPT_IN_ENV_KEYS[0]}=1) \u2014 running on this machine against the bundled corpus.`);
 }
 function resetLocalSkillsModeNotice() {
   localNoticePrinted = false;
@@ -7875,13 +7864,16 @@ function snapshotSkillsOptions(env, options) {
   } } };
 }
 function resolveSkillsFleetOrThrow(env, options) {
+  if (selectsSkillsLocalMode(env))
+    return { mode: "local", apiOrigin: null, apiKey: null };
   const assertFilesUnchanged = captureSkillsCredentialFiles(skillsProfileCredentialFiles(env, options.credentials?.profile));
   const configured = configuredSkillsApiUrl(env, options.credentials?.keychain, options.credentials?.profile);
   const credential = resolveCredential(SKILLS_APP, env, options.credentials);
   if (!credential) {
-    if (!configured)
-      return { mode: "local", apiOrigin: null, apiKey: null };
-    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in hasna.credentials.skills.api-key, ${skillsCredentialFiles(env).join(" or ") || "no credentials file"}, and ${SKILLS_API_KEY_ENV}. Sign in with: skills auth login`);
+    if (!configured) {
+      throw new SkillsFleetCredentialError(`No API key resolved and no Skills API URL is configured \u2014 failing closed ` + `(local mode is opt-in only: set ${SKILLS_LOCAL_OPT_IN_ENV_KEYS[0]}=1 to run on this machine). ` + `Looked in ${credentialLocations(env)}. Sign in with: skills auth login`);
+    }
+    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in ${credentialLocations(env)}. Sign in with: skills auth login`);
   }
   const apiOrigin = normalizeSkillsApiOrigin(configured?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP));
   toV1BaseUrl(apiOrigin);
@@ -7903,6 +7895,10 @@ function resolveSkillsFleetOrThrow(env, options) {
   }
   return { ...base, apiKey: credential.apiKey, apiKeyPointer: null };
 }
+function credentialLocations(env) {
+  const files = skillsCredentialFiles(env).join(" or ") || "no credentials file (HOME is unset)";
+  return `hasna.credentials.${SKILLS_APP}.api-key (macOS Keychain, account HASNA_STATION or the host name), ${files}, and ${SKILLS_API_KEY_ENV}`;
+}
 function assertCredentialInstance(credential, apiOrigin, env, options) {
   let bound;
   if (credential.tier === "disk" || credential.tier === "profile") {
@@ -7956,7 +7952,7 @@ async function skillsCredentialOrReason(env = process.env, options = {}) {
     const connection = await resolveSkillsConnection(env, options);
     return connection ? { apiKey: connection.apiKey, apiOrigin: connection.apiOrigin, reason: null } : { apiKey: null, apiOrigin: null, reason: null };
   } catch (error2) {
-    if (error2 instanceof SkillsFleetCredentialError || error2?.name === "SkillsFleetCredentialError") {
+    if (isSkillsFleetCredentialError(error2)) {
       return { apiKey: null, apiOrigin: null, reason: error2.message };
     }
     throw error2;
@@ -7968,7 +7964,14 @@ function resolveSkillsApiOrigin(env = process.env, options = {}) {
     toV1BaseUrl(configured.value);
     return { origin: normalizeSkillsApiOrigin(configured.value), source: configured.source };
   }
-  const fleet = resolveSkillsFleet(env, options);
+  let fleet;
+  try {
+    fleet = resolveSkillsFleet(env, options);
+  } catch (error2) {
+    if (isSkillsFleetCredentialError(error2))
+      return null;
+    throw error2;
+  }
   return fleet.mode === "hosted" ? { origin: fleet.apiOrigin, source: fleet.apiUrlSource } : null;
 }
 function requireSkillsApiOrigin(action = "This command", env = process.env, options = {}) {
@@ -7987,6 +7990,8 @@ var SKILLS_APP = "skills", ENV_KEYS, SKILLS_API_URL_ENV_KEYS, SKILLS_API_KEY_ENV
 var init_fleet_credentials = __esm(() => {
   init_transport();
   init_instance_credentials();
+  init_local_opt_in();
+  init_local_opt_in();
   ENV_KEYS = clientTransportEnvKeys(SKILLS_APP);
   SKILLS_API_URL_ENV_KEYS = ENV_KEYS.apiUrlKeys;
   SKILLS_API_KEY_ENV_KEYS = ENV_KEYS.apiKeyKeys;
@@ -8009,6 +8014,78 @@ var init_fleet_credentials = __esm(() => {
   };
 });
 
+// src/lib/auth-store.ts
+import { chmodSync, existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync11, renameSync as renameSync2, statSync as statSync7, unlinkSync, writeFileSync as writeFileSync5 } from "fs";
+import { basename as basename3, dirname as dirname5, join as join13 } from "path";
+function getAuthFilePath(env = process.env) {
+  return skillsCredentialFilePath(env);
+}
+function getIdentityFilePath(env = process.env) {
+  const file = skillsCredentialFilePath(env);
+  return join13(dirname5(file), basename3(file).replace(/^credentials/, "identity") + ".json");
+}
+function getApiUrl(action, env = process.env, options = {}) {
+  return requireSkillsApiOrigin(action, env, options);
+}
+function credentialFileMode(env = process.env) {
+  try {
+    return statSync7(skillsCredentialFilePath(env)).mode & 511;
+  } catch {
+    return null;
+  }
+}
+var init_auth_store = __esm(() => {
+  init_transport();
+  init_instance_credentials();
+  init_fleet_credentials();
+  init_transport();
+  init_fleet_credentials();
+});
+
+// src/lib/remote-run-contract.ts
+function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
+  const record3 = isRecord3(payload) ? payload : {};
+  return {
+    contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
+    ...pickString(record3, "id"),
+    skill: pickStringValue(record3, "skill") ?? fallbackSkill,
+    ...pickString(record3, "requestedSlug"),
+    ...pickString(record3, "status"),
+    ...pickNumber(record3, "exitCode"),
+    ...pickString(record3, "correlationId"),
+    ...pickString(record3, "createdAt"),
+    ...pickString(record3, "startedAt"),
+    ...pickString(record3, "completedAt"),
+    ...pickNumber(record3, "durationMs"),
+    ...pickString(record3, "outputType"),
+    ...hasOwn(record3, "outputPreview") ? { outputPreview: record3.outputPreview } : {},
+    ...pickString(record3, "errorCode"),
+    ...pickString(record3, "errorMessage"),
+    ...pickString(record3, "error"),
+    ...pickString(record3, "code"),
+    ...hasOwn(record3, "details") ? { details: record3.details } : {}
+  };
+}
+function isRecord3(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function hasOwn(record3, key) {
+  return Object.prototype.hasOwnProperty.call(record3, key);
+}
+function pickString(record3, key) {
+  const value = pickStringValue(record3, key);
+  return value === undefined ? {} : { [key]: value };
+}
+function pickStringValue(record3, key) {
+  const value = record3[key];
+  return typeof value === "string" ? value : undefined;
+}
+function pickNumber(record3, key) {
+  const value = record3[key];
+  return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
+}
+var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
+
 // src/lib/blog-article.ts
 var exports_blog_article = {};
 __export(exports_blog_article, {
@@ -8223,16 +8300,194 @@ var init_remote_files = __esm(() => {
   MAX_REMOTE_FILE_BYTES = 64 * 1024 * 1024;
 });
 
-// src/lib/auth-store.ts
-function getApiUrl(action, env = process.env, options = {}) {
-  return requireSkillsApiOrigin(action, env, options);
+// src/lib/remote-workspace-selection.ts
+function workspaceExpectedUserId(value) {
+  if (!uuid2(value))
+    throw new WorkspaceContextInputError;
+  return value;
 }
-var init_auth_store = __esm(() => {
-  init_transport();
-  init_instance_credentials();
-  init_fleet_credentials();
-  init_transport();
-  init_fleet_credentials();
+function workspaceContext(value) {
+  if (!record3(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid2(value.userId) || !uuid2(value.membershipId))
+    throw new WorkspaceContextInputError;
+  return { userId: value.userId, membershipId: value.membershipId };
+}
+function invalid() {
+  throw new Error(invalidWorkspaceResult);
+}
+function organization(v) {
+  if (!record3(v) || !uuid2(v.id) || !text(v.slug) || !text(v.name))
+    return invalid();
+  return { id: v.id, slug: v.slug, name: v.name };
+}
+function parseAccountWorkspaces(value) {
+  if (!record3(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
+    return invalid();
+  const workspaces = value.workspaces.map((v) => {
+    if (!record3(v) || !uuid2(v.membershipId) || !role(v.role) || typeof v.current !== "boolean")
+      return invalid();
+    return { membershipId: v.membershipId, organization: organization(v.organization), role: v.role, current: v.current };
+  });
+  if (workspaces.filter((w) => w.current).length !== 1 || new Set(workspaces.map((w) => w.membershipId)).size !== workspaces.length || new Set(workspaces.map((w) => w.organization.id)).size !== workspaces.length)
+    return invalid();
+  return { workspaces };
+}
+function parseWorkspaceIdentity(value, expectedUserId) {
+  if (!record3(value))
+    return invalid();
+  const user = value.user;
+  if (!record3(user) || !uuid2(user.id) || !uuid2(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role(user.role))
+    return invalid();
+  if (user.id !== expectedUserId)
+    throw new WorkspaceIdentityMismatchError;
+  return { user: { id: user.id, membershipId: user.membershipId, email: user.email, displayName: user.displayName, role: user.role }, organization: organization(value.organization) };
+}
+function sessionToken(value) {
+  if (typeof value !== "string" || !value || value.length > 8192 || /[^\x21-\x7e]/.test(value) || value.startsWith("sk_"))
+    return invalid();
+  return value;
+}
+function parseWorkspaceSession(value, expected) {
+  const identity = parseWorkspaceIdentity(value, expected.userId);
+  if (identity.user.membershipId !== expected.membershipId)
+    throw new WorkspaceIdentityMismatchError;
+  return { token: sessionToken(value.token), ...identity };
+}
+function parseWorkspaceLogin(value, expectedUserId) {
+  const user = record3(value) && value.user;
+  if (!record3(value) || !record3(user) || !uuid2(user.id))
+    return invalid();
+  if (expectedUserId !== undefined && user.id !== expectedUserId)
+    throw new WorkspaceIdentityMismatchError;
+  return { token: sessionToken(value.token), userId: user.id };
+}
+function workspaceSelectionFailure(value, status) {
+  if (!record3(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
+    return null;
+  const code = value.code;
+  return workspaceSelectionFailures[code][0] === status ? code : null;
+}
+var record3 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid2 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), text = (v, max = 1024) => typeof v === "string" && !!v.trim() && v.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v), role = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), invalidWorkspaceResult = "The server returned an invalid workspace selection result.", WorkspaceContextInputError, WorkspaceIdentityMismatchError, workspaceSelectionFailures;
+var init_remote_workspace_selection = __esm(() => {
+  WorkspaceContextInputError = class WorkspaceContextInputError extends Error {
+    constructor() {
+      super("Provide the observed user ID and exact lowercase membership ID.");
+      this.name = "WorkspaceContextInputError";
+    }
+  };
+  WorkspaceIdentityMismatchError = class WorkspaceIdentityMismatchError extends Error {
+    constructor() {
+      super("The verified account does not match the requested workspace context.");
+      this.name = "WorkspaceIdentityMismatchError";
+    }
+  };
+  workspaceSelectionFailures = {
+    INVALID_WORKSPACE_SELECTION: [400, "Provide only the exact membership ID from your workspace list."],
+    SESSION_EXPIRED: [401, "Sign in again before selecting a workspace."],
+    ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "Interactive sign-in is required to select a workspace."],
+    WORKSPACE_UNAVAILABLE: [404, "Workspace is unavailable. Refresh your workspace list."],
+    WORKSPACE_BUSY: [503, "Workspace is busy. Refresh before retrying."]
+  };
+});
+
+// src/lib/remote-workspace.ts
+function workspaceMembersQuery(options = {}) {
+  if (!record4(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+    throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
+  const query = new URLSearchParams;
+  if (options.limit !== undefined)
+    query.set("limit", String(options.limit));
+  if (options.cursor !== undefined)
+    query.set("cursor", options.cursor);
+  return query.size ? `?${query}` : "";
+}
+function timestamp(value) {
+  if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}Z$/.test(value))
+    return false;
+  const time3 = Date.parse(value);
+  return Number.isFinite(time3) && new Date(time3).toISOString().slice(0, 23) === value.slice(0, 23);
+}
+function parseMember(row, fail) {
+  if (!record4(row) || !uuid3(row.membershipId) || !uuid3(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp(row.createdAt))
+    return fail();
+  return {
+    membershipId: row.membershipId,
+    userId: row.userId,
+    email: row.email,
+    displayName: row.displayName,
+    role: row.role,
+    createdAt: row.createdAt
+  };
+}
+function mutationInput(membershipId, input, roleChange) {
+  if (typeof membershipId !== "string" || !uuid3(membershipId) || membershipId !== membershipId.toLowerCase() || !record4(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+    throw new WorkspaceMemberInputError;
+  const expectedRole = input.expectedRole, role2 = roleChange ? input.role : undefined;
+  if (!isRole(expectedRole) || roleChange && !isRole(role2))
+    throw new WorkspaceMemberInputError;
+  return { membershipId, role: role2, expectedRole };
+}
+function workspaceMemberRoleInput(membershipId, input) {
+  const value = mutationInput(membershipId, input, true);
+  return { membershipId: value.membershipId, body: { role: value.role, expectedRole: value.expectedRole } };
+}
+function workspaceMemberRemovalInput(membershipId, input) {
+  const value = mutationInput(membershipId, input, false);
+  return { membershipId: value.membershipId, body: { expectedRole: value.expectedRole } };
+}
+function parseWorkspaceMemberRoleResult(value, membershipId, role2) {
+  const fail = () => {
+    throw new Error(invalidMemberResult);
+  };
+  if (!record4(value) || !uuid3(value.organizationId) || typeof value.changed !== "boolean")
+    return fail();
+  const member = parseMember(value.member, fail);
+  if (member.membershipId !== membershipId || member.role !== role2)
+    return fail();
+  return { organizationId: value.organizationId, member, changed: value.changed };
+}
+function parseWorkspaceMemberRemovalResult(value, membershipId) {
+  if (!record4(value) || !uuid3(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+    throw new Error(invalidMemberResult);
+  return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
+}
+function workspaceMemberFailure(value, status) {
+  if (!record4(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+    return null;
+  const code = value.code;
+  return workspaceMemberFailures[code][0] === status ? code : null;
+}
+function parseWorkspaceMembersPage(value) {
+  const fail = () => {
+    throw new Error("The server returned an invalid workspace roster.");
+  };
+  if (!record4(value) || !uuid3(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+    return fail();
+  const members = value.members.map((row) => parseMember(row, fail));
+  if (new Set(members.map((row) => row.membershipId)).size !== members.length)
+    return fail();
+  return { organizationId: value.organizationId, members, nextCursor: value.nextCursor };
+}
+var record4 = (value) => !!value && typeof value === "object" && !Array.isArray(value), cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value), uuid3 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value), isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value), WorkspaceMemberInputError, invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.", workspaceMemberFailures;
+var init_remote_workspace = __esm(() => {
+  WorkspaceMemberInputError = class WorkspaceMemberInputError extends Error {
+    constructor() {
+      super("Use an unchanged lowercase membership ID and the exact role and expected-role parameters from the roster.");
+      this.name = "WorkspaceMemberInputError";
+    }
+  };
+  workspaceMemberFailures = {
+    INVALID_REQUEST: [400, "Provide the exact membership role parameters."],
+    ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required."],
+    WORKSPACE_ADMIN_REQUIRED: [403, "A current workspace owner or admin is required."],
+    MEMBERSHIP_ACTION_FORBIDDEN: [403, "Your current workspace role cannot perform this membership action."],
+    MEMBERSHIP_NOT_FOUND: [404, "Membership was not found in the current workspace."],
+    SELF_REMOVAL_UNAVAILABLE: [409, "Leaving your own workspace is not available through member removal."],
+    MEMBERSHIP_ROLE_CHANGED: [409, "The member role changed. Refresh the roster before another action."],
+    LAST_OWNER_REQUIRED: [409, "The workspace must retain at least one active owner."],
+    MEMBERSHIP_BUSY: [503, "Membership is busy. Refresh the roster before another action."]
+  };
 });
 
