@hasna/skills 0.5.0 → 0.5.2

package/bin/index.js

@@ -36860,7 +36860,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.5.0",
+    version: "0.5.2",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -49045,9 +49045,99 @@ var init_read_access = __esm(() => {
   init_remote_registry();
 });
 
+// src/lib/remote-workspace-selection.ts
+function workspaceExpectedUserId(value) {
+  if (!uuid(value))
+    throw new WorkspaceContextInputError;
+  return value;
+}
+function workspaceContext(value) {
+  if (!record(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid(value.userId) || !uuid(value.membershipId))
+    throw new WorkspaceContextInputError;
+  return { userId: value.userId, membershipId: value.membershipId };
+}
+function invalid() {
+  throw new Error(invalidWorkspaceResult);
+}
+function organization(v) {
+  if (!record(v) || !uuid(v.id) || !text(v.slug) || !text(v.name))
+    return invalid();
+  return { id: v.id, slug: v.slug, name: v.name };
+}
+function parseAccountWorkspaces(value) {
+  if (!record(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
+    return invalid();
+  const workspaces = value.workspaces.map((v) => {
+    if (!record(v) || !uuid(v.membershipId) || !role(v.role) || typeof v.current !== "boolean")
+      return invalid();
+    return { membershipId: v.membershipId, organization: organization(v.organization), role: v.role, current: v.current };
+  });
+  if (workspaces.filter((w) => w.current).length !== 1 || new Set(workspaces.map((w) => w.membershipId)).size !== workspaces.length || new Set(workspaces.map((w) => w.organization.id)).size !== workspaces.length)
+    return invalid();
+  return { workspaces };
+}
+function parseWorkspaceIdentity(value, expectedUserId) {
+  if (!record(value))
+    return invalid();
+  const user = value.user;
+  if (!record(user) || !uuid(user.id) || !uuid(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role(user.role))
+    return invalid();
+  if (user.id !== expectedUserId)
+    throw new WorkspaceIdentityMismatchError;
+  return { user: { id: user.id, membershipId: user.membershipId, email: user.email, displayName: user.displayName, role: user.role }, organization: organization(value.organization) };
+}
+function sessionToken(value) {
+  if (typeof value !== "string" || !value || value.length > 8192 || /[^\x21-\x7e]/.test(value) || value.startsWith("sk_"))
+    return invalid();
+  return value;
+}
+function parseWorkspaceSession(value, expected) {
+  const identity2 = parseWorkspaceIdentity(value, expected.userId);
+  if (identity2.user.membershipId !== expected.membershipId)
+    throw new WorkspaceIdentityMismatchError;
+  return { token: sessionToken(value.token), ...identity2 };
+}
+function parseWorkspaceLogin(value, expectedUserId) {
+  const user = record(value) && value.user;
+  if (!record(value) || !record(user) || !uuid(user.id))
+    return invalid();
+  if (expectedUserId !== undefined && user.id !== expectedUserId)
+    throw new WorkspaceIdentityMismatchError;
+  return { token: sessionToken(value.token), userId: user.id };
+}
+function workspaceSelectionFailure(value, status) {
+  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
+    return null;
+  const code = value.code;
+  return workspaceSelectionFailures[code][0] === status ? code : null;
+}
+var record = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), text = (v, max2 = 1024) => typeof v === "string" && !!v.trim() && v.length <= max2 && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v), role = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), invalidWorkspaceResult = "The server returned an invalid workspace selection result.", WorkspaceContextInputError, WorkspaceIdentityMismatchError, workspaceSelectionFailures;
+var init_remote_workspace_selection = __esm(() => {
+  WorkspaceContextInputError = class WorkspaceContextInputError extends Error {
+    constructor() {
+      super("Provide the observed user ID and exact lowercase membership ID.");
+      this.name = "WorkspaceContextInputError";
+    }
+  };
+  WorkspaceIdentityMismatchError = class WorkspaceIdentityMismatchError extends Error {
+    constructor() {
+      super("The verified account does not match the requested workspace context.");
+      this.name = "WorkspaceIdentityMismatchError";
+    }
+  };
+  workspaceSelectionFailures = {
+    INVALID_WORKSPACE_SELECTION: [400, "Provide only the exact membership ID from your workspace list."],
+    SESSION_EXPIRED: [401, "Sign in again before selecting a workspace."],
+    ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "Interactive sign-in is required to select a workspace."],
+    WORKSPACE_UNAVAILABLE: [404, "Workspace is unavailable. Refresh your workspace list."],
+    WORKSPACE_BUSY: [503, "Workspace is busy. Refresh before retrying."]
+  };
+});
+
 // src/lib/remote-workspace.ts
 function workspaceMembersQuery(options = {}) {
-  if (!record(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+  if (!record2(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
     throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
   const query = new URLSearchParams;
   if (options.limit !== undefined)
@@ -49063,7 +49153,7 @@ function timestamp(value) {
   return Number.isFinite(time) && new Date(time).toISOString().slice(0, 23) === value.slice(0, 23);
 }
 function parseMember(row, fail2) {
-  if (!record(row) || !uuid(row.membershipId) || !uuid(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp(row.createdAt))
+  if (!record2(row) || !uuid2(row.membershipId) || !uuid2(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp(row.createdAt))
     return fail2();
   return {
     membershipId: row.membershipId,
@@ -49075,12 +49165,12 @@ function parseMember(row, fail2) {
   };
 }
 function mutationInput(membershipId, input, roleChange) {
-  if (typeof membershipId !== "string" || !uuid(membershipId) || membershipId !== membershipId.toLowerCase() || !record(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+  if (typeof membershipId !== "string" || !uuid2(membershipId) || membershipId !== membershipId.toLowerCase() || !record2(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
     throw new WorkspaceMemberInputError;
-  const expectedRole = input.expectedRole, role = roleChange ? input.role : undefined;
-  if (!isRole(expectedRole) || roleChange && !isRole(role))
+  const expectedRole = input.expectedRole, role2 = roleChange ? input.role : undefined;
+  if (!isRole(expectedRole) || roleChange && !isRole(role2))
     throw new WorkspaceMemberInputError;
-  return { membershipId, role, expectedRole };
+  return { membershipId, role: role2, expectedRole };
 }
 function workspaceMemberRoleInput(membershipId, input) {
   const value = mutationInput(membershipId, input, true);
@@ -49090,24 +49180,24 @@ function workspaceMemberRemovalInput(membershipId, input) {
   const value = mutationInput(membershipId, input, false);
   return { membershipId: value.membershipId, body: { expectedRole: value.expectedRole } };
 }
-function parseWorkspaceMemberRoleResult(value, membershipId, role) {
+function parseWorkspaceMemberRoleResult(value, membershipId, role2) {
   const fail2 = () => {
     throw new Error(invalidMemberResult);
   };
-  if (!record(value) || !uuid(value.organizationId) || typeof value.changed !== "boolean")
+  if (!record2(value) || !uuid2(value.organizationId) || typeof value.changed !== "boolean")
     return fail2();
   const member = parseMember(value.member, fail2);
-  if (member.membershipId !== membershipId || member.role !== role)
+  if (member.membershipId !== membershipId || member.role !== role2)
     return fail2();
   return { organizationId: value.organizationId, member, changed: value.changed };
 }
 function parseWorkspaceMemberRemovalResult(value, membershipId) {
-  if (!record(value) || !uuid(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+  if (!record2(value) || !uuid2(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
     throw new Error(invalidMemberResult);
   return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
 }
 function workspaceMemberFailure(value, status) {
-  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+  if (!record2(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
     return null;
   const code = value.code;
   return workspaceMemberFailures[code][0] === status ? code : null;
@@ -49116,14 +49206,14 @@ function parseWorkspaceMembersPage(value) {
   const fail2 = () => {
     throw new Error("The server returned an invalid workspace roster.");
   };
-  if (!record(value) || !uuid(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+  if (!record2(value) || !uuid2(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
     return fail2();
   const members = value.members.map((row) => parseMember(row, fail2));
   if (new Set(members.map((row) => row.membershipId)).size !== members.length)
     return fail2();
   return { organizationId: value.organizationId, members, nextCursor: value.nextCursor };
 }
-var record = (value) => !!value && typeof value === "object" && !Array.isArray(value), cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value), uuid = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value), isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value), WorkspaceMemberInputError, invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.", workspaceMemberFailures;
+var record2 = (value) => !!value && typeof value === "object" && !Array.isArray(value), cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value), uuid2 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value), isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value), WorkspaceMemberInputError, invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.", workspaceMemberFailures;
 var init_remote_workspace = __esm(() => {
   WorkspaceMemberInputError = class WorkspaceMemberInputError extends Error {
     constructor() {
@@ -49145,6 +49235,75 @@ var init_remote_workspace = __esm(() => {
   };
 });
 
+// src/lib/remote-workspace-leave.ts
+function workspaceLeaveInput(context, input) {
+  const target = workspaceContext(context);
+  if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).sort().join(",") !== "confirm,expectedRole" || input.confirm !== true)
+    throw new WorkspaceLeaveInputError;
+  const captured = workspaceMemberRemovalInput(target.membershipId, { expectedRole: input.expectedRole });
+  return {
+    context: target,
+    input: { expectedRole: captured.body.expectedRole, confirm: true },
+    body: { membershipId: target.membershipId, expectedRole: captured.body.expectedRole }
+  };
+}
+function workspaceLeaveFailure(value, status) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const code = value.code;
+  return typeof code === "string" && Object.hasOwn(workspaceLeaveFailures, code) && workspaceLeaveFailures[code][0] === status ? code : null;
+}
+function parseWorkspaceLeaveResult(value, membershipId, organizationId) {
+  const row = value;
+  if (!row || typeof row !== "object" || Array.isArray(row) || row.membershipId !== membershipId || row.organizationId !== organizationId || row.removed !== true || row.signInRequired !== true)
+    throw new RemoteWorkspaceLeaveUnconfirmedError;
+  return { membershipId, organizationId, removed: true, signInRequired: true };
+}
+function workspaceLeaveProfileContext(membershipId, userId, profile) {
+  const observed = profile === undefined ? undefined : workspaceContext(profile);
+  const target = workspaceContext({ userId: userId ?? observed?.userId, membershipId });
+  if (observed && (observed.userId !== target.userId || observed.membershipId !== target.membershipId))
+    throw new WorkspaceIdentityMismatchError;
+  return target;
+}
+var WorkspaceLeaveInputError, workspaceLeaveFailures, RemoteWorkspaceLeaveError, RemoteWorkspaceLeaveUnconfirmedError;
+var init_remote_workspace_leave = __esm(() => {
+  init_remote_workspace_selection();
+  init_remote_workspace();
+  WorkspaceLeaveInputError = class WorkspaceLeaveInputError extends Error {
+    constructor() {
+      super("Confirm leaving the exact observed user and membership with its expected role.");
+      this.name = "WorkspaceLeaveInputError";
+    }
+  };
+  workspaceLeaveFailures = {
+    INVALID_REQUEST: [400, "Provide the exact current membership and expected role."],
+    ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required to leave a workspace."],
+    MEMBERSHIP_ROLE_CHANGED: [409, "Your role changed. Sign in and inspect the workspace before leaving."],
+    LAST_OWNER_REQUIRED: [409, "The workspace must retain another active owner."],
+    LAST_WORKSPACE_REQUIRED: [409, "Another available workspace is required before leaving."],
+    MEMBERSHIP_BUSY: [503, "Membership is busy. Inspect the workspace before another leave action."]
+  };
+  RemoteWorkspaceLeaveError = class RemoteWorkspaceLeaveError extends Error {
+    code;
+    status;
+    constructor(code) {
+      super(workspaceLeaveFailures[code][1]);
+      this.code = code;
+      this.name = "RemoteWorkspaceLeaveError";
+      this.status = workspaceLeaveFailures[code][0];
+    }
+  };
+  RemoteWorkspaceLeaveUnconfirmedError = class RemoteWorkspaceLeaveUnconfirmedError extends Error {
+    code = "WORKSPACE_LEAVE_UNCONFIRMED";
+    constructor() {
+      super("The leave outcome is unconfirmed. Sign in again and inspect available memberships before another action. Do not retry automatically; saved credentials are unchanged.");
+      this.name = "RemoteWorkspaceLeaveUnconfirmedError";
+    }
+  };
+});
+
 // src/lib/auth-store.ts
 import { chmodSync, existsSync as existsSync17, mkdirSync as mkdirSync7, readFileSync as readFileSync12, renameSync as renameSync4, statSync as statSync9, unlinkSync, writeFileSync as writeFileSync7 } from "fs";
 import { basename as basename4, dirname as dirname6, join as join18 } from "path";
@@ -49163,14 +49322,14 @@ function readIdentity(env3 = process.env) {
     const parsed = JSON.parse(readFileSync12(getIdentityFilePath(env3), "utf-8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
-    const record2 = parsed;
+    const record3 = parsed;
     const selected = resolveSkillsApiOrigin(env3)?.origin;
-    const bound = typeof record2.apiUrl === "string" ? record2.apiUrl : readCredentialValue(SKILLS_BOUND_API_URL, env3) ?? readStoredApiUrl(env3) ?? defaultFleetGatewayBaseUrl("skills");
+    const bound = typeof record3.apiUrl === "string" ? record3.apiUrl : readCredentialValue(SKILLS_BOUND_API_URL, env3) ?? readStoredApiUrl(env3) ?? defaultFleetGatewayBaseUrl("skills");
     if (selected && normalizeSkillsApiOrigin(bound) !== selected)
       return {};
     const identity2 = {};
     for (const field of ["email", "orgId", "orgSlug", "userId"]) {
-      const value = record2[field];
+      const value = record3[field];
       if (typeof value === "string" && value.length > 0)
         identity2[field] = value;
     }
@@ -49319,44 +49478,44 @@ var init_auth_store = __esm(() => {
 
 // src/lib/remote-run-contract.ts
 function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
-  const record2 = isRecord3(payload) ? payload : {};
+  const record3 = isRecord3(payload) ? payload : {};
   return {
     contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
-    ...pickString(record2, "id"),
-    skill: pickStringValue(record2, "skill") ?? fallbackSkill,
-    ...pickString(record2, "requestedSlug"),
-    ...pickString(record2, "status"),
-    ...pickNumber(record2, "exitCode"),
-    ...pickString(record2, "correlationId"),
-    ...pickString(record2, "createdAt"),
-    ...pickString(record2, "startedAt"),
-    ...pickString(record2, "completedAt"),
-    ...pickNumber(record2, "durationMs"),
-    ...pickString(record2, "outputType"),
-    ...hasOwn(record2, "outputPreview") ? { outputPreview: record2.outputPreview } : {},
-    ...pickString(record2, "errorCode"),
-    ...pickString(record2, "errorMessage"),
-    ...pickString(record2, "error"),
-    ...pickString(record2, "code"),
-    ...hasOwn(record2, "details") ? { details: record2.details } : {}
+    ...pickString(record3, "id"),
+    skill: pickStringValue(record3, "skill") ?? fallbackSkill,
+    ...pickString(record3, "requestedSlug"),
+    ...pickString(record3, "status"),
+    ...pickNumber(record3, "exitCode"),
+    ...pickString(record3, "correlationId"),
+    ...pickString(record3, "createdAt"),
+    ...pickString(record3, "startedAt"),
+    ...pickString(record3, "completedAt"),
+    ...pickNumber(record3, "durationMs"),
+    ...pickString(record3, "outputType"),
+    ...hasOwn(record3, "outputPreview") ? { outputPreview: record3.outputPreview } : {},
+    ...pickString(record3, "errorCode"),
+    ...pickString(record3, "errorMessage"),
+    ...pickString(record3, "error"),
+    ...pickString(record3, "code"),
+    ...hasOwn(record3, "details") ? { details: record3.details } : {}
   };
 }
 function isRecord3(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function hasOwn(record2, key) {
-  return Object.prototype.hasOwnProperty.call(record2, key);
+function hasOwn(record3, key) {
+  return Object.prototype.hasOwnProperty.call(record3, key);
 }
-function pickString(record2, key) {
-  const value = pickStringValue(record2, key);
+function pickString(record3, key) {
+  const value = pickStringValue(record3, key);
   return value === undefined ? {} : { [key]: value };
 }
-function pickStringValue(record2, key) {
-  const value = record2[key];
+function pickStringValue(record3, key) {
+  const value = record3[key];
   return typeof value === "string" ? value : undefined;
 }
-function pickNumber(record2, key) {
-  const value = record2[key];
+function pickNumber(record3, key) {
+  const value = record3[key];
   return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
 }
 var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
@@ -49548,11 +49707,11 @@ function parseUpdatedProfile(value) {
   return { user: { id: user.id, email: user.email, displayName: user.displayName, role: user.role } };
 }
 function parseUpdatedWorkspace(value) {
-  const organization = isRecord4(value) && value.organization;
-  if (!isRecord4(organization) || !string(organization.id) || !string(organization.slug) || !string(organization.name)) {
+  const organization2 = isRecord4(value) && value.organization;
+  if (!isRecord4(organization2) || !string(organization2.id) || !string(organization2.slug) || !string(organization2.name)) {
     throw new Error("The server returned an invalid workspace.");
   }
-  return { organization: { id: organization.id, slug: organization.slug, name: organization.name } };
+  return { organization: { id: organization2.id, slug: organization2.slug, name: organization2.name } };
 }
 
