@hasna/skills 0.5.0 → 0.5.2

package/dist/index.js

@@ -10254,12 +10254,106 @@ function primitiveHaystack(primitive) {
 function clone(value) {
   return value === undefined ? undefined : JSON.parse(JSON.stringify(value));
 }
+// src/lib/remote-workspace-selection.ts
+var record = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var uuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
+var text = (v, max = 1024) => typeof v === "string" && !!v.trim() && v.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v);
+var role = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v);
+var invalidWorkspaceResult = "The server returned an invalid workspace selection result.";
+
+class WorkspaceContextInputError extends Error {
+  constructor() {
+    super("Provide the observed user ID and exact lowercase membership ID.");
+    this.name = "WorkspaceContextInputError";
+  }
+}
+
+class WorkspaceIdentityMismatchError extends Error {
+  constructor() {
+    super("The verified account does not match the requested workspace context.");
+    this.name = "WorkspaceIdentityMismatchError";
+  }
+}
+function workspaceExpectedUserId(value) {
+  if (!uuid(value))
+    throw new WorkspaceContextInputError;
+  return value;
+}
+function workspaceContext(value) {
+  if (!record(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid(value.userId) || !uuid(value.membershipId))
+    throw new WorkspaceContextInputError;
+  return { userId: value.userId, membershipId: value.membershipId };
+}
+function invalid() {
+  throw new Error(invalidWorkspaceResult);
+}
+function organization(v) {
+  if (!record(v) || !uuid(v.id) || !text(v.slug) || !text(v.name))
+    return invalid();
+  return { id: v.id, slug: v.slug, name: v.name };
+}
+function parseAccountWorkspaces(value) {
+  if (!record(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
+    return invalid();
+  const workspaces = value.workspaces.map((v) => {
+    if (!record(v) || !uuid(v.membershipId) || !role(v.role) || typeof v.current !== "boolean")
+      return invalid();
+    return { membershipId: v.membershipId, organization: organization(v.organization), role: v.role, current: v.current };
+  });
+  if (workspaces.filter((w) => w.current).length !== 1 || new Set(workspaces.map((w) => w.membershipId)).size !== workspaces.length || new Set(workspaces.map((w) => w.organization.id)).size !== workspaces.length)
+    return invalid();
+  return { workspaces };
+}
+function parseWorkspaceIdentity(value, expectedUserId) {
+  if (!record(value))
+    return invalid();
+  const user = value.user;
+  if (!record(user) || !uuid(user.id) || !uuid(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role(user.role))
+    return invalid();
+  if (user.id !== expectedUserId)
+    throw new WorkspaceIdentityMismatchError;
+  return { user: { id: user.id, membershipId: user.membershipId, email: user.email, displayName: user.displayName, role: user.role }, organization: organization(value.organization) };
+}
+function sessionToken(value) {
+  if (typeof value !== "string" || !value || value.length > 8192 || /[^\x21-\x7e]/.test(value) || value.startsWith("sk_"))
+    return invalid();
+  return value;
+}
+function parseWorkspaceSession(value, expected) {
+  const identity = parseWorkspaceIdentity(value, expected.userId);
+  if (identity.user.membershipId !== expected.membershipId)
+    throw new WorkspaceIdentityMismatchError;
+  return { token: sessionToken(value.token), ...identity };
+}
+function parseWorkspaceLogin(value, expectedUserId) {
+  const user = record(value) && value.user;
+  if (!record(value) || !record(user) || !uuid(user.id))
+    return invalid();
+  if (expectedUserId !== undefined && user.id !== expectedUserId)
+    throw new WorkspaceIdentityMismatchError;
+  return { token: sessionToken(value.token), userId: user.id };
+}
+var workspaceSelectionFailures = {
+  INVALID_WORKSPACE_SELECTION: [400, "Provide only the exact membership ID from your workspace list."],
+  SESSION_EXPIRED: [401, "Sign in again before selecting a workspace."],
+  ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+  INTERACTIVE_SESSION_REQUIRED: [403, "Interactive sign-in is required to select a workspace."],
+  WORKSPACE_UNAVAILABLE: [404, "Workspace is unavailable. Refresh your workspace list."],
+  WORKSPACE_BUSY: [503, "Workspace is busy. Refresh before retrying."]