 // src/lib/remote-account.ts
@@ -8314,14 +8569,48 @@ var init_remote_account = __esm(() => {
   };
 });
 
+// src/lib/remote-profile.ts
+function customerNamePatch(input, field) {
+  if (!isRecord4(input) || Object.keys(input).length !== 1 || !Object.hasOwn(input, field))
+    throw new Error("Provide only the requested name field.");
+  const value = input[field];
+  if (typeof value !== "string" || /[\p{Cc}\p{Cs}\u2028\u2029]/u.test(value) || !value.trim() || [...value.trim()].length > 100) {
+    throw new Error("Use a name of 1\u2013100 characters without control characters or newlines.");
+  }
+  return { [field]: value.trim() };
+}
+function isRecord4(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function string4(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function parseUpdatedProfile(value) {
+  const user = isRecord4(value) && value.user;
+  if (!isRecord4(user) || !string4(user.id) || !string4(user.email) || !(user.displayName === null || typeof user.displayName === "string") || typeof user.role !== "string" || !["owner", "admin", "member", "viewer"].includes(user.role)) {
+    throw new Error("The server returned an invalid account profile.");
+  }
+  return { user: { id: user.id, email: user.email, displayName: user.displayName, role: user.role } };
+}
+function parseUpdatedWorkspace(value) {
+  const organization2 = isRecord4(value) && value.organization;
+  if (!isRecord4(organization2) || !string4(organization2.id) || !string4(organization2.slug) || !string4(organization2.name)) {
+    throw new Error("The server returned an invalid workspace.");
+  }
+  return { organization: { id: organization2.id, slug: organization2.slug, name: organization2.name } };
+}
+
 // src/lib/remote-client.ts
 var exports_remote_client = {};
 __export(exports_remote_client, {
   createRemoteSkillsClientReadOnly: () => createRemoteSkillsClientReadOnly,
   createRemoteSkillsClient: () => createRemoteSkillsClient,
+  RemoteWorkspaceSelectionError: () => RemoteWorkspaceSelectionError,
+  RemoteWorkspaceMemberError: () => RemoteWorkspaceMemberError,
   RemoteSkillsClient: () => RemoteSkillsClient,
   RemoteRouteUnsupportedError: () => RemoteRouteUnsupportedError,
-  RemoteRequestError: () => RemoteRequestError
+  RemoteRequestError: () => RemoteRequestError,
+  RemoteCapabilityUnavailableError: () => RemoteCapabilityUnavailableError
 });
 
 class RemoteSkillsClient {
@@ -8336,6 +8625,7 @@ class RemoteSkillsClient {
     return fetch(`${this.apiUrl}${path}`, {
       ...options,
       redirect: "error",
+      credentials: "omit",
       signal: options?.signal ?? AbortSignal.timeout(15000),
       headers: {
         Authorization: `Bearer ${this.apiKey}`,
@@ -8351,9 +8641,14 @@ class RemoteSkillsClient {
       if (response.status === 404 && opts.domainNotFoundCodes?.length && await responseBodyCarriesCode(response, opts.domainNotFoundCodes)) {
         return response;
       }
+      response.body?.cancel().catch(() => {});
       throw new RemoteRouteUnsupportedError(routePath, response.status, this.apiUrl);
     }
     if (!response.ok) {
+      if (path === "/api/v1/billing/checkout" && options?.method === "POST" && response.status === 503 && await responseBodyCarriesCode(response, ["SUBSCRIPTION_CHECKOUT_UNAVAILABLE"])) {
+        throw new RemoteCapabilityUnavailableError;
+      }
+      response.body?.cancel().catch(() => {});
       throw new RemoteRequestError(routePath, response.status, response.statusText);
     }
     return response;
@@ -8437,6 +8732,117 @@ class RemoteSkillsClient {
   async getIdentity() {
     return (await this.requestNewRoute("/api/auth/whoami")).json();
   }
+  async listAccountWorkspaces(expectedUserId) {
+    const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    let identity;
+    if (expected !== undefined) {
+      const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+      if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+        throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces", "INTERACTIVE_SESSION_REQUIRED");
+      identity = parseWorkspaceIdentity(value, expected);
+    }
+    const result = parseAccountWorkspaces(await connection.requestWorkspaceSelection("/api/v1/account/workspaces"));
+    const current = result.workspaces.find((workspace) => workspace.current);
+    if (identity && (current.membershipId !== identity.user.membershipId || current.organization.id !== identity.organization.id))
+      throw new WorkspaceIdentityMismatchError;
+    return result;
+  }
+  async switchWorkspace(context) {
+    const target = workspaceContext(context);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+      throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces/switch", "INTERACTIVE_SESSION_REQUIRED");
+    parseWorkspaceIdentity(value, target.userId);
+    const selected = parseWorkspaceSession(await connection.requestWorkspaceSelection("/api/v1/account/workspaces/switch", {
+      method: "POST",
+      body: JSON.stringify({ membershipId: target.membershipId })
+    }), target);
+    const verified = await new RemoteSkillsClient(selected.token, connection.apiUrl).requestWorkspaceSelection("/api/auth/whoami");
+    if (!verified || typeof verified !== "object" || verified.authMethod !== "jwt")
+      throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces/switch", "INTERACTIVE_SESSION_REQUIRED");
+    const identity = parseWorkspaceIdentity(verified, target.userId);
+    if (identity.user.membershipId !== target.membershipId || identity.organization.id !== selected.organization.id)
+      throw new WorkspaceIdentityMismatchError;
+    return { token: selected.token, ...identity };
+  }
+  async requestWorkspaceSelection(path, options) {
+    let response;
+    try {
+      response = await this.request(path, { ...options, credentials: "omit" });
+    } catch {
+      throw new Error("Unable to reach the Skills workspace API.");
+    }
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 1024 * 1024 : 4096)));
+    } catch {
+      if (response.ok)
+        throw new Error(invalidWorkspaceResult);
+    }
+    if (!response.ok) {
+      const code = workspaceSelectionFailure(value, response.status);
+      if (code)
+        throw new RemoteWorkspaceSelectionError(path, code);
+      if (response.status === 404 || response.status === 405)
+        throw new RemoteRouteUnsupportedError(path, response.status, this.apiUrl);
+      throw new RemoteRequestError(path, response.status);
+    }
+    return value;
+  }
+  async updateProfile(input) {
+    const body = customerNamePatch(input, "displayName");
+    return parseUpdatedProfile(await (await this.requestNewRoute("/api/v1/account/profile", { method: "PATCH", body: JSON.stringify(body) })).json());
+  }
+  async updateCurrentWorkspace(input) {
+    const body = customerNamePatch(input, "name");
+    return parseUpdatedWorkspace(await (await this.requestNewRoute("/api/v1/workspaces/current", { method: "PATCH", body: JSON.stringify(body) })).json());
+  }
+  async listWorkspaceMembers(options = {}) {
+    const query = workspaceMembersQuery(options);
+    const requestedCursor = options.cursor;
+    const response = await this.requestNewRoute(`/api/v1/workspace/members${query}`);
+    let value;
+    try {
+      value = await response.json();
+    } catch {
+      throw new Error("The server returned an invalid workspace roster.");
+    }
+    const page = parseWorkspaceMembersPage(value);
+    if (requestedCursor !== undefined && page.nextCursor === requestedCursor)
+      throw new Error("The server returned an invalid workspace roster.");
+    return page;
+  }
+  async setWorkspaceMemberRole(membershipId, input) {
+    const captured = workspaceMemberRoleInput(membershipId, input);
+    const value = await this.requestWorkspaceMember(captured.membershipId, "PATCH", captured.body);
+    return parseWorkspaceMemberRoleResult(value, captured.membershipId, captured.body.role);
+  }
+  async removeWorkspaceMember(membershipId, input) {
+    const captured = workspaceMemberRemovalInput(membershipId, input);
+    return parseWorkspaceMemberRemovalResult(await this.requestWorkspaceMember(captured.membershipId, "DELETE", captured.body), captured.membershipId);
+  }
+  async requestWorkspaceMember(membershipId, method, body) {
+    const path = `/api/v1/workspace/members/${membershipId}`;
+    const response = await this.request(path, { method, body: JSON.stringify(body) });
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 64 * 1024 : 4096)));
+    } catch {
+      if (response.ok)
+        throw new Error(invalidMemberResult);
+    }
+    if (!response.ok) {
+      const code = workspaceMemberFailure(value, response.status);
+      if (code)
+        throw new RemoteWorkspaceMemberError(path, code);
+      if (response.status === 404 || response.status === 405)
+        throw new RemoteRouteUnsupportedError(path, response.status, this.apiUrl);
+      throw new RemoteRequestError(path, response.status);
+    }
+    return value;
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -8628,8 +9034,10 @@ class RemoteSkillsClient {
       return [];
     if (!response.ok)
       throw new Error(`versions request failed: ${response.status}`);
-    const body = await response.json();
-    return Array.isArray(body.versions) ? body.versions : [];
+    const body = await readSkillVersionPayload(response);
+    if (!isVersionRecord(body) || !Array.isArray(body.versions) || body.slug !== undefined && body.slug !== slug)
+      throw new Error(INVALID_SKILL_VERSION_RESPONSE);
+    return body.versions.map((entry) => normalizeSkillVersion(entry, slug));
   }
   async getSkillVersion(slug, version2) {
     const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version2)}`, undefined, { domainNotFoundCodes: ["SKILL_NOT_FOUND", "SKILL_VERSION_NOT_FOUND"] });
@@ -8637,7 +9045,7 @@ class RemoteSkillsClient {
       return null;
     if (!response.ok)
       throw new Error(`version request failed: ${response.status}`);
-    return await response.json();
+    return normalizeSkillVersion(await readSkillVersionPayload(response), slug, version2);
   }
   async listPins() {
     const response = await this.requestNewRoute("/api/v1/pins");
@@ -8685,31 +9093,47 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record3, field) {
-  if (record3[field] === undefined)
+function requireOptionalString(record5, field) {
+  if (record5[field] === undefined)
     return;
-  if (typeof record3[field] !== "string") {
+  if (typeof record5[field] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field} must be a string when present)`);
   }
-  return record3[field];
+  return record5[field];
+}
+function isVersionRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+async function readSkillVersionPayload(response) {
+  try {
+    return await response.json();
+  } catch {
+    throw new Error(INVALID_SKILL_VERSION_RESPONSE);
+  }
+}
+function normalizeSkillVersion(entry, slug, version2) {
+  if (!isVersionRecord(entry) || typeof entry.slug !== "string" || !entry.slug.trim() || entry.slug !== slug || typeof entry.version !== "string" || !entry.version.trim() || version2 !== undefined && entry.version !== version2 || typeof entry.bundleSha256 !== "string" || !/^[a-f0-9]{64}$/i.test(entry.bundleSha256) || typeof entry.bundleByteSize !== "number" || !Number.isSafeInteger(entry.bundleByteSize) || entry.bundleByteSize < 0 || typeof entry.createdAt !== "string" || !entry.createdAt.trim() || entry.current !== undefined && typeof entry.current !== "boolean" || entry.storageKind !== undefined && typeof entry.storageKind !== "string" || entry.manifest !== undefined && !isVersionRecord(entry.manifest)) {
+    throw new Error(INVALID_SKILL_VERSION_RESPONSE);
+  }
+  return entry;
 }
 function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record3 = entry;
-  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  const record5 = entry;
+  const slug = typeof record5.slug === "string" && record5.slug.trim() ? record5.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record3.metadata !== undefined) {
-    if (!record3.metadata || typeof record3.metadata !== "object" || Array.isArray(record3.metadata)) {
+  if (record5.metadata !== undefined) {
+    if (!record5.metadata || typeof record5.metadata !== "object" || Array.isArray(record5.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record3.metadata;
+    metadata = record5.metadata;
   }
-  const pinnedAt = requireOptionalString(record3, "pinnedAt");
+  const pinnedAt = requireOptionalString(record5, "pinnedAt");
   return {
     slug,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -8726,16 +9150,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record3 = entry;
-  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  const record5 = entry;
+  const slug = typeof record5.slug === "string" && record5.slug.trim() ? record5.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug,
-    ...requireOptionalString(record3, "name") !== undefined ? { name: requireOptionalString(record3, "name") } : {},
-    ...requireOptionalString(record3, "version") !== undefined ? { version: requireOptionalString(record3, "version") } : {},
-    ...requireOptionalString(record3, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record3, "updatedAt") } : {}
+    ...requireOptionalString(record5, "name") !== undefined ? { name: requireOptionalString(record5, "name") } : {},
+    ...requireOptionalString(record5, "version") !== undefined ? { version: requireOptionalString(record5, "version") } : {},
+    ...requireOptionalString(record5, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record5, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -8745,26 +9169,55 @@ function normalizeSkillSummaryList(payload) {
   return payload.map(normalizeSkillSummary);
 }
 async function responseBodyCarriesCode(response, codes) {
+  const reader = response.body?.getReader();
+  if (!reader)
+    return false;
+  const maximum = 8 * 1024;
+  let deadline;
+  const expired = new Promise((_, reject) => {
+    deadline = setTimeout(() => reject(new Error("Error response read deadline exceeded")), 1000);
+  });
   try {
-    const payload = await response.clone().json();
-    if (!payload || typeof payload !== "object")
+    const chunks = [];
+    let size = 0;
+    while (true) {
+      const next = await Promise.race([reader.read(), expired]);
+      if (next.done)
+        break;
+      size += next.value.byteLength;
+      if (size > maximum)
+        return false;
+      chunks.push(next.value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    if (!payload || typeof payload !== "object" || Array.isArray(payload) || !Object.hasOwn(payload, "code"))
       return false;
     const code = payload.code;
     return typeof code === "string" && codes.includes(code);
   } catch {
     return false;
+  } finally {
+    clearTimeout(deadline);
+    reader.cancel().catch(() => {});
+    reader.releaseLock();
   }
 }
 function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record3 = payload;
-  if (!Array.isArray(record3.skills)) {
+  const record5 = payload;
+  if (!Array.isArray(record5.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record3.skills.map(normalizeSkillSummary);
-  const nextCursor = record3.nextCursor === undefined || record3.nextCursor === null ? null : record3.nextCursor;
+  const skills = record5.skills.map(normalizeSkillSummary);
+  const nextCursor = record5.nextCursor === undefined || record5.nextCursor === null ? null : record5.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -8777,8 +9230,11 @@ async function createRemoteSkillsClient(env = process.env) {
 function createRemoteSkillsClientReadOnly(env = process.env) {
   return createRemoteSkillsClient(env);
 }
-var RemoteRouteUnsupportedError, RemoteRequestError;
+var RemoteRouteUnsupportedError, RemoteRequestError, RemoteWorkspaceMemberError, RemoteWorkspaceSelectionError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 var init_remote_client = __esm(() => {
+  init_remote_workspace_selection();
+  init_remote_workspace();
+  init_remote_workspace();
   init_auth_store();
   init_fleet_credentials();
   init_remote_account();
@@ -8798,13 +9254,39 @@ var init_remote_client = __esm(() => {
   RemoteRequestError = class RemoteRequestError extends Error {
     path;
     status;
-    constructor(path, status, statusText) {
-      super(`Remote request to ${path} failed: HTTP ${status}${statusText ? ` ${statusText}` : ""}`);
+    constructor(path, status, _statusText) {
+      super(`Remote request to ${path} failed: HTTP ${status}`);
       this.path = path;
       this.status = status;
       this.name = "RemoteRequestError";
     }
   };
+  RemoteWorkspaceMemberError = class RemoteWorkspaceMemberError extends RemoteRequestError {
+    code;
+    constructor(path, code) {
+      super(path, workspaceMemberFailures[code][0]);
+      this.code = code;
+      this.name = "RemoteWorkspaceMemberError";
+      this.message = workspaceMemberFailures[code][1];
+    }
+  };
+  RemoteWorkspaceSelectionError = class RemoteWorkspaceSelectionError extends RemoteRequestError {
+    code;
+    constructor(path, code) {
+      super(path, workspaceSelectionFailures[code][0]);
+      this.code = code;
+      this.name = "RemoteWorkspaceSelectionError";
+      this.message = workspaceSelectionFailures[code][1];
+    }
+  };
+  RemoteCapabilityUnavailableError = class RemoteCapabilityUnavailableError extends RemoteRequestError {
+    code = "SUBSCRIPTION_CHECKOUT_UNAVAILABLE";
+    constructor() {
+      super("/api/v1/billing/checkout", 503);
+      this.name = "RemoteCapabilityUnavailableError";
+      this.message = "Subscription checkout is unavailable on the configured Skills server. " + "Use skills credits packs to view credit packs, or skills billing portal to manage an existing subscription.";
+    }
+  };
 });
 