 // src/lib/remote-client.ts
@@ -49560,6 +49719,7 @@ var exports_remote_client = {};
 __export(exports_remote_client, {
   createRemoteSkillsClientReadOnly: () => createRemoteSkillsClientReadOnly,
   createRemoteSkillsClient: () => createRemoteSkillsClient,
+  RemoteWorkspaceSelectionError: () => RemoteWorkspaceSelectionError,
   RemoteWorkspaceMemberError: () => RemoteWorkspaceMemberError,
   RemoteSkillsClient: () => RemoteSkillsClient,
   RemoteRouteUnsupportedError: () => RemoteRouteUnsupportedError,
@@ -49579,6 +49739,7 @@ class RemoteSkillsClient {
     return fetch(`${this.apiUrl}${path}`, {
       ...options,
       redirect: "error",
+      credentials: "omit",
       signal: options?.signal ?? AbortSignal.timeout(15000),
       headers: {
         Authorization: `Bearer ${this.apiKey}`,
@@ -49685,6 +49846,65 @@ class RemoteSkillsClient {
   async getIdentity() {
     return (await this.requestNewRoute("/api/auth/whoami")).json();
   }
+  async listAccountWorkspaces(expectedUserId) {
+    const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    let identity2;
+    if (expected !== undefined) {
+      const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+      if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+        throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces", "INTERACTIVE_SESSION_REQUIRED");
+      identity2 = parseWorkspaceIdentity(value, expected);
+    }
+    const result2 = parseAccountWorkspaces(await connection.requestWorkspaceSelection("/api/v1/account/workspaces"));
+    const current = result2.workspaces.find((workspace) => workspace.current);
+    if (identity2 && (current.membershipId !== identity2.user.membershipId || current.organization.id !== identity2.organization.id))
+      throw new WorkspaceIdentityMismatchError;
+    return result2;
+  }
+  async switchWorkspace(context) {
+    const target = workspaceContext(context);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+      throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces/switch", "INTERACTIVE_SESSION_REQUIRED");
+    parseWorkspaceIdentity(value, target.userId);
+    const selected = parseWorkspaceSession(await connection.requestWorkspaceSelection("/api/v1/account/workspaces/switch", {
+      method: "POST",
+      body: JSON.stringify({ membershipId: target.membershipId })
+    }), target);
+    const verified = await new RemoteSkillsClient(selected.token, connection.apiUrl).requestWorkspaceSelection("/api/auth/whoami");
+    if (!verified || typeof verified !== "object" || verified.authMethod !== "jwt")
+      throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces/switch", "INTERACTIVE_SESSION_REQUIRED");
+    const identity2 = parseWorkspaceIdentity(verified, target.userId);
+    if (identity2.user.membershipId !== target.membershipId || identity2.organization.id !== selected.organization.id)
+      throw new WorkspaceIdentityMismatchError;
+    return { token: selected.token, ...identity2 };
+  }
+  async requestWorkspaceSelection(path, options) {
+    let response;
+    try {
+      response = await this.request(path, { ...options, credentials: "omit" });
+    } catch {
+      throw new Error("Unable to reach the Skills workspace API.");
+    }
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 1024 * 1024 : 4096)));
+    } catch {
+      if (response.ok)
+        throw new Error(invalidWorkspaceResult);
+    }
+    if (!response.ok) {
+      const code = workspaceSelectionFailure(value, response.status);
+      if (code)
+        throw new RemoteWorkspaceSelectionError(path, code);
+      if (response.status === 404 || response.status === 405)
+        throw new RemoteRouteUnsupportedError(path, response.status, this.apiUrl);
+      throw new RemoteRequestError(path, response.status);
+    }
+    return value;
+  }
   async updateProfile(input) {
     const body = customerNamePatch(input, "displayName");
     return parseUpdatedProfile(await (await this.requestNewRoute("/api/v1/account/profile", { method: "PATCH", body: JSON.stringify(body) })).json());
@@ -49737,6 +49957,30 @@ class RemoteSkillsClient {
     }
     return value;
   }
+  async leaveWorkspace(context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+      throw new RemoteWorkspaceLeaveError("INTERACTIVE_SESSION_REQUIRED");
+    const identity2 = parseWorkspaceIdentity(value, captured.context.userId);
+    if (identity2.user.membershipId !== captured.context.membershipId)
+      throw new WorkspaceIdentityMismatchError;
+    let response, body;
+    try {
+      response = await connection.request("/api/v1/account/workspaces/leave", { method: "POST", body: JSON.stringify(captured.body) });
+      body = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, 4096)));
+    } catch {
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    if (!response.ok) {
+      const code = workspaceLeaveFailure(body, response.status);
+      if (code)
+        throw new RemoteWorkspaceLeaveError(code);
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    return parseWorkspaceLeaveResult(body, captured.context.membershipId, identity2.organization.id);
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -49987,13 +50231,13 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record2, field) {
-  if (record2[field] === undefined)
+function requireOptionalString(record3, field) {
+  if (record3[field] === undefined)
     return;
-  if (typeof record2[field] !== "string") {
+  if (typeof record3[field] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field} must be a string when present)`);
   }
-  return record2[field];
+  return record3[field];
 }
 function isVersionRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -50015,19 +50259,19 @@ function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record2 = entry;
-  const slug = typeof record2.slug === "string" && record2.slug.trim() ? record2.slug.trim() : undefined;
+  const record3 = entry;
+  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record2.metadata !== undefined) {
-    if (!record2.metadata || typeof record2.metadata !== "object" || Array.isArray(record2.metadata)) {
+  if (record3.metadata !== undefined) {
+    if (!record3.metadata || typeof record3.metadata !== "object" || Array.isArray(record3.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record2.metadata;
+    metadata = record3.metadata;
   }
-  const pinnedAt = requireOptionalString(record2, "pinnedAt");
+  const pinnedAt = requireOptionalString(record3, "pinnedAt");
   return {
     slug,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -50044,16 +50288,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record2 = entry;
-  const slug = typeof record2.slug === "string" && record2.slug.trim() ? record2.slug.trim() : undefined;
+  const record3 = entry;
+  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug,
-    ...requireOptionalString(record2, "name") !== undefined ? { name: requireOptionalString(record2, "name") } : {},
-    ...requireOptionalString(record2, "version") !== undefined ? { version: requireOptionalString(record2, "version") } : {},
-    ...requireOptionalString(record2, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record2, "updatedAt") } : {}
+    ...requireOptionalString(record3, "name") !== undefined ? { name: requireOptionalString(record3, "name") } : {},
+    ...requireOptionalString(record3, "version") !== undefined ? { version: requireOptionalString(record3, "version") } : {},
+    ...requireOptionalString(record3, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record3, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -50106,12 +50350,12 @@ function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record2 = payload;
-  if (!Array.isArray(record2.skills)) {
+  const record3 = payload;
+  if (!Array.isArray(record3.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record2.skills.map(normalizeSkillSummary);
-  const nextCursor = record2.nextCursor === undefined || record2.nextCursor === null ? null : record2.nextCursor;
+  const skills = record3.skills.map(normalizeSkillSummary);
+  const nextCursor = record3.nextCursor === undefined || record3.nextCursor === null ? null : record3.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -50124,8 +50368,10 @@ async function createRemoteSkillsClient(env3 = process.env) {
 function createRemoteSkillsClientReadOnly(env3 = process.env) {
   return createRemoteSkillsClient(env3);
 }
-var RemoteRouteUnsupportedError, RemoteRequestError, RemoteWorkspaceMemberError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
+var RemoteRouteUnsupportedError, RemoteRequestError, RemoteWorkspaceMemberError, RemoteWorkspaceSelectionError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 var init_remote_client = __esm(() => {
+  init_remote_workspace_leave();
+  init_remote_workspace_selection();
   init_remote_workspace();
   init_remote_workspace();
   init_auth_store();
@@ -50163,6 +50409,15 @@ var init_remote_client = __esm(() => {
       this.message = workspaceMemberFailures[code][1];
     }
   };
+  RemoteWorkspaceSelectionError = class RemoteWorkspaceSelectionError extends RemoteRequestError {
+    code;
+    constructor(path, code) {
+      super(path, workspaceSelectionFailures[code][0]);
+      this.code = code;
+      this.name = "RemoteWorkspaceSelectionError";
+      this.message = workspaceSelectionFailures[code][1];
+    }
+  };
   RemoteCapabilityUnavailableError = class RemoteCapabilityUnavailableError extends RemoteRequestError {
     code = "SUBSCRIPTION_CHECKOUT_UNAVAILABLE";
     constructor() {
@@ -50891,16 +51146,16 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
   }
   return { path: target, created };
 }
-function writePullMarker(dir, record2) {
+function writePullMarker(dir, record3) {
   const marker = {
     managedBy: "@hasna/skills",
-    skill: record2.skill,
-    source: record2.source ?? "pull",
-    ...record2.version ? { version: record2.version } : {},
-    ...record2.contentHash ? { contentHash: record2.contentHash } : {},
-    ...record2.sourceCommit ? { sourceCommit: record2.sourceCommit } : {},
-    ...record2.signature ? { signature: record2.signature } : {},
-    ...record2.revisionId ? { revisionId: record2.revisionId } : {},
+    skill: record3.skill,
+    source: record3.source ?? "pull",
+    ...record3.version ? { version: record3.version } : {},
+    ...record3.contentHash ? { contentHash: record3.contentHash } : {},
+    ...record3.sourceCommit ? { sourceCommit: record3.sourceCommit } : {},
+    ...record3.signature ? { signature: record3.signature } : {},
+    ...record3.revisionId ? { revisionId: record3.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
   writeFileSync8(join20(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
@@ -50915,19 +51170,19 @@ async function safeMeta(client, slug) {
   }
   if (!raw || typeof raw !== "object")
     return null;
-  const record2 = raw;
-  const kind = record2.kind === "instruction" || record2.kind === "executable" ? record2.kind : undefined;
-  const tags = Array.isArray(record2.tags) ? record2.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
+  const record3 = raw;
+  const kind = record3.kind === "instruction" || record3.kind === "executable" ? record3.kind : undefined;
+  const tags = Array.isArray(record3.tags) ? record3.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
   return {
-    ...str(record2.displayName) ? { displayName: str(record2.displayName) } : {},
-    ...str(record2.description) ? { description: str(record2.description) } : {},
-    ...str(record2.category) ? { category: str(record2.category) } : {},
+    ...str(record3.displayName) ? { displayName: str(record3.displayName) } : {},
+    ...str(record3.description) ? { description: str(record3.description) } : {},
+    ...str(record3.category) ? { category: str(record3.category) } : {},
     ...tags && tags.length ? { tags } : {},
-    ...str(record2.version) ? { version: str(record2.version) } : {},
+    ...str(record3.version) ? { version: str(record3.version) } : {},
     ...kind ? { kind } : {},
-    ...REVISION_ID_PATTERN.test(str(record2.revisionId) ?? "") ? { revisionId: str(record2.revisionId) } : {},
-    ...typeof record2.skillMd === "string" && record2.skillMd.length > 0 ? { skillMd: record2.skillMd } : {},
-    ...str(record2.publishedSource) ? { publishedSource: str(record2.publishedSource) } : {}
+    ...REVISION_ID_PATTERN.test(str(record3.revisionId) ?? "") ? { revisionId: str(record3.revisionId) } : {},
+    ...typeof record3.skillMd === "string" && record3.skillMd.length > 0 ? { skillMd: record3.skillMd } : {},
+    ...str(record3.publishedSource) ? { publishedSource: str(record3.publishedSource) } : {}
   };
 }
 function pickCorpusOptions(options) {
@@ -50936,8 +51191,8 @@ function pickCorpusOptions(options) {
 function extractSlug(entry) {
   if (!entry || typeof entry !== "object")
     return;
-  const record2 = entry;
-  return str(record2.slug) ?? str(record2.name);
+  const record3 = entry;
+  return str(record3.slug) ?? str(record3.name);
 }
 function dedupe(values2) {
   return [...new Set(values2)];
@@ -51210,17 +51465,17 @@ var init_install = __esm(() => {
 