+};
+function workspaceSelectionFailure(value, status) {
+  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
+    return null;
+  const code = value.code;
+  return workspaceSelectionFailures[code][0] === status ? code : null;
+}
+
 // src/lib/remote-workspace.ts
-var record = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+var record2 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
 var cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value);
-var uuid = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value);
+var uuid2 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value);
 function workspaceMembersQuery(options = {}) {
-  if (!record(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+  if (!record2(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
     throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
   const query = new URLSearchParams;
   if (options.limit !== undefined)
@@ -10275,7 +10369,7 @@ function timestamp(value) {
   return Number.isFinite(time) && new Date(time).toISOString().slice(0, 23) === value.slice(0, 23);
 }
 function parseMember(row, fail) {
-  if (!record(row) || !uuid(row.membershipId) || !uuid(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp(row.createdAt))
+  if (!record2(row) || !uuid2(row.membershipId) || !uuid2(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp(row.createdAt))
     return fail();
   return {
     membershipId: row.membershipId,
@@ -10295,12 +10389,12 @@ class WorkspaceMemberInputError extends Error {
   }
 }
 function mutationInput(membershipId, input, roleChange) {
-  if (typeof membershipId !== "string" || !uuid(membershipId) || membershipId !== membershipId.toLowerCase() || !record(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+  if (typeof membershipId !== "string" || !uuid2(membershipId) || membershipId !== membershipId.toLowerCase() || !record2(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
     throw new WorkspaceMemberInputError;
-  const expectedRole = input.expectedRole, role = roleChange ? input.role : undefined;
-  if (!isRole(expectedRole) || roleChange && !isRole(role))
+  const expectedRole = input.expectedRole, role2 = roleChange ? input.role : undefined;
+  if (!isRole(expectedRole) || roleChange && !isRole(role2))
     throw new WorkspaceMemberInputError;
-  return { membershipId, role, expectedRole };
+  return { membershipId, role: role2, expectedRole };
 }
 function workspaceMemberRoleInput(membershipId, input) {
   const value = mutationInput(membershipId, input, true);
@@ -10311,19 +10405,19 @@ function workspaceMemberRemovalInput(membershipId, input) {
   return { membershipId: value.membershipId, body: { expectedRole: value.expectedRole } };
 }
 var invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.";
-function parseWorkspaceMemberRoleResult(value, membershipId, role) {
+function parseWorkspaceMemberRoleResult(value, membershipId, role2) {
   const fail = () => {
     throw new Error(invalidMemberResult);
   };
-  if (!record(value) || !uuid(value.organizationId) || typeof value.changed !== "boolean")
+  if (!record2(value) || !uuid2(value.organizationId) || typeof value.changed !== "boolean")
     return fail();
   const member = parseMember(value.member, fail);
-  if (member.membershipId !== membershipId || member.role !== role)
+  if (member.membershipId !== membershipId || member.role !== role2)
     return fail();
   return { organizationId: value.organizationId, member, changed: value.changed };
 }
 function parseWorkspaceMemberRemovalResult(value, membershipId) {
-  if (!record(value) || !uuid(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+  if (!record2(value) || !uuid2(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
     throw new Error(invalidMemberResult);
   return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
 }
@@ -10340,7 +10434,7 @@ var workspaceMemberFailures = {
   MEMBERSHIP_BUSY: [503, "Membership is busy. Refresh the roster before another action."]
 };
 function workspaceMemberFailure(value, status) {
-  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+  if (!record2(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
     return null;
   const code = value.code;
   return workspaceMemberFailures[code][0] === status ? code : null;
@@ -10349,13 +10443,72 @@ function parseWorkspaceMembersPage(value) {
   const fail = () => {
     throw new Error("The server returned an invalid workspace roster.");
   };
-  if (!record(value) || !uuid(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+  if (!record2(value) || !uuid2(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
     return fail();
   const members = value.members.map((row) => parseMember(row, fail));
   if (new Set(members.map((row) => row.membershipId)).size !== members.length)
     return fail();
   return { organizationId: value.organizationId, members, nextCursor: value.nextCursor };
 }
+
+// src/lib/remote-workspace-leave.ts
+class WorkspaceLeaveInputError extends Error {
+  constructor() {
+    super("Confirm leaving the exact observed user and membership with its expected role.");
+    this.name = "WorkspaceLeaveInputError";
+  }
+}
+function workspaceLeaveInput(context, input) {
+  const target = workspaceContext(context);
+  if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).sort().join(",") !== "confirm,expectedRole" || input.confirm !== true)
+    throw new WorkspaceLeaveInputError;
+  const captured = workspaceMemberRemovalInput(target.membershipId, { expectedRole: input.expectedRole });
+  return {
+    context: target,
+    input: { expectedRole: captured.body.expectedRole, confirm: true },
+    body: { membershipId: target.membershipId, expectedRole: captured.body.expectedRole }
+  };
+}
+var workspaceLeaveFailures = {
+  INVALID_REQUEST: [400, "Provide the exact current membership and expected role."],
+  ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+  INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required to leave a workspace."],
+  MEMBERSHIP_ROLE_CHANGED: [409, "Your role changed. Sign in and inspect the workspace before leaving."],
+  LAST_OWNER_REQUIRED: [409, "The workspace must retain another active owner."],
+  LAST_WORKSPACE_REQUIRED: [409, "Another available workspace is required before leaving."],
+  MEMBERSHIP_BUSY: [503, "Membership is busy. Inspect the workspace before another leave action."]
