@hasna/skills 0.4.0 → 0.5.1

package/dist/index.js

@@ -111,12 +111,7 @@ import { homedir } from "os";
 import { join, resolve } from "path";
 import { homedir as pathsResolverHomedir } from "os";
 import { join as pathsResolverJoin } from "path";
-var PATHS_RESOLVER_KIND_ENV = {
-  config: "HASNA_CONFIG_HOME",
-  data: "HASNA_DATA_HOME",
-  state: "HASNA_STATE_HOME",
-  cache: "HASNA_CACHE_HOME"
-};
+var PATHS_RESOLVER_DATA_ENV = "HASNA_DATA_HOME";
 var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 function pathsResolverAssertApp(app) {
   if (typeof app !== "string" || app.length === 0) {
@@ -126,48 +121,19 @@ function pathsResolverAssertApp(app) {
     throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
   }
 }
-function pathsResolverAssertKind(kind) {
-  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
-    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
-  }
-}
-function pathsResolverBaseDir(kind, options) {
-  pathsResolverAssertKind(kind);
+function pathsResolverDataBaseDir(options) {
   const env = options.env ?? process.env;
-  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  const override = env[PATHS_RESOLVER_DATA_ENV];
   if (typeof override === "string" && override.length > 0)
     return override;
   const home = options.home ?? pathsResolverHomedir();
   const platform = options.platform ?? process.platform;
-  if (platform === "darwin") {
-    switch (kind) {
-      case "config":
-      case "data":
-        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
-      case "cache":
-        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
-      case "state":
-        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
-    }
-  }
-  switch (kind) {
-    case "config":
-      return pathsResolverJoin(home, ".config", "hasna");
-    case "data":
-      return pathsResolverJoin(home, ".local", "share", "hasna");
-    case "state":
-      return pathsResolverJoin(home, ".local", "state", "hasna");
-    case "cache":
-      return pathsResolverJoin(home, ".cache", "hasna");
-  }
-}
-function pathsResolverResolve(kind, options) {
-  pathsResolverAssertApp(options.app);
-  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
-  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+  return platform === "darwin" ? pathsResolverJoin(home, "Library", "Application Support", "Hasna") : pathsResolverJoin(home, ".local", "share", "hasna");
 }
 function dataDir(options) {
-  return pathsResolverResolve("data", options);
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverDataBaseDir(options), appSegment);
 }
 var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
 var HASNA_SKILLS_HOME_ENV = "HASNA_SKILLS_HOME";
@@ -1838,14 +1804,27 @@ function normalizePortableSkillName(name) {
   }
   return normalized;
 }
+function normalizeNewPortableSkillName(name) {
+  normalizePortableSkillName(name);
+  const normalized = name.trim().replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (!normalized)
+    throw new Error(`Invalid skill name '${name}'. Include letters or numbers.`);
+  return normalized;
+}
 function readPortableSkillManifest(skillPath, fallbackName = basename(skillPath)) {
+  return readManifest(skillPath, fallbackName, normalizePortableSkillName);
+}
+function readPortableSkillManifestForImport(skillPath) {
+  return readManifest(skillPath, basename(skillPath), normalizeNewPortableSkillName);
+}
+function readManifest(skillPath, fallbackName, normalizeName) {
   const skillJsonPath = join6(skillPath, "skill.json");
   const skillMdPath = join6(skillPath, "SKILL.md");
   const pkgPath = join6(skillPath, "package.json");
   const jsonManifest = existsSync6(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
   const frontmatter = existsSync6(skillMdPath) ? parseSkillFrontmatter(readFileSync5(skillMdPath, "utf-8")) ?? undefined : undefined;
   const pkg = existsSync6(pkgPath) ? readJsonObject(pkgPath) : undefined;
-  const name = normalizePortableSkillName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
+  const name = normalizeName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
   const description = stringField(jsonManifest, "description") ?? frontmatter?.description ?? stringValue(pkg?.description) ?? `${name} skill`;
   const version = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
   const kind = parseSkillKind(stringField(jsonManifest, "kind") ?? frontmatter?.kind);
@@ -2093,10 +2072,45 @@ function ensureInstructionSkillFiles(skillPath, manifest) {
   };
   if (!existsSync6(join6(skillPath, "SKILL.md"))) {
     writeFileSync2(join6(skillPath, "SKILL.md"), renderSkillMd(next));
+  } else {
+    const path = join6(skillPath, "SKILL.md");
+    const content = readFileSync5(path, "utf8");
+    const declaredName = parseSkillFrontmatter(content)?.name;
+    if (declaredName && declaredName !== next.name) {
+      writeFileSync2(path, renameInstructionFrontmatter(content, next.name));
+    }
+  }
+  const packagePath = join6(skillPath, "package.json");
+  if (existsSync6(packagePath)) {
+    const pkg = readJsonObject(packagePath);
+    if (typeof pkg.name === "string" && pkg.name !== next.name) {
+      writeFileSync2(packagePath, `${JSON.stringify({ ...pkg, name: next.name }, null, 2)}
+`);
+    }
   }
   writeSkillJsonWithHash(skillPath, next);
   return readPortableSkillManifest(skillPath, next.name);
 }
+function renameInstructionFrontmatter(content, name) {
+  const frontmatter = content.match(/^---\r?\n([\s\S]*?)\r?\n---(?=\r?\n|$)/);
+  const names = frontmatter?.[1]?.match(/^[ \t]*name[ \t]*:[^\r\n]*/gm) ?? [];
+  const declaration = names.length === 1 ? names[0].match(/^(name[ \t]*:[ \t]*)(.*?)([ \t]*)$/) : null;
+  const scalar = declaration?.[2] ?? "";
+  let simple = /^[a-zA-Z0-9_.@/ -]+$/.test(scalar);
+  if (scalar.startsWith('"')) {
+    try {
+      simple = typeof JSON.parse(scalar) === "string";
+    } catch {
+      simple = false;
+    }
+  } else if (scalar.startsWith("'"))
+    simple = /^'[^'\r\n]*'$/.test(scalar);
+  if (!frontmatter || !declaration || !simple) {
+    throw new Error("Cannot rename instruction SKILL.md: use one unambiguous top-level name scalar in frontmatter.");
+  }
+  const renamed = frontmatter[0].replace(/^name[ \t]*:[^\r\n]*/m, () => `${declaration[1]}${name}${declaration[3]}`);
+  return renamed + content.slice(frontmatter[0].length);
+}
 function copySkillDirectory(source, destination) {
   const resolvedSource = lstatSync2(source).isSymbolicLink() ? realpathSync(source) : source;
   mkdirSync2(destination, { recursive: true });
@@ -2504,7 +2518,7 @@ function isOfficialSkillName(name) {
   return OFFICIAL_SKILL_NAMES.has(name);
 }
 function scaffoldPortableSkill(name, options = {}) {
-  const skillName = normalizePortableSkillName(name);
+  const skillName = normalizeNewPortableSkillName(name);
   const root = getPortableSkillsRoot(options);
   const skillPath = join7(root, skillName);
   if (existsSync7(skillPath)) {
@@ -2574,9 +2588,9 @@ function portPortableSkill(sourcePath, options = {}) {
   if (!existsSync7(absoluteSource) || !statSync6(absoluteSource).isDirectory()) {
     throw new Error(`Skill source directory not found: ${sourcePath}`);
   }
-  const inferred = readPortableSkillManifest(absoluteSource, basename2(absoluteSource));
+  const inferred = readPortableSkillManifestForImport(absoluteSource);
   const explicitName = options.name != null;
-  const skillName = normalizePortableSkillName(options.name ?? inferred.name);
+  const skillName = normalizeNewPortableSkillName(options.name ?? inferred.name);
   if (isOfficialSkillName(skillName) && !options.allowShadow) {
     const sourceSlug = safeNormalizeName(basename2(absoluteSource));