 // src/lib/compact-output.ts
 function truncateText(value, maxChars = 96) {
-  const text = String(value ?? "").replace(/\s+/g, " ").trim();
-  if (text.length <= maxChars)
-    return text;
-  return `${text.slice(0, Math.max(0, maxChars - 3)).trimEnd()}...`;
+  const text2 = String(value ?? "").replace(/\s+/g, " ").trim();
+  if (text2.length <= maxChars)
+    return text2;
+  return `${text2.slice(0, Math.max(0, maxChars - 3)).trimEnd()}...`;
 }
 function previewText(value, maxChars = DEFAULT_PREVIEW_CHARS) {
-  const text = String(value ?? "");
+  const text2 = String(value ?? "");
   return {
-    text: text.length > maxChars ? `${text.slice(0, Math.max(0, maxChars - 3))}...` : text,
-    length: text.length,
-    truncated: text.length > maxChars
+    text: text2.length > maxChars ? `${text2.slice(0, Math.max(0, maxChars - 3))}...` : text2,
+    length: text2.length,
+    truncated: text2.length > maxChars
   };
 }
 function parsePageLimit(value, fallback, options = {}) {
@@ -51339,10 +51594,10 @@ function handleBrowseError(error) {
   process.exitCode = 1;
 }
 async function writeJson(value, space) {
-  const text = `${JSON.stringify(value, null, space)}
+  const text2 = `${JSON.stringify(value, null, space)}
 `;
   await new Promise((resolve3, reject2) => {
-    process.stdout.write(text, (error) => {
+    process.stdout.write(text2, (error) => {
       if (error)
         reject2(error);
       else
@@ -52049,12 +52304,12 @@ function generateSkillMd(name) {
 `) + `
 `;
 }
-function extractEnvVars(text) {
+function extractEnvVars(text2) {
   const envVars = new Set;
   for (const pattern of [ENV_VAR_PATTERN, GENERIC_ENV_PATTERN]) {
     pattern.lastIndex = 0;
     let match;
-    while ((match = pattern.exec(text)) !== null) {
+    while ((match = pattern.exec(text2)) !== null) {
       envVars.add(match[1]);
     }
   }
@@ -53260,8 +53515,8 @@ function writeRollbackRecord(mode, entries, appDir = getDataDir()) {
   const dir = join24(appDir, ROLLBACK_DIRNAME);
   mkdirSync9(dir, { recursive: true });
   const file = join24(dir, `${mode}-${Date.now()}.json`);
-  const record2 = { version: 1, mode, timestamp: new Date().toISOString(), entries };
-  writeFileSync10(file, `${JSON.stringify(record2, null, 2)}
+  const record3 = { version: 1, mode, timestamp: new Date().toISOString(), entries };
+  writeFileSync10(file, `${JSON.stringify(record3, null, 2)}
 `);
   return file;
 }
@@ -53568,10 +53823,10 @@ function setEnvAssignment(path, assignment) {
     }
     let prepared = initial2;
     if (previous) {
-      const original = readFileSync20(descriptor), text = original.toString("utf8");
-      if (!Buffer.from(text, "utf8").equals(original))
+      const original = readFileSync20(descriptor), text2 = original.toString("utf8");
+      if (!Buffer.from(text2, "utf8").equals(original))
         throw new EnvAssignmentError(INVALID_LAYOUT);
-      prepared = prepareEnvAssignment(assignment, text);
+      prepared = prepareEnvAssignment(assignment, text2);
     }
     const bytes = Buffer.from(prepared.content, "utf8");
     let written = 0;
@@ -54139,7 +54394,7 @@ function createSkillRun(params, targetDir = process.cwd()) {
   mkdirSync10(logsDir, { recursive: true });
   mkdirSync10(exportDir, { recursive: true });
   mkdirSync10(join27(root, "tmp"), { recursive: true });
-  const record2 = {
+  const record3 = {
     id,
     skill: skillName,
     status: params.status ?? "running",
@@ -54157,10 +54412,10 @@ function createSkillRun(params, targetDir = process.cwd()) {
       logsDir: toProjectRelative(targetDir, logsDir)
     }
   };
-  const context = { targetDir, runDir, exportDir, logsDir, record: record2 };
+  const context = { targetDir, runDir, exportDir, logsDir, record: record3 };
   writeRunRecord(context);
   writeArtifactsManifest(context, []);
-  appendRunEvent(context, "created", { status: record2.status });
+  appendRunEvent(context, "created", { status: record3.status });
   return context;
 }
 function completeSkillRun(context, patch) {
@@ -54210,9 +54465,9 @@ function listSkillRuns(targetDir = process.cwd(), limit = 50) {
     if (!statSync14(dayDir).isDirectory())
       continue;
     for (const runId of readdirSync13(dayDir).sort().reverse()) {
-      const record2 = readRunRecord(join27(dayDir, runId));
-      if (record2)
-        records.push(record2);
+      const record3 = readRunRecord(join27(dayDir, runId));
+      if (record3)
+        records.push(record3);
       if (records.length >= limit)
         return records;
     }
@@ -54224,9 +54479,9 @@ function findSkillRun(runId, targetDir = process.cwd()) {
   if (!existsSync25(runsRoot))
     return null;
   for (const day of readdirSync13(runsRoot)) {
-    const record2 = readRunRecord(join27(runsRoot, day, runId));
-    if (record2)
-      return record2;
+    const record3 = readRunRecord(join27(runsRoot, day, runId));
+    if (record3)
+      return record3;
   }
   return null;
 }
@@ -55062,7 +55317,7 @@ function datetime(args) {
   const timeRegex2 = `${time2}(?:${opts.join("|")})`;
   return new RegExp(`^${dateSource}T(?:${timeRegex2})$`);
 }
-var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid2 = (version) => {
+var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid3 = (version) => {
   if (!version)
     return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000)$/;
   return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
@@ -55856,9 +56111,9 @@ var init_schemas = __esm(() => {
       const v = versionMap[def.version];
       if (v === undefined)
         throw new Error(`Invalid UUID version: "${def.version}"`);
-      def.pattern ?? (def.pattern = uuid2(v));
+      def.pattern ?? (def.pattern = uuid3(v));
     } else
-      def.pattern ?? (def.pattern = uuid2());
+      def.pattern ?? (def.pattern = uuid3());
     $ZodStringFormat.init(inst, def);
   });
   $ZodEmail = /* @__PURE__ */ $constructor("$ZodEmail", (inst, def) => {
@@ -58338,7 +58593,7 @@ function intersection2(left, right) {
     right
   });
 }
-function record2(keyType, valueType, params) {
+function record3(keyType, valueType, params) {
   return new ZodRecord2({
     type: "record",
     keyType,
@@ -59039,7 +59294,7 @@ var init_types2 = __esm(() => {
   });
   FormElicitationCapabilitySchema = intersection2(object2({
     applyDefaults: boolean2().optional()
-  }), record2(string3(), unknown()));
+  }), record3(string3(), unknown()));
   ElicitationCapabilitySchema = preprocess((value) => {
     if (value && typeof value === "object" && !Array.isArray(value)) {
       if (Object.keys(value).length === 0) {
@@ -59050,7 +59305,7 @@ var init_types2 = __esm(() => {
   }, intersection2(object2({
     form: FormElicitationCapabilitySchema.optional(),
     url: AssertObjectSchema.optional()
-  }), record2(string3(), unknown()).optional()));
+  }), record3(string3(), unknown()).optional()));
   ClientTasksCapabilitySchema = looseObject({
     list: AssertObjectSchema.optional(),
     cancel: AssertObjectSchema.optional(),
@@ -59073,7 +59328,7 @@ var init_types2 = __esm(() => {
     }).optional()
   });
   ClientCapabilitiesSchema = object2({
-    experimental: record2(string3(), AssertObjectSchema).optional(),
+    experimental: record3(string3(), AssertObjectSchema).optional(),
     sampling: object2({
       context: AssertObjectSchema.optional(),
       tools: AssertObjectSchema.optional()
@@ -59083,7 +59338,7 @@ var init_types2 = __esm(() => {
       listChanged: boolean2().optional()
     }).optional(),
     tasks: ClientTasksCapabilitySchema.optional(),
-    extensions: record2(string3(), AssertObjectSchema).optional()
+    extensions: record3(string3(), AssertObjectSchema).optional()
   });
   InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
     protocolVersion: string3(),
@@ -59095,7 +59350,7 @@ var init_types2 = __esm(() => {
     params: InitializeRequestParamsSchema
   });
   ServerCapabilitiesSchema = object2({
-    experimental: record2(string3(), AssertObjectSchema).optional(),
+    experimental: record3(string3(), AssertObjectSchema).optional(),
     logging: AssertObjectSchema.optional(),
     completions: AssertObjectSchema.optional(),
     prompts: object2({
@@ -59109,7 +59364,7 @@ var init_types2 = __esm(() => {
       listChanged: boolean2().optional()
     }).optional(),
     tasks: ServerTasksCapabilitySchema.optional(),
-    extensions: record2(string3(), AssertObjectSchema).optional()
+    extensions: record3(string3(), AssertObjectSchema).optional()
   });
   InitializeResultSchema = ResultSchema.extend({
     protocolVersion: string3(),
@@ -59196,7 +59451,7 @@ var init_types2 = __esm(() => {
   ResourceContentsSchema = object2({
     uri: string3(),
     mimeType: optional(string3()),
-    _meta: record2(string3(), unknown()).optional()
+    _meta: record3(string3(), unknown()).optional()
   });
   TextResourceContentsSchema = ResourceContentsSchema.extend({
     text: string3()
@@ -59301,7 +59556,7 @@ var init_types2 = __esm(() => {
   });
   GetPromptRequestParamsSchema = BaseRequestParamsSchema.extend({
     name: string3(),
-    arguments: record2(string3(), string3()).optional()
+    arguments: record3(string3(), string3()).optional()
   });
   GetPromptRequestSchema = RequestSchema.extend({
     method: literal("prompts/get"),
@@ -59311,34 +59566,34 @@ var init_types2 = __esm(() => {
     type: literal("text"),
     text: string3(),
     annotations: AnnotationsSchema.optional(),
-    _meta: record2(string3(), unknown()).optional()
+    _meta: record3(string3(), unknown()).optional()
   });
   ImageContentSchema = object2({
     type: literal("image"),
     data: Base64Schema,
     mimeType: string3(),
     annotations: AnnotationsSchema.optional(),
-    _meta: record2(string3(), unknown()).optional()
+    _meta: record3(string3(), unknown()).optional()
   });
   AudioContentSchema = object2({
     type: literal("audio"),
     data: Base64Schema,
     mimeType: string3(),
     annotations: AnnotationsSchema.optional(),
-    _meta: record2(string3(), unknown()).optional()
+    _meta: record3(string3(), unknown()).optional()
   });
   ToolUseContentSchema = object2({
     type: literal("tool_use"),
     name: string3(),
     id: string3(),
-    input: record2(string3(), unknown()),
-    _meta: record2(string3(), unknown()).optional()
+    input: record3(string3(), unknown()),
+    _meta: record3(string3(), unknown()).optional()
   });
   EmbeddedResourceSchema = object2({
     type: literal("resource"),
     resource: union2([TextResourceContentsSchema, BlobResourceContentsSchema]),
     annotations: AnnotationsSchema.optional(),
-    _meta: record2(string3(), unknown()).optional()
+    _meta: record3(string3(), unknown()).optional()
   });
   ResourceLinkSchema = ResourceSchema.extend({
     type: literal("resource_link")
@@ -59378,17 +59633,17 @@ var init_types2 = __esm(() => {
     description: string3().optional(),
     inputSchema: object2({
       type: literal("object"),
-      properties: record2(string3(), AssertObjectSchema).optional(),
+      properties: record3(string3(), AssertObjectSchema).optional(),
       required: array(string3()).optional()
     }).catchall(unknown()),
     outputSchema: object2({
       type: literal("object"),
-      properties: record2(string3(), AssertObjectSchema).optional(),
+      properties: record3(string3(), AssertObjectSchema).optional(),
       required: array(string3()).optional()
     }).catchall(unknown()).optional(),
     annotations: ToolAnnotationsSchema.optional(),
     execution: ToolExecutionSchema.optional(),
-    _meta: record2(string3(), unknown()).optional()
+    _meta: record3(string3(), unknown()).optional()
   });
   ListToolsRequestSchema = PaginatedRequestSchema.extend({
     method: literal("tools/list")
@@ -59398,7 +59653,7 @@ var init_types2 = __esm(() => {
   });
   CallToolResultSchema = ResultSchema.extend({
     content: array(ContentBlockSchema).default([]),
-    structuredContent: record2(string3(), unknown()).optional(),
+    structuredContent: record3(string3(), unknown()).optional(),
     isError: boolean2().optional()
   });
   CompatibilityCallToolResultSchema = CallToolResultSchema.or(ResultSchema.extend({
@@ -59406,7 +59661,7 @@ var init_types2 = __esm(() => {
   }));
   CallToolRequestParamsSchema = TaskAugmentedRequestParamsSchema.extend({
     name: string3(),
-    arguments: record2(string3(), unknown()).optional()
+    arguments: record3(string3(), unknown()).optional()
   });
   CallToolRequestSchema = RequestSchema.extend({
     method: literal("tools/call"),
@@ -59455,7 +59710,7 @@ var init_types2 = __esm(() => {
     content: array(ContentBlockSchema).default([]),
     structuredContent: object2({}).loose().optional(),
     isError: boolean2().optional(),
-    _meta: record2(string3(), unknown()).optional()
+    _meta: record3(string3(), unknown()).optional()
   });
   SamplingContentSchema = discriminatedUnion("type", [TextContentSchema, ImageContentSchema, AudioContentSchema]);
   SamplingMessageContentBlockSchema = discriminatedUnion("type", [
@@ -59468,7 +59723,7 @@ var init_types2 = __esm(() => {
   SamplingMessageSchema = object2({
     role: RoleSchema,
     content: union2([SamplingMessageContentBlockSchema, array(SamplingMessageContentBlockSchema)]),
-    _meta: record2(string3(), unknown()).optional()
+    _meta: record3(string3(), unknown()).optional()
   });
   CreateMessageRequestParamsSchema = TaskAugmentedRequestParamsSchema.extend({
     messages: array(SamplingMessageSchema),
@@ -59581,7 +59836,7 @@ var init_types2 = __esm(() => {
     message: string3(),
     requestedSchema: object2({
       type: literal("object"),
-      properties: record2(string3(), PrimitiveSchemaDefinitionSchema),
+      properties: record3(string3(), PrimitiveSchemaDefinitionSchema),
       required: array(string3()).optional()
     })
   });
@@ -59605,7 +59860,7 @@ var init_types2 = __esm(() => {
   });
   ElicitResultSchema = ResultSchema.extend({
     action: _enum(["accept", "decline", "cancel"]),
-    content: preprocess((val) => val === null ? undefined : val, record2(string3(), union2([string3(), number2(), boolean2(), array(string3())])).optional())
+    content: preprocess((val) => val === null ? undefined : val, record3(string3(), union2([string3(), number2(), boolean2(), array(string3())])).optional())
   });
   ResourceTemplateReferenceSchema = object2({
     type: literal("ref/resource"),
@@ -59622,7 +59877,7 @@ var init_types2 = __esm(() => {
       value: string3()
     }),
     context: object2({
-      arguments: record2(string3(), string3()).optional()
+      arguments: record3(string3(), string3()).optional()
     }).optional()
   });
   CompleteRequestSchema = RequestSchema.extend({
@@ -59639,7 +59894,7 @@ var init_types2 = __esm(() => {
   RootSchema = object2({
     uri: string3().startsWith("file://"),
     name: string3().optional(),
-    _meta: record2(string3(), unknown()).optional()
+    _meta: record3(string3(), unknown()).optional()
   });
   ListRootsRequestSchema = RequestSchema.extend({
     method: literal("roots/list"),
@@ -66892,7 +67147,7 @@ var require_core = __commonJS((exports) => {
     errorsText(errors4 = this.errors, { separator = ", ", dataVar = "data" } = {}) {
       if (!errors4 || errors4.length === 0)
         return "No errors";
-      return errors4.map((e) => `${dataVar}${e.instancePath} ${e.message}`).reduce((text, msg) => text + separator + msg);
+      return errors4.map((e) => `${dataVar}${e.instancePath} ${e.message}`).reduce((text2, msg) => text2 + separator + msg);
     }
     $dataMetaSchema(metaSchema, keywordsJsonPointers) {
       const rules = this.RULES.all;
@@ -67303,8 +67558,8 @@ var require_multipleOf = __commonJS((exports) => {
       const { gen, data, schemaCode, it } = cxt;
       const prec = it.opts.multipleOfPrecision;
       const res = gen.let("res");
-      const invalid = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
-      cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid}))`);
+      const invalid2 = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
+      cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid2}))`);
     }
   };
   exports.default = def;
@@ -73400,13 +73655,13 @@ async function requestAuthApi(instance, path, options) {
       apiUrl: safeUrl
     });
   }
-  const text = await res.text();
-  const body = text ? parseJsonBody(text) : {};
+  const text2 = await res.text();
+  const body = text2 ? parseJsonBody(text2) : {};
   if (!res.ok) {
-    const record4 = isRecord5(body) ? body : {};
-    const detail = typeof record4.detail === "string" ? record4.detail : undefined;
-    const error2 = typeof record4.error === "string" ? record4.error : undefined;
-    const code = typeof record4.code === "string" ? record4.code : undefined;
+    const record5 = isRecord5(body) ? body : {};
+    const detail = typeof record5.detail === "string" ? record5.detail : undefined;
+    const error2 = typeof record5.error === "string" ? record5.error : undefined;
+    const code = typeof record5.code === "string" ? record5.code : undefined;
     throw new HostedApiError(detail || error2 || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -73417,15 +73672,15 @@ async function requestAuthApi(instance, path, options) {
   }
   return body;
 }
-function parseJsonBody(text) {
+function parseJsonBody(text2) {
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { detail: condenseErrorBody(text) };
+    return { detail: condenseErrorBody(text2) };
   }
 }
-function condenseErrorBody(text) {
-  const stripped = /<[a-z!/]/i.test(text) ? text.replace(/<(script|style)[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]*>/g, " ") : text;
+function condenseErrorBody(text2) {
+  const stripped = /<[a-z!/]/i.test(text2) ? text2.replace(/<(script|style)[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]*>/g, " ") : text2;
   const collapsed = stripped.replace(/\s+/g, " ").trim();
   if (collapsed.length <= MAX_ERROR_DETAIL_LENGTH)
     return collapsed;
@@ -73452,7 +73707,12 @@ class RemoteSkillsAuthClient {
   pollDevice(deviceCode) {
     return this.request("/api/auth/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) });
   }
-  async sessionClient(email2, code) {
+  async sessionClient(email2, code, context) {
+    if (context !== undefined) {
+      const target = workspaceContext(context), apiOrigin2 = this.apiOrigin;
+      const session = await this.switchWorkspace(email2, code, target);
+      return new RemoteSkillsClient(session.token, apiOrigin2);
+    }
     const apiOrigin = this.apiOrigin;
     if (!email2.includes("@") || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
@@ -73461,34 +73721,80 @@ class RemoteSkillsAuthClient {
       throw new Error("The server did not return an authorized account session");
     return new RemoteSkillsClient(login.token, apiOrigin);
   }
-  async createApiKey(email2, code, name, scopes) {
-    return (await this.sessionClient(email2, code)).createApiKey(name, scopes);
+  async listAccountWorkspaces(email2, code, expectedUserId) {
+    const login = await this.workspaceLogin(email2, code, expectedUserId);
+    const result2 = await new RemoteSkillsClient(login.token, login.apiOrigin).listAccountWorkspaces(login.userId);
+    return { userId: login.userId, ...result2 };
+  }
+  async switchWorkspace(email2, code, context) {
+    const target = workspaceContext(context);
+    const login = await this.workspaceLogin(email2, code, target.userId);
+    return new RemoteSkillsClient(login.token, login.apiOrigin).switchWorkspace(target);
+  }
+  async workspaceLogin(email2, code, expectedUserId) {
+    const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
+    const apiOrigin = this.apiOrigin;
+    if (typeof email2 !== "string" || !email2.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
+      throw new Error("Fresh email and six-digit verification code are required to manage this account");
+    let response;
+    try {
+      response = await fetch(`${apiOrigin}/api/auth/verify`, {
+        method: "POST",
+        redirect: "error",
+        credentials: "omit",
+        signal: AbortSignal.timeout(15000),
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email: email2, code })
+      });
+    } catch {
+      throw new HostedApiError("Unable to verify the Skills account.");
+    }
+    if (!response.ok) {
+      response.body?.cancel().catch(() => {});
+      throw new HostedApiError("Unable to verify the Skills account.", { status: response.status });
+    }
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, 64 * 1024)));
+    } catch {
+      throw new HostedApiError("The server returned an invalid account verification result.");
+    }
+    return { ...parseWorkspaceLogin(value, expected), apiOrigin };
   }
-  async listApiKeys(email2, code) {
-    return (await this.sessionClient(email2, code)).listApiKeys();
+  async createApiKey(email2, code, name, scopes, context) {
+    const capturedScopes = scopes === undefined ? undefined : [...scopes];
+    return (await this.sessionClient(email2, code, context)).createApiKey(name, capturedScopes);
   }
-  async revokeApiKey(email2, code, keyId) {
-    return (await this.sessionClient(email2, code)).revokeApiKey(keyId);
+  async listApiKeys(email2, code, context) {
+    return (await this.sessionClient(email2, code, context)).listApiKeys();
   }
-  async updateProfile(email2, code, input) {
-    customerNamePatch(input, "displayName");
-    return (await this.sessionClient(email2, code)).updateProfile(input);
+  async revokeApiKey(email2, code, keyId, context) {
+    return (await this.sessionClient(email2, code, context)).revokeApiKey(keyId);
   }
-  async updateCurrentWorkspace(email2, code, input) {
-    customerNamePatch(input, "name");
-    return (await this.sessionClient(email2, code)).updateCurrentWorkspace(input);
+  async updateProfile(email2, code, input, context) {
+    const body = customerNamePatch(input, "displayName");
+    return (await this.sessionClient(email2, code, context)).updateProfile({ displayName: body.displayName });
   }
-  async listWorkspaceMembers(email2, code, options = {}) {
+  async updateCurrentWorkspace(email2, code, input, context) {
+    const body = customerNamePatch(input, "name");
+    return (await this.sessionClient(email2, code, context)).updateCurrentWorkspace({ name: body.name });
+  }
+  async listWorkspaceMembers(email2, code, options = {}, context) {
     workspaceMembersQuery(options);
-    return (await this.sessionClient(email2, code)).listWorkspaceMembers(options);
+    const captured = { ...options };
+    return (await this.sessionClient(email2, code, context)).listWorkspaceMembers(captured);
   }
-  async setWorkspaceMemberRole(email2, code, membershipId, input) {
+  async setWorkspaceMemberRole(email2, code, membershipId, input, context) {
     const captured = workspaceMemberRoleInput(membershipId, input);
-    return (await this.sessionClient(email2, code)).setWorkspaceMemberRole(captured.membershipId, captured.body);
+    return (await this.sessionClient(email2, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
+  }
+  async leaveWorkspace(email2, code, context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    return (await this.sessionClient(email2, code, captured.context)).leaveWorkspace(captured.context, captured.input);
   }
-  async removeWorkspaceMember(email2, code, membershipId, input) {
+  async removeWorkspaceMember(email2, code, membershipId, input, context) {
     const captured = workspaceMemberRemovalInput(membershipId, input);
-    return (await this.sessionClient(email2, code)).removeWorkspaceMember(captured.membershipId, captured.body);
+    return (await this.sessionClient(email2, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
   }
   request(path, options) {
     if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
@@ -73498,6 +73804,9 @@ class RemoteSkillsAuthClient {
 }
 var MAX_ERROR_DETAIL_LENGTH = 200, HostedApiError;
 var init_remote_auth = __esm(() => {
+  init_remote_workspace_leave();
+  init_remote_workspace_selection();
+  init_remote_files();
   init_remote_workspace();
   init_remote_workspace();
   init_remote_client();
@@ -73520,6 +73829,224 @@ var init_remote_auth = __esm(() => {
   };
 });
 