 // ../../node_modules/.bun/content-type@1.0.5/node_modules/content-type/index.js
@@ -8831,7 +9313,7 @@ var require_content_type = __commonJS((exports) => {
     if (!type || !TYPE_REGEXP.test(type)) {
       throw new TypeError("invalid type");
     }
-    var string4 = type;
+    var string5 = type;
     if (parameters && typeof parameters === "object") {
       var param;
       var params = Object.keys(parameters).sort();
@@ -8840,16 +9322,16 @@ var require_content_type = __commonJS((exports) => {
         if (!TOKEN_REGEXP.test(param)) {
           throw new TypeError("invalid parameter name");
         }
-        string4 += "; " + param + "=" + qstring(parameters[param]);
+        string5 += "; " + param + "=" + qstring(parameters[param]);
       }
     }
-    return string4;
+    return string5;
   }
-  function parse6(string4) {
-    if (!string4) {
+  function parse6(string5) {
+    if (!string5) {
       throw new TypeError("argument string is required");
     }
-    var header = typeof string4 === "object" ? getcontenttype(string4) : string4;
+    var header = typeof string5 === "object" ? getcontenttype(string5) : string5;
     if (typeof header !== "string") {
       throw new TypeError("argument string is required to be a string");
     }
@@ -14323,7 +14805,7 @@ class StdioServerTransport {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.4.0",
+  version: "0.5.1",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -14355,6 +14837,7 @@ var package_default = {
   files: [
     "dist/",
     "!dist/**/*.test.d.ts",
+    "!dist/**/*.fixture.d.ts",
     "!dist/test-preload.d.ts",
     "!dist/platform",
     "bin/",
@@ -14380,8 +14863,9 @@ var package_default = {
     migrate: "bun run ./src/server/migrate.ts",
     typecheck: "tsc --noEmit",
     "verify:release": "bun run scripts/release-guard.ts",
+    "verify:consumer-types": "bun run scripts/consumer-types.ts",
     prepare: "bun run build:js",
-    prepack: "bun run build && bun run verify:release",
+    prepack: "bun run build && bun run verify:release && bun run verify:consumer-types",
     prepublishOnly: "bun run typecheck && bun run test"
   },
   keywords: [
@@ -14403,6 +14887,7 @@ var package_default = {
   author: "Hasna",
   license: "Apache-2.0",
   devDependencies: {
+    "@hasna/contracts": "1.0.2",
     "@types/bun": "1.3.14",
     "@types/node": "25.2.3",
     "@types/react": "^18.2.0",
@@ -14414,8 +14899,7 @@ var package_default = {
   dependencies: {
     "@aws-sdk/client-ecs": "^3.1079.0",
     "@aws-sdk/client-s3": "^3.1079.0",
-    "@hasna/contracts": "1.0.1",
-    "@hasna/events": "0.1.16",
+    "@hasna/events": "0.1.18",
     "@modelcontextprotocol/sdk": "^1.26.0",
     chalk: "^5.3.0",
     commander: "^12.1.0",
@@ -22331,12 +22815,7 @@ import { homedir } from "os";
 import { join, resolve } from "path";
 import { homedir as pathsResolverHomedir } from "os";
 import { join as pathsResolverJoin } from "path";
-var PATHS_RESOLVER_KIND_ENV = {
-  config: "HASNA_CONFIG_HOME",
-  data: "HASNA_DATA_HOME",
-  state: "HASNA_STATE_HOME",
-  cache: "HASNA_CACHE_HOME"
-};
+var PATHS_RESOLVER_DATA_ENV = "HASNA_DATA_HOME";
 var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 function pathsResolverAssertApp(app) {
   if (typeof app !== "string" || app.length === 0) {
@@ -22346,48 +22825,19 @@ function pathsResolverAssertApp(app) {
     throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
   }
 }
-function pathsResolverAssertKind(kind) {
-  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
-    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
-  }
-}
-function pathsResolverBaseDir(kind, options) {
-  pathsResolverAssertKind(kind);
+function pathsResolverDataBaseDir(options) {
   const env = options.env ?? process.env;
-  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  const override = env[PATHS_RESOLVER_DATA_ENV];
   if (typeof override === "string" && override.length > 0)
     return override;
   const home = options.home ?? pathsResolverHomedir();
   const platform = options.platform ?? process.platform;
-  if (platform === "darwin") {
-    switch (kind) {
-      case "config":
-      case "data":
-        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
-      case "cache":
-        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
-      case "state":
-        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
-    }
-  }
-  switch (kind) {
-    case "config":
-      return pathsResolverJoin(home, ".config", "hasna");
-    case "data":
-      return pathsResolverJoin(home, ".local", "share", "hasna");
-    case "state":
-      return pathsResolverJoin(home, ".local", "state", "hasna");
-    case "cache":
-      return pathsResolverJoin(home, ".cache", "hasna");
-  }
-}
-function pathsResolverResolve(kind, options) {
-  pathsResolverAssertApp(options.app);
-  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
-  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+  return platform === "darwin" ? pathsResolverJoin(home, "Library", "Application Support", "Hasna") : pathsResolverJoin(home, ".local", "share", "hasna");
 }
 function dataDir(options) {
-  return pathsResolverResolve("data", options);
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverDataBaseDir(options), appSegment);
 }
 var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
 var HASNA_SKILLS_HOME_ENV = "HASNA_SKILLS_HOME";
@@ -23967,14 +24417,27 @@ function normalizePortableSkillName(name) {
   }
   return normalized;
 }
+function normalizeNewPortableSkillName(name) {
+  normalizePortableSkillName(name);
+  const normalized = name.trim().replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (!normalized)
+    throw new Error(`Invalid skill name '${name}'. Include letters or numbers.`);
+  return normalized;
+}
 function readPortableSkillManifest(skillPath, fallbackName = basename(skillPath)) {
+  return readManifest(skillPath, fallbackName, normalizePortableSkillName);
+}
+function readPortableSkillManifestForImport(skillPath) {
+  return readManifest(skillPath, basename(skillPath), normalizeNewPortableSkillName);
+}
+function readManifest(skillPath, fallbackName, normalizeName) {
   const skillJsonPath = join6(skillPath, "skill.json");
   const skillMdPath = join6(skillPath, "SKILL.md");
   const pkgPath = join6(skillPath, "package.json");
   const jsonManifest = existsSync6(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
   const frontmatter = existsSync6(skillMdPath) ? parseSkillFrontmatter(readFileSync5(skillMdPath, "utf-8")) ?? undefined : undefined;
   const pkg = existsSync6(pkgPath) ? readJsonObject(pkgPath) : undefined;
-  const name = normalizePortableSkillName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
+  const name = normalizeName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
   const description = stringField(jsonManifest, "description") ?? frontmatter?.description ?? stringValue(pkg?.description) ?? `${name} skill`;
   const version2 = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
   const kind = parseSkillKind(stringField(jsonManifest, "kind") ?? frontmatter?.kind);
@@ -24222,10 +24685,45 @@ function ensureInstructionSkillFiles(skillPath, manifest) {
   };
   if (!existsSync6(join6(skillPath, "SKILL.md"))) {
     writeFileSync2(join6(skillPath, "SKILL.md"), renderSkillMd(next));
+  } else {
+    const path = join6(skillPath, "SKILL.md");
+    const content = readFileSync5(path, "utf8");
+    const declaredName = parseSkillFrontmatter(content)?.name;
+    if (declaredName && declaredName !== next.name) {
+      writeFileSync2(path, renameInstructionFrontmatter(content, next.name));
+    }
+  }
+  const packagePath = join6(skillPath, "package.json");
+  if (existsSync6(packagePath)) {
+    const pkg = readJsonObject(packagePath);
+    if (typeof pkg.name === "string" && pkg.name !== next.name) {
+      writeFileSync2(packagePath, `${JSON.stringify({ ...pkg, name: next.name }, null, 2)}
+`);
+    }
   }
   writeSkillJsonWithHash(skillPath, next);
   return readPortableSkillManifest(skillPath, next.name);
 }
+function renameInstructionFrontmatter(content, name) {
+  const frontmatter = content.match(/^---\r?\n([\s\S]*?)\r?\n---(?=\r?\n|$)/);
+  const names = frontmatter?.[1]?.match(/^[ \t]*name[ \t]*:[^\r\n]*/gm) ?? [];
+  const declaration = names.length === 1 ? names[0].match(/^(name[ \t]*:[ \t]*)(.*?)([ \t]*)$/) : null;
+  const scalar = declaration?.[2] ?? "";
+  let simple = /^[a-zA-Z0-9_.@/ -]+$/.test(scalar);
+  if (scalar.startsWith('"')) {
+    try {
+      simple = typeof JSON.parse(scalar) === "string";
+    } catch {
+      simple = false;
+    }
+  } else if (scalar.startsWith("'"))
+    simple = /^'[^'\r\n]*'$/.test(scalar);
+  if (!frontmatter || !declaration || !simple) {
+    throw new Error("Cannot rename instruction SKILL.md: use one unambiguous top-level name scalar in frontmatter.");
+  }
+  const renamed = frontmatter[0].replace(/^name[ \t]*:[^\r\n]*/m, () => `${declaration[1]}${name}${declaration[3]}`);
+  return renamed + content.slice(frontmatter[0].length);
+}
 function copySkillDirectory(source, destination) {
   const resolvedSource = lstatSync2(source).isSymbolicLink() ? realpathSync(source) : source;
   mkdirSync2(destination, { recursive: true });
@@ -24624,7 +25122,7 @@ function isOfficialSkillName(name) {
   return OFFICIAL_SKILL_NAMES.has(name);
 }
 function scaffoldPortableSkill(name, options = {}) {
-  const skillName = normalizePortableSkillName(name);
+  const skillName = normalizeNewPortableSkillName(name);
   const root = getPortableSkillsRoot(options);
   const skillPath = join7(root, skillName);
   if (existsSync7(skillPath)) {
@@ -24648,9 +25146,9 @@ function portPortableSkill(sourcePath, options = {}) {
   if (!existsSync7(absoluteSource) || !statSync6(absoluteSource).isDirectory()) {
     throw new Error(`Skill source directory not found: ${sourcePath}`);
   }
-  const inferred = readPortableSkillManifest(absoluteSource, basename2(absoluteSource));
+  const inferred = readPortableSkillManifestForImport(absoluteSource);
   const explicitName = options.name != null;
-  const skillName = normalizePortableSkillName(options.name ?? inferred.name);
+  const skillName = normalizeNewPortableSkillName(options.name ?? inferred.name);
   if (isOfficialSkillName(skillName) && !options.allowShadow) {
     const sourceSlug = safeNormalizeName(basename2(absoluteSource));
     const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename2(absoluteSource)}')` : ""} matches a bundled official skill.`;
@@ -25131,23 +25629,300 @@ function mergeCustomSkills(skills) {
   return Array.from(byName.values()).sort((a, b) => a.name.localeCompare(b.name));
 }
 