     const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename2(absoluteSource)}')` : ""} matches a bundled official skill.`;
@@ -3191,6 +3205,7 @@ import { fileURLToPath } from "url";
 import {
   cpSync as cpSync3,
   existsSync as existsSync9,
+  lstatSync as lstatSync3,
   mkdirSync as mkdirSync4,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync7,
@@ -3212,6 +3227,20 @@ var SYNC_AGENTS = ["claude", "codewith", "codex", "opencode", "cursor"];
 var SKILLS_SOURCE_ENV = "SKILLS_SOURCE";
 var SYNC_MARKER_FILE = ".hasna-skills.json";
 var SYNC_MARKER_MANAGED_BY = "@hasna/skills";
+function isSkillsOwnershipMarker(marker) {
+  return typeof marker === "object" && marker !== null && Object.hasOwn(marker, "managedBy") && marker.managedBy === SYNC_MARKER_MANAGED_BY;
+}
+function hasSkillsOwnershipMarker(dir) {
+  const path = join9(dir, SYNC_MARKER_FILE);
+  try {
+    if (!lstatSync3(path).isFile())
+      return false;
+    const marker = JSON.parse(readFileSync7(path, "utf8"));
+    return isSkillsOwnershipMarker(marker);
+  } catch {
+    return false;
+  }
+}
 function isSyncAgent(value) {
   return SYNC_AGENTS.includes(value);
 }
@@ -3395,7 +3424,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
   const skillMdPath = join9(dir, "SKILL.md");
   const markerPath = join9(dir, SYNC_MARKER_FILE);
   const dirExists = existsSync9(dir);
-  const managed = existsSync9(markerPath);
+  const managed = hasSkillsOwnershipMarker(dir);
   const hasSkillMd = existsSync9(skillMdPath);
   if (dirExists && !managed && !hasSkillMd) {
     return {
@@ -3408,7 +3437,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
     return {
       action: "skip",
       path: skillMdPath,
-      reason: "an unmanaged SKILL.md already exists here (hand-authored); pass --force to overwrite"
+      reason: existsSync9(markerPath) ? "an unmanaged SKILL.md already exists here (invalid or foreign ownership marker); pass --force to overwrite" : "an unmanaged SKILL.md already exists here (hand-authored); pass --force to overwrite"
     };
   }
   if (dirExists && managed && hasSkillMd && !options.force && isPointerSkillMd(skillMd)) {
@@ -3485,7 +3514,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
 }
 function removeManagedAgentSkill(skill, agent, homeDir = homedir2()) {
   const dir = join9(agentGlobalSkillsDir(agent, homeDir), skill);
-  if (!existsSync9(join9(dir, SYNC_MARKER_FILE)))
+  if (!hasSkillsOwnershipMarker(dir))
     return false;
   rmSync2(dir, { recursive: true, force: true });
   return true;
@@ -3861,7 +3890,7 @@ function removeSkillForAgent(name, options) {
   const canonicalName = getCanonicalSkillName(name);
   const scope = options.scope ?? "global";
   const dir = getAgentSkillPath(canonicalName, options.agent, scope, options.projectDir);
-  if (!existsSync11(join11(dir, SYNC_MARKER_FILE)))
+  if (!hasSkillsOwnershipMarker(dir))
     return false;
   rmSync3(dir, { recursive: true, force: true });
   return true;
@@ -4288,7 +4317,7 @@ async function runSkill(name, args, options = {}) {
   }
   const proc = Bun.spawn(["bun", "run", entryPath, ...args], {
     cwd: skillPath,
-    stdout: options.stdio === "pipe" ? "pipe" : "inherit",
+    stdout: options.stdio === "pipe" ? "pipe" : options.stdio === "stderr" ? 2 : "inherit",
     stderr: options.stdio === "pipe" ? "pipe" : "inherit",
     stdin: "inherit",
     env: { ...process.env, ...options.env }
@@ -9106,7 +9135,7 @@ var AUTHORITY_OVERRIDE_HEADERS = new Set([
 ]);
 
 // src/lib/instance-credentials.ts
-import { closeSync as closeSync2, constants, fstatSync as fstatSync2, lstatSync as lstatSync3, openSync as openSync2, readSync } from "fs";
+import { closeSync as closeSync2, constants, fstatSync as fstatSync2, lstatSync as lstatSync4, openSync as openSync2, readSync } from "fs";
 var SKILLS_BOUND_API_URL = "HASNA_SKILLS_BOUND_API_URL";
 function selectedSkillsProfile(env, explicit) {
   const selected = explicit ?? env.HASNA_PROFILE;
@@ -9122,7 +9151,7 @@ function skillsProfileCredentialFiles(env, explicit) {
 }
 function fileIdentity(file) {
   try {
-    return lstatSync3(file);
+    return lstatSync4(file);
   } catch (error) {
     if (["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
       return null;
@@ -9193,6 +9222,28 @@ function readSkillsInstanceMetadata(file) {
   return { apiUrl: urls[0], binding: values.get(SKILLS_BOUND_API_URL) };
 }
 
+// src/lib/local-opt-in.ts
+var SKILLS_LOCAL_OPT_IN_ENV_KEYS = ["HASNA_SKILLS_LOCAL", "SKILLS_LOCAL"];
+function isSkillsLocalOptIn(env = process.env) {
+  return SKILLS_LOCAL_OPT_IN_ENV_KEYS.some((key) => (env[key] ?? "").trim() !== "");
+}
+function skillsAuthorityEnvKeys() {
+  const keys = clientTransportEnvKeys("skills");
+  return [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey("skills"),
+    credentialPointerEnvKey("skills"),
+    CREDENTIAL_PROFILE_ENV_KEY
+  ];
+}
+function hasSkillsEnvAuthorityIntent(env = process.env) {
+  return skillsAuthorityEnvKeys().some((key) => (env[key] ?? "").trim() !== "");
+}
+function selectsSkillsLocalMode(env = process.env) {
+  return !hasSkillsEnvAuthorityIntent(env) && isSkillsLocalOptIn(env);
+}
+
 // src/lib/fleet-credentials.ts
 var SKILLS_APP = "skills";
 var ENV_KEYS = clientTransportEnvKeys(SKILLS_APP);
@@ -9212,6 +9263,9 @@ class SkillsFleetCredentialError extends Error {
 function isCredentialResolutionError(error) {
   return error instanceof CredentialResolutionError || typeof error === "object" && error !== null && error.name === "CredentialResolutionError";
 }
+function isSkillsFleetCredentialError(error) {
+  return error instanceof SkillsFleetCredentialError || typeof error === "object" && error !== null && error.name === "SkillsFleetCredentialError";
+}
 function asSkillsFleetCredentialError(error) {
   if (!isCredentialResolutionError(error))
     return null;
@@ -9278,7 +9332,7 @@ function noticeLocalSkillsMode(write = (line) => console.error(line)) {
   if (localNoticePrinted)
     return;
   localNoticePrinted = true;
-  write(`skills: local mode \u2014 no ${SKILLS_API_KEY_ENV} and no ${SKILLS_API_URL_ENV} resolved, ` + `so this runs on this machine against the bundled corpus. ` + `Sign in with: skills auth login`);
+  write(`skills: local mode (${SKILLS_LOCAL_OPT_IN_ENV_KEYS[0]}=1) \u2014 running on this machine against the bundled corpus.`);
 }
 function resolveSkillsFleet(env = process.env, options = {}) {
   try {
@@ -9315,13 +9369,16 @@ function snapshotSkillsOptions(env, options) {
   } } };
 }
 function resolveSkillsFleetOrThrow(env, options) {
+  if (selectsSkillsLocalMode(env))
+    return { mode: "local", apiOrigin: null, apiKey: null };
   const assertFilesUnchanged = captureSkillsCredentialFiles(skillsProfileCredentialFiles(env, options.credentials?.profile));
   const configured = configuredSkillsApiUrl(env, options.credentials?.keychain, options.credentials?.profile);
   const credential = resolveCredential(SKILLS_APP, env, options.credentials);
   if (!credential) {
-    if (!configured)
-      return { mode: "local", apiOrigin: null, apiKey: null };
-    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in hasna.credentials.skills.api-key, ${skillsCredentialFiles(env).join(" or ") || "no credentials file"}, and ${SKILLS_API_KEY_ENV}. Sign in with: skills auth login`);
+    if (!configured) {
+      throw new SkillsFleetCredentialError(`No API key resolved and no Skills API URL is configured \u2014 failing closed ` + `(local mode is opt-in only: set ${SKILLS_LOCAL_OPT_IN_ENV_KEYS[0]}=1 to run on this machine). ` + `Looked in ${credentialLocations(env)}. Sign in with: skills auth login`);
+    }