+// src/lib/workspace-profile.ts
+import { constants as constants4, closeSync as closeSync4, fstatSync as fstatSync4, lstatSync as lstatSync6, mkdirSync as mkdirSync14, mkdtempSync as mkdtempSync4, openSync as openSync4, readFileSync as readFileSync25, renameSync as renameSync6, rmSync as rmSync7, writeFileSync as writeFileSync14 } from "fs";
+import { dirname as dirname10, join as join32 } from "path";
+function stat(path) {
+  try {
+    return lstatSync6(path);
+  } catch (error2) {
+    if (error2.code === "ENOENT")
+      return null;
+    throw error2;
+  }
+}
+function safeText(file) {
+  if (stat(file) === null)
+    return null;
+  const fd = openSync4(file, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
+  try {
+    const s = fstatSync4(fd);
+    if (!s.isFile() || s.size > 65536 || ![256, 384].includes(s.mode & 4095) || process.getuid && s.uid !== process.getuid())
+      return fail2("The selected profile must use bounded owner-only regular files.");
+    return readFileSync25(fd, "utf8");
+  } finally {
+    closeSync4(fd);
+  }
+}
+function checkIdentityMetadata(file, identity2) {
+  const text2 = safeText(file);
+  if (text2 === null)
+    return;
+  let value;
+  try {
+    value = JSON.parse(text2);
+  } catch {
+    return fail2("The profile identity metadata is invalid. Sign in again before managing this workspace.");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return fail2("The profile identity metadata is invalid.");
+  for (const [key, expected] of Object.entries({ userId: identity2.user.id, orgId: identity2.organization.id })) {
+    if (value[key] !== undefined && value[key] !== expected)
+      return fail2("The profile identity metadata does not match its authenticated key. Sign in again before managing this workspace.");
+  }
+}
+async function keyIdentity(key, origin) {
+  const value = await new RemoteSkillsClient(key, origin).getIdentity();
+  if (value.authMethod !== "api_key")
+    return fail2("The selected credential is not a workspace API key.");
+  const user = value.user;
+  return parseWorkspaceIdentity(value, workspaceExpectedUserId(user?.id));
+}
+function prepareProfileWorkspace(action, source = process.env) {
+  const env3 = { ...source }, origin = getApiUrl(action, env3), profile = selectedSkillsProfile(env3);
+  const unchanged2 = captureSkillsCredentialFiles(skillsProfileCredentialFiles(env3));
+  return { origin, async resolve() {
+    unchanged2();
+    if (!profile)
+      return { origin, context: undefined, unchanged: unchanged2 };
+    const connection = await resolveSkillsConnection(env3);
+    if (!connection || connection.apiOrigin !== origin)
+      return fail2("The selected profile has no usable credential for this server.");
+    const identity2 = await keyIdentity(connection.apiKey, origin);
+    checkIdentityMetadata(getIdentityFilePath(env3), identity2);
+    unchanged2();
+    const context = { userId: identity2.user.id, membershipId: identity2.user.membershipId };
+    return { origin, context, unchanged: unchanged2 };
+  } };
+}
+async function captureProfileWorkspace(action, source = process.env) {
+  return prepareProfileWorkspace(action, source).resolve();
+}
+async function prepareWorkspaceEnrollment(membershipId, source = process.env) {
+  workspaceExpectedUserId(membershipId);
+  const env3 = { ...source }, profile = selectedSkillsProfile(env3);
+  if (!profile)
+    return fail2("Workspace login requires an explicit HASNA_PROFILE name.");
+  if (["HASNA_SKILLS_API_KEY_OVERRIDE", "HASNA_SKILLS_API_KEY_REF", "HASNA_SKILLS_API_KEY", "SKILLS_API_KEY"].some((name) => env3[name]?.trim()))
+    return fail2("Clear injected API keys before enrolling a named workspace profile.");
+  const origin = getApiUrl("Sign in to a workspace", env3);
+  const file = getAuthFilePath(env3), identityFile = getIdentityFilePath(env3);
+  const paths = [...new Set([...skillsProfileCredentialFiles(env3), file, identityFile])];
+  const unchangedFiles = captureSkillsCredentialFiles(paths);
+  const old = safeText(file), oldIdentity = safeText(identityFile);
+  const managed = new Set(["HASNA_SKILLS_API_KEY", "SKILLS_API_KEY", "HASNA_SKILLS_API_URL", "SKILLS_API_URL", "HASNA_SKILLS_BOUND_API_URL"]);
+  const lines = (old ?? "").split(/\r?\n/).filter((line) => !managed.has(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line)?.[1] ?? ""));
+  const credentialBody = (key) => [...lines.filter(Boolean), `HASNA_SKILLS_API_KEY=${key}`, `HASNA_SKILLS_API_URL=${origin}`, `HASNA_SKILLS_BOUND_API_URL=${origin}`, ""].join(`
+`);
+  if (Buffer.byteLength(credentialBody("x".repeat(8192)), "utf8") > 65536)
+    return fail2("The selected profile has insufficient space for a bounded credential. Reduce its unrelated configuration before signing in.");
+  const parents = [];
+  for (let path = dirname10(file);; path = dirname10(path)) {
+    const before2 = stat(path);
+    if (before2 && (!before2.isDirectory() || before2.isSymbolicLink()))
+      return fail2("The profile directory must not be a symbolic link.");
+    parents.push([path, before2]);
+    if (path === dirname10(path))
+      break;
+  }
+  const unchanged2 = () => {
+    unchangedFiles();
+    for (const [path, before2] of parents) {
+      const now3 = stat(path);
+      if (!before2 ? now3 !== null : !now3 || !now3.isDirectory() || before2.dev !== now3.dev || before2.ino !== now3.ino)
+        changed();
+    }
+  };
+  let expected;
+  try {
+    const connection = await resolveSkillsConnection(env3);
+    if (connection) {
+      if (connection.apiKeyTier !== "profile" || connection.apiOrigin !== origin)
+        return fail2("Workspace login must resolve only the explicitly named profile.");
+      expected = await keyIdentity(connection.apiKey, origin);
+      checkIdentityMetadata(identityFile, expected);
+    }
+  } catch (error2) {
+    if (!(error2 instanceof SkillsFleetCredentialError && error2.code === "MISSING_API_CREDENTIAL" && (old === null || !/^\s*(?:export\s+)?(?:HASNA_SKILLS_API_KEY|SKILLS_API_KEY)\s*=/m.test(old))))
+      throw error2;
+  }
+  unchanged2();
+  return {
+    profile,
+    origin,
+    async complete(email2, code) {
+      unchanged2();
+      if (!email2.includes("@") || !/^\d{6}$/.test(code))
+        return fail2("A fresh email and six-digit verification code are required.");
+      if (expected && expected.user.email.toLowerCase() !== email2.toLowerCase())
+        return fail2("This profile belongs to another account. Use a different profile or ordinary replacement login.");
+      let issued = false;
+      try {
+        const result2 = await new RemoteSkillsAuthClient(origin).verifyCode(email2, code);
+        const login = parseWorkspaceLogin(result2, expected?.user.id);
+        if (result2.firstLogin === true)
+          return fail2("This sign-in created a new account using the server signup policy. Finish ordinary account login before enrolling a workspace profile.");
+        const session = await new RemoteSkillsClient(login.token, origin).switchWorkspace({ userId: login.userId, membershipId });
+        if (session.user.email.toLowerCase() !== email2.toLowerCase())
+          return fail2("The verified account does not match the requested email.");
+        if (session.user.role === "viewer")
+          return fail2("Viewer memberships cannot enroll API keys.");
+        unchanged2();
+        issued = true;
+        const created = await new RemoteSkillsClient(session.token, origin).createApiKey("cli");
+        const verified = await keyIdentity(created.key, origin);
+        if (verified.user.id !== session.user.id || verified.user.membershipId !== membershipId || verified.organization.id !== session.organization.id)
+          return fail2("The issued key does not match the selected workspace.");
+        unchanged2();
+        if (!created.key.trim() || /[^\x21-\x7e]/.test(created.key) || created.key.length > 8192)
+          return fail2("The server returned an invalid API key.");
+        const body = credentialBody(created.key);
+        if (Buffer.byteLength(body, "utf8") > 65536)
+          return fail2("The new profile exceeds the credential reader size limit.");
+        const identity2 = JSON.stringify({ email: verified.user.email, userId: verified.user.id, orgId: verified.organization.id, orgSlug: verified.organization.slug, apiUrl: origin }, null, 2) + `
+`;
+        mkdirSync14(dirname10(file), { recursive: true, mode: 448 });
+        const temp = mkdtempSync4(join32(dirname10(file), ".workspace-login-"));
+        let identityInstalled = false;
+        try {
+          writeFileSync14(join32(temp, "credentials"), body, { mode: 384, flag: "wx" });
+          writeFileSync14(join32(temp, "identity"), identity2, { mode: 384, flag: "wx" });
+          unchangedFiles();
+          for (const [path, before2] of parents) {
+            const now3 = stat(path);
+            if (!now3 || !now3.isDirectory() || now3.isSymbolicLink() || before2 && (before2.dev !== now3.dev || before2.ino !== now3.ino))
+              changed();
+            if (!before2 && now3 && ((now3.mode & 63) !== 0 || process.getuid && now3.uid !== process.getuid()))
+              changed();
+          }
+          renameSync6(join32(temp, "identity"), identityFile);
+          identityInstalled = true;
+          renameSync6(join32(temp, "credentials"), file);
+        } catch (error2) {
+          if (identityInstalled) {
+            if (oldIdentity === null)
+              rmSync7(identityFile, { force: true });
+            else {
+              writeFileSync14(join32(temp, "restore"), oldIdentity, { mode: 384, flag: "wx" });
+              renameSync6(join32(temp, "restore"), identityFile);
+            }
+          }
+          throw error2;
+        } finally {
+          rmSync7(temp, { recursive: true, force: true });
+        }
+        return {
+          status: "authenticated",
+          profile,
+          apiUrl: origin,
+          userId: verified.user.id,
+          email: verified.user.email,
+          membershipId,
+          organization: verified.organization.slug,
+          organizationId: verified.organization.id,
+          role: verified.user.role,
+          keyCreated: true
+        };
+      } catch (error2) {
+        if (issued)
+          return fail2("Workspace key issuance was attempted, but enrollment could not be confirmed. Inspect the selected profile and workspace keys before retrying; do not retry automatically.");
+        if (error2 instanceof WorkspaceProfileError)
+          throw error2;
+        return fail2("Unable to verify and select the workspace. Check the account, membership, selected server and fresh code. No enrollment key was requested.");
+      }
+    }
+  };
+}
+var WorkspaceProfileError, fail2 = (message) => {
+  throw new WorkspaceProfileError(message);
+}, changed = () => fail2("The selected profile changed during sign-in. No credential was saved; retry with a stable profile.");
+var init_workspace_profile = __esm(() => {
+  init_auth_store();
+  init_fleet_credentials();
+  init_instance_credentials();
+  init_remote_client();
+  init_remote_auth();
+  init_remote_workspace_selection();
+  WorkspaceProfileError = class WorkspaceProfileError extends Error {
+  };
+});
+
 // src/mcp/remote-customer-tools.ts
 function registerRemoteCustomerTools(server) {
   const memberRole = exports_external.enum(["owner", "admin", "member", "viewer"]);
@@ -73529,13 +74056,25 @@ function registerRemoteCustomerTools(server) {
     email: exports_external.string().email(),
     code: exports_external.string().regex(/^\d{6}$/)
   };
+  server.registerTool("leave_workspace", {
+    title: "Leave Current Workspace",
+    description: "Leave exactly the observed user and membership with confirm=true and fresh verification. The server enforces last-owner and last-workspace safeguards. Sign in again afterwards; no automatic retry or saved-profile deletion.",
+    annotations: { destructiveHint: true, idempotentHint: false, readOnlyHint: false },
+    inputSchema: exports_external.object({ ...memberInput, userId: memberInput.membershipId, confirm: exports_external.literal(true) }).strict()
+  }, async ({ membershipId, userId, expectedRole, email: email2, code, confirm }) => {
+    try {
+      return mcpJson(await freshAccount("Leave workspace", (client, context) => client.leaveWorkspace(email2, code, workspaceLeaveProfileContext(membershipId, userId, context), { expectedRole, confirm })));
+    } catch (error2) {
+      return error2 instanceof RemoteWorkspaceLeaveError || error2 instanceof RemoteWorkspaceLeaveUnconfirmedError ? mcpError(error2.code, error2.message) : mcpError("WORKSPACE_LEAVE_UNCONFIRMED", "Leaving could not be confirmed. Check the selected profile and exact membership, sign in again and inspect available workspaces before another action. Do not retry automatically; saved credentials are unchanged.");
+    }
+  });
   server.registerTool("set_workspace_member_role", {
     title: "Set Current Workspace Member Role",
     description: "Change exactly this membership incarnation with its observed expectedRole and fresh verification. The server enforces owner/admin policy. No automatic refresh or retry; saved credentials stay unchanged.",
     inputSchema: exports_external.object({ ...memberInput, role: memberRole }).strict()
-  }, async ({ membershipId, role, expectedRole, email: email2, code }) => {
+  }, async ({ membershipId, role: role2, expectedRole, email: email2, code }) => {
     try {
-      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("Set workspace member role")).setWorkspaceMemberRole(email2, code, membershipId, { role, expectedRole }));
+      return mcpJson(await freshAccount("Set workspace member role", (client, context) => client.setWorkspaceMemberRole(email2, code, membershipId, { role: role2, expectedRole }, context)));
     } catch (error2) {
       return memberError(error2);
     }
@@ -73546,7 +74085,7 @@ function registerRemoteCustomerTools(server) {
     inputSchema: exports_external.object(memberInput).strict()
   }, async ({ membershipId, expectedRole, email: email2, code }) => {
     try {
-      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("Remove workspace member")).removeWorkspaceMember(email2, code, membershipId, { expectedRole }));
+      return mcpJson(await freshAccount("Remove workspace member", (client, context) => client.removeWorkspaceMember(email2, code, membershipId, { expectedRole }, context)));
     } catch (error2) {
       return memberError(error2);
     }
@@ -73562,7 +74101,7 @@ function registerRemoteCustomerTools(server) {
     }).strict()
   }, async ({ email: email2, code, limit, cursor: cursor2 }) => {
     try {
-      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("List workspace members")).listWorkspaceMembers(email2, code, { limit, cursor: cursor2 }));
+      return mcpJson(await freshAccount("List workspace members", (client, context) => client.listWorkspaceMembers(email2, code, { limit, cursor: cursor2 }, context)));
     } catch {
       return mcpError("WORKSPACE_MEMBERS_FAILED", "Unable to list workspace members. Check the selected server, owner/admin permissions, pagination and fresh verification code.");
     }
@@ -73574,8 +74113,7 @@ function registerRemoteCustomerTools(server) {
       inputSchema: exports_external.object({ name: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }).strict()
     }, async ({ name, email: email2, code }) => {
       try {
-        const client = new RemoteSkillsAuthClient(getApiUrl("Update customer name"));
-        return mcpJson(kind === "profile" ? await client.updateProfile(email2, code, { displayName: name }) : await client.updateCurrentWorkspace(email2, code, { name }));
+        return mcpJson(await freshAccount("Update customer name", async (client, context) => kind === "profile" ? client.updateProfile(email2, code, { displayName: name }, context) : client.updateCurrentWorkspace(email2, code, { name }, context)));
       } catch {
         return mcpError("NAME_UPDATE_FAILED", "Unable to update the name. Check the selected server, name, permissions and fresh verification code.");
       }
@@ -73597,9 +74135,9 @@ function registerRemoteCustomerTools(server) {
     inputSchema: { email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }
   }, async ({ email: email2, code }) => {
     try {
-      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("List API keys")).listApiKeys(email2, code));
-    } catch (error2) {
-      return mcpError("KEY_LIST_FAILED", error2.message);
+      return mcpJson(await freshAccount("List API keys", (client, context) => client.listApiKeys(email2, code, context)));
+    } catch {
+      return mcpError("KEY_LIST_FAILED", "Unable to list API keys. Check the selected profile, server, account and fresh verification code.");
     }
   });
   server.registerTool("revoke_api_key", {
@@ -73608,9 +74146,9 @@ function registerRemoteCustomerTools(server) {
     inputSchema: { key_id: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }
   }, async ({ key_id, email: email2, code }) => {
     try {
-      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("Revoke API key")).revokeApiKey(email2, code, key_id));
-    } catch (error2) {
-      return mcpError("KEY_REVOKE_FAILED", error2.message);
+      return mcpJson(await freshAccount("Revoke API key", (client, context) => client.revokeApiKey(email2, code, key_id, context)));
+    } catch {
+      return mcpError("KEY_REVOKE_FAILED", "Unable to revoke this API key. Check the selected profile, key, account and fresh verification code.");
     }
   });
   server.registerTool("create_api_key", {
@@ -73618,10 +74156,11 @@ function registerRemoteCustomerTools(server) {
     description: "Create an API key using fresh email OTP reauthentication; returns its secret once. A stored API key cannot grant this authority.",
     inputSchema: { name: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/), scopes: exports_external.array(exports_external.string()).optional() }
   }, async ({ name, email: email2, code, scopes }) => {
+    const capturedScopes = scopes === undefined ? undefined : [...scopes];
     try {
-      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("Create API key")).createApiKey(email2, code, name, scopes));
-    } catch (error2) {
-      return mcpError("KEY_CREATION_FAILED", error2.message);
+      return mcpJson(await freshAccount("Create API key", (client, context) => client.createApiKey(email2, code, name, capturedScopes, context)));
+    } catch {
+      return mcpError("KEY_CREATION_FAILED", "API key creation could not be confirmed. Check the selected profile and workspace keys before retrying; a lost response may still have created a key.");
     }
   });
   server.registerTool("quote_skill", {
@@ -73655,12 +74194,18 @@ async function callRemote(action) {
     return mcpError("REMOTE_REQUEST_FAILED", error2 instanceof Error ? error2.message : "Skills server request failed");
   }
 }
+async function freshAccount(action, operation) {
+  const target = await captureProfileWorkspace(action);
+  target.unchanged();
+  return operation(new RemoteSkillsAuthClient(target.origin), target.context);
+}
 var init_remote_customer_tools = __esm(() => {
   init_zod();
   init_remote_auth();
-  init_auth_store();
+  init_workspace_profile();
   init_remote_customer_operations();
   init_remote_client();
+  init_remote_workspace_leave();
   init_helpers();
 });
 