-// src/lib/installer.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8, rmSync as rmSync2 } from "fs";
-import { dirname as dirname4, join as join10 } from "path";
-import { homedir as homedir2 } from "os";
-import { fileURLToPath } from "url";
-// src/lib/utils.ts
-function normalizeSkillName(name) {
-  return name;
-}
+// src/lib/read-access.ts
+init_fleet_credentials();
 
-// src/lib/project-state.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
-import { join as join9 } from "path";
-var VALID_PIN_SOURCES = [
-  "official",
-  "custom",
-  "remote",
+// src/lib/api-url.ts
+init_fleet_credentials();
+init_fleet_credentials();
+var API_URL_ENV_VAR = SKILLS_API_URL_ENV;
+var MISSING_API_URL_HINT = `run: skills auth login, or set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
+function resolveApiUrl(env = process.env, options = {}) {
+  const fleet = resolveSkillsFleet(env, options);
+  return fleet.mode === "hosted" ? fleet.apiOrigin : undefined;
+}
+
+// src/lib/remote-registry.ts
+init_fleet_credentials();
+
+// src/lib/discovery.ts
+var VENDOR_TERMS = [
+  "Google Gemini",
+  "OpenAI Sora",
+  "MiniMax Hailuo",
+  "Claude Code",
+  "Claude Vision",
+  "DALL-E 3",
+  "GPT-4o Mini",
+  "Cerebras",
+  "OpenRouter",
+  "Firecrawl",
+  "ElevenLabs",
+  "Anthropic",
+  "OpenAI",
+  "Minimax",
+  "MiniMax",
+  "Gemini",
+  "Claude",
+  "Whisper",
+  "Seedance",
+  "Lyria",
+  "Sora",
+  "Veo",
+  "Exa.ai",
+  "Exa",
+  "XAI",
+  "xAI"
+];
+var VENDOR_TAGS = new Set([
+  "anthropic",
+  "cerebras",
+  "claude",
+  "exa",
+  "firecrawl",
+  "gemini",
+  "google",
+  "minimax",
+  "openai",
+  "openrouter",
+  "seedance",
+  "whisper",
+  "xai"
+]);
+var vendorPattern = new RegExp(`\\b(${VENDOR_TERMS.map(escapeRegExp).join("|")})\\b`, "gi");
+function getCompactSkillDiscovery(skill) {
+  return {
+    name: skill.name,
+    category: skill.category,
+    description: sanitizePublicDiscoveryText(skill.description)
+  };
+}
+function getPublicSkillDiscovery(skill) {
+  return {
+    ...skill,
+    description: sanitizePublicDiscoveryText(skill.description),
+    tags: publicDiscoveryTags(skill.tags)
+  };
+}
+function publicDiscoveryTags(tags) {
+  return tags.filter((tag) => !VENDOR_TAGS.has(tag.toLowerCase()));
+}
+function sanitizePublicDiscoveryText(text) {
+  let sanitized = text.replace(vendorPattern, "hosted AI").replace(/\bLLM\b/g, "AI").replace(/\s{2,}/g, " ");
+  let previous;
+  do {
+    previous = sanitized;
+    sanitized = sanitized.replace(/\bhosted AI(?: providers)?\s*,\s*hosted AI(?: providers)?\b/gi, "hosted AI providers").replace(/\bhosted AI(?: providers)?\s*,?\s*and\s*hosted AI(?: providers)?\b/gi, "hosted AI providers").replace(/\bhosted AI(?: providers)?\s+or\s+hosted AI(?: providers)?\b/gi, "hosted AI providers").replace(/\bhosted AI providers\s+hosted AI\b/gi, "hosted AI providers").replace(/\bhosted AI providers\s+providers\b/gi, "hosted AI providers");
+  } while (sanitized !== previous);
+  return sanitized.trim();
+}
+function publicDiscoveryEnvVars(_skillName, envVars) {
+  return envVars;
+}
+function publicDiscoveryDependencies(_skillName, dependencies) {
+  return dependencies;
+}
+function publicDiscoveryDocumentation(_skill, documentation) {
+  return documentation;
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// src/lib/remote-registry.ts
+var remoteAvailabilitySchema = exports_external.object({
+  status: exports_external.enum(["available", "unavailable"]),
+  code: exports_external.string().optional(),
+  message: exports_external.string().optional(),
+  details: exports_external.array(exports_external.string()).optional()
+}).passthrough();
+var remoteSkillSchema = exports_external.object({
+  name: exports_external.string().min(1).optional(),
+  slug: exports_external.string().min(1).optional(),
+  displayName: exports_external.string().optional(),
+  description: exports_external.string().optional(),
+  category: exports_external.string().optional(),
+  tags: exports_external.array(exports_external.string()).optional(),
+  dependencies: exports_external.array(exports_external.string()).optional(),
+  version: exports_external.string().optional(),
+  availability: remoteAvailabilitySchema.optional()
+}).passthrough().refine((skill) => skill.name || skill.slug, {
+  message: "Remote skill requires name or slug"
+});
+var secretValuePatterns = [
+  /\bsk-[A-Za-z0-9_-]{8,}\b/g,
+  /\bgh[opsur]_[A-Za-z0-9_]{8,}\b/g,
+  /\bgithub_pat_[A-Za-z0-9_]{8,}\b/g,
+  /\bnpm_[A-Za-z0-9_]{8,}\b/g,
+  /\bAKIA[A-Z0-9]{12,}\b/g,
+  /\bAIza[A-Za-z0-9_-]{10,}\b/g,
+  new RegExp("\\bsecret" + "-token:\\s*[A-Za-z0-9._-]+", "gi"),
+  /\bctx7sk\-[A-Za-z0-9_-]{8,}\b/g,
+  /\bxai\-[A-Za-z0-9_-]{8,}\b/g
+];
+var remoteSkillDetailSchema = exports_external.union([
+  remoteSkillSchema,
+  exports_external.object({ skill: remoteSkillSchema }),
+  exports_external.object({ data: remoteSkillSchema })
+]);
+var remoteRegistrySchema = exports_external.union([
+  exports_external.array(remoteSkillSchema),
+  exports_external.object({ skills: exports_external.array(remoteSkillSchema) }),
+  exports_external.object({ data: exports_external.array(remoteSkillSchema) })
+]);
+function getConfiguredApiUrl(env = process.env) {
+  return resolveApiUrl(env);
+}
+function buildSkillsApiUrl(apiUrl, endpoint = "/skills") {
+  const url = new URL(apiUrl);
+  const cleanEndpoint = endpoint.startsWith("/") ? endpoint : `/${endpoint}`;
+  const pathname = url.pathname.replace(/\/+$/, "");
+  const apiBase = /\/api(?:\/v1)?\/skills$/.test(pathname) ? pathname.slice(0, -"/skills".length) : pathname;
+  if (/\/api(?:\/v1)?$/.test(apiBase)) {
+    url.pathname = `${apiBase}${cleanEndpoint}`;
+    return url.toString();
+  }
+  url.pathname = `${apiBase}/api/v1${cleanEndpoint}`.replace(/\/{2,}/g, "/");
+  return url.toString();
+}
+function titleize(name) {
+  return name.replace(/-/g, " ").replace(/\b\w/g, (char) => char.toUpperCase());
+}
+function normalizeRemoteSkill(skill) {
+  const name = skill.name || skill.slug;
+  if (!name)
+    throw new Error("Remote skill requires name or slug");
+  return {
+    name,
+    displayName: skill.displayName || titleize(name),
+    description: skill.description || "",
+    category: skill.category || "Remote",
+    tags: skill.tags || ["remote"],
+    dependencies: skill.dependencies,
+    ...skill.version ? { version: skill.version } : {},
+    availability: normalizeRemoteAvailability(skill.availability),
+    source: "remote"
+  };
+}
+function normalizeRemoteAvailability(availability) {
+  if (!availability)
+    return { status: "available" };
+  if (availability.status === "available")
+    return { status: "available" };
+  return {
+    status: availability.status,
+    ...safeAvailabilityCode(availability.code) ? { code: safeAvailabilityCode(availability.code) } : {},
+    ...availability.message ? { message: sanitizeAvailabilityText(availability.message) } : {},
+    ...availability.details ? { details: availability.details.map(sanitizeAvailabilityText).filter(Boolean) } : {}
+  };
+}
+function safeAvailabilityCode(code) {
+  if (!code)
+    return;
+  return /^[A-Z0-9_]+$/.test(code) ? code : undefined;
+}
+function sanitizeAvailabilityText(text) {
+  return secretValuePatterns.reduce((value, pattern) => value.replace(pattern, "credential"), sanitizePublicDiscoveryText(text).replace(/\b[A-Z0-9_]*(?:API_KEY|SECRET|TOKEN|CREDENTIAL)[A-Z0-9_]*\b/g, "credential")).replace(/\s{2,}/g, " ").trim();
+}
+function parseRemoteRegistryPayload(payload) {
+  const parsed = parseRemoteContract(remoteRegistrySchema, payload, "Remote registry payload did not match the expected skills contract");
+  const rawSkills = Array.isArray(parsed) ? parsed : ("skills" in parsed) ? parsed.skills : parsed.data;
+  return rawSkills.map(normalizeRemoteSkill);
+}
+function parseRemoteContract(schema, payload, message) {
+  try {
+    return schema.parse(payload);
+  } catch (error2) {
+    if (error2 instanceof exports_external.ZodError)
+      throw new Error(message, { cause: error2 });
+    throw error2;
+  }
+}
+async function remoteRequestHeaders(options) {
+  const headers = new Headers({ Accept: "application/json" });
+  const token = options.authToken !== undefined ? options.authToken : await ambientTokenFor(options.apiUrl);
+  const trimmed = token?.trim();
+  if (trimmed)
+    headers.set("Authorization", `Bearer ${trimmed}`);
+  return headers;
+}
+async function ambientTokenFor(callerApiUrl) {
+  const connection = await resolveSkillsConnection();
+  if (!connection)
+    return null;
+  if (callerApiUrl !== undefined && normalizeSkillsApiOrigin(callerApiUrl) !== connection.apiOrigin) {
+    throw new SkillsFleetCredentialError(`The Skills credential resolved for ${connection.apiOrigin} is never sent to a caller-supplied apiUrl ` + `(${normalizeSkillsApiOrigin(callerApiUrl)}). Pass an explicit authToken for that instance, or authToken: null ` + `for an unauthenticated read; no credential was sent.`, "INSTANCE_CREDENTIAL_MISMATCH");
+  }
+  return connection.apiKey;
+}
+async function fetchRemoteJson(url, options) {
+  const fetchImpl = options.fetchImpl || fetch;
+  const headers = await remoteRequestHeaders(options);
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 1e4);
+  try {
+    const response = await fetchImpl(url, {
+      headers,
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      throw new Error(`Remote registry request failed: ${response.status} ${response.statusText}`);
+    }
+    return response.json();
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function loadRemoteRegistry(options = {}) {
+  const apiUrl = options.apiUrl || getConfiguredApiUrl();
+  if (!apiUrl) {
+    throw new Error(`Remote registry requires a Skills credential (${SKILLS_API_KEY_ENV}, the Keychain item, or ~/.hasna/skills/config/credentials) and, for your own instance, ${SKILLS_API_URL_ENV}`);
+  }
+  const url = buildSkillsApiUrl(apiUrl, options.endpoint);
+  return parseRemoteRegistryPayload(await fetchRemoteJson(url, options));
+}
+async function mergeRemoteRegistry(local, options = {}) {
+  const apiUrl = options.apiUrl || getConfiguredApiUrl();
+  if (!apiUrl)
+    return local;
+  if (options.authToken !== undefined && !options.authToken?.trim())
+    return local;
+  const remote = await loadRemoteRegistry({ ...options, apiUrl });
+  return mergeSkillRegistryLists(local, remote);
+}
+
+// src/lib/read-access.ts
+async function requireSkillsReadAccess(env = process.env, options = {}) {
+  const connection = await resolveSkillsConnection(env, options);
+  return connection ? { mode: "hosted", apiOrigin: connection.apiOrigin } : { mode: "local" };
+}
+async function getBrowseRegistry(options = {}) {
+  const profile = options.all ? "all" : "basic";
+  const local = loadRegistryProfile(profile);
+  if (options.remote) {
+    const remote = await loadRemoteRegistry();
+    return mergeSkillRegistryLists(local, remote);
+  }
+  return mergeRemoteRegistry(local);
+}
+
+// src/lib/installer.ts
+import { existsSync as existsSync10, readFileSync as readFileSync9, rmSync as rmSync2 } from "fs";
+import { dirname as dirname4, join as join11 } from "path";
+import { homedir as homedir2 } from "os";
+import { fileURLToPath } from "url";
+// src/lib/utils.ts
+function normalizeSkillName(name) {
+  return name;
+}
+
+// src/lib/project-state.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
+import { join as join10 } from "path";
+var VALID_PIN_SOURCES = [
+  "official",
+  "custom",
+  "remote",
   "private",
   "private-hosted",
   "upstream",
@@ -25158,17 +25933,17 @@ var SKILLS_PROJECT_DIR = ".skills";
 var PROJECT_CONFIG_FILE = "project.json";
 var DEFAULT_EXPORT_DIR = ".skills/exports";
 function getProjectStateDir(targetDir = process.cwd()) {
-  return join9(targetDir, SKILLS_PROJECT_DIR);
+  return join10(targetDir, SKILLS_PROJECT_DIR);
 }
 function getProjectConfigPath(targetDir = process.cwd()) {
-  return join9(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
+  return join10(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
 }
 function loadProjectConfig(targetDir = process.cwd()) {
   const path = getProjectConfigPath(targetDir);
   if (!existsSync9(path))
     return null;
   try {
-    return normalizeProjectConfig(JSON.parse(readFileSync7(path, "utf-8")));
+    return normalizeProjectConfig(JSON.parse(readFileSync8(path, "utf-8")));
   } catch {
     return null;
   }
@@ -25267,12 +26042,12 @@ var __dirname2 = dirname4(fileURLToPath(import.meta.url));
 function findSkillsDir() {
   let dir = __dirname2;
   for (let i = 0;i < 5; i++) {
-    const candidate = join10(dir, "skills");
+    const candidate = join11(dir, "skills");
     if (existsSync10(candidate) && !dir.includes(".skills"))
       return candidate;
     dir = dirname4(dir);
   }
-  return join10(__dirname2, "..", "skills");
+  return join11(__dirname2, "..", "skills");
 }
 var SKILLS_DIR = findSkillsDir();
 function getSkillPath(name) {
@@ -25280,13 +26055,13 @@ function getSkillPath(name) {
   const portable = findPortableSkill(skillName);
   if (portable)
     return portable.path;
-  const legacyCustomPath = join10(getDataDir(), "custom", skillName);
+  const legacyCustomPath = join11(getDataDir(), "custom", skillName);
   if (existsSync10(legacyCustomPath))
     return legacyCustomPath;
   const extensionPath = findExtensionSkillPath(skillName);
   if (extensionPath)
     return extensionPath;
-  return join10(SKILLS_DIR, skillName);
+  return join11(SKILLS_DIR, skillName);
 }
 function getCanonicalSkillName(name) {
   return getSkill(name)?.name ?? resolveSkillAlias(normalizeSkillSlug(name));
@@ -25350,11 +26125,11 @@ function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const base = projectDir || process.cwd();
   switch (agent) {
     case "pi":
-      return scope === "project" ? join10(base, ".pi", "skills") : join10(homedir2(), ".pi", "agent", "skills");
+      return scope === "project" ? join11(base, ".pi", "skills") : join11(homedir2(), ".pi", "agent", "skills");
     case "opencode":
-      return scope === "project" ? join10(base, ".opencode", "skills") : join10(homedir2(), ".config", "opencode", "skills");
+      return scope === "project" ? join11(base, ".opencode", "skills") : join11(homedir2(), ".config", "opencode", "skills");
     default:
-      return scope === "project" ? join10(base, `.${agent}`, "skills") : join10(homedir2(), `.${agent}`, "skills");
+      return scope === "project" ? join11(base, `.${agent}`, "skills") : join11(homedir2(), `.${agent}`, "skills");
   }
 }
 function warnMissingDependencies(name, targetDir) {
@@ -25369,11 +26144,11 @@ function warnMissingDependencies(name, targetDir) {
   }
 }
 function readBundledSkillVersion(name) {
-  const pkgPath = join10(getSkillPath(name), "package.json");
+  const pkgPath = join11(getSkillPath(name), "package.json");
   if (!existsSync10(pkgPath))
     return "unknown";
   try {
-    const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
     return pkg.version || "unknown";
   } catch {
     return "unknown";
@@ -25381,16 +26156,16 @@ function readBundledSkillVersion(name) {
 }
 