+    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in ${credentialLocations(env)}. Sign in with: skills auth login`);
   }
   const apiOrigin = normalizeSkillsApiOrigin(configured?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP));
   toV1BaseUrl(apiOrigin);
@@ -9343,6 +9400,10 @@ function resolveSkillsFleetOrThrow(env, options) {
   }
   return { ...base, apiKey: credential.apiKey, apiKeyPointer: null };
 }
+function credentialLocations(env) {
+  const files = skillsCredentialFiles(env).join(" or ") || "no credentials file (HOME is unset)";
+  return `hasna.credentials.${SKILLS_APP}.api-key (macOS Keychain, account HASNA_STATION or the host name), ${files}, and ${SKILLS_API_KEY_ENV}`;
+}
 function assertCredentialInstance(credential, apiOrigin, env, options) {
   let bound;
   if (credential.tier === "disk" || credential.tier === "profile") {
@@ -9396,7 +9457,7 @@ async function skillsCredentialOrReason(env = process.env, options = {}) {
     const connection = await resolveSkillsConnection(env, options);
     return connection ? { apiKey: connection.apiKey, apiOrigin: connection.apiOrigin, reason: null } : { apiKey: null, apiOrigin: null, reason: null };
   } catch (error) {
-    if (error instanceof SkillsFleetCredentialError || error?.name === "SkillsFleetCredentialError") {
+    if (isSkillsFleetCredentialError(error)) {
       return { apiKey: null, apiOrigin: null, reason: error.message };
     }
     throw error;
@@ -9408,7 +9469,14 @@ function resolveSkillsApiOrigin(env = process.env, options = {}) {
     toV1BaseUrl(configured.value);
     return { origin: normalizeSkillsApiOrigin(configured.value), source: configured.source };
   }
-  const fleet = resolveSkillsFleet(env, options);
+  let fleet;
+  try {
+    fleet = resolveSkillsFleet(env, options);
+  } catch (error) {
+    if (isSkillsFleetCredentialError(error))
+      return null;
+    throw error;
+  }
   return fleet.mode === "hosted" ? { origin: fleet.apiOrigin, source: fleet.apiUrlSource } : null;
 }
 function requireSkillsApiOrigin(action = "This command", env = process.env, options = {}) {
@@ -9640,12 +9708,21 @@ function parseRemoteContract(schema, payload, message) {
 }
 async function remoteRequestHeaders(options) {
   const headers = new Headers({ Accept: "application/json" });
-  const token = options.authToken !== undefined ? options.authToken : await resolveSkillsApiKey();
+  const token = options.authToken !== undefined ? options.authToken : await ambientTokenFor(options.apiUrl);
   const trimmed = token?.trim();
   if (trimmed)
     headers.set("Authorization", `Bearer ${trimmed}`);
   return headers;
 }
+async function ambientTokenFor(callerApiUrl) {
+  const connection = await resolveSkillsConnection();
+  if (!connection)
+    return null;
+  if (callerApiUrl !== undefined && normalizeSkillsApiOrigin(callerApiUrl) !== connection.apiOrigin) {
+    throw new SkillsFleetCredentialError(`The Skills credential resolved for ${connection.apiOrigin} is never sent to a caller-supplied apiUrl ` + `(${normalizeSkillsApiOrigin(callerApiUrl)}). Pass an explicit authToken for that instance, or authToken: null ` + `for an unauthenticated read; no credential was sent.`, "INSTANCE_CREDENTIAL_MISMATCH");
+  }
+  return connection.apiKey;
+}
 async function fetchRemoteJson(url, options) {
   const fetchImpl = options.fetchImpl || fetch;
   const headers = await remoteRequestHeaders(options);
@@ -10177,6 +10254,202 @@ function primitiveHaystack(primitive) {
 function clone(value) {
   return value === undefined ? undefined : JSON.parse(JSON.stringify(value));
 }
+// src/lib/remote-workspace-selection.ts
+var record = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var uuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
+var text = (v, max = 1024) => typeof v === "string" && !!v.trim() && v.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v);
+var role = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v);
+var invalidWorkspaceResult = "The server returned an invalid workspace selection result.";
+
+class WorkspaceContextInputError extends Error {
+  constructor() {
+    super("Provide the observed user ID and exact lowercase membership ID.");
+    this.name = "WorkspaceContextInputError";
+  }
+}
+
+class WorkspaceIdentityMismatchError extends Error {
+  constructor() {
+    super("The verified account does not match the requested workspace context.");
+    this.name = "WorkspaceIdentityMismatchError";
+  }
+}
+function workspaceExpectedUserId(value) {
+  if (!uuid(value))
+    throw new WorkspaceContextInputError;
+  return value;
+}
+function workspaceContext(value) {
+  if (!record(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid(value.userId) || !uuid(value.membershipId))
+    throw new WorkspaceContextInputError;
+  return { userId: value.userId, membershipId: value.membershipId };
+}
+function invalid() {
+  throw new Error(invalidWorkspaceResult);
+}
+function organization(v) {
+  if (!record(v) || !uuid(v.id) || !text(v.slug) || !text(v.name))
+    return invalid();
+  return { id: v.id, slug: v.slug, name: v.name };
+}
+function parseAccountWorkspaces(value) {
+  if (!record(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
+    return invalid();
+  const workspaces = value.workspaces.map((v) => {
+    if (!record(v) || !uuid(v.membershipId) || !role(v.role) || typeof v.current !== "boolean")
+      return invalid();
+    return { membershipId: v.membershipId, organization: organization(v.organization), role: v.role, current: v.current };
+  });
+  if (workspaces.filter((w) => w.current).length !== 1 || new Set(workspaces.map((w) => w.membershipId)).size !== workspaces.length || new Set(workspaces.map((w) => w.organization.id)).size !== workspaces.length)
+    return invalid();
+  return { workspaces };
+}
+function parseWorkspaceIdentity(value, expectedUserId) {
+  if (!record(value))
+    return invalid();
+  const user = value.user;
+  if (!record(user) || !uuid(user.id) || !uuid(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role(user.role))
+    return invalid();
+  if (user.id !== expectedUserId)
+    throw new WorkspaceIdentityMismatchError;
+  return { user: { id: user.id, membershipId: user.membershipId, email: user.email, displayName: user.displayName, role: user.role }, organization: organization(value.organization) };
+}
+function sessionToken(value) {
+  if (typeof value !== "string" || !value || value.length > 8192 || /[^\x21-\x7e]/.test(value) || value.startsWith("sk_"))
+    return invalid();
+  return value;
+}
+function parseWorkspaceSession(value, expected) {
+  const identity = parseWorkspaceIdentity(value, expected.userId);
+  if (identity.user.membershipId !== expected.membershipId)
+    throw new WorkspaceIdentityMismatchError;
+  return { token: sessionToken(value.token), ...identity };
+}
+function parseWorkspaceLogin(value, expectedUserId) {
+  const user = record(value) && value.user;
+  if (!record(value) || !record(user) || !uuid(user.id))
+    return invalid();
+  if (expectedUserId !== undefined && user.id !== expectedUserId)
+    throw new WorkspaceIdentityMismatchError;
+  return { token: sessionToken(value.token), userId: user.id };
+}
+var workspaceSelectionFailures = {
+  INVALID_WORKSPACE_SELECTION: [400, "Provide only the exact membership ID from your workspace list."],
+  SESSION_EXPIRED: [401, "Sign in again before selecting a workspace."],
+  ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+  INTERACTIVE_SESSION_REQUIRED: [403, "Interactive sign-in is required to select a workspace."],
+  WORKSPACE_UNAVAILABLE: [404, "Workspace is unavailable. Refresh your workspace list."],
+  WORKSPACE_BUSY: [503, "Workspace is busy. Refresh before retrying."]