@@ -74106,9 +74651,9 @@ var init_mcp2 = __esm(() => {
 });
 
 // src/cli/commands/runtime-mcp.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync14, readFileSync as readFileSync25, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync15, readFileSync as readFileSync26, writeFileSync as writeFileSync15 } from "fs";
 import { homedir as homedir7 } from "os";
-import { dirname as dirname10, join as join32 } from "path";
+import { dirname as dirname11, join as join33 } from "path";
 async function handleMcp(options) {
   if (options.register) {
     let agents;
@@ -74151,24 +74696,24 @@ async function registerMcpForAgent(agent, command) {
     case "codex":
       return registerCodexMcp(command);
     case "gemini":
-      return registerJsonMcpServer(agent, join32(homedir7(), ".gemini", "settings.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join33(homedir7(), ".gemini", "settings.json"), "mcpServers", {
         command,
         args: []
       });
     case "pi":
-      return registerJsonMcpServer(agent, join32(homedir7(), ".pi", "agent", "mcp.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join33(homedir7(), ".pi", "agent", "mcp.json"), "mcpServers", {
         command,
         args: []
       });
     case "opencode":
       return registerOpenCodeMcp(command);
     case "cursor":
-      return registerJsonMcpServer(agent, join32(homedir7(), ".cursor", "mcp.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join33(homedir7(), ".cursor", "mcp.json"), "mcpServers", {
         command,
         args: []
       });
     case "windsurf":
-      return registerJsonMcpServer(agent, join32(homedir7(), ".windsurf", "mcp.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join33(homedir7(), ".windsurf", "mcp.json"), "mcpServers", {
         command,
         args: []
       });
@@ -74191,7 +74736,7 @@ async function registerClaudeMcp(command) {
     if (exitCode === 0) {
       return { agent: "claude", success: true, command: cliCommand };
     }
-    const fallback = registerJsonMcpServer("claude", join32(homedir7(), ".claude", ".mcp.json"), "mcpServers", {
+    const fallback = registerJsonMcpServer("claude", join33(homedir7(), ".claude", ".mcp.json"), "mcpServers", {
       command,
       args: []
     });
@@ -74201,7 +74746,7 @@ async function registerClaudeMcp(command) {
       error: fallback.success ? undefined : `claude exited with ${exitCode}: ${(stderr || stdout).trim()}`
     };
   } catch (err) {
-    const fallback = registerJsonMcpServer("claude", join32(homedir7(), ".claude", ".mcp.json"), "mcpServers", {
+    const fallback = registerJsonMcpServer("claude", join33(homedir7(), ".claude", ".mcp.json"), "mcpServers", {
       command,
       args: []
     });
@@ -74213,11 +74758,11 @@ async function registerClaudeMcp(command) {
   }
 }
 function registerCodexMcp(command) {
-  const path = join32(homedir7(), ".codex", "config.toml");
+  const path = join33(homedir7(), ".codex", "config.toml");
   const config2 = `[mcp_servers.${MCP_SERVER_NAME}]
 command = ${JSON.stringify(command)}`;
   try {
-    const current = existsSync30(path) ? readFileSync25(path, "utf-8") : "";
+    const current = existsSync30(path) ? readFileSync26(path, "utf-8") : "";
     writeTextFile(path, upsertTomlSection(current, `[mcp_servers.${MCP_SERVER_NAME}]`, `command = ${JSON.stringify(command)}`));
     return { agent: "codex", success: true, path, config: config2 };
   } catch (err) {
@@ -74225,7 +74770,7 @@ command = ${JSON.stringify(command)}`;
   }
 }
 function registerOpenCodeMcp(command) {
-  const path = join32(homedir7(), ".config", "opencode", "opencode.json");
+  const path = join33(homedir7(), ".config", "opencode", "opencode.json");
   const config2 = JSON.stringify({
     $schema: "https://opencode.ai/config.json",
     mcp: {
@@ -74269,7 +74814,7 @@ function registerJsonMcpServer(agent, path, containerKey, server2) {
 function readJsonObject2(path) {
   if (!existsSync30(path))
     return {};
-  const raw = readFileSync25(path, "utf-8").trim();
+  const raw = readFileSync26(path, "utf-8").trim();
   if (!raw)
     return {};
   const parsed = JSON.parse(raw);
@@ -74282,8 +74827,8 @@ function writeJsonObject(path, data) {
 `);
 }
 function writeTextFile(path, content) {
-  mkdirSync14(dirname10(path), { recursive: true });
-  writeFileSync14(path, content.endsWith(`
+  mkdirSync15(dirname11(path), { recursive: true });
+  writeFileSync15(path, content.endsWith(`
 `) ? content : `${content}
 `);
 }
@@ -74313,7 +74858,7 @@ function findCommandOnPath(command) {
   for (const dir of pathValue.split(":")) {
     if (!dir)
       continue;
-    const candidate = join32(dir, command);
+    const candidate = join33(dir, command);
     if (existsSync30(candidate))
       return candidate;
   }
@@ -74375,8 +74920,8 @@ var exports_runtime = {};
 __export(exports_runtime, {
   registerRuntime: () => registerRuntime
 });
-import { lstatSync as lstatSync6, mkdirSync as mkdirSync15, readFileSync as readFileSync26, realpathSync as realpathSync2, writeFileSync as writeFileSync15 } from "fs";
-import { basename as basename5, isAbsolute as isAbsolute4, join as join33 } from "path";
+import { lstatSync as lstatSync7, mkdirSync as mkdirSync16, readFileSync as readFileSync27, realpathSync as realpathSync2, writeFileSync as writeFileSync16 } from "fs";
+import { basename as basename5, isAbsolute as isAbsolute4, join as join34 } from "path";
 import { createInterface } from "readline";
 function registerRuntime(parent) {
   parent.command("run").argument("<skill>", "Skill name").argument("[args...]", "Arguments to pass to the skill").allowUnknownOption(true).passThroughOptions(true).option("--json", "Output result as JSON", false).option("--remote", "Run on the configured server, using its catalog and quote", false).option("--yes", "Approve the server's quoted credit cost for this run", false).option("--idempotency-key <key>", "Reuse this key when retrying the same remote submission").option("--file <path>", "Attach a local input file to a remote run (repeatable)", (value, prior) => [...prior, value], []).option("--wait", "Poll remote runs until a terminal status", false).option("--poll-interval-ms <ms>", "Remote polling interval in milliseconds", "1000").option("--poll-timeout-ms <ms>", "Maximum time to wait for a remote run", "300000").description("Run a skill directly").action(async (name, args2, options) => handleRun(name, args2, options));
@@ -74650,10 +75195,10 @@ async function handleRun(name, args2, options) {
     try {
       parsePollingOptions(options);
       inputFiles = (options.file ?? []).map((path) => {
-        const info = lstatSync6(path);
+        const info = lstatSync7(path);
         if (!info.isFile() || info.size > 20 * 1024 * 1024)
           throw new Error("Input must be a regular file no larger than 20 MiB");
-        return { name: basename5(path), bytes: new Uint8Array(readFileSync26(path)) };
+        return { name: basename5(path), bytes: new Uint8Array(readFileSync27(path)) };
       });
       describeRemoteFiles(inputFiles);
       client = new RemoteSkillsClient(routing.apiKey, routing.apiOrigin);
@@ -75024,7 +75569,7 @@ async function handleExportsDownload(runId, options) {
     const canonicalSkill = typeof remoteRun.skill === "string" ? remoteRun.skill : "remote";
     const requestedSkill = typeof remoteRun.requestedSlug === "string" && remoteRun.requestedSlug.trim() ? remoteRun.requestedSlug : canonicalSkill;
     const exportDir = getRunExportDir(runId, requestedSkill);
-    mkdirSync15(exportDir, { recursive: true });
+    mkdirSync16(exportDir, { recursive: true });
     const downloaded = [];
     for (const artifact of artifacts) {
       const artifactId = String(artifact.id || "");
@@ -75032,9 +75577,9 @@ async function handleExportsDownload(runId, options) {
         continue;
       const verified = await client.getVerifiedRunArtifact(runId, artifactId);
       const relativePath = safeArtifactRelativePath(typeof artifact.relativePath === "string" ? artifact.relativePath : artifact.fileName, String(artifact.fileName || artifactId));
-      const outputPath = join33(exportDir, relativePath);
+      const outputPath = join34(exportDir, relativePath);
       ensureSafeExportParent(exportDir, relativePath);
-      writeFileSync15(outputPath, verified.bytes, { flag: "wx", mode: 384 });
+      writeFileSync16(outputPath, verified.bytes, { flag: "wx", mode: 384 });
       downloaded.push({ id: artifactId, path: outputPath, byteSize: verified.byteSize });
     }
     const payload = {
@@ -75071,14 +75616,14 @@ function ensureSafeExportParent(root, relativePath) {
   let parent = root;
   for (const part of ["", ...parts]) {
     if (part)
-      parent = join33(parent, part);
+      parent = join34(parent, part);
     try {
-      if (!lstatSync6(parent).isDirectory() || lstatSync6(parent).isSymbolicLink())
+      if (!lstatSync7(parent).isDirectory() || lstatSync7(parent).isSymbolicLink())
         throw new Error("Unsafe artifact directory");
     } catch (error2) {
       if (error2.code !== "ENOENT")
         throw error2;
-      mkdirSync15(parent, { mode: 448 });
+      mkdirSync16(parent, { mode: 448 });
     }
   }
 }
@@ -75416,7 +75961,7 @@ var init_completion = __esm(() => {
 // src/lib/portable-snapshot-filter.ts
 import { readdirSync as readdirSync16, statSync as statSync17 } from "fs";
 import { homedir as homedir8 } from "os";
-import { join as join34, sep as sep3 } from "path";
+import { join as join35, sep as sep3 } from "path";
 function isExcludedSkillFileName(fileName) {
   if (EXCLUDE_FILE_NAMES.has(fileName)) {
     return true;
@@ -75439,16 +75984,16 @@ function isPortableWithinSkill(relativeParts) {
 function homePathFor(definition, homesRoot) {
   const home = homesRoot ?? homedir8();
   if (definition.subClass === "skills" || definition.subClass === "custom") {
-    return join34(skillsDataRootForHome(home), definition.name);
+    return join35(skillsDataRootForHome(home), definition.name);
   }
   if (definition.agent === "opencode") {
-    return join34(home, ".config", "opencode", "skills");
+    return join35(home, ".config", "opencode", "skills");
   }
-  return join34(home, `.${definition.agent}`, "skills");
+  return join35(home, `.${definition.agent}`, "skills");
 }
 function destinationFor(definition, stationId, relativePath) {
-  const category = definition.subClass === "agent-homes" ? join34("agent-homes", definition.agent ?? "") : definition.name;
-  return join34("resources", stationId, "skills", category, ...relativePath.split(sep3));
+  const category = definition.subClass === "agent-homes" ? join35("agent-homes", definition.agent ?? "") : definition.name;
+  return join35("resources", stationId, "skills", category, ...relativePath.split(sep3));
 }
 function walkEntries(absoluteRoot) {
   let entries;
@@ -75459,7 +76004,7 @@ function walkEntries(absoluteRoot) {
   }
   const output = [];
   for (const entry of entries) {
-    const childFull = join34(absoluteRoot, entry.name);
+    const childFull = join35(absoluteRoot, entry.name);
     if (entry.isSymbolicLink()) {
       output.push({ kind: "symlink", relativePath: entry.name, fullPath: childFull });
       continue;
@@ -75470,7 +76015,7 @@ function walkEntries(absoluteRoot) {
       }
       const nested = walkEntries(childFull);
       for (const item of nested) {
-        output.push({ ...item, relativePath: join34(entry.name, item.relativePath) });
+        output.push({ ...item, relativePath: join35(entry.name, item.relativePath) });
       }
       continue;
     }
@@ -75566,19 +76111,19 @@ var init_portable_snapshot_filter = __esm(() => {
 import { createHash as createHash7 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
-  mkdirSync as mkdirSync16,
-  readFileSync as readFileSync27,
+  mkdirSync as mkdirSync17,
+  readFileSync as readFileSync28,
   statSync as statSync18,
-  writeFileSync as writeFileSync16
+  writeFileSync as writeFileSync17
 } from "fs";
-import { dirname as dirname12, isAbsolute as isAbsolute5, relative as relative5, resolve as resolve3, sep as sep4 } from "path";
+import { dirname as dirname13, isAbsolute as isAbsolute5, relative as relative5, resolve as resolve3, sep as sep4 } from "path";
 function validateStationId(stationId) {
   if (!/^[a-z0-9-]+$/.test(stationId)) {
     throw new StationSnapshotError("INVALID_STATION", `station id must be a slug, got: ${stationId}`);
   }
 }
 function sha256File(filePath) {
-  return createHash7("sha256").update(readFileSync27(filePath)).digest("hex");
+  return createHash7("sha256").update(readFileSync28(filePath)).digest("hex");
 }
 function scanHome(definition, homesRoot) {
   const homePath = homePathFor(definition, homesRoot);
@@ -75699,7 +76244,7 @@ function writeStationSnapshot(options) {
   let written = 0;
   for (const plan of untouched) {
     const destination = resolve3(repoRoot, plan.destination);
-    mkdirSync16(dirname12(destination), { recursive: true });
+    mkdirSync17(dirname13(destination), { recursive: true });
     copyFileSync2(plan.source.fullPath, destination);
     written += 1;
   }
@@ -75718,8 +76263,8 @@ function writeStationSnapshot(options) {
     files: manifestFiles
   };
   const manifestPath = resolve3(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
-  mkdirSync16(dirname12(manifestPath), { recursive: true });
-  writeFileSync16(manifestPath, `${JSON.stringify(manifest, null, 2)}
+  mkdirSync17(dirname13(manifestPath), { recursive: true });
+  writeFileSync17(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
   return {
     ...base2,
@@ -75751,7 +76296,7 @@ __export(exports_create_sync_config, {
   registerCreateSync: () => registerCreateSync
 });
 import { existsSync as existsSync31 } from "fs";
-import { join as join35 } from "path";
+import { join as join36 } from "path";
 function registerCreateSync(parent) {
   const configCmd = parent.command("config").description("Manage skills configuration");
   configCmd.command("show", { isDefault: true }).option("--json", "Output as JSON", false).description("Show current merged configuration").action((options) => {
