@hasna/skills 0.5.0 → 0.5.2

package/dist/lib/remote-auth.d.ts

@@ -1,3 +1,5 @@
+import { type LeaveRemoteWorkspace } from "./remote-workspace-leave.js";
+import { type RemoteWorkspaceContext, type RemoteWorkspaceSession, type RemoteAccountWorkspaceDiscovery } from "./remote-workspace-selection.js";
 import { type RemoteWorkspaceMembersOptions } from "./remote-workspace.js";
 import { type SetRemoteWorkspaceMemberRole, type RemoveRemoteWorkspaceMember } from "./remote-workspace.js";
 import { type UpdateRemoteProfile, type UpdateRemoteWorkspace } from "./remote-profile.js";
@@ -24,23 +26,30 @@ export declare class RemoteSkillsAuthClient {
     startDevice(): Promise<any>;
     pollDevice(deviceCode: string): Promise<any>;
     private sessionClient;
-    createApiKey(email: string, code: string, name: string, scopes?: string[]): Promise<{
+    /** Discover memberships with fresh sign-in. No key or session is saved. */
+    listAccountWorkspaces(email: string, code: string, expectedUserId?: string): Promise<RemoteAccountWorkspaceDiscovery>;
+    /** Contains a secret session token. Selection never creates or stores an API key. */
+    switchWorkspace(email: string, code: string, context: RemoteWorkspaceContext): Promise<RemoteWorkspaceSession>;
+    private workspaceLogin;
+    createApiKey(email: string, code: string, name: string, scopes?: string[], context?: RemoteWorkspaceContext): Promise<{
         [field: string]: unknown;
         key: string;
     }>;
-    listApiKeys(email: string, code: string): Promise<Record<string, unknown>[]>;
-    revokeApiKey(email: string, code: string, keyId: string): Promise<Record<string, unknown>>;
+    listApiKeys(email: string, code: string, context?: RemoteWorkspaceContext): Promise<Record<string, unknown>[]>;
+    revokeApiKey(email: string, code: string, keyId: string, context?: RemoteWorkspaceContext): Promise<Record<string, unknown>>;
     /** Reauthentication is ephemeral: it never replaces a saved key or profile. */
-    updateProfile(email: string, code: string, input: UpdateRemoteProfile): Promise<{
+    updateProfile(email: string, code: string, input: UpdateRemoteProfile, context?: RemoteWorkspaceContext): Promise<{
         user: import("./remote-profile.js").RemoteCustomerProfile;
     }>;
-    updateCurrentWorkspace(email: string, code: string, input: UpdateRemoteWorkspace): Promise<{
+    updateCurrentWorkspace(email: string, code: string, input: UpdateRemoteWorkspace, context?: RemoteWorkspaceContext): Promise<{
         organization: import("./remote-profile.js").RemoteCurrentWorkspace;
     }>;
-    /** Fresh owner/admin session; no saved credential or profile is replaced. */
-    listWorkspaceMembers(email: string, code: string, options?: RemoteWorkspaceMembersOptions): Promise<import("./remote-workspace.js").RemoteWorkspaceMembersPage>;
-    setWorkspaceMemberRole(email: string, code: string, membershipId: string, input: SetRemoteWorkspaceMemberRole): Promise<import("./remote-workspace.js").RemoteWorkspaceMemberRoleResult>;
-    removeWorkspaceMember(email: string, code: string, membershipId: string, input: RemoveRemoteWorkspaceMember): Promise<import("./remote-workspace.js").RemoteWorkspaceMemberRemovalResult>;
+    /** Fresh owner/admin session; explicit context survives default-workspace OTP selection. */
+    listWorkspaceMembers(email: string, code: string, options?: RemoteWorkspaceMembersOptions, context?: RemoteWorkspaceContext): Promise<import("./remote-workspace.js").RemoteWorkspaceMembersPage>;
+    setWorkspaceMemberRole(email: string, code: string, membershipId: string, input: SetRemoteWorkspaceMemberRole, context?: RemoteWorkspaceContext): Promise<import("./remote-workspace.js").RemoteWorkspaceMemberRoleResult>;
+    /** Fresh verification binds the exact observed incarnation before a single confirmed leave. */
+    leaveWorkspace(email: string, code: string, context: RemoteWorkspaceContext, input: LeaveRemoteWorkspace): Promise<import("./remote-workspace-leave.js").RemoteWorkspaceLeaveResult>;
+    removeWorkspaceMember(email: string, code: string, membershipId: string, input: RemoveRemoteWorkspaceMember, context?: RemoteWorkspaceContext): Promise<import("./remote-workspace.js").RemoteWorkspaceMemberRemovalResult>;
     /** Common auth transport used by CLI login, preserving the selected instance through awaits. */
     request(path: string, options?: RequestInit): Promise<any>;
 }

