@hasna/skills 0.5.0 → 0.5.1

package/dist/lib/remote-auth.d.ts

@@ -1,3 +1,4 @@
+import { type RemoteWorkspaceContext, type RemoteWorkspaceSession, type RemoteAccountWorkspaceDiscovery } from "./remote-workspace-selection.js";
 import { type RemoteWorkspaceMembersOptions } from "./remote-workspace.js";
 import { type SetRemoteWorkspaceMemberRole, type RemoveRemoteWorkspaceMember } from "./remote-workspace.js";
 import { type UpdateRemoteProfile, type UpdateRemoteWorkspace } from "./remote-profile.js";
@@ -24,23 +25,28 @@ export declare class RemoteSkillsAuthClient {
     startDevice(): Promise<any>;
     pollDevice(deviceCode: string): Promise<any>;
     private sessionClient;
-    createApiKey(email: string, code: string, name: string, scopes?: string[]): Promise<{
+    /** Discover memberships with fresh sign-in. No key or session is saved. */
+    listAccountWorkspaces(email: string, code: string, expectedUserId?: string): Promise<RemoteAccountWorkspaceDiscovery>;
+    /** Contains a secret session token. Selection never creates or stores an API key. */
+    switchWorkspace(email: string, code: string, context: RemoteWorkspaceContext): Promise<RemoteWorkspaceSession>;
+    private workspaceLogin;
+    createApiKey(email: string, code: string, name: string, scopes?: string[], context?: RemoteWorkspaceContext): Promise<{
         [field: string]: unknown;
         key: string;
     }>;
-    listApiKeys(email: string, code: string): Promise<Record<string, unknown>[]>;
-    revokeApiKey(email: string, code: string, keyId: string): Promise<Record<string, unknown>>;
+    listApiKeys(email: string, code: string, context?: RemoteWorkspaceContext): Promise<Record<string, unknown>[]>;
+    revokeApiKey(email: string, code: string, keyId: string, context?: RemoteWorkspaceContext): Promise<Record<string, unknown>>;
     /** Reauthentication is ephemeral: it never replaces a saved key or profile. */
-    updateProfile(email: string, code: string, input: UpdateRemoteProfile): Promise<{
+    updateProfile(email: string, code: string, input: UpdateRemoteProfile, context?: RemoteWorkspaceContext): Promise<{
         user: import("./remote-profile.js").RemoteCustomerProfile;
     }>;
-    updateCurrentWorkspace(email: string, code: string, input: UpdateRemoteWorkspace): Promise<{
+    updateCurrentWorkspace(email: string, code: string, input: UpdateRemoteWorkspace, context?: RemoteWorkspaceContext): Promise<{
         organization: import("./remote-profile.js").RemoteCurrentWorkspace;
     }>;
-    /** Fresh owner/admin session; no saved credential or profile is replaced. */
-    listWorkspaceMembers(email: string, code: string, options?: RemoteWorkspaceMembersOptions): Promise<import("./remote-workspace.js").RemoteWorkspaceMembersPage>;
-    setWorkspaceMemberRole(email: string, code: string, membershipId: string, input: SetRemoteWorkspaceMemberRole): Promise<import("./remote-workspace.js").RemoteWorkspaceMemberRoleResult>;
-    removeWorkspaceMember(email: string, code: string, membershipId: string, input: RemoveRemoteWorkspaceMember): Promise<import("./remote-workspace.js").RemoteWorkspaceMemberRemovalResult>;
+    /** Fresh owner/admin session; explicit context survives default-workspace OTP selection. */
+    listWorkspaceMembers(email: string, code: string, options?: RemoteWorkspaceMembersOptions, context?: RemoteWorkspaceContext): Promise<import("./remote-workspace.js").RemoteWorkspaceMembersPage>;
+    setWorkspaceMemberRole(email: string, code: string, membershipId: string, input: SetRemoteWorkspaceMemberRole, context?: RemoteWorkspaceContext): Promise<import("./remote-workspace.js").RemoteWorkspaceMemberRoleResult>;
+    removeWorkspaceMember(email: string, code: string, membershipId: string, input: RemoveRemoteWorkspaceMember, context?: RemoteWorkspaceContext): Promise<import("./remote-workspace.js").RemoteWorkspaceMemberRemovalResult>;
     /** Common auth transport used by CLI login, preserving the selected instance through awaits. */
     request(path: string, options?: RequestInit): Promise<any>;
 }

