@hasna/skills 0.5.1 → 0.5.2

package/README.md

@@ -674,7 +674,7 @@ skills/                      # Public skill contracts and local OSS skills
 |---|---|---|
 | Catalog skills | 86 | `SKILLS.length` (`src/lib/registry-data/`) |
 | Categories | 17 | `CATEGORIES` (`src/lib/registry-types.ts`) |
-| MCP tools | 61 | `tools/list` against a live `buildServer()` |
+| MCP tools | 62 | `tools/list` against a live `buildServer()` |
 
 Every number in this table is re-derived from the source tree on each test run by
 `src/lib/readme-derived-counts.test.ts`, so a drifted figure fails a test rather
@@ -933,3 +933,30 @@ through a tool remains a separate follow-up.
 If enrollment reports that key issuance was attempted but not confirmed, inspect
 the selected profile and workspace keys before retrying. A lost response can
 still have created a server key; the CLI does not retry issuance automatically.
+
+### Leave a workspace
+
+Use the exact membership ID and observed role from fresh `workspace list` output.
+Leaving requires deliberate confirmation and a fresh verification code:
+
+```sh
+HASNA_PROFILE=team-b skills workspace leave <membership-id> --expected-role member --email you@example.com --code-stdin --confirm --json
+```
+
+The selected profile must authenticate the same membership. Without a named
+profile, supply `--user-id <user-id>` from discovery; this also supports viewers
+who cannot create API keys. The server refuses stale roles, the last active
+owner, and leaving your last available workspace. It decides authority atomically.
+
+The SDK offers `RemoteSkillsAuthClient.leaveWorkspace(email, code,
+{ userId, membershipId }, { expectedRole, confirm: true })`; an existing interactive
+session can use `RemoteSkillsClient.leaveWorkspace(context, input)`. MCP exposes
+`leave_workspace` with those same explicit IDs, role, confirmation and fresh code.
+All surfaces call the same HTTP method once. API keys cannot authorize the leave.
+
+Success returns `{ organizationId, membershipId, removed: true,
+signInRequired: true }`. Sign in again to an available workspace afterwards.
+Saved credentials and unrelated profiles remain unchanged; credentials for the
+left membership no longer grant access. A lost or invalid response raises
+`RemoteWorkspaceLeaveUnconfirmedError`: inspect available memberships before any
+new action. Never automatically retry or substitute another membership ID.

package/bin/index.js

@@ -36860,7 +36860,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.5.1",
+    version: "0.5.2",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -49235,6 +49235,75 @@ var init_remote_workspace = __esm(() => {
   };
 });
 