package/dist/lib/remote-client.d.ts

@@ -1,3 +1,5 @@
+import { type LeaveRemoteWorkspace, type RemoteWorkspaceLeaveResult } from "./remote-workspace-leave.js";
+import { type RemoteWorkspaceContext, type RemoteAccountWorkspaces, type RemoteWorkspaceSession, type RemoteWorkspaceSelectionErrorCode } from "./remote-workspace-selection.js";
 import { type RemoteWorkspaceMembersOptions, type RemoteWorkspaceMembersPage } from "./remote-workspace.js";
 import { type RemoteWorkspaceMemberErrorCode, type SetRemoteWorkspaceMemberRole, type RemoveRemoteWorkspaceMember, type RemoteWorkspaceMemberRoleResult, type RemoteWorkspaceMemberRemovalResult } from "./remote-workspace.js";
 import { type RemoteSkillRunContract } from "./remote-run-contract.js";
@@ -27,6 +29,11 @@ export declare class RemoteWorkspaceMemberError extends RemoteRequestError {
     readonly code: RemoteWorkspaceMemberErrorCode;
     constructor(path: string, code: RemoteWorkspaceMemberErrorCode);
 }
+/** Fixed text for recognized workspace refusals; no reflected server error payload. */
+export declare class RemoteWorkspaceSelectionError extends RemoteRequestError {
+    readonly code: RemoteWorkspaceSelectionErrorCode;
+    constructor(path: string, code: RemoteWorkspaceSelectionErrorCode);
+}
 /** A recognized unavailable capability; all displayed text is client-owned. */
 export declare class RemoteCapabilityUnavailableError extends RemoteRequestError {
     readonly code: "SUBSCRIPTION_CHECKOUT_UNAVAILABLE";
@@ -119,6 +126,11 @@ export declare class RemoteSkillsClient {
     /** Quote first and fail closed when the caller has not approved the required credits. */
     submitQuotedRun(slug: string, input?: Record<string, unknown>, args?: string[], approval?: RemoteRunApproval): Promise<RemoteSkillRunContract>;
     getIdentity(): Promise<Record<string, unknown>>;
+    /** List memberships with the current interactive session; never writes credentials. */
+    listAccountWorkspaces(expectedUserId?: string): Promise<RemoteAccountWorkspaces>;
+    /** Return a new ephemeral session; this client and any saved key/profile stay unchanged. */
+    switchWorkspace(context: RemoteWorkspaceContext): Promise<RemoteWorkspaceSession>;
+    private requestWorkspaceSelection;
     /** Requires a customer session; API keys and support impersonation cannot edit names. */
     updateProfile(input: UpdateRemoteProfile): Promise<{
         user: import("./remote-profile.js").RemoteCustomerProfile;
@@ -134,6 +146,8 @@ export declare class RemoteSkillsClient {
     /** Removes only this incarnation. A successful tombstone replay is returned unchanged. */
     removeWorkspaceMember(membershipId: string, input: RemoveRemoteWorkspaceMember): Promise<RemoteWorkspaceMemberRemovalResult>;
     private requestWorkspaceMember;
+    /** Leave only the explicitly confirmed current incarnation, once. No credential writes or retries. */
+    leaveWorkspace(context: RemoteWorkspaceContext, input: LeaveRemoteWorkspace): Promise<RemoteWorkspaceLeaveResult>;
     listApiKeys(): Promise<Record<string, unknown>[]>;
     createApiKey(name: string, scopes?: string[]): Promise<{
         key: string;