+};
+
+class RemoteWorkspaceLeaveError extends Error {
+  code;
+  status;
+  constructor(code) {
+    super(workspaceLeaveFailures[code][1]);
+    this.code = code;
+    this.name = "RemoteWorkspaceLeaveError";
+    this.status = workspaceLeaveFailures[code][0];
+  }
+}
+
+class RemoteWorkspaceLeaveUnconfirmedError extends Error {
+  code = "WORKSPACE_LEAVE_UNCONFIRMED";
+  constructor() {
+    super("The leave outcome is unconfirmed. Sign in again and inspect available memberships before another action. Do not retry automatically; saved credentials are unchanged.");
+    this.name = "RemoteWorkspaceLeaveUnconfirmedError";
+  }
+}
+function workspaceLeaveFailure(value, status) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const code = value.code;
+  return typeof code === "string" && Object.hasOwn(workspaceLeaveFailures, code) && workspaceLeaveFailures[code][0] === status ? code : null;
+}
+function parseWorkspaceLeaveResult(value, membershipId, organizationId) {
+  const row = value;
+  if (!row || typeof row !== "object" || Array.isArray(row) || row.membershipId !== membershipId || row.organizationId !== organizationId || row.removed !== true || row.signInRequired !== true)
+    throw new RemoteWorkspaceLeaveUnconfirmedError;
+  return { membershipId, organizationId, removed: true, signInRequired: true };
+}
 // src/lib/auth-store.ts
 function getApiUrl(action, env = process.env, options = {}) {
   return requireSkillsApiOrigin(action, env, options);
@@ -10364,44 +10517,44 @@ function getApiUrl(action, env = process.env, options = {}) {
 // src/lib/remote-run-contract.ts
 var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
 function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
-  const record2 = isRecord3(payload) ? payload : {};
+  const record3 = isRecord3(payload) ? payload : {};
   return {
     contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
-    ...pickString(record2, "id"),
-    skill: pickStringValue(record2, "skill") ?? fallbackSkill,
-    ...pickString(record2, "requestedSlug"),
-    ...pickString(record2, "status"),
-    ...pickNumber(record2, "exitCode"),
-    ...pickString(record2, "correlationId"),
-    ...pickString(record2, "createdAt"),
-    ...pickString(record2, "startedAt"),
-    ...pickString(record2, "completedAt"),
-    ...pickNumber(record2, "durationMs"),
-    ...pickString(record2, "outputType"),
-    ...hasOwn(record2, "outputPreview") ? { outputPreview: record2.outputPreview } : {},
-    ...pickString(record2, "errorCode"),
-    ...pickString(record2, "errorMessage"),
-    ...pickString(record2, "error"),
-    ...pickString(record2, "code"),
-    ...hasOwn(record2, "details") ? { details: record2.details } : {}
+    ...pickString(record3, "id"),
+    skill: pickStringValue(record3, "skill") ?? fallbackSkill,
+    ...pickString(record3, "requestedSlug"),
+    ...pickString(record3, "status"),
+    ...pickNumber(record3, "exitCode"),
+    ...pickString(record3, "correlationId"),
+    ...pickString(record3, "createdAt"),
+    ...pickString(record3, "startedAt"),
+    ...pickString(record3, "completedAt"),
+    ...pickNumber(record3, "durationMs"),
+    ...pickString(record3, "outputType"),
+    ...hasOwn(record3, "outputPreview") ? { outputPreview: record3.outputPreview } : {},
+    ...pickString(record3, "errorCode"),
+    ...pickString(record3, "errorMessage"),
+    ...pickString(record3, "error"),
+    ...pickString(record3, "code"),
+    ...hasOwn(record3, "details") ? { details: record3.details } : {}
   };
 }
 function isRecord3(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function hasOwn(record2, key) {
-  return Object.prototype.hasOwnProperty.call(record2, key);
+function hasOwn(record3, key) {
+  return Object.prototype.hasOwnProperty.call(record3, key);
 }
-function pickString(record2, key) {
-  const value = pickStringValue(record2, key);
+function pickString(record3, key) {
+  const value = pickStringValue(record3, key);
   return value === undefined ? {} : { [key]: value };
 }
-function pickStringValue(record2, key) {
-  const value = record2[key];
+function pickStringValue(record3, key) {
+  const value = record3[key];
   return typeof value === "string" ? value : undefined;
 }
-function pickNumber(record2, key) {
-  const value = record2[key];
+function pickNumber(record3, key) {
+  const value = record3[key];
   return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
 }
 
@@ -10564,11 +10717,11 @@ function parseUpdatedProfile(value) {