 // src/lib/skillinfo.ts
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
+import { join as join12 } from "path";
 function isInstructionSkillDir(skillPath, meta) {
   if (meta?.kind === "instruction")
     return true;
-  const skillMdPath = join11(skillPath, "SKILL.md");
+  const skillMdPath = join12(skillPath, "SKILL.md");
   if (!existsSync11(skillMdPath))
     return false;
   try {
-    return parseSkillFrontmatter(readFileSync9(skillMdPath, "utf-8"))?.kind === "instruction";
+    return parseSkillFrontmatter(readFileSync10(skillMdPath, "utf-8"))?.kind === "instruction";
   } catch {
     return false;
   }
@@ -25416,9 +26191,9 @@ function getSkillDocs(name) {
   if (!existsSync11(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join11(skillPath, "SKILL.md")),
-    readme: readIfExists(join11(skillPath, "README.md")),
-    claudeMd: readIfExists(join11(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join12(skillPath, "SKILL.md")),
+    readme: readIfExists(join12(skillPath, "README.md")),
+    claudeMd: readIfExists(join12(skillPath, "CLAUDE.md"))
   };
 }
 function getSkillBestDoc(name) {
@@ -25433,7 +26208,7 @@ function getSkillRequirements(name) {
     return null;
   const texts = [];
   for (const file of ["SKILL.md", "README.md", "CLAUDE.md", ".env.example", ".env.local.example"]) {
-    const content = readIfExists(join11(skillPath, file));
+    const content = readIfExists(join12(skillPath, file));
     if (content)
       texts.push(content);
   }
@@ -25473,10 +26248,10 @@ function getSkillRequirements(name) {
   const skillName = normalizeSkillName(name);
   let cliCommand = `skills run ${skillName}`;
   let dependencies = {};
-  const pkgPath = join11(skillPath, "package.json");
+  const pkgPath = join12(skillPath, "package.json");
   if (existsSync11(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
+      const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
       dependencies = pkg.dependencies || {};
     } catch {}
   }
@@ -25503,13 +26278,13 @@ async function runSkill(name, args, options = {}) {
       error: `Skill '${name}' is an instruction skill (kind: instruction) and is not runnable. Instruction skills are consumed by coding agents via SKILL.md, not executed with 'skills run'.`
     };
   }
-  const pkgPath = join11(skillPath, "package.json");
+  const pkgPath = join12(skillPath, "package.json");
   if (!existsSync11(pkgPath)) {
     return { exitCode: 1, error: `No package.json in skill '${name}'` };
   }
   let entryPoint;
   try {
-    const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
     if (pkg.bin) {
       const binValues = Object.values(pkg.bin);
       entryPoint = binValues[0];
@@ -25523,11 +26298,11 @@ async function runSkill(name, args, options = {}) {
   } catch {
     return { exitCode: 1, error: `Failed to parse package.json for skill '${name}'` };
   }
-  const entryPath = join11(skillPath, entryPoint);
+  const entryPath = join12(skillPath, entryPoint);
   if (!existsSync11(entryPath)) {
     return { exitCode: 1, error: `Entry point '${entryPoint}' not found in skill '${name}'` };
   }
-  const nodeModules = join11(skillPath, "node_modules");
+  const nodeModules = join12(skillPath, "node_modules");
   if (!existsSync11(nodeModules)) {
     const install = Bun.spawn(["bun", "install", "--no-save"], {
       cwd: skillPath,
@@ -25538,7 +26313,7 @@ async function runSkill(name, args, options = {}) {
   }
   const proc = Bun.spawn(["bun", "run", entryPath, ...args], {
     cwd: skillPath,
-    stdout: options.stdio === "pipe" ? "pipe" : "inherit",
+    stdout: options.stdio === "pipe" ? "pipe" : options.stdio === "stderr" ? 2 : "inherit",
     stderr: options.stdio === "pipe" ? "pipe" : "inherit",
     stdin: "inherit",
     env: { ...process.env, ...options.env }
@@ -25555,7 +26330,7 @@ async function runSkill(name, args, options = {}) {
   return { exitCode };
 }
 function detectProjectSkills(cwd = process.cwd()) {
-  const pkgPath = join11(cwd, "package.json");
+  const pkgPath = join12(cwd, "package.json");
   if (!existsSync11(pkgPath)) {
     const alwaysRecommend = ["market-research-report", "repo-onboarding-report", "blog-article"];
     const recommended2 = alwaysRecommend.map((name) => loadRegistry().find((s) => s.name === name)).filter((s) => s !== undefined);
@@ -25563,7 +26338,7 @@ function detectProjectSkills(cwd = process.cwd()) {
   }
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
+    pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
   } catch {
     const alwaysRecommend = ["market-research-report", "repo-onboarding-report", "blog-article"];
     const recommended2 = alwaysRecommend.map((name) => loadRegistry().find((s) => s.name === name)).filter((s) => s !== undefined);
@@ -25653,7 +26428,7 @@ function extractEnvVars(text) {
 function readIfExists(path) {
   try {
     if (existsSync11(path)) {
-      return readFileSync9(path, "utf-8");
+      return readFileSync10(path, "utf-8");
     }
   } catch {}
   return null;
@@ -26068,6 +26843,104 @@ var toolContracts = [
       dependencies: objectSchema({}, [], "Package dependencies.", true)
     })
   },
+  {
+    name: "update_account_profile",
+    title: "Update Account Display Name",
+    description: "Update your display name with fresh email verification on the configured server.",
+    params: ["name", "email", "code"],
+    category: "execution",
+    sideEffects: "local-process-or-remote-run",
+    stable: true,
+    inputSchema: objectSchema({ name: stringSchema("Display name, 1\u2013100 characters"), email: { type: "string", format: "email" }, code: { type: "string", pattern: "^\\d{6}$" } }, ["name", "email", "code"]),
+    outputSchema: objectSchema({ user: objectSchema({ id: stringSchema("Account identifier."), email: stringSchema("Account email."), displayName: stringSchema("Display name."), role: stringSchema("Current workspace role.") }, ["id", "email", "displayName", "role"]) }, ["user"])
+  },
+  {
+    name: "update_workspace_name",
+    title: "Update Workspace Name",
+    description: "Update the current workspace name as an owner/admin with fresh email verification.",
+    params: ["name", "email", "code"],
+    category: "execution",
+    sideEffects: "local-process-or-remote-run",
+    stable: true,
+    inputSchema: objectSchema({ name: stringSchema("Workspace name, 1\u2013100 characters"), email: { type: "string", format: "email" }, code: { type: "string", pattern: "^\\d{6}$" } }, ["name", "email", "code"]),
+    outputSchema: objectSchema({ organization: objectSchema({ id: stringSchema("Workspace identifier."), slug: stringSchema("Stable workspace slug."), name: stringSchema("Workspace name.") }, ["id", "slug", "name"]) }, ["organization"])
+  },
+  {
+    name: "set_workspace_member_role",
+    title: "Set Current Workspace Member Role",
+    description: "Set an exact membership incarnation's role with its observed expectedRole and fresh verification; no automatic retry.",
+    params: ["membershipId", "role", "expectedRole", "email", "code"],
+    category: "execution",
+    sideEffects: "local-process-or-remote-run",
+    stable: true,
+    inputSchema: objectSchema({
+      membershipId: { type: "string", pattern: "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$" },
+      role: { type: "string", enum: ["owner", "admin", "member", "viewer"] },
+      expectedRole: { type: "string", enum: ["owner", "admin", "member", "viewer"] },
+      email: { type: "string", format: "email" },
+      code: { type: "string", pattern: "^\\d{6}$" }
+    }, ["membershipId", "role", "expectedRole", "email", "code"]),
+    outputSchema: objectSchema({
+      organizationId: stringSchema("Current workspace identifier."),
+      changed: { type: "boolean" },
+      member: objectSchema({
+        membershipId: stringSchema("Membership incarnation."),
+        userId: stringSchema("Account identifier."),
+        email: stringSchema("Member email."),
+        displayName: { oneOf: [{ type: "string" }, { type: "null" }] },
+        role: { type: "string", enum: ["owner", "admin", "member", "viewer"] },
+        createdAt: stringSchema("Exact server timestamp including microseconds.")
+      }, ["membershipId", "userId", "email", "displayName", "role", "createdAt"])
+    }, ["organizationId", "member", "changed"])
+  },
+  {
+    name: "remove_workspace_member",
+    title: "Remove Current Workspace Member",
+    description: "Remove exactly this membership incarnation using its observed expectedRole and fresh verification; self-removal is unavailable.",
+    params: ["membershipId", "expectedRole", "email", "code"],
+    category: "execution",
+    sideEffects: "local-process-or-remote-run",
+    stable: true,
+    inputSchema: objectSchema({
+      membershipId: { type: "string", pattern: "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$" },
+      expectedRole: { type: "string", enum: ["owner", "admin", "member", "viewer"] },
+      email: { type: "string", format: "email" },
+      code: { type: "string", pattern: "^\\d{6}$" }
+    }, ["membershipId", "expectedRole", "email", "code"]),
+    outputSchema: objectSchema({
+      organizationId: stringSchema("Current workspace identifier."),
+      membershipId: stringSchema("Removed membership incarnation."),
+      removed: { type: "boolean", const: true },
+      alreadyRemoved: { type: "boolean" }
+    }, ["organizationId", "membershipId", "removed", "alreadyRemoved"])
+  },
+  {
+    name: "list_workspace_members",
+    title: "List Current Workspace Members",
+    description: "Read one current-workspace roster page with fresh owner/admin email verification; saved credentials stay unchanged.",
+    params: ["email", "code", "limit?", "cursor?"],
+    category: "execution",
+    sideEffects: "local-process-or-remote-run",
+    stable: true,
+    inputSchema: objectSchema({
+      email: { type: "string", format: "email" },
+      code: { type: "string", pattern: "^\\d{6}$" },
+      limit: { type: "integer", minimum: 1, maximum: 100 },
+      cursor: { type: "string", pattern: "^[A-Za-z0-9_-]{1,512}$" }
+    }, ["email", "code"]),
+    outputSchema: objectSchema({
+      organizationId: stringSchema("Current workspace identifier."),
+      members: arraySchema(objectSchema({
+        membershipId: stringSchema("Membership incarnation."),
+        userId: stringSchema("Account identifier."),
+        email: stringSchema("Member email."),
+        displayName: { oneOf: [{ type: "string" }, { type: "null" }] },
+        role: { type: "string", enum: ["owner", "admin", "member", "viewer"] },
+        createdAt: stringSchema("Exact server timestamp including microseconds.")
+      }, ["membershipId", "userId", "email", "displayName", "role", "createdAt"])),
+      nextCursor: { oneOf: [{ type: "string" }, { type: "null" }] }
+    }, ["organizationId", "members", "nextCursor"])
+  },
   {
     name: "list_api_keys",
     title: "List API Keys",
@@ -26577,90 +27450,6 @@ function clone2(value) {
   return JSON.parse(JSON.stringify(value));
 }
 
-// src/lib/discovery.ts
-var VENDOR_TERMS = [
-  "Google Gemini",
-  "OpenAI Sora",
-  "MiniMax Hailuo",
-  "Claude Code",
-  "Claude Vision",
-  "DALL-E 3",
-  "GPT-4o Mini",
-  "Cerebras",
-  "OpenRouter",
-  "Firecrawl",
-  "ElevenLabs",
-  "Anthropic",
-  "OpenAI",
-  "Minimax",
-  "MiniMax",
-  "Gemini",
-  "Claude",
-  "Whisper",
-  "Seedance",
-  "Lyria",
-  "Sora",
-  "Veo",
-  "Exa.ai",
-  "Exa",
-  "XAI",
-  "xAI"
-];
-var VENDOR_TAGS = new Set([
-  "anthropic",
-  "cerebras",
-  "claude",
-  "exa",
-  "firecrawl",
-  "gemini",
-  "google",
-  "minimax",
-  "openai",
-  "openrouter",
-  "seedance",
-  "whisper",
-  "xai"
-]);
-var vendorPattern = new RegExp(`\\b(${VENDOR_TERMS.map(escapeRegExp).join("|")})\\b`, "gi");
-function getCompactSkillDiscovery(skill) {
-  return {
-    name: skill.name,
-    category: skill.category,
-    description: sanitizePublicDiscoveryText(skill.description)
-  };
-}
-function getPublicSkillDiscovery(skill) {
-  return {
-    ...skill,
-    description: sanitizePublicDiscoveryText(skill.description),
-    tags: publicDiscoveryTags(skill.tags)
-  };
-}
-function publicDiscoveryTags(tags) {
-  return tags.filter((tag) => !VENDOR_TAGS.has(tag.toLowerCase()));
-}
-function sanitizePublicDiscoveryText(text) {
-  let sanitized = text.replace(vendorPattern, "hosted AI").replace(/\bLLM\b/g, "AI").replace(/\s{2,}/g, " ");
-  let previous;
-  do {
-    previous = sanitized;
-    sanitized = sanitized.replace(/\bhosted AI(?: providers)?\s*,\s*hosted AI(?: providers)?\b/gi, "hosted AI providers").replace(/\bhosted AI(?: providers)?\s*,?\s*and\s*hosted AI(?: providers)?\b/gi, "hosted AI providers").replace(/\bhosted AI(?: providers)?\s+or\s+hosted AI(?: providers)?\b/gi, "hosted AI providers").replace(/\bhosted AI providers\s+hosted AI\b/gi, "hosted AI providers").replace(/\bhosted AI providers\s+providers\b/gi, "hosted AI providers");
-  } while (sanitized !== previous);
-  return sanitized.trim();
-}
-function publicDiscoveryEnvVars(_skillName, envVars) {
-  return envVars;
-}
-function publicDiscoveryDependencies(_skillName, dependencies) {
-  return dependencies;
-}
-function publicDiscoveryDocumentation(_skill, documentation) {
-  return documentation;
-}
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
 // src/lib/tool-primitives.ts
 var TOOL_PRIMITIVE_SCHEMA_VERSION = 1;
 var TOOL_PRIMITIVES = [
@@ -27119,22 +27908,20 @@ function compactRemoteRun(run) {
 }
 