+// src/lib/remote-workspace-leave.ts
+function workspaceLeaveInput(context, input) {
+  const target = workspaceContext(context);
+  if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).sort().join(",") !== "confirm,expectedRole" || input.confirm !== true)
+    throw new WorkspaceLeaveInputError;
+  const captured = workspaceMemberRemovalInput(target.membershipId, { expectedRole: input.expectedRole });
+  return {
+    context: target,
+    input: { expectedRole: captured.body.expectedRole, confirm: true },
+    body: { membershipId: target.membershipId, expectedRole: captured.body.expectedRole }
+  };
+}
+function workspaceLeaveFailure(value, status) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const code = value.code;
+  return typeof code === "string" && Object.hasOwn(workspaceLeaveFailures, code) && workspaceLeaveFailures[code][0] === status ? code : null;
+}
+function parseWorkspaceLeaveResult(value, membershipId, organizationId) {
+  const row = value;
+  if (!row || typeof row !== "object" || Array.isArray(row) || row.membershipId !== membershipId || row.organizationId !== organizationId || row.removed !== true || row.signInRequired !== true)
+    throw new RemoteWorkspaceLeaveUnconfirmedError;
+  return { membershipId, organizationId, removed: true, signInRequired: true };
+}
+function workspaceLeaveProfileContext(membershipId, userId, profile) {
+  const observed = profile === undefined ? undefined : workspaceContext(profile);
+  const target = workspaceContext({ userId: userId ?? observed?.userId, membershipId });
+  if (observed && (observed.userId !== target.userId || observed.membershipId !== target.membershipId))
+    throw new WorkspaceIdentityMismatchError;
+  return target;
+}
+var WorkspaceLeaveInputError, workspaceLeaveFailures, RemoteWorkspaceLeaveError, RemoteWorkspaceLeaveUnconfirmedError;
+var init_remote_workspace_leave = __esm(() => {
+  init_remote_workspace_selection();
+  init_remote_workspace();
+  WorkspaceLeaveInputError = class WorkspaceLeaveInputError extends Error {
+    constructor() {
+      super("Confirm leaving the exact observed user and membership with its expected role.");
+      this.name = "WorkspaceLeaveInputError";
+    }
+  };
+  workspaceLeaveFailures = {
+    INVALID_REQUEST: [400, "Provide the exact current membership and expected role."],
+    ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required to leave a workspace."],
+    MEMBERSHIP_ROLE_CHANGED: [409, "Your role changed. Sign in and inspect the workspace before leaving."],
+    LAST_OWNER_REQUIRED: [409, "The workspace must retain another active owner."],
+    LAST_WORKSPACE_REQUIRED: [409, "Another available workspace is required before leaving."],
+    MEMBERSHIP_BUSY: [503, "Membership is busy. Inspect the workspace before another leave action."]
+  };
+  RemoteWorkspaceLeaveError = class RemoteWorkspaceLeaveError extends Error {
+    code;
+    status;
+    constructor(code) {
+      super(workspaceLeaveFailures[code][1]);
+      this.code = code;
+      this.name = "RemoteWorkspaceLeaveError";
+      this.status = workspaceLeaveFailures[code][0];
+    }
+  };
+  RemoteWorkspaceLeaveUnconfirmedError = class RemoteWorkspaceLeaveUnconfirmedError extends Error {
+    code = "WORKSPACE_LEAVE_UNCONFIRMED";
+    constructor() {
+      super("The leave outcome is unconfirmed. Sign in again and inspect available memberships before another action. Do not retry automatically; saved credentials are unchanged.");
+      this.name = "RemoteWorkspaceLeaveUnconfirmedError";
+    }
+  };
+});
+
 // src/lib/auth-store.ts
 import { chmodSync, existsSync as existsSync17, mkdirSync as mkdirSync7, readFileSync as readFileSync12, renameSync as renameSync4, statSync as statSync9, unlinkSync, writeFileSync as writeFileSync7 } from "fs";
 import { basename as basename4, dirname as dirname6, join as join18 } from "path";
@@ -49888,6 +49957,30 @@ class RemoteSkillsClient {
     }
     return value;
   }
+  async leaveWorkspace(context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+      throw new RemoteWorkspaceLeaveError("INTERACTIVE_SESSION_REQUIRED");
+    const identity2 = parseWorkspaceIdentity(value, captured.context.userId);