   return { user: { id: user.id, email: user.email, displayName: user.displayName, role: user.role } };
 }
 function parseUpdatedWorkspace(value) {
-  const organization = isRecord4(value) && value.organization;
-  if (!isRecord4(organization) || !string(organization.id) || !string(organization.slug) || !string(organization.name)) {
+  const organization2 = isRecord4(value) && value.organization;
+  if (!isRecord4(organization2) || !string(organization2.id) || !string(organization2.slug) || !string(organization2.name)) {
     throw new Error("The server returned an invalid workspace.");
   }
-  return { organization: { id: organization.id, slug: organization.slug, name: organization.name } };
+  return { organization: { id: organization2.id, slug: organization2.slug, name: organization2.name } };
 }
 
 // src/lib/remote-client.ts
@@ -10606,6 +10759,16 @@ class RemoteWorkspaceMemberError extends RemoteRequestError {
   }
 }
 
+class RemoteWorkspaceSelectionError extends RemoteRequestError {
+  code;
+  constructor(path, code) {
+    super(path, workspaceSelectionFailures[code][0]);
+    this.code = code;
+    this.name = "RemoteWorkspaceSelectionError";
+    this.message = workspaceSelectionFailures[code][1];
+  }
+}
+
 class RemoteCapabilityUnavailableError extends RemoteRequestError {
   code = "SUBSCRIPTION_CHECKOUT_UNAVAILABLE";
   constructor() {
@@ -10627,6 +10790,7 @@ class RemoteSkillsClient {
     return fetch(`${this.apiUrl}${path}`, {
       ...options,
       redirect: "error",
+      credentials: "omit",
       signal: options?.signal ?? AbortSignal.timeout(15000),
       headers: {
         Authorization: `Bearer ${this.apiKey}`,
@@ -10733,6 +10897,65 @@ class RemoteSkillsClient {
   async getIdentity() {
     return (await this.requestNewRoute("/api/auth/whoami")).json();
   }
+  async listAccountWorkspaces(expectedUserId) {
+    const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    let identity;
+    if (expected !== undefined) {
+      const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+      if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+        throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces", "INTERACTIVE_SESSION_REQUIRED");
+      identity = parseWorkspaceIdentity(value, expected);
+    }
+    const result = parseAccountWorkspaces(await connection.requestWorkspaceSelection("/api/v1/account/workspaces"));
+    const current = result.workspaces.find((workspace) => workspace.current);
+    if (identity && (current.membershipId !== identity.user.membershipId || current.organization.id !== identity.organization.id))
+      throw new WorkspaceIdentityMismatchError;
+    return result;
+  }
+  async switchWorkspace(context) {
+    const target = workspaceContext(context);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+      throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces/switch", "INTERACTIVE_SESSION_REQUIRED");
+    parseWorkspaceIdentity(value, target.userId);
+    const selected = parseWorkspaceSession(await connection.requestWorkspaceSelection("/api/v1/account/workspaces/switch", {
+      method: "POST",
+      body: JSON.stringify({ membershipId: target.membershipId })
+    }), target);
+    const verified = await new RemoteSkillsClient(selected.token, connection.apiUrl).requestWorkspaceSelection("/api/auth/whoami");
+    if (!verified || typeof verified !== "object" || verified.authMethod !== "jwt")
+      throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces/switch", "INTERACTIVE_SESSION_REQUIRED");
+    const identity = parseWorkspaceIdentity(verified, target.userId);
+    if (identity.user.membershipId !== target.membershipId || identity.organization.id !== selected.organization.id)
+      throw new WorkspaceIdentityMismatchError;
+    return { token: selected.token, ...identity };
+  }
+  async requestWorkspaceSelection(path, options) {
+    let response;
+    try {
+      response = await this.request(path, { ...options, credentials: "omit" });
+    } catch {
+      throw new Error("Unable to reach the Skills workspace API.");
+    }
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 1024 * 1024 : 4096)));
+    } catch {
+      if (response.ok)
+        throw new Error(invalidWorkspaceResult);
+    }
+    if (!response.ok) {
+      const code = workspaceSelectionFailure(value, response.status);
+      if (code)
+        throw new RemoteWorkspaceSelectionError(path, code);