@@ -75857,7 +76402,7 @@ function handleCreate(name, options) {
       console.log(source_default.green(`\u2713 Created custom skill '${result2.name}' at ${result2.path}`));
       console.log(source_default.dim(`  Category: ${result2.manifest.category}`));
       console.log(source_default.dim(`  Tags: ${result2.manifest.tags?.join(", ")}`));
-      console.log(`  ${source_default.cyan("Edit:")} ${join35(result2.path, "src", "index.ts")}`);
+      console.log(`  ${source_default.cyan("Edit:")} ${join36(result2.path, "src", "index.ts")}`);
       console.log(`  ${source_default.cyan("Run:")}  skills run ${result2.name} --help`);
     }
   } catch (error2) {
@@ -76136,27 +76681,27 @@ var init_create_sync_config = __esm(() => {
 import { createHash as createHash8 } from "crypto";
 import {
   copyFileSync as copyFileSync3,
-  mkdirSync as mkdirSync17,
+  mkdirSync as mkdirSync18,
   readdirSync as readdirSync17,
-  readFileSync as readFileSync28,
+  readFileSync as readFileSync29,
   statSync as statSync19,
-  writeFileSync as writeFileSync17
+  writeFileSync as writeFileSync18
 } from "fs";
-import { dirname as dirname13, join as join36, resolve as resolve4, sep as sep5 } from "path";
-function fail2(code, message, detail = []) {
+import { dirname as dirname14, join as join37, resolve as resolve4, sep as sep5 } from "path";
+function fail3(code, message, detail = []) {
   throw new StationSnapshotError(code, message, detail);
 }
 function snapshotRootFor(repoRoot, stationId) {
-  return join36(repoRoot, "resources", stationId, "skills");
+  return join37(repoRoot, "resources", stationId, "skills");
 }
 function readSnapshotManifest(repoRoot, stationId) {
   const snapshotRoot = snapshotRootFor(repoRoot, stationId);
-  const manifestPath = join36(snapshotRoot, "sync-manifest.json");
+  const manifestPath = join37(snapshotRoot, "sync-manifest.json");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync28(manifestPath, "utf8"));
+    manifest = JSON.parse(readFileSync29(manifestPath, "utf8"));
   } catch (error2) {
-    fail2("MANIFEST_UNREADABLE", `cannot read snapshot manifest: ${manifestPath}: ${error2.message}`);
+    fail3("MANIFEST_UNREADABLE", `cannot read snapshot manifest: ${manifestPath}: ${error2.message}`);
   }
   const sourceSnapshotSha = sha256File(manifestPath);
   return { manifest, manifestPath, sourceSnapshotSha };
@@ -76178,7 +76723,7 @@ function planStationHydration(stationId, repoRoot) {
   const hashMismatches = [];
   const skippedByRule = [];
   for (const agent of SYNC_AGENTS) {
-    const agentRoot = join36(snapshotRoot, "agent-homes", agent);
+    const agentRoot = join37(snapshotRoot, "agent-homes", agent);
     let identEntries;
     try {
       identEntries = readdirSync17(agentRoot, { withFileTypes: true });
@@ -76189,7 +76734,7 @@ function planStationHydration(stationId, repoRoot) {
       if (!identEntry.isDirectory() || identEntry.name.startsWith(".")) {
         continue;
       }
-      const identRoot = join36(agentRoot, identEntry.name);
+      const identRoot = join37(agentRoot, identEntry.name);
       const entries = walkEntries(identRoot);
       for (const entry of entries) {
         const relativeParts = [identEntry.name, ...entry.relativePath.split(sep5)];
@@ -76263,10 +76808,10 @@ function planStationHydration(stationId, repoRoot) {
     }
   }
   if (symlinks.length > 0) {
-    fail2("SYMLINKS_REFUSED", `${symlinks.length} symlink(s) inside the snapshot; symlinks are refused (fail closed)`);
+    fail3("SYMLINKS_REFUSED", `${symlinks.length} symlink(s) inside the snapshot; symlinks are refused (fail closed)`);
   }
   if (hashMismatches.length > 0) {
-    fail2("MANIFEST_HASH_MISMATCH", `${hashMismatches.length} snapshot file(s) no longer match their sync-manifest sha256; ` + "stale or tampered content is refused (fail closed), nothing written \u2014 re-run sync to refresh the manifest", hashMismatches.map((mismatch) => `agent-homes/${mismatch.agent}/${mismatch.ident}/${mismatch.relativePath}`));
+    fail3("MANIFEST_HASH_MISMATCH", `${hashMismatches.length} snapshot file(s) no longer match their sync-manifest sha256; ` + "stale or tampered content is refused (fail closed), nothing written \u2014 re-run sync to refresh the manifest", hashMismatches.map((mismatch) => `agent-homes/${mismatch.agent}/${mismatch.ident}/${mismatch.relativePath}`));
   }
   const byIdent = new Map;
   for (const candidate of candidates) {
@@ -76290,7 +76835,7 @@ function planStationHydration(stationId, repoRoot) {
         for (const copy of copies) {
           let isStub = false;
           try {
-            isStub = isPointerSkillMd(readFileSync28(copy.fullPath, "utf8"));
+            isStub = isPointerSkillMd(readFileSync29(copy.fullPath, "utf8"));
           } catch {
             isStub = false;
           }
@@ -76374,7 +76919,7 @@ function writeStationHydration(options) {
   const toWrite = [];
   for (const skill of plan.winners) {
     for (const file of skill.files) {
-      const destination = join36(cacheRoot, skill.ident, file.withinIdent);
+      const destination = join37(cacheRoot, skill.ident, file.withinIdent);
       const digest = sha256File(file.winner.fullPath);
       let existingDigest = null;
       try {
@@ -76391,11 +76936,11 @@ function writeStationHydration(options) {
     }
   }
   if (conflicts.length > 0) {
-    fail2("CONFLICT", `${conflicts.length} conflict(s); terminal non-acceptance, nothing written`, conflicts);
+    fail3("CONFLICT", `${conflicts.length} conflict(s); terminal non-acceptance, nothing written`, conflicts);
   }
   let written = 0;
   for (const entry of toWrite) {
-    mkdirSync17(dirname13(entry.destination), { recursive: true });
+    mkdirSync18(dirname14(entry.destination), { recursive: true });
     copyFileSync3(entry.fullPath, entry.destination);
     written += 1;
   }
@@ -76416,9 +76961,9 @@ function writeStationHydration(options) {
     },
     skills: resultSkills
   };
-  const hydrationManifestPath = join36(dirname13(cacheRoot), `hydration-${options.stationId}.json`);
-  mkdirSync17(dirname13(hydrationManifestPath), { recursive: true });
-  writeFileSync17(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
+  const hydrationManifestPath = join37(dirname14(cacheRoot), `hydration-${options.stationId}.json`);
+  mkdirSync18(dirname14(hydrationManifestPath), { recursive: true });
+  writeFileSync18(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
   return {
     ...base2,
@@ -76846,8 +77391,8 @@ var init_schedule = __esm(() => {
 });
 
 // src/lib/registry-sync.ts
-import { mkdirSync as mkdirSync18, writeFileSync as writeFileSync18 } from "fs";
-import { dirname as dirname14, relative as relative6 } from "path";
+import { mkdirSync as mkdirSync19, writeFileSync as writeFileSync19 } from "fs";
+import { dirname as dirname15, relative as relative6 } from "path";
 function createRegistrySyncArtifact(options = {}) {
   const profile = options.profile ?? "all";
   const includeDocs = options.includeDocs ?? true;
@@ -76904,8 +77449,8 @@ function createRegistrySyncArtifact(options = {}) {
   };
 }
 function writeRegistrySyncArtifact(path, artifact) {
-  mkdirSync18(dirname14(path), { recursive: true });
-  writeFileSync18(path, `${JSON.stringify(artifact, null, 2)}
+  mkdirSync19(dirname15(path), { recursive: true });
+  writeFileSync19(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
 function buildDocs(name) {
@@ -76935,10 +77480,10 @@ function registerRegistry(parent) {
   registry2.command("sync").description("Generate a deterministic registry sync artifact").option("--profile <profile>", "Registry profile: basic or all", "all").option("--output <path>", "Write artifact to a JSON file").option("--no-docs", "Exclude skill documentation content").option("--no-requirements", "Exclude extracted skill requirements").option("--no-validation", "Exclude validation results").option("--json", "Print artifact JSON to stdout", false).action((options) => handleRegistrySync(options));
 }
 async function writeJson2(value, space) {
-  const text = `${JSON.stringify(value, null, space)}
+  const text2 = `${JSON.stringify(value, null, space)}
 `;
   await new Promise((resolve5, reject2) => {
-    process.stdout.write(text, (error2) => {
+    process.stdout.write(text2, (error2) => {
       if (error2)
         reject2(error2);
       else
@@ -76970,10 +77515,10 @@ async function handleRegistrySync(options) {
     await writeJson2(artifact, 2);
     return;
   }
-  const invalid = artifact.summary.invalidSkillCount ?? "not checked";
+  const invalid2 = artifact.summary.invalidSkillCount ?? "not checked";
   console.log(source_default.green(`Registry sync artifact written to ${options.output}`));
   console.log(source_default.dim(`  Skills: ${artifact.summary.skillCount}`));
-  console.log(source_default.dim(`  Invalid: ${invalid}`));
+  console.log(source_default.dim(`  Invalid: ${invalid2}`));
 }
 function registerPull(parent) {
   parent.command("pull").argument("[names...]", "Skills to pull from the configured instance (name or name@version)").option("--all", "Pull every skill the instance serves", false).option("--for-machine", "Prepare this machine with the instance's full catalog (implies --all)", false).option("--json", "Output results as JSON", false).description("Fetch skills from the configured Skills instance into this machine's corpus").action(async (names, options) => {
@@ -77078,9 +77623,9 @@ __export(exports_publish, {
   PushSkillError: () => PushSkillError
 });
 import { execFileSync } from "child_process";
-import { existsSync as existsSync32, readFileSync as readFileSync29 } from "fs";
+import { existsSync as existsSync32, readFileSync as readFileSync30 } from "fs";
 import { hostname as hostname2 } from "os";
-import { join as join37 } from "path";
+import { join as join38 } from "path";
 function registerPublish(parent) {
   parent.command("push").argument("<name>", "Name of a skill in the local corpus (~/.hasna/skills/installed or the migrated ~/.hasna/skills/skills)").option("--version <version>", "Override the version recorded on the instance").option("--force-new-version", "If name@version already exists with different content, publish as the next patch version", false).option("--dry-run", "Pack and validate without uploading", false).option("--json", "Output result as JSON", false).description("Publish a local skill to the configured skills instance").action(async (name, options) => {
     try {
@@ -77127,8 +77672,8 @@ async function pushSkill(name, options = {}) {
   }
   const packed = packSkillBundle(skill.path, { maxUnpackedBytes: MAX_UNPACKED_BYTES });
   const versionManifest = buildVersionManifest(skill.path, packed);
-  const skillMdPath = join37(skill.path, "SKILL.md");
-  const skillMd = existsSync32(skillMdPath) ? readFileSync29(skillMdPath, "utf-8") : undefined;
+  const skillMdPath = join38(skill.path, "SKILL.md");
+  const skillMd = existsSync32(skillMdPath) ? readFileSync30(skillMdPath, "utf-8") : undefined;
   const base2 = {
     slug: skill.name,
     path: skill.path,
@@ -77193,21 +77738,21 @@ async function readPublishRevision(client, slug) {
     throw new PushSkillError("Publishing was refused because the current skill revision could not be verified.", ["Check the configured instance and connection, then retry the push. No upload was attempted."]);
   }
   const body = lookup.body;
-  const record4 = body !== null && typeof body === "object" && !Array.isArray(body) ? body : undefined;
-  const nestedError = record4?.error;
-  const code = typeof record4?.code === "string" ? record4.code : nestedError !== null && typeof nestedError === "object" && !Array.isArray(nestedError) ? nestedError.code : undefined;
+  const record5 = body !== null && typeof body === "object" && !Array.isArray(body) ? body : undefined;
+  const nestedError = record5?.error;
+  const code = typeof record5?.code === "string" ? record5.code : nestedError !== null && typeof nestedError === "object" && !Array.isArray(nestedError) ? nestedError.code : undefined;
   if (lookup.status === 404 && code === "SKILL_NOT_FOUND")
     return;
   if (lookup.status < 200 || lookup.status >= 300) {
     throw new PushSkillError(`Publishing was refused because the current skill lookup failed: HTTP ${lookup.status}.`, ["Only an explicit SKILL_NOT_FOUND response establishes an initial publish. Check access and server compatibility before retrying."]);
   }
-  const revision = record4?.revisionId;
-  if (record4?.publicationState === "catalogue-only") {
-    if (record4.name === slug && (record4.slug === undefined || record4.slug === slug) && revision === null)
+  const revision = record5?.revisionId;
+  if (record5?.publicationState === "catalogue-only") {
+    if (record5.name === slug && (record5.slug === undefined || record5.slug === slug) && revision === null)
       return;
     throw new PushSkillError("Publishing was refused because the catalogue-only response had contradictory identity or revision state.", ["Check the configured instance and server compatibility. No upload was attempted."]);
   }
-  if (record4?.slug !== slug || typeof revision !== "string" || revision.length === 0 || revision !== revision.trim() || !/^[\x21-\x7e]+$/.test(revision)) {
+  if (record5?.slug !== slug || typeof revision !== "string" || revision.length === 0 || revision !== revision.trim() || !/^[\x21-\x7e]+$/.test(revision)) {
     throw new PushSkillError("Publishing was refused because the current skill response did not contain a matching slug and valid revision.", ["Check the configured instance and server compatibility. No upload was attempted."]);
   }
   return revision;
@@ -77310,13 +77855,13 @@ Dry run: '${result2.slug}' would be published
   console.log("");
 }
 async function readBody(response) {
-  const text = await response.text();
-  if (!text.trim())
+  const text2 = await response.text();
+  if (!text2.trim())
     return null;
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return text;
+    return text2;
   }
 }
 function describeError(payload) {
@@ -77349,6 +77894,152 @@ var init_publish = __esm(() => {
   };
 });
 