+};
+function workspaceSelectionFailure(value, status) {
+  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
+    return null;
+  const code = value.code;
+  return workspaceSelectionFailures[code][0] === status ? code : null;
+}
+
+// src/lib/remote-workspace.ts
+var record2 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+var cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value);
+var uuid2 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value);
+function workspaceMembersQuery(options = {}) {
+  if (!record2(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+    throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
+  const query = new URLSearchParams;
+  if (options.limit !== undefined)
+    query.set("limit", String(options.limit));
+  if (options.cursor !== undefined)
+    query.set("cursor", options.cursor);
+  return query.size ? `?${query}` : "";
+}
+function timestamp(value) {
+  if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}Z$/.test(value))
+    return false;
+  const time = Date.parse(value);
+  return Number.isFinite(time) && new Date(time).toISOString().slice(0, 23) === value.slice(0, 23);
+}
+function parseMember(row, fail) {
+  if (!record2(row) || !uuid2(row.membershipId) || !uuid2(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp(row.createdAt))
+    return fail();
+  return {
+    membershipId: row.membershipId,
+    userId: row.userId,
+    email: row.email,
+    displayName: row.displayName,
+    role: row.role,
+    createdAt: row.createdAt
+  };
+}
+var isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value);
+
+class WorkspaceMemberInputError extends Error {
+  constructor() {
+    super("Use an unchanged lowercase membership ID and the exact role and expected-role parameters from the roster.");
+    this.name = "WorkspaceMemberInputError";
+  }
+}
+function mutationInput(membershipId, input, roleChange) {
+  if (typeof membershipId !== "string" || !uuid2(membershipId) || membershipId !== membershipId.toLowerCase() || !record2(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+    throw new WorkspaceMemberInputError;
+  const expectedRole = input.expectedRole, role2 = roleChange ? input.role : undefined;
+  if (!isRole(expectedRole) || roleChange && !isRole(role2))
+    throw new WorkspaceMemberInputError;
+  return { membershipId, role: role2, expectedRole };
+}
+function workspaceMemberRoleInput(membershipId, input) {
+  const value = mutationInput(membershipId, input, true);
+  return { membershipId: value.membershipId, body: { role: value.role, expectedRole: value.expectedRole } };
+}
+function workspaceMemberRemovalInput(membershipId, input) {
+  const value = mutationInput(membershipId, input, false);
+  return { membershipId: value.membershipId, body: { expectedRole: value.expectedRole } };
+}
+var invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.";
+function parseWorkspaceMemberRoleResult(value, membershipId, role2) {
+  const fail = () => {
+    throw new Error(invalidMemberResult);
+  };
+  if (!record2(value) || !uuid2(value.organizationId) || typeof value.changed !== "boolean")
+    return fail();
+  const member = parseMember(value.member, fail);
+  if (member.membershipId !== membershipId || member.role !== role2)
+    return fail();
+  return { organizationId: value.organizationId, member, changed: value.changed };
+}
+function parseWorkspaceMemberRemovalResult(value, membershipId) {
+  if (!record2(value) || !uuid2(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+    throw new Error(invalidMemberResult);
+  return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
+}
+var workspaceMemberFailures = {
+  INVALID_REQUEST: [400, "Provide the exact membership role parameters."],
+  ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+  INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required."],
+  WORKSPACE_ADMIN_REQUIRED: [403, "A current workspace owner or admin is required."],
+  MEMBERSHIP_ACTION_FORBIDDEN: [403, "Your current workspace role cannot perform this membership action."],
+  MEMBERSHIP_NOT_FOUND: [404, "Membership was not found in the current workspace."],
+  SELF_REMOVAL_UNAVAILABLE: [409, "Leaving your own workspace is not available through member removal."],
+  MEMBERSHIP_ROLE_CHANGED: [409, "The member role changed. Refresh the roster before another action."],
+  LAST_OWNER_REQUIRED: [409, "The workspace must retain at least one active owner."],
+  MEMBERSHIP_BUSY: [503, "Membership is busy. Refresh the roster before another action."]
+};
+function workspaceMemberFailure(value, status) {
+  if (!record2(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+    return null;
+  const code = value.code;
+  return workspaceMemberFailures[code][0] === status ? code : null;
+}
+function parseWorkspaceMembersPage(value) {
+  const fail = () => {
+    throw new Error("The server returned an invalid workspace roster.");
+  };
+  if (!record2(value) || !uuid2(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+    return fail();
+  const members = value.members.map((row) => parseMember(row, fail));
+  if (new Set(members.map((row) => row.membershipId)).size !== members.length)
+    return fail();
+  return { organizationId: value.organizationId, members, nextCursor: value.nextCursor };
+}
 // src/lib/auth-store.ts
 function getApiUrl(action, env = process.env, options = {}) {
   return requireSkillsApiOrigin(action, env, options);
@@ -10185,44 +10458,44 @@ function getApiUrl(action, env = process.env, options = {}) {
 // src/lib/remote-run-contract.ts
 var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
 function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
-  const record = isRecord3(payload) ? payload : {};
+  const record3 = isRecord3(payload) ? payload : {};
   return {
     contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
-    ...pickString(record, "id"),
-    skill: pickStringValue(record, "skill") ?? fallbackSkill,
-    ...pickString(record, "requestedSlug"),
-    ...pickString(record, "status"),
-    ...pickNumber(record, "exitCode"),
-    ...pickString(record, "correlationId"),
-    ...pickString(record, "createdAt"),
-    ...pickString(record, "startedAt"),
-    ...pickString(record, "completedAt"),
-    ...pickNumber(record, "durationMs"),
-    ...pickString(record, "outputType"),
-    ...hasOwn(record, "outputPreview") ? { outputPreview: record.outputPreview } : {},
-    ...pickString(record, "errorCode"),
-    ...pickString(record, "errorMessage"),
-    ...pickString(record, "error"),
-    ...pickString(record, "code"),
-    ...hasOwn(record, "details") ? { details: record.details } : {}
+    ...pickString(record3, "id"),
+    skill: pickStringValue(record3, "skill") ?? fallbackSkill,
+    ...pickString(record3, "requestedSlug"),
+    ...pickString(record3, "status"),
+    ...pickNumber(record3, "exitCode"),
+    ...pickString(record3, "correlationId"),
+    ...pickString(record3, "createdAt"),
+    ...pickString(record3, "startedAt"),
+    ...pickString(record3, "completedAt"),
+    ...pickNumber(record3, "durationMs"),
+    ...pickString(record3, "outputType"),
+    ...hasOwn(record3, "outputPreview") ? { outputPreview: record3.outputPreview } : {},
+    ...pickString(record3, "errorCode"),
+    ...pickString(record3, "errorMessage"),
+    ...pickString(record3, "error"),
+    ...pickString(record3, "code"),
+    ...hasOwn(record3, "details") ? { details: record3.details } : {}
   };
 }
 function isRecord3(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function hasOwn(record, key) {
-  return Object.prototype.hasOwnProperty.call(record, key);
+function hasOwn(record3, key) {
+  return Object.prototype.hasOwnProperty.call(record3, key);
 }
-function pickString(record, key) {
-  const value = pickStringValue(record, key);
+function pickString(record3, key) {
+  const value = pickStringValue(record3, key);
   return value === undefined ? {} : { [key]: value };
 }
-function pickStringValue(record, key) {
-  const value = record[key];
+function pickStringValue(record3, key) {
+  const value = record3[key];
   return typeof value === "string" ? value : undefined;
 }
-function pickNumber(record, key) {
-  const value = record[key];
+function pickNumber(record3, key) {
+  const value = record3[key];
   return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
 }
 
@@ -10361,6 +10634,37 @@ async function readBoundedResponse(response, maximum) {
   return bytes;
 }
 
+// src/lib/remote-profile.ts
+function customerNamePatch(input, field) {
+  if (!isRecord4(input) || Object.keys(input).length !== 1 || !Object.hasOwn(input, field))
+    throw new Error("Provide only the requested name field.");
+  const value = input[field];
+  if (typeof value !== "string" || /[\p{Cc}\p{Cs}\u2028\u2029]/u.test(value) || !value.trim() || [...value.trim()].length > 100) {
+    throw new Error("Use a name of 1\u2013100 characters without control characters or newlines.");
+  }
+  return { [field]: value.trim() };
+}