+    if (identity2.user.membershipId !== captured.context.membershipId)
+      throw new WorkspaceIdentityMismatchError;
+    let response, body;
+    try {
+      response = await connection.request("/api/v1/account/workspaces/leave", { method: "POST", body: JSON.stringify(captured.body) });
+      body = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, 4096)));
+    } catch {
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    if (!response.ok) {
+      const code = workspaceLeaveFailure(body, response.status);
+      if (code)
+        throw new RemoteWorkspaceLeaveError(code);
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    return parseWorkspaceLeaveResult(body, captured.context.membershipId, identity2.organization.id);
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -50277,6 +50370,7 @@ function createRemoteSkillsClientReadOnly(env3 = process.env) {
 }
 var RemoteRouteUnsupportedError, RemoteRequestError, RemoteWorkspaceMemberError, RemoteWorkspaceSelectionError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 var init_remote_client = __esm(() => {
+  init_remote_workspace_leave();
   init_remote_workspace_selection();
   init_remote_workspace();
   init_remote_workspace();
@@ -73694,6 +73788,10 @@ class RemoteSkillsAuthClient {
     const captured = workspaceMemberRoleInput(membershipId, input);
     return (await this.sessionClient(email2, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
   }
+  async leaveWorkspace(email2, code, context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    return (await this.sessionClient(email2, code, captured.context)).leaveWorkspace(captured.context, captured.input);
+  }
   async removeWorkspaceMember(email2, code, membershipId, input, context) {
     const captured = workspaceMemberRemovalInput(membershipId, input);
     return (await this.sessionClient(email2, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
@@ -73706,6 +73804,7 @@ class RemoteSkillsAuthClient {
 }
 var MAX_ERROR_DETAIL_LENGTH = 200, HostedApiError;
 var init_remote_auth = __esm(() => {
+  init_remote_workspace_leave();
   init_remote_workspace_selection();
   init_remote_files();
   init_remote_workspace();
@@ -73957,6 +74056,18 @@ function registerRemoteCustomerTools(server) {
     email: exports_external.string().email(),
     code: exports_external.string().regex(/^\d{6}$/)
   };
+  server.registerTool("leave_workspace", {
+    title: "Leave Current Workspace",
+    description: "Leave exactly the observed user and membership with confirm=true and fresh verification. The server enforces last-owner and last-workspace safeguards. Sign in again afterwards; no automatic retry or saved-profile deletion.",
+    annotations: { destructiveHint: true, idempotentHint: false, readOnlyHint: false },
+    inputSchema: exports_external.object({ ...memberInput, userId: memberInput.membershipId, confirm: exports_external.literal(true) }).strict()
+  }, async ({ membershipId, userId, expectedRole, email: email2, code, confirm }) => {
+    try {
+      return mcpJson(await freshAccount("Leave workspace", (client, context) => client.leaveWorkspace(email2, code, workspaceLeaveProfileContext(membershipId, userId, context), { expectedRole, confirm })));
+    } catch (error2) {
+      return error2 instanceof RemoteWorkspaceLeaveError || error2 instanceof RemoteWorkspaceLeaveUnconfirmedError ? mcpError(error2.code, error2.message) : mcpError("WORKSPACE_LEAVE_UNCONFIRMED", "Leaving could not be confirmed. Check the selected profile and exact membership, sign in again and inspect available workspaces before another action. Do not retry automatically; saved credentials are unchanged.");
+    }
+  });
   server.registerTool("set_workspace_member_role", {
     title: "Set Current Workspace Member Role",
     description: "Change exactly this membership incarnation with its observed expectedRole and fresh verification. The server enforces owner/admin policy. No automatic refresh or retry; saved credentials stay unchanged.",
@@ -74094,6 +74205,7 @@ var init_remote_customer_tools = __esm(() => {
   init_workspace_profile();
   init_remote_customer_operations();
   init_remote_client();
+  init_remote_workspace_leave();
   init_helpers();
 });
 