 // src/mcp/helpers.ts
+init_fleet_credentials();
+async function readSurface(body) {
+  try {
+    return await body();
+  } catch (error2) {
+    if (isSkillsFleetCredentialError(error2))
+      return mcpError("AUTH_REQUIRED", error2.message, ["skills auth login"]);
+    throw error2;
+  }
+}
 function stripNulls(obj) {
   return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== null && v !== undefined && !(Array.isArray(v) && v.length === 0)));
 }
 var searchCache = new Map;
-var CACHE_MAX = 100;
-function cacheGet(key) {
-  return searchCache.get(key);
-}
-function cacheSet(key, value) {
-  if (searchCache.size >= CACHE_MAX) {
-    const first = searchCache.keys().next().value;
-    if (first !== undefined)
-      searchCache.delete(first);
-  }
-  searchCache.set(key, value);
-}
 function cacheClear() {
   searchCache.clear();
 }
@@ -27174,9 +27961,10 @@ function registerDiscoveryTools(server) {
       limit: exports_external.number().optional(),
       offset: exports_external.number().optional()
     }
-  }, async ({ category, profile, detail, limit, offset }) => {
+  }, async ({ category, profile, detail, limit, offset }) => readSurface(async () => {
     const selectedProfile = profile || "basic";
-    const skills = category ? loadRegistryProfile(selectedProfile).filter((s) => s.category === category) : loadRegistryProfile(selectedProfile);
+    const registry2 = await getBrowseRegistry({ all: selectedProfile === "all" });
+    const skills = category ? registry2.filter((s) => s.category === category) : registry2;
     const mapped = detail ? skills.map(getPublicSkillDiscovery) : skills.map(getCompactSkillDiscovery);
     const page = paginate(mapped, {
       limit: parsePageLimit(limit, DEFAULT_MCP_LIMIT, { max: 100 }),
@@ -27192,7 +27980,7 @@ function registerDiscoveryTools(server) {
       nextArguments: page.hasMore ? { profile: selectedProfile, category, detail: Boolean(detail), limit: page.limit, offset: page.nextOffset } : null,
       detailHint: detail ? undefined : "Set detail:true for full public skill objects, or call get_skill_info for one skill."
     });
-  });
+  }));
   server.registerTool("list_pinned_skills", {
     title: "List Pinned Skills",
     description: "List skills pinned in the current project's .skills/project.json.",
@@ -27216,13 +28004,9 @@ function registerDiscoveryTools(server) {
       limit: exports_external.number().optional(),
       offset: exports_external.number().optional()
     }
-  }, async ({ query, profile, detail, limit, offset }) => {
+  }, async ({ query, profile, detail, limit, offset }) => readSurface(async () => {
     const selectedProfile = profile || "basic";
-    const cacheKey = `${selectedProfile}:${query}:${detail ?? false}`;
-    const cached2 = cacheGet(cacheKey);
-    const results = cached2 ? cached2 : searchSkills(query, loadRegistryProfile(selectedProfile));
-    if (!cached2)
-      cacheSet(cacheKey, results);
+    const results = searchSkills(query, await getBrowseRegistry({ all: selectedProfile === "all" }));
     const out = detail ? results.map(getPublicSkillDiscovery) : results.map(getCompactSkillDiscovery);
     const page = paginate(out, {
       limit: parsePageLimit(limit, DEFAULT_MCP_LIMIT, { max: 100 }),
@@ -27238,14 +28022,15 @@ function registerDiscoveryTools(server) {
       nextArguments: page.hasMore ? { query, profile: selectedProfile, detail: Boolean(detail), limit: page.limit, offset: page.nextOffset } : null,
       detailHint: detail ? undefined : "Set detail:true for full public skill objects, or call get_skill_info for one skill."
     });
-  });
+  }));
   server.registerTool("get_skill_info", {
     title: "Get Skill Info",
     description: "Get skill metadata, env vars, and dependencies.",
     inputSchema: {
       name: exports_external.string()
     }
-  }, async ({ name }) => {
+  }, async ({ name }) => readSurface(async () => {
+    await requireSkillsReadAccess();
     const skill = getSkill(name);
     if (!skill) {
       return mcpError("SKILL_NOT_FOUND", `Skill '${name}' not found`, findSimilarSkills(name));
@@ -27265,20 +28050,21 @@ function registerDiscoveryTools(server) {
     return {
       content: [{ type: "text", text: JSON.stringify(result) }]
     };
-  });
+  }));
   server.registerTool("get_skill_docs", {
     title: "Get Skill Docs",
     description: "Get skill documentation (SKILL.md > README.md > CLAUDE.md).",
     inputSchema: {
       name: exports_external.string()
     }
-  }, async ({ name }) => {
+  }, async ({ name }) => readSurface(async () => {
+    await requireSkillsReadAccess();
     const doc2 = getSkillBestDoc(name);
     if (!doc2) {
       return mcpError("NO_DOCS", `No documentation found for '${name}'`);
     }
     return { content: [{ type: "text", text: doc2 }] };
-  });
+  }));
   server.registerTool("list_tool_primitives", {
     title: "List Tool Primitives",
     description: "List primitive tools that skills depend on across CLI, MCP, API, and hosted worker execution.",
@@ -27324,25 +28110,74 @@ function registerDiscoveryTools(server) {
 }
 
 // src/mcp/operation-tools.ts
-import { existsSync as existsSync13, readdirSync as readdirSync8, statSync as statSync8 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync14, readdirSync as readdirSync8, statSync as statSync9 } from "fs";
+import { join as join15 } from "path";
+
+// src/lib/credential-state.ts
+init_auth_store();
+init_fleet_credentials();
+function describeCredentialState() {
+  let credentialsFile = null;
+  let mode = null;
+  try {
+    credentialsFile = getAuthFilePath();
+    const bits = credentialFileMode();
+    mode = bits === null ? null : `0${bits.toString(8).padStart(3, "0")}`;
+  } catch {}
+  try {
+    const fleet = resolveSkillsFleet();
+    if (fleet.mode === "hosted") {
+      return {
+        mode: "hosted",
+        apiUrl: fleet.apiOrigin,
+        apiUrlSource: fleet.apiUrlSource,
+        apiKeySource: fleet.apiKeySource,
+        apiKeyTier: fleet.apiKeyTier,
+        credentialsFile,
+        credentialsFileMode: mode,
+        error: null
+      };
+    }
+    return {
+      mode: "local",
+      apiUrl: null,
+      apiUrlSource: null,
+      apiKeySource: null,
+      apiKeyTier: null,
+      credentialsFile,
+      credentialsFileMode: mode,
+      error: null
+    };
+  } catch (error2) {
+    return {
+      mode: "misconfigured",
+      apiUrl: null,
+      apiUrlSource: null,
+      apiKeySource: null,
+      apiKeyTier: null,
+      credentialsFile,
+      credentialsFileMode: mode,
+      error: error2.message
+    };
+  }
+}
 
 // src/lib/run-state.ts
 import { createHash as createHash2, randomBytes } from "crypto";
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync10, readdirSync as readdirSync7, statSync as statSync7, writeFileSync as writeFileSync5 } from "fs";
-import { extname, join as join12, relative as relative2 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync6, readFileSync as readFileSync12, readdirSync as readdirSync7, statSync as statSync8, writeFileSync as writeFileSync6 } from "fs";
+import { extname, join as join14, relative as relative2 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now = new Date;
   const id = createRunId(now);
   const day = now.toISOString().slice(0, 10);
   const skillName = normalizeSkillName(params.skill);
   const root = getProjectStateDir(targetDir);
-  const runDir = join12(root, "runs", day, id);
-  const logsDir = join12(runDir, "logs");
-  const exportDir = join12(root, "exports", skillName, id);
-  mkdirSync5(logsDir, { recursive: true });
-  mkdirSync5(exportDir, { recursive: true });
-  mkdirSync5(join12(root, "tmp"), { recursive: true });
+  const runDir = join14(root, "runs", day, id);
+  const logsDir = join14(runDir, "logs");
+  const exportDir = join14(root, "exports", skillName, id);
+  mkdirSync6(logsDir, { recursive: true });
+  mkdirSync6(exportDir, { recursive: true });
+  mkdirSync6(join14(root, "tmp"), { recursive: true });
   const record3 = {
     id,
     skill: skillName,
@@ -27394,22 +28229,22 @@ function updateSkillRun(context, patch) {
   return context.record;
 }
 function writeRunLogs(context, stdout = "", stderr = "") {
-  writeFileSync5(join12(context.logsDir, "stdout.log"), stdout);
-  writeFileSync5(join12(context.logsDir, "stderr.log"), stderr);
+  writeFileSync6(join14(context.logsDir, "stdout.log"), stdout);
+  writeFileSync6(join14(context.logsDir, "stderr.log"), stderr);
 }
 function appendRunEvent(context, event, data = {}) {
   const line = JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + `
 `;
-  const path = join12(context.runDir, "events.ndjson");
-  const previous = existsSync12(path) ? readFileSync10(path, "utf-8") : "";
-  writeFileSync5(path, previous + line);
+  const path = join14(context.runDir, "events.ndjson");
+  const previous = existsSync13(path) ? readFileSync12(path, "utf-8") : "";
+  writeFileSync6(path, previous + line);
 }
 function findSkillRun(runId, targetDir = process.cwd()) {
-  const runsRoot = join12(getProjectStateDir(targetDir), "runs");
-  if (!existsSync12(runsRoot))
+  const runsRoot = join14(getProjectStateDir(targetDir), "runs");
+  if (!existsSync13(runsRoot))
     return null;
   for (const day of readdirSync7(runsRoot)) {
-    const record3 = readRunRecord(join12(runsRoot, day, runId));
+    const record3 = readRunRecord(join14(runsRoot, day, runId));
     if (record3)
       return record3;
   }
@@ -27426,20 +28261,20 @@ function skillRunEnv(context) {
   };
 }
 function writeRunRecord(context) {
-  writeFileSync5(join12(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
+  writeFileSync6(join14(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
 `);
 }
 function writeArtifactsManifest(context, artifacts) {
-  writeFileSync5(join12(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
+  writeFileSync6(join14(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
 `);
 }
 function collectRunArtifacts(context) {
-  if (!existsSync12(context.exportDir))
+  if (!existsSync13(context.exportDir))
     return [];
   const artifacts = [];
   for (const path of walkFiles(context.exportDir)) {
-    const stat = statSync7(path);
-    const bytes = readFileSync10(path);
+    const stat = statSync8(path);
+    const bytes = readFileSync12(path);
     artifacts.push({
       path: toProjectRelative(context.targetDir, path),
       mime: mimeForPath(path),
@@ -27450,11 +28285,11 @@ function collectRunArtifacts(context) {
   return artifacts.sort((a, b) => a.path.localeCompare(b.path));
 }
 function readRunRecord(runDir) {
-  const path = join12(runDir, "run.json");
-  if (!existsSync12(path))
+  const path = join14(runDir, "run.json");
+  if (!existsSync13(path))
     return null;
   try {
-    return JSON.parse(readFileSync10(path, "utf-8"));
+    return JSON.parse(readFileSync12(path, "utf-8"));
   } catch {
     return null;
   }
@@ -27462,8 +28297,8 @@ function readRunRecord(runDir) {
 function walkFiles(dir) {
   const files = [];
   for (const entry of readdirSync7(dir)) {
-    const full = join12(dir, entry);
-    if (statSync7(full).isDirectory())
+    const full = join14(dir, entry);
+    if (statSync8(full).isDirectory())
       files.push(...walkFiles(full));
     else
       files.push(full);
@@ -27536,17 +28371,20 @@ async function resolveConfiguredRunRouting(skill, env = process.env) {
   try {
     connection = await resolveSkillsConnection(env);
   } catch (error2) {
-    const isMissingCredential = (error2 instanceof SkillsFleetCredentialError || error2?.name === "SkillsFleetCredentialError") && error2.code === "MISSING_API_CREDENTIAL";
+    const isMissingCredential = isSkillsFleetCredentialError2(error2) && error2.code === "MISSING_API_CREDENTIAL";
     if (!isMissingCredential)
       throw error2;
     return {
       route: "error",
       code: "REMOTE_REQUIRES_CREDENTIAL",
-      error: `${skill.name} is a server-owned skill. ${error2.message}`
+      error: skill.serverOwned ? `${skill.name} is a server-owned skill. ${error2.message}` : `${skill.name} cannot run: ${error2.message}`
     };
   }
   return resolveRunRouting(skill, connection?.apiKey, connection?.apiOrigin);
 }
+function isSkillsFleetCredentialError2(error2) {
+  return typeof error2 === "object" && error2 !== null && error2.name === "SkillsFleetCredentialError";
+}
 