+function isRecord4(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function string(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function parseUpdatedProfile(value) {
+  const user = isRecord4(value) && value.user;
+  if (!isRecord4(user) || !string(user.id) || !string(user.email) || !(user.displayName === null || typeof user.displayName === "string") || typeof user.role !== "string" || !["owner", "admin", "member", "viewer"].includes(user.role)) {
+    throw new Error("The server returned an invalid account profile.");
+  }
+  return { user: { id: user.id, email: user.email, displayName: user.displayName, role: user.role } };
+}
+function parseUpdatedWorkspace(value) {
+  const organization2 = isRecord4(value) && value.organization;
+  if (!isRecord4(organization2) || !string(organization2.id) || !string(organization2.slug) || !string(organization2.name)) {
+    throw new Error("The server returned an invalid workspace.");
+  }
+  return { organization: { id: organization2.id, slug: organization2.slug, name: organization2.name } };
+}
+
 // src/lib/remote-client.ts
 class RemoteRouteUnsupportedError extends Error {
   path;
@@ -10378,14 +10682,43 @@ class RemoteRouteUnsupportedError extends Error {
 class RemoteRequestError extends Error {
   path;
   status;
-  constructor(path, status, statusText) {
-    super(`Remote request to ${path} failed: HTTP ${status}${statusText ? ` ${statusText}` : ""}`);
+  constructor(path, status, _statusText) {
+    super(`Remote request to ${path} failed: HTTP ${status}`);
     this.path = path;
     this.status = status;
     this.name = "RemoteRequestError";
   }
 }
 
+class RemoteWorkspaceMemberError extends RemoteRequestError {
+  code;
+  constructor(path, code) {
+    super(path, workspaceMemberFailures[code][0]);
+    this.code = code;
+    this.name = "RemoteWorkspaceMemberError";
+    this.message = workspaceMemberFailures[code][1];
+  }
+}
+
+class RemoteWorkspaceSelectionError extends RemoteRequestError {
+  code;
+  constructor(path, code) {
+    super(path, workspaceSelectionFailures[code][0]);
+    this.code = code;
+    this.name = "RemoteWorkspaceSelectionError";
+    this.message = workspaceSelectionFailures[code][1];
+  }
+}
+
+class RemoteCapabilityUnavailableError extends RemoteRequestError {
+  code = "SUBSCRIPTION_CHECKOUT_UNAVAILABLE";
+  constructor() {
+    super("/api/v1/billing/checkout", 503);
+    this.name = "RemoteCapabilityUnavailableError";
+    this.message = "Subscription checkout is unavailable on the configured Skills server. " + "Use skills credits packs to view credit packs, or skills billing portal to manage an existing subscription.";
+  }
+}
+
 class RemoteSkillsClient {
   apiUrl;
   apiKey;
@@ -10398,6 +10731,7 @@ class RemoteSkillsClient {
     return fetch(`${this.apiUrl}${path}`, {
       ...options,
       redirect: "error",
+      credentials: "omit",
       signal: options?.signal ?? AbortSignal.timeout(15000),
       headers: {
         Authorization: `Bearer ${this.apiKey}`,
@@ -10413,9 +10747,14 @@ class RemoteSkillsClient {
       if (response.status === 404 && opts.domainNotFoundCodes?.length && await responseBodyCarriesCode(response, opts.domainNotFoundCodes)) {
         return response;
       }
+      response.body?.cancel().catch(() => {});
       throw new RemoteRouteUnsupportedError(routePath, response.status, this.apiUrl);
     }
     if (!response.ok) {
+      if (path === "/api/v1/billing/checkout" && options?.method === "POST" && response.status === 503 && await responseBodyCarriesCode(response, ["SUBSCRIPTION_CHECKOUT_UNAVAILABLE"])) {
+        throw new RemoteCapabilityUnavailableError;
+      }
+      response.body?.cancel().catch(() => {});
       throw new RemoteRequestError(routePath, response.status, response.statusText);
     }
     return response;
@@ -10499,6 +10838,117 @@ class RemoteSkillsClient {
   async getIdentity() {
     return (await this.requestNewRoute("/api/auth/whoami")).json();
   }
+  async listAccountWorkspaces(expectedUserId) {
+    const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    let identity;
+    if (expected !== undefined) {
+      const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+      if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+        throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces", "INTERACTIVE_SESSION_REQUIRED");
+      identity = parseWorkspaceIdentity(value, expected);
+    }
+    const result = parseAccountWorkspaces(await connection.requestWorkspaceSelection("/api/v1/account/workspaces"));
+    const current = result.workspaces.find((workspace) => workspace.current);
+    if (identity && (current.membershipId !== identity.user.membershipId || current.organization.id !== identity.organization.id))
+      throw new WorkspaceIdentityMismatchError;
+    return result;
+  }
+  async switchWorkspace(context) {
+    const target = workspaceContext(context);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+      throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces/switch", "INTERACTIVE_SESSION_REQUIRED");
+    parseWorkspaceIdentity(value, target.userId);
+    const selected = parseWorkspaceSession(await connection.requestWorkspaceSelection("/api/v1/account/workspaces/switch", {
+      method: "POST",
+      body: JSON.stringify({ membershipId: target.membershipId })
+    }), target);
+    const verified = await new RemoteSkillsClient(selected.token, connection.apiUrl).requestWorkspaceSelection("/api/auth/whoami");
+    if (!verified || typeof verified !== "object" || verified.authMethod !== "jwt")
+      throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces/switch", "INTERACTIVE_SESSION_REQUIRED");
+    const identity = parseWorkspaceIdentity(verified, target.userId);
+    if (identity.user.membershipId !== target.membershipId || identity.organization.id !== selected.organization.id)
+      throw new WorkspaceIdentityMismatchError;
+    return { token: selected.token, ...identity };
+  }
+  async requestWorkspaceSelection(path, options) {
+    let response;
+    try {
+      response = await this.request(path, { ...options, credentials: "omit" });
+    } catch {
+      throw new Error("Unable to reach the Skills workspace API.");
+    }
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 1024 * 1024 : 4096)));
+    } catch {
+      if (response.ok)
+        throw new Error(invalidWorkspaceResult);
+    }
+    if (!response.ok) {
+      const code = workspaceSelectionFailure(value, response.status);
+      if (code)
+        throw new RemoteWorkspaceSelectionError(path, code);
+      if (response.status === 404 || response.status === 405)
+        throw new RemoteRouteUnsupportedError(path, response.status, this.apiUrl);
+      throw new RemoteRequestError(path, response.status);
+    }
+    return value;
+  }
+  async updateProfile(input) {
+    const body = customerNamePatch(input, "displayName");
+    return parseUpdatedProfile(await (await this.requestNewRoute("/api/v1/account/profile", { method: "PATCH", body: JSON.stringify(body) })).json());
+  }
+  async updateCurrentWorkspace(input) {
+    const body = customerNamePatch(input, "name");
+    return parseUpdatedWorkspace(await (await this.requestNewRoute("/api/v1/workspaces/current", { method: "PATCH", body: JSON.stringify(body) })).json());
+  }
+  async listWorkspaceMembers(options = {}) {
+    const query = workspaceMembersQuery(options);
+    const requestedCursor = options.cursor;
+    const response = await this.requestNewRoute(`/api/v1/workspace/members${query}`);
+    let value;
+    try {
+      value = await response.json();
+    } catch {
+      throw new Error("The server returned an invalid workspace roster.");
+    }
+    const page = parseWorkspaceMembersPage(value);
+    if (requestedCursor !== undefined && page.nextCursor === requestedCursor)
+      throw new Error("The server returned an invalid workspace roster.");
+    return page;
+  }
+  async setWorkspaceMemberRole(membershipId, input) {
+    const captured = workspaceMemberRoleInput(membershipId, input);
+    const value = await this.requestWorkspaceMember(captured.membershipId, "PATCH", captured.body);
+    return parseWorkspaceMemberRoleResult(value, captured.membershipId, captured.body.role);
+  }
+  async removeWorkspaceMember(membershipId, input) {
+    const captured = workspaceMemberRemovalInput(membershipId, input);
+    return parseWorkspaceMemberRemovalResult(await this.requestWorkspaceMember(captured.membershipId, "DELETE", captured.body), captured.membershipId);
+  }
+  async requestWorkspaceMember(membershipId, method, body) {
+    const path = `/api/v1/workspace/members/${membershipId}`;
+    const response = await this.request(path, { method, body: JSON.stringify(body) });
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 64 * 1024 : 4096)));
+    } catch {
+      if (response.ok)
+        throw new Error(invalidMemberResult);
+    }
+    if (!response.ok) {
+      const code = workspaceMemberFailure(value, response.status);
+      if (code)
+        throw new RemoteWorkspaceMemberError(path, code);
+      if (response.status === 404 || response.status === 405)