package/dist/lib/remote-client.d.ts

@@ -1,3 +1,4 @@
+import { type RemoteWorkspaceContext, type RemoteAccountWorkspaces, type RemoteWorkspaceSession, type RemoteWorkspaceSelectionErrorCode } from "./remote-workspace-selection.js";
 import { type RemoteWorkspaceMembersOptions, type RemoteWorkspaceMembersPage } from "./remote-workspace.js";
 import { type RemoteWorkspaceMemberErrorCode, type SetRemoteWorkspaceMemberRole, type RemoveRemoteWorkspaceMember, type RemoteWorkspaceMemberRoleResult, type RemoteWorkspaceMemberRemovalResult } from "./remote-workspace.js";
 import { type RemoteSkillRunContract } from "./remote-run-contract.js";
@@ -27,6 +28,11 @@ export declare class RemoteWorkspaceMemberError extends RemoteRequestError {
     readonly code: RemoteWorkspaceMemberErrorCode;
     constructor(path: string, code: RemoteWorkspaceMemberErrorCode);
 }
+/** Fixed text for recognized workspace refusals; no reflected server error payload. */
+export declare class RemoteWorkspaceSelectionError extends RemoteRequestError {
+    readonly code: RemoteWorkspaceSelectionErrorCode;
+    constructor(path: string, code: RemoteWorkspaceSelectionErrorCode);
+}
 /** A recognized unavailable capability; all displayed text is client-owned. */
 export declare class RemoteCapabilityUnavailableError extends RemoteRequestError {
     readonly code: "SUBSCRIPTION_CHECKOUT_UNAVAILABLE";
@@ -119,6 +125,11 @@ export declare class RemoteSkillsClient {
     /** Quote first and fail closed when the caller has not approved the required credits. */
     submitQuotedRun(slug: string, input?: Record<string, unknown>, args?: string[], approval?: RemoteRunApproval): Promise<RemoteSkillRunContract>;
     getIdentity(): Promise<Record<string, unknown>>;
+    /** List memberships with the current interactive session; never writes credentials. */
+    listAccountWorkspaces(expectedUserId?: string): Promise<RemoteAccountWorkspaces>;
+    /** Return a new ephemeral session; this client and any saved key/profile stay unchanged. */
+    switchWorkspace(context: RemoteWorkspaceContext): Promise<RemoteWorkspaceSession>;
+    private requestWorkspaceSelection;
     /** Requires a customer session; API keys and support impersonation cannot edit names. */
     updateProfile(input: UpdateRemoteProfile): Promise<{
         user: import("./remote-profile.js").RemoteCustomerProfile;

package/dist/lib/remote-workspace-selection.d.ts

@@ -0,0 +1,58 @@
+import type { RemoteCurrentWorkspace, RemoteCustomerProfile, RemoteCustomerRole } from "./remote-profile.js";
+/** An observed identity and exact membership incarnation, never a slug or cached role. */
+export type RemoteWorkspaceContext = Readonly<{
+    userId: string;
+    membershipId: string;
+}>;
+export type RemoteAccountWorkspace = {
+    membershipId: string;
+    organization: RemoteCurrentWorkspace;
+    role: RemoteCustomerRole;
+    current: boolean;
+};
+export type RemoteAccountWorkspaces = {
+    workspaces: RemoteAccountWorkspace[];
+};
+export type RemoteWorkspaceIdentity = {
+    user: RemoteCustomerProfile & {
+        membershipId: string;
+    };
+    organization: RemoteCurrentWorkspace;
+};
+/** Contains a secret. SDK callers own its lifetime; never print or persist it implicitly. */
+export type RemoteWorkspaceSession = RemoteWorkspaceIdentity & {
+    token: string;
+};
+export type RemoteAccountWorkspaceDiscovery = RemoteAccountWorkspaces & {
+    userId: string;
+};
+export declare const invalidWorkspaceResult = "The server returned an invalid workspace selection result.";
+export declare class WorkspaceContextInputError extends Error {
+    constructor();
+}
+export declare class WorkspaceIdentityMismatchError extends Error {
+    constructor();
+}
+export declare function workspaceExpectedUserId(value: unknown): string;
+/** Copy before the first await: caller mutations cannot retarget verification. */
+export declare function workspaceContext(value: unknown): RemoteWorkspaceContext;
+/** Project documented fields only; server extras cannot reach display metadata. */
+export declare function parseAccountWorkspaces(value: unknown): RemoteAccountWorkspaces;
+export declare function parseWorkspaceIdentity(value: unknown, expectedUserId: string): RemoteWorkspaceIdentity;
+/** The service still verifies the token; response metadata never grants authority. */
+export declare function parseWorkspaceSession(value: unknown, expected: RemoteWorkspaceContext): RemoteWorkspaceSession;
+/** Fresh verification does not require newer workspace metadata from default-only servers. */
+export declare function parseWorkspaceLogin(value: unknown, expectedUserId?: string): {
+    token: string;
+    userId: string;
+};
+export declare const workspaceSelectionFailures: {
+    readonly INVALID_WORKSPACE_SELECTION: readonly [400, "Provide only the exact membership ID from your workspace list."];
+    readonly SESSION_EXPIRED: readonly [401, "Sign in again before selecting a workspace."];
+    readonly ACCOUNT_UNAVAILABLE: readonly [403, "Account is unavailable."];
+    readonly INTERACTIVE_SESSION_REQUIRED: readonly [403, "Interactive sign-in is required to select a workspace."];
+    readonly WORKSPACE_UNAVAILABLE: readonly [404, "Workspace is unavailable. Refresh your workspace list."];
+    readonly WORKSPACE_BUSY: readonly [503, "Workspace is busy. Refresh before retrying."];
+};
+export type RemoteWorkspaceSelectionErrorCode = keyof typeof workspaceSelectionFailures;
+export declare function workspaceSelectionFailure(value: unknown, status: number): RemoteWorkspaceSelectionErrorCode | null;