package/dist/lib/remote-workspace-leave.d.ts

@@ -0,0 +1,52 @@
+import { type RemoteWorkspaceContext } from "./remote-workspace-selection.js";
+import type { RemoteCustomerRole } from "./remote-profile.js";
+export type LeaveRemoteWorkspace = Readonly<{
+    expectedRole: RemoteCustomerRole;
+    confirm: true;
+}>;
+export type RemoteWorkspaceLeaveResult = {
+    organizationId: string;
+    membershipId: string;
+    removed: true;
+    signInRequired: true;
+};
+export declare class WorkspaceLeaveInputError extends Error {
+    constructor();
+}
+export declare function workspaceLeaveInput(context: RemoteWorkspaceContext, input: LeaveRemoteWorkspace): {
+    context: Readonly<{
+        userId: string;
+        membershipId: string;
+    }>;
+    input: {
+        expectedRole: RemoteCustomerRole;
+        confirm: true;
+    };
+    body: {
+        membershipId: string;
+        expectedRole: RemoteCustomerRole;
+    };
+};
+export declare const workspaceLeaveFailures: {
+    readonly INVALID_REQUEST: readonly [400, "Provide the exact current membership and expected role."];
+    readonly ACCOUNT_UNAVAILABLE: readonly [403, "Account is unavailable."];
+    readonly INTERACTIVE_SESSION_REQUIRED: readonly [403, "Fresh interactive sign-in is required to leave a workspace."];
+    readonly MEMBERSHIP_ROLE_CHANGED: readonly [409, "Your role changed. Sign in and inspect the workspace before leaving."];
+    readonly LAST_OWNER_REQUIRED: readonly [409, "The workspace must retain another active owner."];
+    readonly LAST_WORKSPACE_REQUIRED: readonly [409, "Another available workspace is required before leaving."];
+    readonly MEMBERSHIP_BUSY: readonly [503, "Membership is busy. Inspect the workspace before another leave action."];
+};
+export type RemoteWorkspaceLeaveErrorCode = keyof typeof workspaceLeaveFailures;
+export declare class RemoteWorkspaceLeaveError extends Error {
+    readonly code: RemoteWorkspaceLeaveErrorCode;
+    readonly status: number;
+    constructor(code: RemoteWorkspaceLeaveErrorCode);
+}
+export declare class RemoteWorkspaceLeaveUnconfirmedError extends Error {
+    readonly code = "WORKSPACE_LEAVE_UNCONFIRMED";
+    constructor();
+}
+export declare function workspaceLeaveFailure(value: unknown, status: number): RemoteWorkspaceLeaveErrorCode | null;
+export declare function parseWorkspaceLeaveResult(value: unknown, membershipId: string, organizationId: string): RemoteWorkspaceLeaveResult;
+/** A configured profile may constrain an explicit leave, never retarget it. */
+export declare function workspaceLeaveProfileContext(membershipId: string, userId: string | undefined, profile?: RemoteWorkspaceContext): RemoteWorkspaceContext;

package/dist/lib/remote-workspace-selection.d.ts

@@ -0,0 +1,58 @@
+import type { RemoteCurrentWorkspace, RemoteCustomerProfile, RemoteCustomerRole } from "./remote-profile.js";
+/** An observed identity and exact membership incarnation, never a slug or cached role. */
+export type RemoteWorkspaceContext = Readonly<{
+    userId: string;
+    membershipId: string;
+}>;
+export type RemoteAccountWorkspace = {
+    membershipId: string;
+    organization: RemoteCurrentWorkspace;
+    role: RemoteCustomerRole;
+    current: boolean;
+};
+export type RemoteAccountWorkspaces = {
+    workspaces: RemoteAccountWorkspace[];
+};
+export type RemoteWorkspaceIdentity = {
+    user: RemoteCustomerProfile & {
+        membershipId: string;
+    };
+    organization: RemoteCurrentWorkspace;
+};
+/** Contains a secret. SDK callers own its lifetime; never print or persist it implicitly. */
+export type RemoteWorkspaceSession = RemoteWorkspaceIdentity & {
+    token: string;
+};
+export type RemoteAccountWorkspaceDiscovery = RemoteAccountWorkspaces & {
+    userId: string;
+};
+export declare const invalidWorkspaceResult = "The server returned an invalid workspace selection result.";
+export declare class WorkspaceContextInputError extends Error {
+    constructor();
+}
+export declare class WorkspaceIdentityMismatchError extends Error {
+    constructor();
+}
+export declare function workspaceExpectedUserId(value: unknown): string;
+/** Copy before the first await: caller mutations cannot retarget verification. */
+export declare function workspaceContext(value: unknown): RemoteWorkspaceContext;
+/** Project documented fields only; server extras cannot reach display metadata. */
+export declare function parseAccountWorkspaces(value: unknown): RemoteAccountWorkspaces;
+export declare function parseWorkspaceIdentity(value: unknown, expectedUserId: string): RemoteWorkspaceIdentity;
+/** The service still verifies the token; response metadata never grants authority. */
+export declare function parseWorkspaceSession(value: unknown, expected: RemoteWorkspaceContext): RemoteWorkspaceSession;
+/** Fresh verification does not require newer workspace metadata from default-only servers. */
+export declare function parseWorkspaceLogin(value: unknown, expectedUserId?: string): {
+    token: string;
+    userId: string;
+};
+export declare const workspaceSelectionFailures: {
+    readonly INVALID_WORKSPACE_SELECTION: readonly [400, "Provide only the exact membership ID from your workspace list."];
+    readonly SESSION_EXPIRED: readonly [401, "Sign in again before selecting a workspace."];
+    readonly ACCOUNT_UNAVAILABLE: readonly [403, "Account is unavailable."];
+    readonly INTERACTIVE_SESSION_REQUIRED: readonly [403, "Interactive sign-in is required to select a workspace."];
+    readonly WORKSPACE_UNAVAILABLE: readonly [404, "Workspace is unavailable. Refresh your workspace list."];
+    readonly WORKSPACE_BUSY: readonly [503, "Workspace is busy. Refresh before retrying."];
+};
+export type RemoteWorkspaceSelectionErrorCode = keyof typeof workspaceSelectionFailures;
+export declare function workspaceSelectionFailure(value: unknown, status: number): RemoteWorkspaceSelectionErrorCode | null;