+// src/cli/commands/customer-verification.ts
+import { emitKeypressEvents } from "readline";
+async function readCode() {
+  if (process.stdin.isTTY)
+    throw new NameInputError("Pipe a fresh six-digit verification code when using --code-stdin.");
+  let text2 = "";
+  for await (const chunk2 of process.stdin) {
+    text2 += chunk2.toString();
+    if (text2.length > 32)
+      throw new NameInputError("Supply only a six-digit verification code on stdin.");
+  }
+  const code = text2.trim();
+  if (!/^\d{6}$/.test(code))
+    throw new NameInputError("Supply only a six-digit verification code on stdin.");
+  return code;
+}
+function promptCode() {
+  const { stdin, stderr: output } = process;
+  const { isRaw: wasRaw, readableFlowing: wasFlowing } = stdin;
+  return new Promise((resolve5) => {
+    let value = "", settled = false;
+    const finish = (answer) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      stdin.off("keypress", keypress);
+      stdin.off("end", cancel);
+      process.off("SIGINT", cancel);
+      stdin.setRawMode(wasRaw);
+      if (wasFlowing !== true)
+        stdin.pause();
+      output.write(`
+`);
+      if (answer === null)
+        process.exitCode = 130;
+      resolve5(answer);
+    };
+    const cancel = () => finish(null);
+    const keypress = (text2, key) => {
+      if (key.ctrl && ["c", "d"].includes(key.name ?? "") || key.name === "escape")
+        return cancel();
+      if (key.name === "return" || key.name === "enter") {
+        if (value.length === 6)
+          return finish(value);
+        output.write(`
+Enter all six digits: `);
+        value = "";
+        return;
+      }
+      if (key.name === "backspace") {
+        if (value) {
+          value = value.slice(0, -1);
+          output.write("\b \b");
+        }
+      } else if (/^[0-9]$/.test(text2) && value.length < 6) {
+        value += text2;
+        output.write("*");
+      }
+    };
+    const timer = setTimeout(cancel, 5 * 60 * 1000);
+    emitKeypressEvents(stdin);
+    stdin.setRawMode(true);
+    stdin.on("keypress", keypress);
+    stdin.once("end", cancel);
+    process.once("SIGINT", cancel);
+    output.write("Enter the six-digit code sent to your email: ");
+    stdin.resume();
+  });
+}
+var NameInputError;
+var init_customer_verification = __esm(() => {
+  NameInputError = class NameInputError extends Error {
+  };
+});
+
+// src/cli/commands/workspace-selection.ts
+async function codeFor(client, options) {
+  if (!options.email?.includes("@"))
+    throw new NameInputError("Provide the account email with --email.");
+  if (options.codeStdin)
+    return readCode();
+  if (options.json || !process.stdin.isTTY || !process.stderr.isTTY)
+    throw new NameInputError("Use --code-stdin with a fresh verification code for noninteractive requests.");
+  await client.requestCode(options.email);
+  return promptCode();
+}
+function errorResult(error2, json) {
+  const message = error2 instanceof NameInputError || error2 instanceof WorkspaceProfileError ? error2.message : "Unable to complete workspace sign-in. Check the selected server, profile, account and fresh verification code.";
+  if (json)
+    console.log(JSON.stringify({ error: message }));
+  else
+    console.error(message);
+  process.exitCode = 1;
+}
+function registerWorkspaceListCommand(workspace) {
+  workspace.command("list").allowExcessArguments(false).description("Discover eligible workspaces with fresh sign-in; no credentials are saved").requiredOption("--email <email>", "Account email for fresh verification").option("--code-stdin", "Read a previously requested six-digit verification code from stdin").option("--json", "Output safe workspace identities as JSON").action(async (options) => {
+    try {
+      const origin = getApiUrl("Discover workspaces", { ...process.env });
+      const client = new RemoteSkillsAuthClient(origin);
+      const code = await codeFor(client, options);
+      if (code === null)
+        return;
+      const result2 = await client.listAccountWorkspaces(options.email, code);
+      if (options.json)
+        console.log(JSON.stringify({ apiUrl: origin, ...result2 }));
+      else {
+        console.log(`Account: ${result2.userId}
+API: ${origin}`);
+        for (const entry of result2.workspaces)
+          console.log(`${entry.current ? "*" : " "} ${entry.organization.name}	${entry.role}	${entry.membershipId}`);
+        console.log("* Initial sign-in workspace. Enroll a named profile with auth login --membership-id <id>.");
+      }
+    } catch (error2) {
+      errorResult(error2, options.json);
+    }
+  });
+}
+async function loginWorkspace(options) {
+  try {
+    const enrollment = await prepareWorkspaceEnrollment(options.membershipId);
+    const code = await codeFor(new RemoteSkillsAuthClient(enrollment.origin), options);
+    if (code === null)
+      return;
+    const result2 = await enrollment.complete(options.email, code);
+    if (options.json)
+      console.log(JSON.stringify(result2));
+    else
+      console.log(`Signed in as ${result2.email}
+Profile: ${result2.profile}
+API: ${result2.apiUrl}
+Workspace: ${result2.organization} (${result2.organizationId})
+Membership: ${result2.membershipId}
+Role: ${result2.role}
+One workspace key saved. Use HASNA_PROFILE=${result2.profile} for subsequent commands.`);
+  } catch (error2) {
+    errorResult(error2, options.json);
+  }
+}
+var init_workspace_selection = __esm(() => {
+  init_auth_store();
+  init_remote_auth();
+  init_workspace_profile();
+  init_customer_verification();
+});
+
 // src/cli/commands/auth.ts
 var exports_auth = {};
 __export(exports_auth, {
@@ -77434,13 +78125,13 @@ function authIdentityPayload(authSource, live, cached2, offline = false) {
   const root = recordField(live) ?? {};
   const data = recordField(root.data);
   const user = recordField(root.user) ?? recordField(data?.user);
-  const organization = recordField(root.organization) ?? recordField(root.org) ?? recordField(data?.organization);
+  const organization2 = recordField(root.organization) ?? recordField(root.org) ?? recordField(data?.organization);
   const email2 = stringField2(user?.email) ?? cached2?.email;
-  const orgSlug = stringField2(organization?.slug) ?? cached2?.orgSlug;
-  const orgName = stringField2(organization?.name);
+  const orgSlug = stringField2(organization2?.slug) ?? cached2?.orgSlug;
+  const orgName = stringField2(organization2?.name);
   const userId = stringField2(user?.id) ?? cached2?.userId;
-  const orgId = stringField2(organization?.id) ?? cached2?.orgId;
-  const role = stringField2(user?.role);
+  const orgId = stringField2(organization2?.id) ?? cached2?.orgId;
+  const role2 = stringField2(user?.role);
   return {
     status: "authenticated",
     authSource,
@@ -77450,7 +78141,7 @@ function authIdentityPayload(authSource, live, cached2, offline = false) {
     ...orgName ? { organizationName: orgName } : {},
     ...userId ? { userId } : {},
     ...orgId ? { orgId } : {},
-    ...role ? { role } : {}
+    ...role2 ? { role: role2 } : {}
   };
 }
 function printWhoami(payload) {
@@ -77748,15 +78439,19 @@ function registerAuth(parent) {
   const keys2 = auth.command("keys").description("Manage API keys on the configured instance");
   keys2.command("list").option("--json", "Output as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").action(async (options) => {
     try {
-      console.log(JSON.stringify(await new RemoteSkillsAuthClient(getApiUrl("List API keys")).listApiKeys(options.email, options.code), null, 2));
+      const target = await captureProfileWorkspace("List API keys");
+      target.unchanged();
+      console.log(JSON.stringify(await new RemoteSkillsAuthClient(target.origin).listApiKeys(options.email, options.code, target.context), null, 2));
     } catch (error2) {
       writeCommandError(error2, "Failed to list API keys", options.json);
     }
   });
   keys2.command("create").argument("<name>").option("--scope <scope>", "Limit key scope (repeatable)", (value, all) => [...all, value], []).option("--json", "Output the newly created key as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").description("Create a key; the returned secret is shown once and must be stored securely").action(async (name, options) => {
     try {
-      const client = new RemoteSkillsAuthClient(getApiUrl("Create API key"));
-      const created = await client.createApiKey(options.email, options.code, name, options.scope.length ? options.scope : undefined);
+      const target = await captureProfileWorkspace("Create API key");
+      const client = new RemoteSkillsAuthClient(target.origin);
+      target.unchanged();
+      const created = await client.createApiKey(options.email, options.code, name, options.scope.length ? options.scope : undefined, target.context);
       console.log(JSON.stringify(created, null, 2));
     } catch (error2) {
       writeCommandError(error2, "Failed to create API key", options.json);
@@ -77764,12 +78459,26 @@ function registerAuth(parent) {
   });
   keys2.command("revoke").argument("<key-id>").option("--json", "Output as JSON", false).requiredOption("--email <email>", "Account email for fresh reauthentication").requiredOption("--code <code>", "Fresh OTP requested through auth signup/login").action(async (id, options) => {
     try {
-      console.log(JSON.stringify(await new RemoteSkillsAuthClient(getApiUrl("Revoke API key")).revokeApiKey(options.email, options.code, id), null, 2));
+      const target = await captureProfileWorkspace("Revoke API key");
+      target.unchanged();
+      console.log(JSON.stringify(await new RemoteSkillsAuthClient(target.origin).revokeApiKey(options.email, options.code, id, target.context), null, 2));
     } catch (error2) {
       writeCommandError(error2, "Failed to revoke API key", options.json);
     }
   });
-  auth.command("login").description("Sign in with browser/device code or email code").option("--email <email>", "Email address (non-interactive)").option("--code <code>", "Verification code (non-interactive)").option("--api-key <key>", "Verify and store an API key").option("--device", "Use browser/device-code login", false).option("--no-open", "Do not open a browser for device-code login").option("--poll", "Poll until browser authentication completes in non-interactive mode", false).option("--poll-timeout-ms <ms>", "Maximum time to wait for device-code login").option("--json", "Output result as JSON", false).action(async (options) => {
+  auth.command("login").description("Sign in with browser/device code or email code").option("--email <email>", "Email address (non-interactive)").option("--code <code>", "Verification code (non-interactive)").option("--membership-id <id>", "Enroll an exact workspace membership into an explicit HASNA_PROFILE").option("--code-stdin", "Read a fresh six-digit code for workspace enrollment from stdin").option("--api-key <key>", "Verify and store an API key").option("--device", "Use browser/device-code login", false).option("--no-open", "Do not open a browser for device-code login").option("--poll", "Poll until browser authentication completes in non-interactive mode", false).option("--poll-timeout-ms <ms>", "Maximum time to wait for device-code login").option("--json", "Output result as JSON", false).action(async (options) => {
+    if (options.membershipId !== undefined) {
+      if (options.apiKey || options.device || options.code || options.poll) {
+        writeCommandError(new Error("Workspace login uses email and --code-stdin; do not combine it with device, API key or --code login."), "Invalid login options", options.json);
+        return;
+      }
+      await loginWorkspace({ ...options, membershipId: options.membershipId });
+      return;
+    }
+    if (options.codeStdin) {
+      writeCommandError(new Error("--code-stdin requires --membership-id for this login flow."), "Invalid login options", options.json);
+      return;
+    }
     if (options.apiKey) {
       await doApiKeyLogin(options.apiKey, options.json);
       return;
@@ -77877,6 +78586,8 @@ function registerAuth(parent) {
 }
 var isTTY, DEFAULT_DEVICE_POLL_TIMEOUT_MS, CONFIG_HINT_STATUSES;
 var init_auth = __esm(() => {
+  init_workspace_selection();
+  init_workspace_profile();
   init_source();
   init_auth_store();
   init_fleet_credentials();
@@ -77886,80 +78597,51 @@ var init_auth = __esm(() => {
   CONFIG_HINT_STATUSES = new Set([401, 403, 404, 405, 501]);
 });
 