package/dist/lib/workspace-profile.d.ts

@@ -0,0 +1,49 @@
+type Env = Record<string, string | undefined>;
+export declare class WorkspaceProfileError extends Error {
+}
+/** Capture actual key authority before OTP; cached identity never supplies authority. */
+export declare function prepareProfileWorkspace(action: string, source?: Env): {
+    origin: string;
+    resolve(): Promise<{
+        origin: string;
+        context: undefined;
+        unchanged: () => void;
+    } | {
+        origin: string;
+        context: Readonly<{
+            userId: string;
+            membershipId: string;
+        }>;
+        unchanged: () => void;
+    }>;
+};
+export declare function captureProfileWorkspace(action: string, source?: Env): Promise<{
+    origin: string;
+    context: undefined;
+    unchanged: () => void;
+} | {
+    origin: string;
+    context: Readonly<{
+        userId: string;
+        membershipId: string;
+    }>;
+    unchanged: () => void;
+}>;
+/** Own only the explicitly named profile; injected credentials may not hide enrollment. */
+export declare function prepareWorkspaceEnrollment(membershipId: string, source?: Env): Promise<{
+    profile: string;
+    origin: string;
+    complete(email: string, code: string): Promise<{
+        status: string;
+        profile: string;
+        apiUrl: string;
+        userId: string;
+        email: string;
+        membershipId: string;
+        organization: string;
+        organizationId: string;
+        role: import("./remote-profile.js").RemoteCustomerRole;
+        keyCreated: boolean;
+    }>;
+}>;
+export {};

package/dist/sdk/index.d.ts

@@ -37,3 +37,6 @@ export { RemoteSkillsAuthClient, HostedApiError } from "../lib/remote-auth.js";
 export type { RemoteWorkspaceMember, RemoteWorkspaceMembersPage, RemoteWorkspaceMembersOptions } from "../lib/remote-workspace.js";
 export type { SetRemoteWorkspaceMemberRole, RemoveRemoteWorkspaceMember, RemoteWorkspaceMemberRoleResult, RemoteWorkspaceMemberRemovalResult, RemoteWorkspaceMemberErrorCode } from "../lib/remote-workspace.js";
 export type { RemoteCustomerRole, RemoteCustomerProfile, RemoteCurrentWorkspace, UpdateRemoteProfile, UpdateRemoteWorkspace } from "../lib/remote-profile.js";
+export type { RemoteWorkspaceContext, RemoteAccountWorkspace, RemoteAccountWorkspaces, RemoteWorkspaceIdentity, RemoteWorkspaceSession, RemoteAccountWorkspaceDiscovery, RemoteWorkspaceSelectionErrorCode } from "../lib/remote-workspace-selection.js";
+export { WorkspaceContextInputError, WorkspaceIdentityMismatchError } from "../lib/remote-workspace-selection.js";
+export { RemoteWorkspaceSelectionError } from "../lib/remote-client.js";