@@ -78485,6 +78597,53 @@ var init_auth = __esm(() => {
   CONFIG_HINT_STATUSES = new Set([401, 403, 404, 405, 501]);
 });
 
+// src/cli/commands/workspace-leave.ts
+function registerWorkspaceLeaveCommand(workspace) {
+  workspace.command("leave <membership-id>").allowExcessArguments(false).description("Leave exactly this membership after fresh verification; saved profiles stay unchanged").requiredOption("--expected-role <role>", "Observed role: owner, admin, member or viewer").requiredOption("--email <email>", "Account email for fresh verification").requiredOption("--confirm", "Confirm losing access through this membership and signing in again").option("--user-id <id>", "Observed user ID; required without a named workspace profile").option("--code-stdin", "Read a previously requested six-digit verification code from stdin").option("--json", "Output the confirmed result as JSON").action(async (membershipId, options) => {
+    try {
+      if (options.confirm !== true)
+        throw new WorkspaceLeaveInputError;
+      const pending = prepareProfileWorkspace("Leave workspace");
+      const target = await pending.resolve();
+      const captured = workspaceLeaveInput(workspaceLeaveProfileContext(membershipId, options.userId, target.context), { expectedRole: options.expectedRole, confirm: true });
+      if (!options.email.includes("@"))
+        throw new NameInputError("Provide the verified account email.");
+      if (!options.codeStdin && (options.json || !process.stdin.isTTY || !process.stderr.isTTY))
+        throw new NameInputError("Use --code-stdin with a fresh verification code for noninteractive leave actions.");
+      const client = new RemoteSkillsAuthClient(target.origin);
+      let code;
+      if (options.codeStdin)
+        code = await readCode();
+      else {
+        await client.requestCode(options.email);
+        code = await promptCode();
+      }
+      if (code === null)
+        return;
+      target.unchanged();
+      const result2 = await client.leaveWorkspace(options.email, code, captured.context, captured.input);
+      if (options.json)
+        console.log(JSON.stringify(result2));
+      else
+        console.log("Workspace membership left. Sign in again to an available workspace. Saved credentials are unchanged; this membership's credentials no longer grant access.");
+    } catch (error2) {
+      const known = error2 instanceof RemoteWorkspaceLeaveError || error2 instanceof RemoteWorkspaceLeaveUnconfirmedError;
+      const message = known || error2 instanceof WorkspaceLeaveInputError || error2 instanceof NameInputError ? error2.message : "Leaving could not be confirmed. Check the selected profile and exact membership, sign in again and inspect available workspaces before another action. Do not retry automatically; saved credentials are unchanged.";
+      if (options.json)
+        console.log(JSON.stringify({ error: message, ...known ? { code: error2.code } : {} }));
+      else
+        console.error(message);
+      process.exitCode = 1;
+    }
+  });
+}
+var init_workspace_leave = __esm(() => {
+  init_workspace_profile();
+  init_remote_auth();
+  init_remote_workspace_leave();
+  init_customer_verification();
+});
+
 // src/cli/commands/workspace-members.ts
 function registerWorkspaceMembersCommand(workspace) {
   workspace.command("members").allowExcessArguments(false).description("List the current workspace roster with fresh owner/admin verification").requiredOption("--email <email>", "Account email for fresh verification").option("--code-stdin", "Read a previously requested six-digit verification code from stdin").option("--limit <count>", "Page size from 1 to 100 (server default: 50)").option("--cursor <cursor>", "Unchanged nextCursor from the preceding page").option("--json", "Output the complete page as JSON").action(async (options) => {
@@ -78609,6 +78768,7 @@ function registerCustomerProfileCommands(program2) {
   registerWorkspaceListCommand(workspace);
   registerWorkspaceMembersCommand(workspace);
   registerWorkspaceMemberMutationCommands(workspace);
+  registerWorkspaceLeaveCommand(workspace);
   const commands = [
     { kind: "account", command: account.command("update") },
     { kind: "workspace", command: workspace.command("update") }
@@ -78655,6 +78815,7 @@ var init_customer_profile = __esm(() => {
   init_workspace_selection();
   init_remote_auth();
   init_customer_verification();
+  init_workspace_leave();
   init_workspace_members();
   init_workspace_member_mutations();
 });

package/bin/mcp.js

@@ -8490,6 +8490,75 @@ var init_remote_workspace = __esm(() => {
   };
 });
 