+        throw new RemoteRouteUnsupportedError(path, response.status, this.apiUrl);
+      throw new RemoteRequestError(path, response.status);
+    }
+    return value;
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -10690,8 +11140,10 @@ class RemoteSkillsClient {
       return [];
     if (!response.ok)
       throw new Error(`versions request failed: ${response.status}`);
-    const body = await response.json();
-    return Array.isArray(body.versions) ? body.versions : [];
+    const body = await readSkillVersionPayload(response);
+    if (!isVersionRecord(body) || !Array.isArray(body.versions) || body.slug !== undefined && body.slug !== slug)
+      throw new Error(INVALID_SKILL_VERSION_RESPONSE);
+    return body.versions.map((entry) => normalizeSkillVersion(entry, slug));
   }
   async getSkillVersion(slug, version) {
     const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}`, undefined, { domainNotFoundCodes: ["SKILL_NOT_FOUND", "SKILL_VERSION_NOT_FOUND"] });
@@ -10699,7 +11151,7 @@ class RemoteSkillsClient {
       return null;
     if (!response.ok)
       throw new Error(`version request failed: ${response.status}`);
-    return await response.json();
+    return normalizeSkillVersion(await readSkillVersionPayload(response), slug, version);
   }
   async listPins() {
     const response = await this.requestNewRoute("/api/v1/pins");
@@ -10747,31 +11199,48 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record, field) {
-  if (record[field] === undefined)
+function requireOptionalString(record3, field) {
+  if (record3[field] === undefined)
     return;
-  if (typeof record[field] !== "string") {
+  if (typeof record3[field] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field} must be a string when present)`);
   }
-  return record[field];
+  return record3[field];
+}
+var INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
+function isVersionRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+async function readSkillVersionPayload(response) {
+  try {
+    return await response.json();
+  } catch {
+    throw new Error(INVALID_SKILL_VERSION_RESPONSE);
+  }
+}
+function normalizeSkillVersion(entry, slug, version) {
+  if (!isVersionRecord(entry) || typeof entry.slug !== "string" || !entry.slug.trim() || entry.slug !== slug || typeof entry.version !== "string" || !entry.version.trim() || version !== undefined && entry.version !== version || typeof entry.bundleSha256 !== "string" || !/^[a-f0-9]{64}$/i.test(entry.bundleSha256) || typeof entry.bundleByteSize !== "number" || !Number.isSafeInteger(entry.bundleByteSize) || entry.bundleByteSize < 0 || typeof entry.createdAt !== "string" || !entry.createdAt.trim() || entry.current !== undefined && typeof entry.current !== "boolean" || entry.storageKind !== undefined && typeof entry.storageKind !== "string" || entry.manifest !== undefined && !isVersionRecord(entry.manifest)) {
+    throw new Error(INVALID_SKILL_VERSION_RESPONSE);
+  }
+  return entry;
 }
 function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record = entry;
-  const slug = typeof record.slug === "string" && record.slug.trim() ? record.slug.trim() : undefined;
+  const record3 = entry;
+  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record.metadata !== undefined) {
-    if (!record.metadata || typeof record.metadata !== "object" || Array.isArray(record.metadata)) {
+  if (record3.metadata !== undefined) {
+    if (!record3.metadata || typeof record3.metadata !== "object" || Array.isArray(record3.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record.metadata;
+    metadata = record3.metadata;
   }
-  const pinnedAt = requireOptionalString(record, "pinnedAt");
+  const pinnedAt = requireOptionalString(record3, "pinnedAt");
   return {
     slug,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -10788,16 +11257,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record = entry;
-  const slug = typeof record.slug === "string" && record.slug.trim() ? record.slug.trim() : undefined;
+  const record3 = entry;
+  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug,
-    ...requireOptionalString(record, "name") !== undefined ? { name: requireOptionalString(record, "name") } : {},
-    ...requireOptionalString(record, "version") !== undefined ? { version: requireOptionalString(record, "version") } : {},
-    ...requireOptionalString(record, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record, "updatedAt") } : {}
+    ...requireOptionalString(record3, "name") !== undefined ? { name: requireOptionalString(record3, "name") } : {},
+    ...requireOptionalString(record3, "version") !== undefined ? { version: requireOptionalString(record3, "version") } : {},
+    ...requireOptionalString(record3, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record3, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -10807,26 +11276,55 @@ function normalizeSkillSummaryList(payload) {
   return payload.map(normalizeSkillSummary);
 }
 async function responseBodyCarriesCode(response, codes) {
+  const reader = response.body?.getReader();
+  if (!reader)
+    return false;
+  const maximum = 8 * 1024;
+  let deadline;
+  const expired = new Promise((_, reject) => {
+    deadline = setTimeout(() => reject(new Error("Error response read deadline exceeded")), 1000);
+  });
   try {
-    const payload = await response.clone().json();
-    if (!payload || typeof payload !== "object")
+    const chunks = [];
+    let size = 0;
+    while (true) {
+      const next = await Promise.race([reader.read(), expired]);
+      if (next.done)
+        break;
+      size += next.value.byteLength;
+      if (size > maximum)
+        return false;
+      chunks.push(next.value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    if (!payload || typeof payload !== "object" || Array.isArray(payload) || !Object.hasOwn(payload, "code"))
       return false;
     const code = payload.code;
     return typeof code === "string" && codes.includes(code);
   } catch {
     return false;
+  } finally {
+    clearTimeout(deadline);
+    reader.cancel().catch(() => {});
+    reader.releaseLock();
   }
 }
 function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record = payload;
-  if (!Array.isArray(record.skills)) {
+  const record3 = payload;
+  if (!Array.isArray(record3.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record.skills.map(normalizeSkillSummary);
-  const nextCursor = record.nextCursor === undefined || record.nextCursor === null ? null : record.nextCursor;
+  const skills = record3.skills.map(normalizeSkillSummary);
+  const nextCursor = record3.nextCursor === undefined || record3.nextCursor === null ? null : record3.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -11063,8 +11561,8 @@ function revisionIdOf(content) {
   });
   return createHash4("sha256").update(canonical).digest("hex");
 }
-function revisionIdOfRecord(record) {
-  return revisionIdOf(record);
+function revisionIdOfRecord(record3) {
+  return revisionIdOf(record3);
 }
 
 // src/lib/skill-bundle.ts
@@ -11590,7 +12088,7 @@ function provenRevision(meta, slug, bundle) {
 }
 function reconcileTombstone(slug, corpusOptions) {
   const target = join17(getPortableSkillsRoot(corpusOptions), slug);
-  if (!existsSync15(join17(target, PULL_MARKER_FILE))) {
+  if (!hasSkillsOwnershipMarker(target)) {
     return { name: slug, success: true, tombstoned: true, removed: false, leftInPlace: true };
   }
   rmSync4(target, { recursive: true, force: true });
@@ -11771,16 +12269,16 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
   }
   return { path: target, created };
 }
-function writePullMarker(dir, record) {
+function writePullMarker(dir, record3) {
   const marker = {
     managedBy: "@hasna/skills",
-    skill: record.skill,
-    source: record.source ?? "pull",
-    ...record.version ? { version: record.version } : {},
-    ...record.contentHash ? { contentHash: record.contentHash } : {},
-    ...record.sourceCommit ? { sourceCommit: record.sourceCommit } : {},
-    ...record.signature ? { signature: record.signature } : {},
-    ...record.revisionId ? { revisionId: record.revisionId } : {},
+    skill: record3.skill,
+    source: record3.source ?? "pull",
+    ...record3.version ? { version: record3.version } : {},
+    ...record3.contentHash ? { contentHash: record3.contentHash } : {},
+    ...record3.sourceCommit ? { sourceCommit: record3.sourceCommit } : {},
+    ...record3.signature ? { signature: record3.signature } : {},
+    ...record3.revisionId ? { revisionId: record3.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
   writeFileSync8(join17(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
@@ -11795,19 +12293,19 @@ async function safeMeta(client, slug) {
   }
   if (!raw || typeof raw !== "object")
     return null;
-  const record = raw;
-  const kind = record.kind === "instruction" || record.kind === "executable" ? record.kind : undefined;
-  const tags = Array.isArray(record.tags) ? record.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
+  const record3 = raw;