+      if (response.status === 404 || response.status === 405)
+        throw new RemoteRouteUnsupportedError(path, response.status, this.apiUrl);
+      throw new RemoteRequestError(path, response.status);
+    }
+    return value;
+  }
   async updateProfile(input) {
     const body = customerNamePatch(input, "displayName");
     return parseUpdatedProfile(await (await this.requestNewRoute("/api/v1/account/profile", { method: "PATCH", body: JSON.stringify(body) })).json());
@@ -10785,6 +11008,30 @@ class RemoteSkillsClient {
     }
     return value;
   }
+  async leaveWorkspace(context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+      throw new RemoteWorkspaceLeaveError("INTERACTIVE_SESSION_REQUIRED");
+    const identity = parseWorkspaceIdentity(value, captured.context.userId);
+    if (identity.user.membershipId !== captured.context.membershipId)
+      throw new WorkspaceIdentityMismatchError;
+    let response, body;
+    try {
+      response = await connection.request("/api/v1/account/workspaces/leave", { method: "POST", body: JSON.stringify(captured.body) });
+      body = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, 4096)));
+    } catch {
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    if (!response.ok) {
+      const code = workspaceLeaveFailure(body, response.status);
+      if (code)
+        throw new RemoteWorkspaceLeaveError(code);
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    return parseWorkspaceLeaveResult(body, captured.context.membershipId, identity.organization.id);
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -11035,13 +11282,13 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record2, field) {
-  if (record2[field] === undefined)
+function requireOptionalString(record3, field) {
+  if (record3[field] === undefined)
     return;
-  if (typeof record2[field] !== "string") {
+  if (typeof record3[field] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field} must be a string when present)`);
   }
-  return record2[field];
+  return record3[field];
 }
 var INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 function isVersionRecord(value) {
@@ -11064,19 +11311,19 @@ function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record2 = entry;
-  const slug = typeof record2.slug === "string" && record2.slug.trim() ? record2.slug.trim() : undefined;
+  const record3 = entry;
+  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record2.metadata !== undefined) {
-    if (!record2.metadata || typeof record2.metadata !== "object" || Array.isArray(record2.metadata)) {
+  if (record3.metadata !== undefined) {
+    if (!record3.metadata || typeof record3.metadata !== "object" || Array.isArray(record3.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record2.metadata;
+    metadata = record3.metadata;
   }
-  const pinnedAt = requireOptionalString(record2, "pinnedAt");
+  const pinnedAt = requireOptionalString(record3, "pinnedAt");
   return {
     slug,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -11093,16 +11340,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record2 = entry;
-  const slug = typeof record2.slug === "string" && record2.slug.trim() ? record2.slug.trim() : undefined;
+  const record3 = entry;
+  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug,
-    ...requireOptionalString(record2, "name") !== undefined ? { name: requireOptionalString(record2, "name") } : {},
-    ...requireOptionalString(record2, "version") !== undefined ? { version: requireOptionalString(record2, "version") } : {},
-    ...requireOptionalString(record2, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record2, "updatedAt") } : {}
+    ...requireOptionalString(record3, "name") !== undefined ? { name: requireOptionalString(record3, "name") } : {},
+    ...requireOptionalString(record3, "version") !== undefined ? { version: requireOptionalString(record3, "version") } : {},
+    ...requireOptionalString(record3, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record3, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -11155,12 +11402,12 @@ function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record2 = payload;
-  if (!Array.isArray(record2.skills)) {
+  const record3 = payload;
+  if (!Array.isArray(record3.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record2.skills.map(normalizeSkillSummary);
-  const nextCursor = record2.nextCursor === undefined || record2.nextCursor === null ? null : record2.nextCursor;