 // src/mcp/operation-tools.ts
 function registerOperationTools(server) {
@@ -27709,39 +28547,42 @@ function registerOperationTools(server) {
   server.registerTool("list_categories", {
     title: "List Categories",
     description: "List all 17 skill categories with skill counts."
-  }, async () => {
-    const cats = CATEGORIES.map((category) => ({
+  }, async () => readSurface(async () => {
+    const registry2 = await getBrowseRegistry({ all: true });
+    const extras = Array.from(new Set(registry2.map((skill) => skill.category))).filter((category) => !CATEGORIES.includes(category)).sort();
+    const cats = [...CATEGORIES, ...extras].map((category) => ({
       name: category,
-      count: getSkillsByCategory(category).length
+      count: registry2.filter((skill) => skill.category === category).length
     }));
     return { content: [{ type: "text", text: JSON.stringify(cats, null, 2) }] };
-  });
+  }));
   server.registerTool("list_tags", {
     title: "List Tags",
     description: "List all unique skill tags with occurrence counts."
-  }, async () => {
+  }, async () => readSurface(async () => {
     const tagCounts = new Map;
-    for (const skill of loadRegistry()) {
+    for (const skill of await getBrowseRegistry({ all: true })) {
       for (const tag of skill.tags) {
         tagCounts.set(tag, (tagCounts.get(tag) ?? 0) + 1);
       }
     }
     const sorted = Array.from(tagCounts.entries()).sort(([a], [b]) => a.localeCompare(b)).map(([name, count]) => ({ name, count }));
     return { content: [{ type: "text", text: JSON.stringify(sorted, null, 2) }] };
-  });
+  }));
   server.registerTool("get_requirements", {
     title: "Get Requirements",
     description: "Get env vars, system deps, and npm dependencies for a skill.",
     inputSchema: {
       name: exports_external.string()
     }
-  }, async ({ name }) => {
+  }, async ({ name }) => readSurface(async () => {
+    await requireSkillsReadAccess();
     const reqs = getSkillRequirements(name);
     if (!reqs) {
       return mcpError("SKILL_NOT_FOUND", `Skill '${name}' not found`, findSimilarSkills(name));
     }
     return { content: [{ type: "text", text: JSON.stringify(reqs, null, 2) }] };
-  });
+  }));
   server.registerTool("run_skill", {
     title: "Run Skill",
     description: "Run a skill by name with optional arguments.",
@@ -27783,20 +28624,16 @@ function registerOperationTools(server) {
     } catch (error2) {
       return mcpError("INVALID_INPUT_FILES", error2.message);
     }
+    if (routing.route === "error") {
+      const suggestions = routing.code === "REMOTE_REQUIRES_ORIGIN" ? ["skills setup --api-url <url>", "skills auth login"] : ["skills auth login"];
+      return mcpError(routing.code, routing.error, suggestions);
+    }
     const runContext = createSkillRun({
       skill: skillName,
       args: runArgs,
       remote: routing.route === "remote",
       ...routing.route === "remote" ? { remoteApiOrigin: routing.apiOrigin } : {}
     });
-    if (routing.route === "error") {
-      const error2 = routing.error;
-      writeRunLogs(runContext, "", error2 + `
-`);
-      const run = completeSkillRun(runContext, { status: "failed", error: error2 });
-      const suggestions = routing.code === "REMOTE_REQUIRES_ORIGIN" ? ["skills setup --api-url <url>", "skills auth login"] : ["skills auth login"];
-      return mcpError(routing.code, `${error2}. Local run metadata: ${run.paths.runDir}/run.json`, suggestions);
-    }
     if (routing.route === "remote") {
       try {
         const { RemoteSkillsClient: RemoteSkillsClient2 } = await Promise.resolve().then(() => (init_remote_client(), exports_remote_client));
@@ -27953,21 +28790,22 @@ function registerOperationTools(server) {
   });
   server.registerTool("whoami", {
     title: "Skills Whoami",
-    description: "Show setup summary: version, pinned skills, agent configs, cwd."
+    description: "Show setup summary: version, pinned skills, agent configs, cwd, and the credential/transport SOURCES (never values)."
   }, async () => {
     const version2 = package_default.version;
     const cwd = process.cwd();
+    const credential = describeCredentialState();
     const installed = getInstalledSkills();
     const agents = [];
     for (const agent of AGENT_TARGETS) {
       const agentSkillsPath = getAgentSkillsDir(agent, "global");
-      const exists = existsSync13(agentSkillsPath);
+      const exists = existsSync14(agentSkillsPath);
       let skillCount = 0;
       if (exists) {
         try {
           skillCount = readdirSync8(agentSkillsPath).filter((f) => {
-            const full = join14(agentSkillsPath, f);
-            return !f.startsWith(".") && statSync8(full).isDirectory();
+            const full = join15(agentSkillsPath, f);
+            return !f.startsWith(".") && statSync9(full).isDirectory();
           }).length;
         } catch {}
       }
@@ -27980,7 +28818,8 @@ function registerOperationTools(server) {
       installed,
       agents,
       skillsDir,
-      cwd
+      cwd,
+      credential
     };
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
@@ -28012,29 +28851,17 @@ function compactRunToolPayload(payload, detailHint) {
 }
 
 // src/lib/feedback.ts
-import { appendFileSync, existsSync as existsSync14, mkdirSync as mkdirSync6 } from "fs";
-import { dirname as dirname5, join as join15 } from "path";
+import { appendFileSync, existsSync as existsSync15, mkdirSync as mkdirSync7 } from "fs";
+import { dirname as dirname6, join as join16 } from "path";
 import { Database } from "bun:sqlite";
-
-// src/lib/api-url.ts
-init_fleet_credentials();
-init_fleet_credentials();
-var API_URL_ENV_VAR = SKILLS_API_URL_ENV;
-var MISSING_API_URL_HINT = `run: skills auth login, or set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
-function resolveApiUrl(env = process.env, options = {}) {
-  const fleet = resolveSkillsFleet(env, options);
-  return fleet.mode === "hosted" ? fleet.apiOrigin : undefined;
-}
-
-// src/lib/feedback.ts
 function getFeedbackDbPath() {
-  return join15(getDataDir(), "skills.db");
+  return join16(getDataDir(), "skills.db");
 }
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
-  const dir = dirname5(dbPath);
-  if (!existsSync14(dir))
-    mkdirSync6(dir, { recursive: true });
+  const dir = dirname6(dbPath);
+  if (!existsSync15(dir))
+    mkdirSync7(dir, { recursive: true });
   const db = new Database(dbPath);
   db.exec("PRAGMA journal_mode = WAL");
   db.exec([
@@ -28060,10 +28887,10 @@ function saveFeedback(input) {
     throw new Error("Feedback message is required");
   const category = input.category ?? "general";
   if (isApiMode()) {
-    const path = join15(getDataDir(), "feedback.jsonl");
-    const dir = dirname5(path);
-    if (!existsSync14(dir))
-      mkdirSync6(dir, { recursive: true });
+    const path = join16(getDataDir(), "feedback.jsonl");
+    const dir = dirname6(path);
+    if (!existsSync15(dir))
+      mkdirSync7(dir, { recursive: true });
     appendFileSync(path, JSON.stringify({ message, category, email: input.email ?? null, agent: input.agent ?? null, version: input.version ?? null, createdAt: new Date().toISOString() }) + `
 `);
     return { saved: true, category, path };
@@ -28208,26 +29035,26 @@ function registerResourceMetaTools(server) {
 }
 
 // src/lib/scheduler.ts
-import { existsSync as existsSync15, readFileSync as readFileSync12, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync13, writeFileSync as writeFileSync7, mkdirSync as mkdirSync8 } from "fs";
+import { join as join17 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
-  return join16(targetDir, ".skills", "schedules.json");
+  return join17(targetDir, ".skills", "schedules.json");
 }
 function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  if (existsSync15(path)) {
+  if (existsSync16(path)) {
     try {
-      return JSON.parse(readFileSync12(path, "utf-8"));
+      return JSON.parse(readFileSync13(path, "utf-8"));
     } catch {}
   }
   return { version: 1, schedules: [] };
 }
 function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  const dir = join16(targetDir, ".skills");
-  if (!existsSync15(dir))
-    mkdirSync7(dir, { recursive: true });
-  writeFileSync6(path, JSON.stringify(data, null, 2));
+  const dir = join17(targetDir, ".skills");
+  if (!existsSync16(dir))
+    mkdirSync8(dir, { recursive: true });
+  writeFileSync7(path, JSON.stringify(data, null, 2));
 }
 function validateCronField(expr, min, max, label) {
   for (const part of expr.split(",")) {
@@ -28487,14 +29314,14 @@ function registerScheduleTools(server) {
 // src/lib/native-storage.ts
 import { createHash as createHash4, createHmac } from "crypto";
 import {
-  existsSync as existsSync16,
-  mkdirSync as mkdirSync8,
-  readFileSync as readFileSync13,
+  existsSync as existsSync17,
+  mkdirSync as mkdirSync9,
+  readFileSync as readFileSync14,
   readdirSync as readdirSync9,
-  statSync as statSync9,
-  writeFileSync as writeFileSync7
+  statSync as statSync10,
+  writeFileSync as writeFileSync8
 } from "fs";
-import { dirname as dirname6, join as join17, normalize as normalize3, relative as relative3, sep as sep2 } from "path";
+import { dirname as dirname7, join as join18, normalize as normalize3, relative as relative3, sep as sep2 } from "path";
 var SKILLS_STORAGE_TABLES = [
   "skills_sync_records",
   "skills_sync_cursors"
@@ -28570,7 +29397,7 @@ function getSkillsNativeStorageStatus(options = {}) {
     local: {
       dataDir: getDataDir(),
       projectStateDir: getProjectStateDir(targetDir),
-      feedbackDbPath: join17(getDataDir(), "skills.db")
+      feedbackDbPath: join18(getDataDir(), "skills.db")
     },
     remote: {
       databaseConfigured: Boolean(config2.databaseUrl),
@@ -28590,9 +29417,9 @@ function getStorageStatus(options = {}) {
 function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
   const projectStateDir = getProjectStateDir(targetDir);
   const files = [];
-  if (existsSync16(projectStateDir)) {
+  if (existsSync17(projectStateDir)) {
     for (const filePath of walkFiles2(projectStateDir)) {
-      const bytes = readFileSync13(filePath);
+      const bytes = readFileSync14(filePath);
       const relativePath = toPosix(relative3(targetDir, filePath));
       files.push({
         path: relativePath,
@@ -28674,8 +29501,8 @@ function parsePositiveInteger(value) {
 function walkFiles2(dir) {
   const files = [];
   for (const entry of readdirSync9(dir)) {
-    const full = join17(dir, entry);
-    const stats = statSync9(full);
+    const full = join18(dir, entry);
+    const stats = statSync10(full);
     if (stats.isDirectory())
       files.push(...walkFiles2(full));
     else
@@ -28730,6 +29557,10 @@ function registerStorageTools(server) {
 }
 
 // src/lib/remote-auth.ts
+init_remote_workspace_selection();
+init_remote_files();
+init_remote_workspace();
+init_remote_workspace();
 init_remote_client();
 init_fleet_credentials();
 var MAX_ERROR_DETAIL_LENGTH = 200;
@@ -28768,13 +29599,13 @@ async function requestAuthApi(instance, path, options) {
       apiUrl: safeUrl
     });
   }
-  const text = await res.text();
-  const body = text ? parseJsonBody(text) : {};
+  const text2 = await res.text();
+  const body = text2 ? parseJsonBody(text2) : {};
   if (!res.ok) {
-    const record3 = isRecord4(body) ? body : {};
-    const detail = typeof record3.detail === "string" ? record3.detail : undefined;
-    const error2 = typeof record3.error === "string" ? record3.error : undefined;
-    const code = typeof record3.code === "string" ? record3.code : undefined;
+    const record5 = isRecord5(body) ? body : {};
+    const detail = typeof record5.detail === "string" ? record5.detail : undefined;
+    const error2 = typeof record5.error === "string" ? record5.error : undefined;
+    const code = typeof record5.code === "string" ? record5.code : undefined;
     throw new HostedApiError(detail || error2 || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -28785,21 +29616,21 @@ async function requestAuthApi(instance, path, options) {
   }
   return body;
 }
-function parseJsonBody(text) {
+function parseJsonBody(text2) {
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { detail: condenseErrorBody(text) };
+    return { detail: condenseErrorBody(text2) };
   }
 }
-function condenseErrorBody(text) {
-  const stripped = /<[a-z!/]/i.test(text) ? text.replace(/<(script|style)[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]*>/g, " ") : text;
+function condenseErrorBody(text2) {
+  const stripped = /<[a-z!/]/i.test(text2) ? text2.replace(/<(script|style)[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]*>/g, " ") : text2;
   const collapsed = stripped.replace(/\s+/g, " ").trim();
   if (collapsed.length <= MAX_ERROR_DETAIL_LENGTH)
     return collapsed;
   return `${collapsed.slice(0, MAX_ERROR_DETAIL_LENGTH - 1).trimEnd()}\u2026`;
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 
@@ -28820,22 +29651,90 @@ class RemoteSkillsAuthClient {
   pollDevice(deviceCode) {
     return this.request("/api/auth/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) });
   }
-  async sessionClient(email2, code) {
+  async sessionClient(email2, code, context) {
+    if (context !== undefined) {
+      const target = workspaceContext(context), apiOrigin2 = this.apiOrigin;
+      const session = await this.switchWorkspace(email2, code, target);
+      return new RemoteSkillsClient(session.token, apiOrigin2);
+    }
+    const apiOrigin = this.apiOrigin;
     if (!email2.includes("@") || !/^\d{6}$/.test(code))
-      throw new Error("Fresh email and six-digit verification code are required to manage API keys");
+      throw new Error("Fresh email and six-digit verification code are required to manage this account");
     const login = await this.verifyCode(email2, code);
     if (!login || typeof login.token !== "string" || !login.token)
       throw new Error("The server did not return an authorized account session");
-    return new RemoteSkillsClient(login.token, this.apiOrigin);
+    return new RemoteSkillsClient(login.token, apiOrigin);
+  }
+  async listAccountWorkspaces(email2, code, expectedUserId) {
+    const login = await this.workspaceLogin(email2, code, expectedUserId);
+    const result = await new RemoteSkillsClient(login.token, login.apiOrigin).listAccountWorkspaces(login.userId);
+    return { userId: login.userId, ...result };
+  }
+  async switchWorkspace(email2, code, context) {
+    const target = workspaceContext(context);
+    const login = await this.workspaceLogin(email2, code, target.userId);
+    return new RemoteSkillsClient(login.token, login.apiOrigin).switchWorkspace(target);
+  }
+  async workspaceLogin(email2, code, expectedUserId) {
+    const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
+    const apiOrigin = this.apiOrigin;
+    if (typeof email2 !== "string" || !email2.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
+      throw new Error("Fresh email and six-digit verification code are required to manage this account");
+    let response;
+    try {
+      response = await fetch(`${apiOrigin}/api/auth/verify`, {
+        method: "POST",
+        redirect: "error",
+        credentials: "omit",
+        signal: AbortSignal.timeout(15000),
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email: email2, code })
+      });
+    } catch {
+      throw new HostedApiError("Unable to verify the Skills account.");
+    }
+    if (!response.ok) {
+      response.body?.cancel().catch(() => {});
+      throw new HostedApiError("Unable to verify the Skills account.", { status: response.status });
+    }
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, 64 * 1024)));
+    } catch {
+      throw new HostedApiError("The server returned an invalid account verification result.");
+    }
+    return { ...parseWorkspaceLogin(value, expected), apiOrigin };
   }
-  async createApiKey(email2, code, name, scopes) {
-    return (await this.sessionClient(email2, code)).createApiKey(name, scopes);
+  async createApiKey(email2, code, name, scopes, context) {
+    const capturedScopes = scopes === undefined ? undefined : [...scopes];
+    return (await this.sessionClient(email2, code, context)).createApiKey(name, capturedScopes);
   }
-  async listApiKeys(email2, code) {
-    return (await this.sessionClient(email2, code)).listApiKeys();
+  async listApiKeys(email2, code, context) {
+    return (await this.sessionClient(email2, code, context)).listApiKeys();
   }
-  async revokeApiKey(email2, code, keyId) {
-    return (await this.sessionClient(email2, code)).revokeApiKey(keyId);
+  async revokeApiKey(email2, code, keyId, context) {
+    return (await this.sessionClient(email2, code, context)).revokeApiKey(keyId);
+  }
+  async updateProfile(email2, code, input, context) {
+    const body = customerNamePatch(input, "displayName");
+    return (await this.sessionClient(email2, code, context)).updateProfile({ displayName: body.displayName });
+  }
+  async updateCurrentWorkspace(email2, code, input, context) {
+    const body = customerNamePatch(input, "name");
+    return (await this.sessionClient(email2, code, context)).updateCurrentWorkspace({ name: body.name });
+  }
+  async listWorkspaceMembers(email2, code, options = {}, context) {
+    workspaceMembersQuery(options);
+    const captured = { ...options };
+    return (await this.sessionClient(email2, code, context)).listWorkspaceMembers(captured);
+  }
+  async setWorkspaceMemberRole(email2, code, membershipId, input, context) {
+    const captured = workspaceMemberRoleInput(membershipId, input);
+    return (await this.sessionClient(email2, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
+  }
+  async removeWorkspaceMember(email2, code, membershipId, input, context) {
+    const captured = workspaceMemberRemovalInput(membershipId, input);
+    return (await this.sessionClient(email2, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
   }
   request(path, options) {
     if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
@@ -28844,10 +29743,147 @@ class RemoteSkillsAuthClient {
   }
 }
 
