@hasna/skills 0.5.0 → 0.5.2

package/README.md

@@ -674,7 +674,7 @@ skills/                      # Public skill contracts and local OSS skills
 |---|---|---|
 | Catalog skills | 86 | `SKILLS.length` (`src/lib/registry-data/`) |
 | Categories | 17 | `CATEGORIES` (`src/lib/registry-types.ts`) |
-| MCP tools | 61 | `tools/list` against a live `buildServer()` |
+| MCP tools | 62 | `tools/list` against a live `buildServer()` |
 
 Every number in this table is re-derived from the source tree on each test run by
 `src/lib/readme-derived-counts.test.ts`, so a drifted figure fails a test rather
@@ -889,3 +889,74 @@ The client never refreshes, changes the precondition, or retries automatically.
 Known refusals expose a fixed message and code through `RemoteWorkspaceMemberError`;
 unsupported routes remain errors. Invitations, workspace switching and leaving
 your own workspace are separate capabilities.
+
+### Workspace profiles
+
+Discover the workspaces available to your account using a fresh verification code:
+
+```sh
+skills workspace list --email you@example.com --code-stdin --json
+```
+
+Pipe the six-digit code to stdin. Interactive terminal requests can omit
+`--code-stdin` to request and enter a masked code. Discovery saves no credential.
+The current marker identifies the workspace initially chosen by sign-in; it does
+not change your account's default workspace.
+
+To enroll a workspace, choose its exact membership ID from that list and name
+the destination credential profile explicitly:
+
+```sh
+HASNA_PROFILE=team-b skills auth login --membership-id <membership-id> --email you@example.com --code-stdin --json
+HASNA_PROFILE=team-b skills auth whoami --json
+```
+
+This fresh sign-in creates one ordinary CLI API key in that workspace, verifies
+its identity, and saves it only in the named profile. Existing keys and other
+profiles stay bound to their original workspaces. Viewer memberships cannot
+create keys. Session JWTs are never saved. Remove injected API-key overrides
+before enrolling a profile so that later commands use the saved credential.
+A profile belonging to a different account requires a different profile name
+or an ordinary replacement login. New accounts must finish ordinary account
+login before workspace enrollment; the server's existing signup policy applies.
+
+Named-profile account/workspace name updates, roster/member actions, and API-key
+management retain that profile's live workspace identity through fresh OTP
+verification. A revoked key, unavailable membership, or inconsistent profile
+metadata refuses the operation; it does not fall back to the default workspace.
+The CLI cannot change your parent shell: keep `HASNA_PROFILE=team-b` on subsequent
+commands or configure it explicitly in that shell. Existing MCP fresh-auth
+account, member and key tools retain the same named profile authority for each
+invocation. Changing an MCP host’s selected profile
+through a tool remains a separate follow-up.
+
+If enrollment reports that key issuance was attempted but not confirmed, inspect
+the selected profile and workspace keys before retrying. A lost response can
+still have created a server key; the CLI does not retry issuance automatically.
+
+### Leave a workspace
+
+Use the exact membership ID and observed role from fresh `workspace list` output.
+Leaving requires deliberate confirmation and a fresh verification code:
+
+```sh
+HASNA_PROFILE=team-b skills workspace leave <membership-id> --expected-role member --email you@example.com --code-stdin --confirm --json
+```
+
+The selected profile must authenticate the same membership. Without a named
+profile, supply `--user-id <user-id>` from discovery; this also supports viewers
+who cannot create API keys. The server refuses stale roles, the last active
+owner, and leaving your last available workspace. It decides authority atomically.
+
+The SDK offers `RemoteSkillsAuthClient.leaveWorkspace(email, code,
+{ userId, membershipId }, { expectedRole, confirm: true })`; an existing interactive
+session can use `RemoteSkillsClient.leaveWorkspace(context, input)`. MCP exposes
+`leave_workspace` with those same explicit IDs, role, confirmation and fresh code.
+All surfaces call the same HTTP method once. API keys cannot authorize the leave.
+
+Success returns `{ organizationId, membershipId, removed: true,
+signInRequired: true }`. Sign in again to an available workspace afterwards.
+Saved credentials and unrelated profiles remain unchanged; credentials for the
+left membership no longer grant access. A lost or invalid response raises
+`RemoteWorkspaceLeaveUnconfirmedError`: inspect available memberships before any
+new action. Never automatically retry or substitute another membership ID.