+// src/lib/remote-workspace-leave.ts
+function workspaceLeaveInput(context, input) {
+  const target = workspaceContext(context);
+  if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).sort().join(",") !== "confirm,expectedRole" || input.confirm !== true)
+    throw new WorkspaceLeaveInputError;
+  const captured = workspaceMemberRemovalInput(target.membershipId, { expectedRole: input.expectedRole });
+  return {
+    context: target,
+    input: { expectedRole: captured.body.expectedRole, confirm: true },
+    body: { membershipId: target.membershipId, expectedRole: captured.body.expectedRole }
+  };
+}
+function workspaceLeaveFailure(value, status) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const code = value.code;
+  return typeof code === "string" && Object.hasOwn(workspaceLeaveFailures, code) && workspaceLeaveFailures[code][0] === status ? code : null;
+}
+function parseWorkspaceLeaveResult(value, membershipId, organizationId) {
+  const row = value;
+  if (!row || typeof row !== "object" || Array.isArray(row) || row.membershipId !== membershipId || row.organizationId !== organizationId || row.removed !== true || row.signInRequired !== true)
+    throw new RemoteWorkspaceLeaveUnconfirmedError;
+  return { membershipId, organizationId, removed: true, signInRequired: true };
+}
+function workspaceLeaveProfileContext(membershipId, userId, profile) {
+  const observed = profile === undefined ? undefined : workspaceContext(profile);
+  const target = workspaceContext({ userId: userId ?? observed?.userId, membershipId });
+  if (observed && (observed.userId !== target.userId || observed.membershipId !== target.membershipId))
+    throw new WorkspaceIdentityMismatchError;
+  return target;
+}
+var WorkspaceLeaveInputError, workspaceLeaveFailures, RemoteWorkspaceLeaveError, RemoteWorkspaceLeaveUnconfirmedError;
+var init_remote_workspace_leave = __esm(() => {
+  init_remote_workspace_selection();
+  init_remote_workspace();
+  WorkspaceLeaveInputError = class WorkspaceLeaveInputError extends Error {
+    constructor() {
+      super("Confirm leaving the exact observed user and membership with its expected role.");
+      this.name = "WorkspaceLeaveInputError";
+    }
+  };
+  workspaceLeaveFailures = {
+    INVALID_REQUEST: [400, "Provide the exact current membership and expected role."],
+    ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required to leave a workspace."],
+    MEMBERSHIP_ROLE_CHANGED: [409, "Your role changed. Sign in and inspect the workspace before leaving."],
+    LAST_OWNER_REQUIRED: [409, "The workspace must retain another active owner."],
+    LAST_WORKSPACE_REQUIRED: [409, "Another available workspace is required before leaving."],
+    MEMBERSHIP_BUSY: [503, "Membership is busy. Inspect the workspace before another leave action."]
+  };
+  RemoteWorkspaceLeaveError = class RemoteWorkspaceLeaveError extends Error {
+    code;
+    status;
+    constructor(code) {
+      super(workspaceLeaveFailures[code][1]);
+      this.code = code;
+      this.name = "RemoteWorkspaceLeaveError";
+      this.status = workspaceLeaveFailures[code][0];
+    }
+  };
+  RemoteWorkspaceLeaveUnconfirmedError = class RemoteWorkspaceLeaveUnconfirmedError extends Error {
+    code = "WORKSPACE_LEAVE_UNCONFIRMED";
+    constructor() {
+      super("The leave outcome is unconfirmed. Sign in again and inspect available memberships before another action. Do not retry automatically; saved credentials are unchanged.");
+      this.name = "RemoteWorkspaceLeaveUnconfirmedError";
+    }
+  };
+});
+
 // src/lib/remote-account.ts
 function creditCount(value) {
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0 || value > 2147483647) {
@@ -8843,6 +8912,30 @@ class RemoteSkillsClient {
     }
     return value;
   }
+  async leaveWorkspace(context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+      throw new RemoteWorkspaceLeaveError("INTERACTIVE_SESSION_REQUIRED");
+    const identity = parseWorkspaceIdentity(value, captured.context.userId);
+    if (identity.user.membershipId !== captured.context.membershipId)
+      throw new WorkspaceIdentityMismatchError;
+    let response, body;
+    try {
+      response = await connection.request("/api/v1/account/workspaces/leave", { method: "POST", body: JSON.stringify(captured.body) });
+      body = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, 4096)));
+    } catch {
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    if (!response.ok) {
+      const code = workspaceLeaveFailure(body, response.status);
+      if (code)
+        throw new RemoteWorkspaceLeaveError(code);
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    return parseWorkspaceLeaveResult(body, captured.context.membershipId, identity.organization.id);
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -9232,6 +9325,7 @@ function createRemoteSkillsClientReadOnly(env = process.env) {
 }
 var RemoteRouteUnsupportedError, RemoteRequestError, RemoteWorkspaceMemberError, RemoteWorkspaceSelectionError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 var init_remote_client = __esm(() => {
+  init_remote_workspace_leave();
   init_remote_workspace_selection();
   init_remote_workspace();
   init_remote_workspace();
@@ -14805,7 +14899,7 @@ class StdioServerTransport {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.5.1",
+  version: "0.5.2",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -29557,6 +29651,7 @@ function registerStorageTools(server) {
 }
 