+  const skills = record3.skills.map(normalizeSkillSummary);
+  const nextCursor = record3.nextCursor === undefined || record3.nextCursor === null ? null : record3.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -11397,8 +11644,8 @@ function revisionIdOf(content) {
   });
   return createHash4("sha256").update(canonical).digest("hex");
 }
-function revisionIdOfRecord(record2) {
-  return revisionIdOf(record2);
+function revisionIdOfRecord(record3) {
+  return revisionIdOf(record3);
 }
 
 // src/lib/skill-bundle.ts
@@ -12105,16 +12352,16 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
   }
   return { path: target, created };
 }
-function writePullMarker(dir, record2) {
+function writePullMarker(dir, record3) {
   const marker = {
     managedBy: "@hasna/skills",
-    skill: record2.skill,
-    source: record2.source ?? "pull",
-    ...record2.version ? { version: record2.version } : {},
-    ...record2.contentHash ? { contentHash: record2.contentHash } : {},
-    ...record2.sourceCommit ? { sourceCommit: record2.sourceCommit } : {},
-    ...record2.signature ? { signature: record2.signature } : {},
-    ...record2.revisionId ? { revisionId: record2.revisionId } : {},
+    skill: record3.skill,
+    source: record3.source ?? "pull",
+    ...record3.version ? { version: record3.version } : {},
+    ...record3.contentHash ? { contentHash: record3.contentHash } : {},
+    ...record3.sourceCommit ? { sourceCommit: record3.sourceCommit } : {},
+    ...record3.signature ? { signature: record3.signature } : {},
+    ...record3.revisionId ? { revisionId: record3.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
   writeFileSync8(join17(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
@@ -12129,19 +12376,19 @@ async function safeMeta(client, slug) {
   }
   if (!raw || typeof raw !== "object")
     return null;
-  const record2 = raw;
-  const kind = record2.kind === "instruction" || record2.kind === "executable" ? record2.kind : undefined;
-  const tags = Array.isArray(record2.tags) ? record2.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
+  const record3 = raw;
+  const kind = record3.kind === "instruction" || record3.kind === "executable" ? record3.kind : undefined;
+  const tags = Array.isArray(record3.tags) ? record3.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
   return {
-    ...str(record2.displayName) ? { displayName: str(record2.displayName) } : {},
-    ...str(record2.description) ? { description: str(record2.description) } : {},
-    ...str(record2.category) ? { category: str(record2.category) } : {},
+    ...str(record3.displayName) ? { displayName: str(record3.displayName) } : {},
+    ...str(record3.description) ? { description: str(record3.description) } : {},
+    ...str(record3.category) ? { category: str(record3.category) } : {},
     ...tags && tags.length ? { tags } : {},
-    ...str(record2.version) ? { version: str(record2.version) } : {},
+    ...str(record3.version) ? { version: str(record3.version) } : {},
     ...kind ? { kind } : {},
-    ...REVISION_ID_PATTERN.test(str(record2.revisionId) ?? "") ? { revisionId: str(record2.revisionId) } : {},
-    ...typeof record2.skillMd === "string" && record2.skillMd.length > 0 ? { skillMd: record2.skillMd } : {},
-    ...str(record2.publishedSource) ? { publishedSource: str(record2.publishedSource) } : {}
+    ...REVISION_ID_PATTERN.test(str(record3.revisionId) ?? "") ? { revisionId: str(record3.revisionId) } : {},
+    ...typeof record3.skillMd === "string" && record3.skillMd.length > 0 ? { skillMd: record3.skillMd } : {},
+    ...str(record3.publishedSource) ? { publishedSource: str(record3.publishedSource) } : {}
   };
 }
 function pickCorpusOptions(options) {
@@ -12150,8 +12397,8 @@ function pickCorpusOptions(options) {
 function extractSlug(entry) {
   if (!entry || typeof entry !== "object")
     return;
-  const record2 = entry;
-  return str(record2.slug) ?? str(record2.name);
+  const record3 = entry;
+  return str(record3.slug) ?? str(record3.name);
 }
 function dedupe(values) {
   return [...new Set(values)];
@@ -12277,7 +12524,7 @@ import { dirname as dirname7, relative as relative4 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.5.0",
+  version: "0.5.2",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -13788,7 +14035,7 @@ class SkillsPostgresSyncStore {
   }
   async upsertRecords(records) {
     let count = 0;
-    for (const record2 of records) {
+    for (const record3 of records) {
       await this.client.query([