package/dist/lib/workspace-profile.d.ts

@@ -0,0 +1,49 @@
+type Env = Record<string, string | undefined>;
+export declare class WorkspaceProfileError extends Error {
+}
+/** Capture actual key authority before OTP; cached identity never supplies authority. */
+export declare function prepareProfileWorkspace(action: string, source?: Env): {
+    origin: string;
+    resolve(): Promise<{
+        origin: string;
+        context: undefined;
+        unchanged: () => void;
+    } | {
+        origin: string;
+        context: Readonly<{
+            userId: string;
+            membershipId: string;
+        }>;
+        unchanged: () => void;
+    }>;
+};
+export declare function captureProfileWorkspace(action: string, source?: Env): Promise<{
+    origin: string;
+    context: undefined;
+    unchanged: () => void;
+} | {
+    origin: string;
+    context: Readonly<{
+        userId: string;
+        membershipId: string;
+    }>;
+    unchanged: () => void;
+}>;
+/** Own only the explicitly named profile; injected credentials may not hide enrollment. */
+export declare function prepareWorkspaceEnrollment(membershipId: string, source?: Env): Promise<{
+    profile: string;
+    origin: string;
+    complete(email: string, code: string): Promise<{
+        status: string;
+        profile: string;
+        apiUrl: string;
+        userId: string;
+        email: string;
+        membershipId: string;
+        organization: string;
+        organizationId: string;
+        role: import("./remote-profile.js").RemoteCustomerRole;
+        keyCreated: boolean;
+    }>;
+}>;
+export {};

package/dist/sdk/index.d.ts

@@ -37,3 +37,8 @@ export { RemoteSkillsAuthClient, HostedApiError } from "../lib/remote-auth.js";
 export type { RemoteWorkspaceMember, RemoteWorkspaceMembersPage, RemoteWorkspaceMembersOptions } from "../lib/remote-workspace.js";
 export type { SetRemoteWorkspaceMemberRole, RemoveRemoteWorkspaceMember, RemoteWorkspaceMemberRoleResult, RemoteWorkspaceMemberRemovalResult, RemoteWorkspaceMemberErrorCode } from "../lib/remote-workspace.js";
 export type { RemoteCustomerRole, RemoteCustomerProfile, RemoteCurrentWorkspace, UpdateRemoteProfile, UpdateRemoteWorkspace } from "../lib/remote-profile.js";
+export type { RemoteWorkspaceContext, RemoteAccountWorkspace, RemoteAccountWorkspaces, RemoteWorkspaceIdentity, RemoteWorkspaceSession, RemoteAccountWorkspaceDiscovery, RemoteWorkspaceSelectionErrorCode } from "../lib/remote-workspace-selection.js";
+export { WorkspaceContextInputError, WorkspaceIdentityMismatchError } from "../lib/remote-workspace-selection.js";
+export { RemoteWorkspaceSelectionError } from "../lib/remote-client.js";
+export type { LeaveRemoteWorkspace, RemoteWorkspaceLeaveResult, RemoteWorkspaceLeaveErrorCode } from "../lib/remote-workspace-leave.js";
+export { WorkspaceLeaveInputError, RemoteWorkspaceLeaveError, RemoteWorkspaceLeaveUnconfirmedError } from "../lib/remote-workspace-leave.js";