-// src/cli/commands/customer-verification.ts
-import { emitKeypressEvents } from "readline";
-async function readCode() {
-  if (process.stdin.isTTY)
-    throw new NameInputError("Pipe a fresh six-digit verification code when using --code-stdin.");
-  let text = "";
-  for await (const chunk2 of process.stdin) {
-    text += chunk2.toString();
-    if (text.length > 32)
-      throw new NameInputError("Supply only a six-digit verification code on stdin.");
-  }
-  const code = text.trim();
-  if (!/^\d{6}$/.test(code))
-    throw new NameInputError("Supply only a six-digit verification code on stdin.");
-  return code;
-}
-function promptCode() {
-  const { stdin, stderr: output } = process;
-  const { isRaw: wasRaw, readableFlowing: wasFlowing } = stdin;
-  return new Promise((resolve5) => {
-    let value = "", settled = false;
-    const finish = (answer) => {
-      if (settled)
-        return;
-      settled = true;
-      clearTimeout(timer);
-      stdin.off("keypress", keypress);
-      stdin.off("end", cancel);
-      process.off("SIGINT", cancel);
-      stdin.setRawMode(wasRaw);
-      if (wasFlowing !== true)
-        stdin.pause();
-      output.write(`
-`);
-      if (answer === null)
-        process.exitCode = 130;
-      resolve5(answer);
-    };
-    const cancel = () => finish(null);
-    const keypress = (text, key) => {
-      if (key.ctrl && ["c", "d"].includes(key.name ?? "") || key.name === "escape")
-        return cancel();
-      if (key.name === "return" || key.name === "enter") {
-        if (value.length === 6)
-          return finish(value);
-        output.write(`
-Enter all six digits: `);
-        value = "";
-        return;
-      }
-      if (key.name === "backspace") {
-        if (value) {
-          value = value.slice(0, -1);
-          output.write("\b \b");
-        }
-      } else if (/^[0-9]$/.test(text) && value.length < 6) {
-        value += text;
-        output.write("*");
+// src/cli/commands/workspace-leave.ts
+function registerWorkspaceLeaveCommand(workspace) {
+  workspace.command("leave <membership-id>").allowExcessArguments(false).description("Leave exactly this membership after fresh verification; saved profiles stay unchanged").requiredOption("--expected-role <role>", "Observed role: owner, admin, member or viewer").requiredOption("--email <email>", "Account email for fresh verification").requiredOption("--confirm", "Confirm losing access through this membership and signing in again").option("--user-id <id>", "Observed user ID; required without a named workspace profile").option("--code-stdin", "Read a previously requested six-digit verification code from stdin").option("--json", "Output the confirmed result as JSON").action(async (membershipId, options) => {
+    try {
+      if (options.confirm !== true)
+        throw new WorkspaceLeaveInputError;
+      const pending = prepareProfileWorkspace("Leave workspace");
+      const target = await pending.resolve();
+      const captured = workspaceLeaveInput(workspaceLeaveProfileContext(membershipId, options.userId, target.context), { expectedRole: options.expectedRole, confirm: true });
+      if (!options.email.includes("@"))
+        throw new NameInputError("Provide the verified account email.");
+      if (!options.codeStdin && (options.json || !process.stdin.isTTY || !process.stderr.isTTY))
+        throw new NameInputError("Use --code-stdin with a fresh verification code for noninteractive leave actions.");
+      const client = new RemoteSkillsAuthClient(target.origin);
+      let code;
+      if (options.codeStdin)
+        code = await readCode();
+      else {
+        await client.requestCode(options.email);
+        code = await promptCode();
       }
-    };
-    const timer = setTimeout(cancel, 5 * 60 * 1000);
-    emitKeypressEvents(stdin);
-    stdin.setRawMode(true);
-    stdin.on("keypress", keypress);
-    stdin.once("end", cancel);
-    process.once("SIGINT", cancel);
-    output.write("Enter the six-digit code sent to your email: ");
-    stdin.resume();
+      if (code === null)
+        return;
+      target.unchanged();
+      const result2 = await client.leaveWorkspace(options.email, code, captured.context, captured.input);
+      if (options.json)
+        console.log(JSON.stringify(result2));
+      else
+        console.log("Workspace membership left. Sign in again to an available workspace. Saved credentials are unchanged; this membership's credentials no longer grant access.");
+    } catch (error2) {
+      const known = error2 instanceof RemoteWorkspaceLeaveError || error2 instanceof RemoteWorkspaceLeaveUnconfirmedError;
+      const message = known || error2 instanceof WorkspaceLeaveInputError || error2 instanceof NameInputError ? error2.message : "Leaving could not be confirmed. Check the selected profile and exact membership, sign in again and inspect available workspaces before another action. Do not retry automatically; saved credentials are unchanged.";
+      if (options.json)
+        console.log(JSON.stringify({ error: message, ...known ? { code: error2.code } : {} }));
+      else
+        console.error(message);
+      process.exitCode = 1;
+    }
   });
 }
-var NameInputError;
-var init_customer_verification = __esm(() => {
-  NameInputError = class NameInputError extends Error {
-  };
+var init_workspace_leave = __esm(() => {
+  init_workspace_profile();
+  init_remote_auth();
+  init_remote_workspace_leave();
+  init_customer_verification();
 });
 
 // src/cli/commands/workspace-members.ts
@@ -77970,7 +78652,8 @@ function registerWorkspaceMembersCommand(workspace) {
         throw new NameInputError("Use a roster limit from 1 to 100.");
       const page = { limit: options.limit === undefined ? undefined : Number(options.limit), cursor: options.cursor };
       workspaceMembersQuery(page);
-      const client = new RemoteSkillsAuthClient(getApiUrl("List workspace members"));
+      const pending = prepareProfileWorkspace("List workspace members");
+      const client = new RemoteSkillsAuthClient(pending.origin);
       if (!options.codeStdin && (options.json || !process.stdin.isTTY || !process.stderr.isTTY))
         throw new NameInputError("Use --code-stdin with a fresh verification code for JSON or noninteractive roster requests.");
       let code;
@@ -77982,16 +78665,18 @@ function registerWorkspaceMembersCommand(workspace) {
       }
       if (code === null)
         return;
-      const result2 = await client.listWorkspaceMembers(options.email, code, page);
+      const target = await pending.resolve();
+      target.unchanged();
+      const result2 = await client.listWorkspaceMembers(options.email, code, page, target.context);
       if (options.json)
         console.log(JSON.stringify(result2));
       else {
-        const text = (value) => value.replace(/[\p{Cc}\p{Cs}\u2028\u2029]/gu, " ");
+        const text2 = (value) => value.replace(/[\p{Cc}\p{Cs}\u2028\u2029]/gu, " ");
         console.log(`Workspace: ${result2.organizationId}`);
         if (!result2.members.length)
           console.log("No members in this page.");
         for (const member of result2.members)
-          console.log(`${text(member.email)}	${member.role}	${text(member.displayName ?? "")}	${member.membershipId}	${member.createdAt}`);
+          console.log(`${text2(member.email)}	${member.role}	${text2(member.displayName ?? "")}	${member.membershipId}	${member.createdAt}`);
         if (result2.nextCursor !== null)
           console.log(`Next cursor: ${result2.nextCursor}`);
       }
@@ -78007,7 +78692,7 @@ function registerWorkspaceMembersCommand(workspace) {
   });
 }
 var init_workspace_members = __esm(() => {
-  init_auth_store();
+  init_workspace_profile();
   init_remote_auth();
   init_remote_workspace();
   init_customer_verification();
@@ -78023,7 +78708,8 @@ function registerWorkspaceMemberMutationCommands(workspace) {
     command.action(async (membershipId, options) => {
       try {
         const captured = action === "role" ? { kind: "role", ...workspaceMemberRoleInput(membershipId, { role: options.role, expectedRole: options.expectedRole }) } : { kind: "remove", ...workspaceMemberRemovalInput(membershipId, { expectedRole: options.expectedRole }) };
-        const client = new RemoteSkillsAuthClient(getApiUrl("Manage workspace member"));
+        const pending = prepareProfileWorkspace("Manage workspace member");
+        const client = new RemoteSkillsAuthClient(pending.origin);
         if (!options.codeStdin && (options.json || !process.stdin.isTTY || !process.stderr.isTTY))
           throw new NameInputError("Use --code-stdin with a fresh verification code for JSON or noninteractive member actions.");
         let code;
@@ -78035,14 +78721,16 @@ function registerWorkspaceMemberMutationCommands(workspace) {
         }
         if (code === null)
           return;
+        const target = await pending.resolve();
+        target.unchanged();
         if (captured.kind === "role") {
-          const result2 = await client.setWorkspaceMemberRole(options.email, code, captured.membershipId, captured.body);
+          const result2 = await client.setWorkspaceMemberRole(options.email, code, captured.membershipId, captured.body, target.context);
           if (options.json)
             console.log(JSON.stringify(result2));
           else
             console.log(result2.changed ? `Member role changed to ${result2.member.role}.` : `Member already has role ${result2.member.role}.`);
         } else {
-          const result2 = await client.removeWorkspaceMember(options.email, code, captured.membershipId, captured.body);
+          const result2 = await client.removeWorkspaceMember(options.email, code, captured.membershipId, captured.body, target.context);
           if (options.json)
             console.log(JSON.stringify(result2));
           else
@@ -78062,7 +78750,7 @@ function registerWorkspaceMemberMutationCommands(workspace) {
   }
 }
 var init_workspace_member_mutations = __esm(() => {
-  init_auth_store();
+  init_workspace_profile();
   init_remote_auth();
   init_remote_client();
   init_remote_workspace();
@@ -78077,8 +78765,10 @@ __export(exports_customer_profile, {
 function registerCustomerProfileCommands(program2) {
   const account = program2.command("account").description("Manage your account on the selected Skills server");
   const workspace = program2.command("workspace").description("Manage the current workspace on the selected Skills server");
+  registerWorkspaceListCommand(workspace);
   registerWorkspaceMembersCommand(workspace);
   registerWorkspaceMemberMutationCommands(workspace);
+  registerWorkspaceLeaveCommand(workspace);
   const commands = [
     { kind: "account", command: account.command("update") },
     { kind: "workspace", command: workspace.command("update") }
@@ -78086,7 +78776,8 @@ function registerCustomerProfileCommands(program2) {
   for (const { kind, command } of commands) {
     command.allowExcessArguments(false).description(kind === "account" ? "Update your display name with fresh email verification" : "Update the current workspace name as an owner or admin").requiredOption(kind === "account" ? "--display-name <name>" : "--name <name>", "New name (1\u2013100 characters)").requiredOption("--email <email>", "Account email for fresh verification").option("--code-stdin", "Read a previously requested six-digit verification code from stdin").option("--json", "Output JSON").action(async (options) => {
       try {
-        const client = new RemoteSkillsAuthClient(getApiUrl(`Update ${kind} name`));
+        const pending = prepareProfileWorkspace(`Update ${kind} name`);
+        const client = new RemoteSkillsAuthClient(pending.origin);
         customerNamePatch(kind === "account" ? { displayName: options.displayName } : { name: options.name }, kind === "account" ? "displayName" : "name");
         if (!options.codeStdin && (options.json || !process.stdin.isTTY || !process.stderr.isTTY)) {
           throw new NameInputError("Use --code-stdin with a fresh verification code for JSON or noninteractive updates.");
@@ -78100,7 +78791,9 @@ function registerCustomerProfileCommands(program2) {
         }
         if (code === null)
           return;
-        const result2 = kind === "account" ? await client.updateProfile(options.email, code, { displayName: options.displayName }) : await client.updateCurrentWorkspace(options.email, code, { name: options.name });
+        const target = await pending.resolve();
+        target.unchanged();
+        const result2 = kind === "account" ? await client.updateProfile(options.email, code, { displayName: options.displayName }, target.context) : await client.updateCurrentWorkspace(options.email, code, { name: options.name }, target.context);
         if (options.json)
           console.log(JSON.stringify(result2));
         else
@@ -78118,9 +78811,11 @@ function registerCustomerProfileCommands(program2) {
   }
 }
 var init_customer_profile = __esm(() => {
-  init_auth_store();
+  init_workspace_profile();
+  init_workspace_selection();
   init_remote_auth();
   init_customer_verification();
+  init_workspace_leave();
   init_workspace_members();
   init_workspace_member_mutations();
 });
@@ -78265,8 +78960,8 @@ var init_storage = __esm(() => {
 });
 
 // src/lib/registry-reconcile.ts
-import { existsSync as existsSync33, readFileSync as readFileSync30, statSync as statSync20, writeFileSync as writeFileSync19 } from "fs";
-import { join as join38 } from "path";
+import { existsSync as existsSync33, readFileSync as readFileSync31, statSync as statSync20, writeFileSync as writeFileSync20 } from "fs";
+import { join as join39 } from "path";
 function isDirectory2(path) {
   try {
     return statSync20(path).isDirectory();
@@ -78277,15 +78972,15 @@ function isDirectory2(path) {
 function migrationNeeded(options) {
   if (options.rootDir)
     return false;
-  const appDir = options.homeDir ? join38(options.homeDir, ".hasna", "skills") : getDataDir();
-  return !(isOwnerLayoutMigrated(appDir) && isDirectory2(join38(appDir, SKILLS_CACHE_DIRNAME)));
+  const appDir = options.homeDir ? join39(options.homeDir, ".hasna", "skills") : getDataDir();
+  return !(isOwnerLayoutMigrated(appDir) && isDirectory2(join39(appDir, SKILLS_CACHE_DIRNAME)));
 }
 function readBaseline(skillDir) {
-  const markerPath = join38(skillDir, PULL_MARKER_FILE);
+  const markerPath = join39(skillDir, PULL_MARKER_FILE);
   if (!existsSync33(markerPath))
     return;
   try {
-    const marker = JSON.parse(readFileSync30(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync31(markerPath, "utf-8"));
     if (!isSkillsOwnershipMarker(marker))
       return;
     return {
@@ -78297,11 +78992,11 @@ function readBaseline(skillDir) {
   }
 }
 function readCursor(root) {
-  const path = join38(root, SYNC_CURSOR_FILE);
+  const path = join39(root, SYNC_CURSOR_FILE);
   if (!existsSync33(path))
     return { runCount: 0 };
   try {
-    const cursor2 = JSON.parse(readFileSync30(path, "utf-8"));
+    const cursor2 = JSON.parse(readFileSync31(path, "utf-8"));
     return { runCount: typeof cursor2.runCount === "number" ? cursor2.runCount : 0 };
   } catch {
     return { runCount: 0 };
@@ -78310,21 +79005,21 @@ function readCursor(root) {
 function resolveCorpusRootReadOnly(options) {
   if (options.rootDir)
     return { root: options.rootDir, migrationPending: false };
-  const appDir = options.homeDir ? join38(options.homeDir, ".hasna", "skills") : getDataDirReadOnly();
-  const cache3 = join38(appDir, SKILLS_CACHE_DIRNAME);
+  const appDir = options.homeDir ? join39(options.homeDir, ".hasna", "skills") : getDataDirReadOnly();
+  const cache3 = join39(appDir, SKILLS_CACHE_DIRNAME);
   if (isOwnerLayoutMigrated(appDir) && isDirectory2(cache3)) {
     return { root: cache3, migrationPending: false };
   }
-  return { root: join38(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
+  return { root: join39(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
 }
-function remoteRowToSkill(record4) {
-  const slug = typeof record4.slug === "string" ? record4.slug : typeof record4.name === "string" ? record4.name : undefined;
+function remoteRowToSkill(record5) {
+  const slug = typeof record5.slug === "string" ? record5.slug : typeof record5.name === "string" ? record5.name : undefined;
   if (!slug)
     return;
   return {
     slug,
-    version: typeof record4.version === "string" ? record4.version : undefined,
-    sha256: typeof record4.bundleSha256 === "string" && record4.bundleSha256 ? record4.bundleSha256 : undefined
+    version: typeof record5.version === "string" ? record5.version : undefined,
+    sha256: typeof record5.bundleSha256 === "string" && record5.bundleSha256 ? record5.bundleSha256 : undefined
   };
 }
 function recheckLocalSide(plannedLocal, localDir, ops = {
@@ -78449,7 +79144,7 @@ async function reconcileRegistry(options = {}) {
   for (const slug of allSlugs) {
     const local = locals.get(slug);
     const remote = remotes.get(slug);
-    const baseline = local ? readBaseline(join38(root, slug)) : undefined;
+    const baseline = local ? readBaseline(join39(root, slug)) : undefined;
     const { state, reason } = classifySkill(local, remote, baseline);
     let { action, reason: actionReason } = resolveAction(state, direction, conflict);
     if (state === "remote-only" && isDigestless(remote)) {
@@ -78508,7 +79203,7 @@ async function reconcileRegistry(options = {}) {
       try {
         await pushSkill(slug, { rootDir: root, client });
         const pushed = locals.get(slug);
-        writePullMarker(join38(root, slug), {
+        writePullMarker(join39(root, slug), {
           skill: slug,
           ...pushed?.version ? { version: pushed.version } : {},
           ...pushed?.sha256 ? { contentHash: pushed.sha256 } : {},
@@ -78580,7 +79275,7 @@ async function reconcileRegistry(options = {}) {
         runCount: readCursor(root).runCount + 1,
         summary
       };
-      writeFileSync19(join38(root, SYNC_CURSOR_FILE), `${JSON.stringify(cursor2, null, 2)}
+      writeFileSync20(join39(root, SYNC_CURSOR_FILE), `${JSON.stringify(cursor2, null, 2)}
 `);
       return {
         corpusRoot: root,