         "INSERT INTO skills_sync_records",
         "(scope, kind, id, updated_at, deleted_at, source, payload)",
@@ -13799,13 +14046,13 @@ class SkillsPostgresSyncStore {
         "source = EXCLUDED.source,",
         "payload = EXCLUDED.payload"
       ].join(" "), [
-        record2.scope,
-        record2.kind,
-        record2.id,
-        record2.updatedAt,
-        record2.deletedAt ?? null,
-        record2.source ?? null,
-        JSON.stringify(record2.payload)
+        record3.scope,
+        record3.kind,
+        record3.id,
+        record3.updatedAt,
+        record3.deletedAt ?? null,
+        record3.source ?? null,
+        JSON.stringify(record3.payload)
       ]);
       count += 1;
     }
@@ -14784,13 +15031,13 @@ async function requestAuthApi(instance, path, options) {
       apiUrl: safeUrl
     });
   }
-  const text = await res.text();
-  const body = text ? parseJsonBody(text) : {};
+  const text2 = await res.text();
+  const body = text2 ? parseJsonBody(text2) : {};
   if (!res.ok) {
-    const record2 = isRecord5(body) ? body : {};
-    const detail = typeof record2.detail === "string" ? record2.detail : undefined;
-    const error = typeof record2.error === "string" ? record2.error : undefined;
-    const code = typeof record2.code === "string" ? record2.code : undefined;
+    const record3 = isRecord5(body) ? body : {};
+    const detail = typeof record3.detail === "string" ? record3.detail : undefined;
+    const error = typeof record3.error === "string" ? record3.error : undefined;
+    const code = typeof record3.code === "string" ? record3.code : undefined;
     throw new HostedApiError(detail || error || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -14801,15 +15048,15 @@ async function requestAuthApi(instance, path, options) {
   }
   return body;
 }
-function parseJsonBody(text) {
+function parseJsonBody(text2) {
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { detail: condenseErrorBody(text) };
+    return { detail: condenseErrorBody(text2) };
   }
 }
-function condenseErrorBody(text) {
-  const stripped = /<[a-z!/]/i.test(text) ? text.replace(/<(script|style)[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]*>/g, " ") : text;
+function condenseErrorBody(text2) {
+  const stripped = /<[a-z!/]/i.test(text2) ? text2.replace(/<(script|style)[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]*>/g, " ") : text2;
   const collapsed = stripped.replace(/\s+/g, " ").trim();
   if (collapsed.length <= MAX_ERROR_DETAIL_LENGTH)
     return collapsed;
@@ -14836,7 +15083,12 @@ class RemoteSkillsAuthClient {
   pollDevice(deviceCode) {
     return this.request("/api/auth/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) });
   }
-  async sessionClient(email, code) {
+  async sessionClient(email, code, context) {
+    if (context !== undefined) {
+      const target = workspaceContext(context), apiOrigin2 = this.apiOrigin;
+      const session = await this.switchWorkspace(email, code, target);
+      return new RemoteSkillsClient(session.token, apiOrigin2);
+    }
     const apiOrigin = this.apiOrigin;
     if (!email.includes("@") || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
@@ -14845,34 +15097,80 @@ class RemoteSkillsAuthClient {
       throw new Error("The server did not return an authorized account session");
     return new RemoteSkillsClient(login.token, apiOrigin);
   }
-  async createApiKey(email, code, name, scopes) {
-    return (await this.sessionClient(email, code)).createApiKey(name, scopes);
+  async listAccountWorkspaces(email, code, expectedUserId) {
+    const login = await this.workspaceLogin(email, code, expectedUserId);
+    const result = await new RemoteSkillsClient(login.token, login.apiOrigin).listAccountWorkspaces(login.userId);
+    return { userId: login.userId, ...result };
   }
-  async listApiKeys(email, code) {
-    return (await this.sessionClient(email, code)).listApiKeys();
+  async switchWorkspace(email, code, context) {
+    const target = workspaceContext(context);
+    const login = await this.workspaceLogin(email, code, target.userId);
+    return new RemoteSkillsClient(login.token, login.apiOrigin).switchWorkspace(target);
   }
-  async revokeApiKey(email, code, keyId) {
-    return (await this.sessionClient(email, code)).revokeApiKey(keyId);
+  async workspaceLogin(email, code, expectedUserId) {
+    const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
+    const apiOrigin = this.apiOrigin;