+  const kind = record3.kind === "instruction" || record3.kind === "executable" ? record3.kind : undefined;
+  const tags = Array.isArray(record3.tags) ? record3.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
   return {
-    ...str(record.displayName) ? { displayName: str(record.displayName) } : {},
-    ...str(record.description) ? { description: str(record.description) } : {},
-    ...str(record.category) ? { category: str(record.category) } : {},
+    ...str(record3.displayName) ? { displayName: str(record3.displayName) } : {},
+    ...str(record3.description) ? { description: str(record3.description) } : {},
+    ...str(record3.category) ? { category: str(record3.category) } : {},
     ...tags && tags.length ? { tags } : {},
-    ...str(record.version) ? { version: str(record.version) } : {},
+    ...str(record3.version) ? { version: str(record3.version) } : {},
     ...kind ? { kind } : {},
-    ...REVISION_ID_PATTERN.test(str(record.revisionId) ?? "") ? { revisionId: str(record.revisionId) } : {},
-    ...typeof record.skillMd === "string" && record.skillMd.length > 0 ? { skillMd: record.skillMd } : {},
-    ...str(record.publishedSource) ? { publishedSource: str(record.publishedSource) } : {}
+    ...REVISION_ID_PATTERN.test(str(record3.revisionId) ?? "") ? { revisionId: str(record3.revisionId) } : {},
+    ...typeof record3.skillMd === "string" && record3.skillMd.length > 0 ? { skillMd: record3.skillMd } : {},
+    ...str(record3.publishedSource) ? { publishedSource: str(record3.publishedSource) } : {}
   };
 }
 function pickCorpusOptions(options) {
@@ -11816,8 +12314,8 @@ function pickCorpusOptions(options) {
 function extractSlug(entry) {
   if (!entry || typeof entry !== "object")
     return;
-  const record = entry;
-  return str(record.slug) ?? str(record.name);
+  const record3 = entry;
+  return str(record3.slug) ?? str(record3.name);
 }
 function dedupe(values) {
   return [...new Set(values)];
@@ -11943,7 +12441,7 @@ import { dirname as dirname7, relative as relative4 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.4.0",
+  version: "0.5.1",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -11975,6 +12473,7 @@ var package_default = {
   files: [
     "dist/",
     "!dist/**/*.test.d.ts",
+    "!dist/**/*.fixture.d.ts",
     "!dist/test-preload.d.ts",
     "!dist/platform",
     "bin/",
@@ -12000,8 +12499,9 @@ var package_default = {
     migrate: "bun run ./src/server/migrate.ts",
     typecheck: "tsc --noEmit",
     "verify:release": "bun run scripts/release-guard.ts",
+    "verify:consumer-types": "bun run scripts/consumer-types.ts",
     prepare: "bun run build:js",
-    prepack: "bun run build && bun run verify:release",
+    prepack: "bun run build && bun run verify:release && bun run verify:consumer-types",
     prepublishOnly: "bun run typecheck && bun run test"
   },
   keywords: [
@@ -12023,6 +12523,7 @@ var package_default = {
   author: "Hasna",
   license: "Apache-2.0",
   devDependencies: {
+    "@hasna/contracts": "1.0.2",
     "@types/bun": "1.3.14",
     "@types/node": "25.2.3",
     "@types/react": "^18.2.0",
@@ -12034,8 +12535,7 @@ var package_default = {
   dependencies: {
     "@aws-sdk/client-ecs": "^3.1079.0",
     "@aws-sdk/client-s3": "^3.1079.0",
-    "@hasna/contracts": "1.0.1",
-    "@hasna/events": "0.1.16",
+    "@hasna/events": "0.1.18",
     "@modelcontextprotocol/sdk": "^1.26.0",
     chalk: "^5.3.0",
     commander: "^12.1.0",
@@ -12540,6 +13040,104 @@ var toolContracts = [
       dependencies: objectSchema({}, [], "Package dependencies.", true)
     })
   },
+  {
+    name: "update_account_profile",
+    title: "Update Account Display Name",
+    description: "Update your display name with fresh email verification on the configured server.",
+    params: ["name", "email", "code"],
+    category: "execution",
+    sideEffects: "local-process-or-remote-run",
+    stable: true,
+    inputSchema: objectSchema({ name: stringSchema("Display name, 1\u2013100 characters"), email: { type: "string", format: "email" }, code: { type: "string", pattern: "^\\d{6}$" } }, ["name", "email", "code"]),
+    outputSchema: objectSchema({ user: objectSchema({ id: stringSchema("Account identifier."), email: stringSchema("Account email."), displayName: stringSchema("Display name."), role: stringSchema("Current workspace role.") }, ["id", "email", "displayName", "role"]) }, ["user"])
+  },
+  {
+    name: "update_workspace_name",
+    title: "Update Workspace Name",
+    description: "Update the current workspace name as an owner/admin with fresh email verification.",
+    params: ["name", "email", "code"],
+    category: "execution",
+    sideEffects: "local-process-or-remote-run",
+    stable: true,
+    inputSchema: objectSchema({ name: stringSchema("Workspace name, 1\u2013100 characters"), email: { type: "string", format: "email" }, code: { type: "string", pattern: "^\\d{6}$" } }, ["name", "email", "code"]),
+    outputSchema: objectSchema({ organization: objectSchema({ id: stringSchema("Workspace identifier."), slug: stringSchema("Stable workspace slug."), name: stringSchema("Workspace name.") }, ["id", "slug", "name"]) }, ["organization"])
+  },
+  {
+    name: "set_workspace_member_role",
+    title: "Set Current Workspace Member Role",
+    description: "Set an exact membership incarnation's role with its observed expectedRole and fresh verification; no automatic retry.",
+    params: ["membershipId", "role", "expectedRole", "email", "code"],
+    category: "execution",
+    sideEffects: "local-process-or-remote-run",
+    stable: true,
+    inputSchema: objectSchema({
+      membershipId: { type: "string", pattern: "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$" },
+      role: { type: "string", enum: ["owner", "admin", "member", "viewer"] },
+      expectedRole: { type: "string", enum: ["owner", "admin", "member", "viewer"] },
+      email: { type: "string", format: "email" },
+      code: { type: "string", pattern: "^\\d{6}$" }
+    }, ["membershipId", "role", "expectedRole", "email", "code"]),
+    outputSchema: objectSchema({
+      organizationId: stringSchema("Current workspace identifier."),
+      changed: { type: "boolean" },
+      member: objectSchema({
+        membershipId: stringSchema("Membership incarnation."),
+        userId: stringSchema("Account identifier."),
+        email: stringSchema("Member email."),
+        displayName: { oneOf: [{ type: "string" }, { type: "null" }] },
+        role: { type: "string", enum: ["owner", "admin", "member", "viewer"] },
+        createdAt: stringSchema("Exact server timestamp including microseconds.")
+      }, ["membershipId", "userId", "email", "displayName", "role", "createdAt"])
+    }, ["organizationId", "member", "changed"])
+  },
+  {
+    name: "remove_workspace_member",
+    title: "Remove Current Workspace Member",
+    description: "Remove exactly this membership incarnation using its observed expectedRole and fresh verification; self-removal is unavailable.",
+    params: ["membershipId", "expectedRole", "email", "code"],
+    category: "execution",
+    sideEffects: "local-process-or-remote-run",
+    stable: true,
+    inputSchema: objectSchema({
+      membershipId: { type: "string", pattern: "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$" },
+      expectedRole: { type: "string", enum: ["owner", "admin", "member", "viewer"] },
+      email: { type: "string", format: "email" },
+      code: { type: "string", pattern: "^\\d{6}$" }
+    }, ["membershipId", "expectedRole", "email", "code"]),
+    outputSchema: objectSchema({
+      organizationId: stringSchema("Current workspace identifier."),
+      membershipId: stringSchema("Removed membership incarnation."),
+      removed: { type: "boolean", const: true },
+      alreadyRemoved: { type: "boolean" }
+    }, ["organizationId", "membershipId", "removed", "alreadyRemoved"])
+  },
+  {
+    name: "list_workspace_members",
+    title: "List Current Workspace Members",
+    description: "Read one current-workspace roster page with fresh owner/admin email verification; saved credentials stay unchanged.",
+    params: ["email", "code", "limit?", "cursor?"],
+    category: "execution",
+    sideEffects: "local-process-or-remote-run",
+    stable: true,
+    inputSchema: objectSchema({
+      email: { type: "string", format: "email" },
+      code: { type: "string", pattern: "^\\d{6}$" },
+      limit: { type: "integer", minimum: 1, maximum: 100 },
+      cursor: { type: "string", pattern: "^[A-Za-z0-9_-]{1,512}$" }
+    }, ["email", "code"]),
+    outputSchema: objectSchema({
+      organizationId: stringSchema("Current workspace identifier."),
+      members: arraySchema(objectSchema({
+        membershipId: stringSchema("Membership incarnation."),
+        userId: stringSchema("Account identifier."),
+        email: stringSchema("Member email."),
+        displayName: { oneOf: [{ type: "string" }, { type: "null" }] },
+        role: { type: "string", enum: ["owner", "admin", "member", "viewer"] },
+        createdAt: stringSchema("Exact server timestamp including microseconds.")