-// src/mcp/remote-customer-tools.ts
+// src/lib/workspace-profile.ts
+import { constants as constants2, closeSync as closeSync3, fstatSync as fstatSync3, lstatSync as lstatSync4, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync2, openSync as openSync3, readFileSync as readFileSync15, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync9 } from "fs";
 init_auth_store();
+init_fleet_credentials();
+init_instance_credentials();
+init_remote_client();
+init_remote_workspace_selection();
+
+class WorkspaceProfileError extends Error {
+}
+var fail = (message) => {
+  throw new WorkspaceProfileError(message);
+};
+function stat(path) {
+  try {
+    return lstatSync4(path);
+  } catch (error2) {
+    if (error2.code === "ENOENT")
+      return null;
+    throw error2;
+  }
+}
+function safeText(file) {
+  if (stat(file) === null)
+    return null;
+  const fd = openSync3(file, constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK);
+  try {
+    const s = fstatSync3(fd);
+    if (!s.isFile() || s.size > 65536 || ![256, 384].includes(s.mode & 4095) || process.getuid && s.uid !== process.getuid())
+      return fail("The selected profile must use bounded owner-only regular files.");
+    return readFileSync15(fd, "utf8");
+  } finally {
+    closeSync3(fd);
+  }
+}
+function checkIdentityMetadata(file, identity) {
+  const text2 = safeText(file);
+  if (text2 === null)
+    return;
+  let value;
+  try {
+    value = JSON.parse(text2);
+  } catch {
+    return fail("The profile identity metadata is invalid. Sign in again before managing this workspace.");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return fail("The profile identity metadata is invalid.");
+  for (const [key, expected] of Object.entries({ userId: identity.user.id, orgId: identity.organization.id })) {
+    if (value[key] !== undefined && value[key] !== expected)
+      return fail("The profile identity metadata does not match its authenticated key. Sign in again before managing this workspace.");
+  }
+}
+async function keyIdentity(key, origin) {
+  const value = await new RemoteSkillsClient(key, origin).getIdentity();
+  if (value.authMethod !== "api_key")
+    return fail("The selected credential is not a workspace API key.");
+  const user = value.user;
+  return parseWorkspaceIdentity(value, workspaceExpectedUserId(user?.id));
+}
+function prepareProfileWorkspace(action, source = process.env) {
+  const env = { ...source }, origin = getApiUrl(action, env), profile = selectedSkillsProfile(env);
+  const unchanged2 = captureSkillsCredentialFiles(skillsProfileCredentialFiles(env));
+  return { origin, async resolve() {
+    unchanged2();
+    if (!profile)
+      return { origin, context: undefined, unchanged: unchanged2 };
+    const connection = await resolveSkillsConnection(env);
+    if (!connection || connection.apiOrigin !== origin)
+      return fail("The selected profile has no usable credential for this server.");
+    const identity = await keyIdentity(connection.apiKey, origin);
+    checkIdentityMetadata(getIdentityFilePath(env), identity);
+    unchanged2();
+    const context = { userId: identity.user.id, membershipId: identity.user.membershipId };
+    return { origin, context, unchanged: unchanged2 };
+  } };
+}
+async function captureProfileWorkspace(action, source = process.env) {
+  return prepareProfileWorkspace(action, source).resolve();
+}
+
+// src/mcp/remote-customer-tools.ts
 init_remote_client();
 function registerRemoteCustomerTools(server) {
+  const memberRole = exports_external.enum(["owner", "admin", "member", "viewer"]);
+  const memberInput = {
+    membershipId: exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/),
+    expectedRole: memberRole,
+    email: exports_external.string().email(),
+    code: exports_external.string().regex(/^\d{6}$/)
+  };
+  server.registerTool("set_workspace_member_role", {
+    title: "Set Current Workspace Member Role",
+    description: "Change exactly this membership incarnation with its observed expectedRole and fresh verification. The server enforces owner/admin policy. No automatic refresh or retry; saved credentials stay unchanged.",
+    inputSchema: exports_external.object({ ...memberInput, role: memberRole }).strict()
+  }, async ({ membershipId, role: role2, expectedRole, email: email2, code }) => {
+    try {
+      return mcpJson(await freshAccount("Set workspace member role", (client, context) => client.setWorkspaceMemberRole(email2, code, membershipId, { role: role2, expectedRole }, context)));
+    } catch (error2) {
+      return memberError(error2);
+    }
+  });
+  server.registerTool("remove_workspace_member", {
+    title: "Remove Current Workspace Member",
+    description: "Remove exactly this membership incarnation using its observed expectedRole and fresh verification. Self-removal is unavailable. A retry cannot remove a later replacement membership; saved credentials stay unchanged.",
+    inputSchema: exports_external.object(memberInput).strict()
+  }, async ({ membershipId, expectedRole, email: email2, code }) => {
+    try {
+      return mcpJson(await freshAccount("Remove workspace member", (client, context) => client.removeWorkspaceMember(email2, code, membershipId, { expectedRole }, context)));
+    } catch (error2) {
+      return memberError(error2);
+    }
+  });
+  server.registerTool("list_workspace_members", {
+    title: "List Current Workspace Members",
+    description: "Read one roster page on the selected Skills server using fresh owner/admin email verification. Saved credentials are unchanged. This does not invite, change or switch members/workspaces.",
+    inputSchema: exports_external.object({
+      email: exports_external.string().email(),
+      code: exports_external.string().regex(/^\d{6}$/),
+      limit: exports_external.number().int().min(1).max(100).optional(),
+      cursor: exports_external.string().regex(/^[A-Za-z0-9_-]{1,512}$/).optional()
+    }).strict()
+  }, async ({ email: email2, code, limit, cursor: cursor2 }) => {
+    try {
+      return mcpJson(await freshAccount("List workspace members", (client, context) => client.listWorkspaceMembers(email2, code, { limit, cursor: cursor2 }, context)));
+    } catch {
+      return mcpError("WORKSPACE_MEMBERS_FAILED", "Unable to list workspace members. Check the selected server, owner/admin permissions, pagination and fresh verification code.");
+    }
+  });
+  for (const kind of ["profile", "workspace"]) {
+    server.registerTool(kind === "profile" ? "update_account_profile" : "update_workspace_name", {
+      title: kind === "profile" ? "Update Account Display Name" : "Update Workspace Name",
+      description: "Update only the name on the explicitly selected Skills server using fresh email OTP. Workspace changes require an owner/admin. Saved credentials are unchanged.",
+      inputSchema: exports_external.object({ name: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }).strict()
+    }, async ({ name, email: email2, code }) => {
+      try {
+        return mcpJson(await freshAccount("Update customer name", async (client, context) => kind === "profile" ? client.updateProfile(email2, code, { displayName: name }, context) : client.updateCurrentWorkspace(email2, code, { name }, context)));
+      } catch {
+        return mcpError("NAME_UPDATE_FAILED", "Unable to update the name. Check the selected server, name, permissions and fresh verification code.");
+      }
+    });
+  }
   for (const operation of REMOTE_CUSTOMER_OPERATIONS) {
     const inputSchema = {};
     if (operation.parameter)
@@ -28864,9 +29900,9 @@ function registerRemoteCustomerTools(server) {
     inputSchema: { email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }
   }, async ({ email: email2, code }) => {
     try {
-      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("List API keys")).listApiKeys(email2, code));
-    } catch (error2) {
-      return mcpError("KEY_LIST_FAILED", error2.message);
+      return mcpJson(await freshAccount("List API keys", (client, context) => client.listApiKeys(email2, code, context)));
+    } catch {
+      return mcpError("KEY_LIST_FAILED", "Unable to list API keys. Check the selected profile, server, account and fresh verification code.");
     }
   });
   server.registerTool("revoke_api_key", {
@@ -28875,9 +29911,9 @@ function registerRemoteCustomerTools(server) {
     inputSchema: { key_id: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }
   }, async ({ key_id, email: email2, code }) => {
     try {
-      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("Revoke API key")).revokeApiKey(email2, code, key_id));
-    } catch (error2) {
-      return mcpError("KEY_REVOKE_FAILED", error2.message);
+      return mcpJson(await freshAccount("Revoke API key", (client, context) => client.revokeApiKey(email2, code, key_id, context)));
+    } catch {
+      return mcpError("KEY_REVOKE_FAILED", "Unable to revoke this API key. Check the selected profile, key, account and fresh verification code.");
     }
   });
   server.registerTool("create_api_key", {
@@ -28885,10 +29921,11 @@ function registerRemoteCustomerTools(server) {
     description: "Create an API key using fresh email OTP reauthentication; returns its secret once. A stored API key cannot grant this authority.",
     inputSchema: { name: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/), scopes: exports_external.array(exports_external.string()).optional() }
   }, async ({ name, email: email2, code, scopes }) => {
+    const capturedScopes = scopes === undefined ? undefined : [...scopes];
     try {
-      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("Create API key")).createApiKey(email2, code, name, scopes));
-    } catch (error2) {
-      return mcpError("KEY_CREATION_FAILED", error2.message);
+      return mcpJson(await freshAccount("Create API key", (client, context) => client.createApiKey(email2, code, name, capturedScopes, context)));
+    } catch {
+      return mcpError("KEY_CREATION_FAILED", "API key creation could not be confirmed. Check the selected profile and workspace keys before retrying; a lost response may still have created a key.");
     }
   });
   server.registerTool("quote_skill", {
@@ -28906,6 +29943,9 @@ function registerRemoteCustomerTools(server) {
     return { ...metadata, base64: Buffer.from(bytes).toString("base64") };
   }));
 }
+function memberError(error2) {
+  return error2 instanceof RemoteWorkspaceMemberError ? mcpError(error2.code, error2.message) : mcpError("WORKSPACE_MEMBER_FAILED", "Unable to manage workspace member. Check the selected server and fresh verification, then refresh the roster before another action.");
+}
 async function callRemote(action) {
   try {
     const client = await createRemoteSkillsClient();
@@ -28913,9 +29953,17 @@ async function callRemote(action) {
       return mcpError("AUTH_REQUIRED", "Configure a Skills API and sign in with skills auth login");
     return mcpJson(await action(client));
   } catch (error2) {
+    if (error2 instanceof RemoteCapabilityUnavailableError) {
+      return { ...mcpJson({ code: error2.code, message: error2.message, status: error2.status }), isError: true };
+    }
     return mcpError("REMOTE_REQUEST_FAILED", error2 instanceof Error ? error2.message : "Skills server request failed");
   }
 }
+async function freshAccount(action, operation) {
+  const target = await captureProfileWorkspace(action);
+  target.unchanged();
+  return operation(new RemoteSkillsAuthClient(target.origin), target.context);
+}
 
 // src/mcp/server.ts
 function buildServer() {
@@ -30383,6 +31431,7 @@ async function startSkillsMcpHttpServer(options = {}) {
 }
 
 // src/mcp/index.ts
+init_fleet_credentials();
 var args = process.argv.slice(2);
 function printHelp() {
   console.log(`Usage: skills-mcp [options]
@@ -30404,7 +31453,18 @@ if (args.includes("--version") || args.includes("-V")) {
   console.log(package_default.version);
   process.exit(0);
 }
+function assertSkillsMcpConfigured(env = process.env) {
+  try {
+    resolveSkillsFleet(env);
+  } catch (error2) {
+    if (!isSkillsFleetCredentialError(error2))
+      throw error2;
+    console.error(error2.message);
+    process.exit(1);
+  }
+}
 async function startMcpStdio() {
+  assertSkillsMcpConfigured();
   const server2 = buildServer();
   await server2.connect(new StdioServerTransport);
 }
@@ -30413,6 +31473,7 @@ async function main() {
     await startMcpStdio();
     return;
   }
+  assertSkillsMcpConfigured();
   const port = parseMcpHttpPort(args);
   await startSkillsMcpHttpServer({ port, hostname: "127.0.0.1" });
 }
@@ -30424,5 +31485,6 @@ if (import.meta.main) {
 }
 export {
   startMcpStdio,
-  buildServer
+  buildServer,
+  assertSkillsMcpConfigured
 };