+    if (typeof email !== "string" || !email.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
+      throw new Error("Fresh email and six-digit verification code are required to manage this account");
+    let response;
+    try {
+      response = await fetch(`${apiOrigin}/api/auth/verify`, {
+        method: "POST",
+        redirect: "error",
+        credentials: "omit",
+        signal: AbortSignal.timeout(15000),
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email, code })
+      });
+    } catch {
+      throw new HostedApiError("Unable to verify the Skills account.");
+    }
+    if (!response.ok) {
+      response.body?.cancel().catch(() => {});
+      throw new HostedApiError("Unable to verify the Skills account.", { status: response.status });
+    }
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, 64 * 1024)));
+    } catch {
+      throw new HostedApiError("The server returned an invalid account verification result.");
+    }
+    return { ...parseWorkspaceLogin(value, expected), apiOrigin };
+  }
+  async createApiKey(email, code, name, scopes, context) {
+    const capturedScopes = scopes === undefined ? undefined : [...scopes];
+    return (await this.sessionClient(email, code, context)).createApiKey(name, capturedScopes);
   }
-  async updateProfile(email, code, input) {
-    customerNamePatch(input, "displayName");
-    return (await this.sessionClient(email, code)).updateProfile(input);
+  async listApiKeys(email, code, context) {
+    return (await this.sessionClient(email, code, context)).listApiKeys();
   }
-  async updateCurrentWorkspace(email, code, input) {
-    customerNamePatch(input, "name");
-    return (await this.sessionClient(email, code)).updateCurrentWorkspace(input);
+  async revokeApiKey(email, code, keyId, context) {
+    return (await this.sessionClient(email, code, context)).revokeApiKey(keyId);
   }
-  async listWorkspaceMembers(email, code, options = {}) {
+  async updateProfile(email, code, input, context) {
+    const body = customerNamePatch(input, "displayName");
+    return (await this.sessionClient(email, code, context)).updateProfile({ displayName: body.displayName });
+  }
+  async updateCurrentWorkspace(email, code, input, context) {
+    const body = customerNamePatch(input, "name");
+    return (await this.sessionClient(email, code, context)).updateCurrentWorkspace({ name: body.name });
+  }
+  async listWorkspaceMembers(email, code, options = {}, context) {
     workspaceMembersQuery(options);
-    return (await this.sessionClient(email, code)).listWorkspaceMembers(options);
+    const captured = { ...options };
+    return (await this.sessionClient(email, code, context)).listWorkspaceMembers(captured);
   }
-  async setWorkspaceMemberRole(email, code, membershipId, input) {
+  async setWorkspaceMemberRole(email, code, membershipId, input, context) {
     const captured = workspaceMemberRoleInput(membershipId, input);
-    return (await this.sessionClient(email, code)).setWorkspaceMemberRole(captured.membershipId, captured.body);
+    return (await this.sessionClient(email, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
+  }
+  async leaveWorkspace(email, code, context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    return (await this.sessionClient(email, code, captured.context)).leaveWorkspace(captured.context, captured.input);
   }
-  async removeWorkspaceMember(email, code, membershipId, input) {
+  async removeWorkspaceMember(email, code, membershipId, input, context) {
     const captured = workspaceMemberRemovalInput(membershipId, input);
-    return (await this.sessionClient(email, code)).removeWorkspaceMember(captured.membershipId, captured.body);
+    return (await this.sessionClient(email, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
   }
   request(path, options) {
     if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
@@ -15062,6 +15360,9 @@ export {
   agentGlobalSkillsDir,
   addSchedule,
   adaptSkillMdForAgent,
+  WorkspaceLeaveInputError,
+  WorkspaceIdentityMismatchError,
+  WorkspaceContextInputError,
   TOOL_PRIMITIVE_SCHEMA_VERSION,
   TOOL_PRIMITIVES,
   StationSnapshotError,
@@ -15093,7 +15394,10 @@ export {
   SKILLS_API_KEY_ENV_KEYS,
   SKILLS_API_KEY_ENV,
   SKILLS,
+  RemoteWorkspaceSelectionError,
   RemoteWorkspaceMemberError,
+  RemoteWorkspaceLeaveUnconfirmedError,
+  RemoteWorkspaceLeaveError,
   RemoteSkillsClient,
   RemoteSkillsAuthClient,
   RemoteRouteUnsupportedError,