+      }, ["membershipId", "userId", "email", "displayName", "role", "createdAt"])),
+      nextCursor: { oneOf: [{ type: "string" }, { type: "null" }] }
+    }, ["organizationId", "members", "nextCursor"])
+  },
   {
     name: "list_api_keys",
     title: "List API Keys",
@@ -13354,7 +13952,7 @@ class SkillsPostgresSyncStore {
   }
   async upsertRecords(records) {
     let count = 0;
-    for (const record of records) {
+    for (const record3 of records) {
       await this.client.query([
         "INSERT INTO skills_sync_records",
         "(scope, kind, id, updated_at, deleted_at, source, payload)",
@@ -13365,13 +13963,13 @@ class SkillsPostgresSyncStore {
         "source = EXCLUDED.source,",
         "payload = EXCLUDED.payload"
       ].join(" "), [
-        record.scope,
-        record.kind,
-        record.id,
-        record.updatedAt,
-        record.deletedAt ?? null,
-        record.source ?? null,
-        JSON.stringify(record.payload)
+        record3.scope,
+        record3.kind,
+        record3.id,
+        record3.updatedAt,
+        record3.deletedAt ?? null,
+        record3.source ?? null,
+        JSON.stringify(record3.payload)
       ]);
       count += 1;
     }
@@ -14350,13 +14948,13 @@ async function requestAuthApi(instance, path, options) {
       apiUrl: safeUrl
     });
   }
-  const text = await res.text();
-  const body = text ? parseJsonBody(text) : {};
+  const text2 = await res.text();
+  const body = text2 ? parseJsonBody(text2) : {};
   if (!res.ok) {
-    const record = isRecord4(body) ? body : {};
-    const detail = typeof record.detail === "string" ? record.detail : undefined;
-    const error = typeof record.error === "string" ? record.error : undefined;
-    const code = typeof record.code === "string" ? record.code : undefined;
+    const record3 = isRecord5(body) ? body : {};
+    const detail = typeof record3.detail === "string" ? record3.detail : undefined;
+    const error = typeof record3.error === "string" ? record3.error : undefined;
+    const code = typeof record3.code === "string" ? record3.code : undefined;
     throw new HostedApiError(detail || error || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -14367,21 +14965,21 @@ async function requestAuthApi(instance, path, options) {
   }
   return body;
 }
-function parseJsonBody(text) {
+function parseJsonBody(text2) {
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { detail: condenseErrorBody(text) };
+    return { detail: condenseErrorBody(text2) };
   }
 }
-function condenseErrorBody(text) {
-  const stripped = /<[a-z!/]/i.test(text) ? text.replace(/<(script|style)[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]*>/g, " ") : text;
+function condenseErrorBody(text2) {
+  const stripped = /<[a-z!/]/i.test(text2) ? text2.replace(/<(script|style)[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]*>/g, " ") : text2;
   const collapsed = stripped.replace(/\s+/g, " ").trim();
   if (collapsed.length <= MAX_ERROR_DETAIL_LENGTH)
     return collapsed;
   return `${collapsed.slice(0, MAX_ERROR_DETAIL_LENGTH - 1).trimEnd()}\u2026`;
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 
@@ -14402,22 +15000,90 @@ class RemoteSkillsAuthClient {
   pollDevice(deviceCode) {
     return this.request("/api/auth/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) });
   }
-  async sessionClient(email, code) {
+  async sessionClient(email, code, context) {
+    if (context !== undefined) {
+      const target = workspaceContext(context), apiOrigin2 = this.apiOrigin;
+      const session = await this.switchWorkspace(email, code, target);
+      return new RemoteSkillsClient(session.token, apiOrigin2);
+    }
+    const apiOrigin = this.apiOrigin;
     if (!email.includes("@") || !/^\d{6}$/.test(code))
-      throw new Error("Fresh email and six-digit verification code are required to manage API keys");
+      throw new Error("Fresh email and six-digit verification code are required to manage this account");
     const login = await this.verifyCode(email, code);
     if (!login || typeof login.token !== "string" || !login.token)
       throw new Error("The server did not return an authorized account session");
-    return new RemoteSkillsClient(login.token, this.apiOrigin);
+    return new RemoteSkillsClient(login.token, apiOrigin);
+  }
+  async listAccountWorkspaces(email, code, expectedUserId) {
+    const login = await this.workspaceLogin(email, code, expectedUserId);
+    const result = await new RemoteSkillsClient(login.token, login.apiOrigin).listAccountWorkspaces(login.userId);
+    return { userId: login.userId, ...result };
+  }
+  async switchWorkspace(email, code, context) {
+    const target = workspaceContext(context);
+    const login = await this.workspaceLogin(email, code, target.userId);
+    return new RemoteSkillsClient(login.token, login.apiOrigin).switchWorkspace(target);
+  }
+  async workspaceLogin(email, code, expectedUserId) {
+    const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
+    const apiOrigin = this.apiOrigin;
+    if (typeof email !== "string" || !email.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
+      throw new Error("Fresh email and six-digit verification code are required to manage this account");
+    let response;
+    try {
+      response = await fetch(`${apiOrigin}/api/auth/verify`, {
+        method: "POST",
+        redirect: "error",
+        credentials: "omit",
+        signal: AbortSignal.timeout(15000),
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email, code })
+      });
+    } catch {
+      throw new HostedApiError("Unable to verify the Skills account.");
+    }
+    if (!response.ok) {
+      response.body?.cancel().catch(() => {});
+      throw new HostedApiError("Unable to verify the Skills account.", { status: response.status });
+    }
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, 64 * 1024)));
+    } catch {
+      throw new HostedApiError("The server returned an invalid account verification result.");
+    }
+    return { ...parseWorkspaceLogin(value, expected), apiOrigin };
+  }
+  async createApiKey(email, code, name, scopes, context) {
+    const capturedScopes = scopes === undefined ? undefined : [...scopes];
+    return (await this.sessionClient(email, code, context)).createApiKey(name, capturedScopes);
+  }
+  async listApiKeys(email, code, context) {
+    return (await this.sessionClient(email, code, context)).listApiKeys();
+  }
+  async revokeApiKey(email, code, keyId, context) {
+    return (await this.sessionClient(email, code, context)).revokeApiKey(keyId);
+  }
+  async updateProfile(email, code, input, context) {
+    const body = customerNamePatch(input, "displayName");
+    return (await this.sessionClient(email, code, context)).updateProfile({ displayName: body.displayName });
+  }
+  async updateCurrentWorkspace(email, code, input, context) {
+    const body = customerNamePatch(input, "name");
+    return (await this.sessionClient(email, code, context)).updateCurrentWorkspace({ name: body.name });
   }
-  async createApiKey(email, code, name, scopes) {
-    return (await this.sessionClient(email, code)).createApiKey(name, scopes);
+  async listWorkspaceMembers(email, code, options = {}, context) {
+    workspaceMembersQuery(options);
+    const captured = { ...options };
+    return (await this.sessionClient(email, code, context)).listWorkspaceMembers(captured);
   }
-  async listApiKeys(email, code) {
-    return (await this.sessionClient(email, code)).listApiKeys();
+  async setWorkspaceMemberRole(email, code, membershipId, input, context) {
+    const captured = workspaceMemberRoleInput(membershipId, input);
+    return (await this.sessionClient(email, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
   }
-  async revokeApiKey(email, code, keyId) {
-    return (await this.sessionClient(email, code)).revokeApiKey(keyId);
+  async removeWorkspaceMember(email, code, membershipId, input, context) {
+    const captured = workspaceMemberRemovalInput(membershipId, input);
+    return (await this.sessionClient(email, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
   }
   request(path, options) {
     if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
@@ -14461,6 +15127,7 @@ export {
   sha256File,
   setSkillDisabled,
   setScheduleEnabled,
+  selectsSkillsLocalMode,
   searchSkills,
   scaffoldPortableSkill,
   saveProjectConfig,
@@ -14521,6 +15188,7 @@ export {
   listPinnedSkills,
   listMcpToolContracts,
   isSyncAgent,
+  isSkillsLocalOptIn,
   isRegularFile,
   isPortableWithinSkill,
   isGatewayBackedSkill,
@@ -14605,6 +15273,8 @@ export {
   agentGlobalSkillsDir,
   addSchedule,
   adaptSkillMdForAgent,
+  WorkspaceIdentityMismatchError,
+  WorkspaceContextInputError,
   TOOL_PRIMITIVE_SCHEMA_VERSION,
   TOOL_PRIMITIVES,
   StationSnapshotError,
@@ -14628,6 +15298,7 @@ export {
   SKILLS_PROJECT_DIR,
   SKILLS_NATIVE_STORAGE_FALLBACK_ENV,
   SKILLS_NATIVE_STORAGE_ENV,
+  SKILLS_LOCAL_OPT_IN_ENV_KEYS,
   SKILLS_CLI_MCP_PARITY,
   SKILLS_APP,
   SKILLS_API_URL_ENV_KEYS,
@@ -14635,11 +15306,14 @@ export {
   SKILLS_API_KEY_ENV_KEYS,
   SKILLS_API_KEY_ENV,
   SKILLS,
+  RemoteWorkspaceSelectionError,
+  RemoteWorkspaceMemberError,
   RemoteSkillsClient,
   RemoteSkillsAuthClient,
   RemoteRouteUnsupportedError,
   RemoteRequestError,
   RemoteCreditApprovalError,
+  RemoteCapabilityUnavailableError,
   REMOTE_SKILL_RUN_CONTRACT_VERSION,
   REFUSED_SCANNER_FLAGGED,
   PullSkillError,