 // src/lib/remote-auth.ts
+init_remote_workspace_leave();
 init_remote_workspace_selection();
 init_remote_files();
 init_remote_workspace();
@@ -29732,6 +29827,10 @@ class RemoteSkillsAuthClient {
     const captured = workspaceMemberRoleInput(membershipId, input);
     return (await this.sessionClient(email2, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
   }
+  async leaveWorkspace(email2, code, context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    return (await this.sessionClient(email2, code, captured.context)).leaveWorkspace(captured.context, captured.input);
+  }
   async removeWorkspaceMember(email2, code, membershipId, input, context) {
     const captured = workspaceMemberRemovalInput(membershipId, input);
     return (await this.sessionClient(email2, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
@@ -29825,6 +29924,7 @@ async function captureProfileWorkspace(action, source = process.env) {
 
 // src/mcp/remote-customer-tools.ts
 init_remote_client();
+init_remote_workspace_leave();
 function registerRemoteCustomerTools(server) {
   const memberRole = exports_external.enum(["owner", "admin", "member", "viewer"]);
   const memberInput = {
@@ -29833,6 +29933,18 @@ function registerRemoteCustomerTools(server) {
     email: exports_external.string().email(),
     code: exports_external.string().regex(/^\d{6}$/)
   };
+  server.registerTool("leave_workspace", {
+    title: "Leave Current Workspace",
+    description: "Leave exactly the observed user and membership with confirm=true and fresh verification. The server enforces last-owner and last-workspace safeguards. Sign in again afterwards; no automatic retry or saved-profile deletion.",
+    annotations: { destructiveHint: true, idempotentHint: false, readOnlyHint: false },
+    inputSchema: exports_external.object({ ...memberInput, userId: memberInput.membershipId, confirm: exports_external.literal(true) }).strict()
+  }, async ({ membershipId, userId, expectedRole, email: email2, code, confirm }) => {
+    try {
+      return mcpJson(await freshAccount("Leave workspace", (client, context) => client.leaveWorkspace(email2, code, workspaceLeaveProfileContext(membershipId, userId, context), { expectedRole, confirm })));
+    } catch (error2) {
+      return error2 instanceof RemoteWorkspaceLeaveError || error2 instanceof RemoteWorkspaceLeaveUnconfirmedError ? mcpError(error2.code, error2.message) : mcpError("WORKSPACE_LEAVE_UNCONFIRMED", "Leaving could not be confirmed. Check the selected profile and exact membership, sign in again and inspect available workspaces before another action. Do not retry automatically; saved credentials are unchanged.");
+    }
+  });
   server.registerTool("set_workspace_member_role", {
     title: "Set Current Workspace Member Role",
     description: "Change exactly this membership incarnation with its observed expectedRole and fresh verification. The server enforces owner/admin policy. No automatic refresh or retry; saved credentials stay unchanged.",

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join6 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.5.1",
+  version: "0.5.2",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -23100,7 +23100,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.5.1",
+  version: "0.5.2",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -23103,7 +23103,7 @@ import { randomUUID as randomUUID4 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.5.1",
+  version: "0.5.2",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/cli/commands/workspace-leave.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerWorkspaceLeaveCommand(workspace: Command): void;

package/dist/index.d.ts

@@ -46,3 +46,5 @@ export type { RemoteCustomerRole, RemoteCustomerProfile, RemoteCurrentWorkspace,
 export type { RemoteWorkspaceContext, RemoteAccountWorkspace, RemoteAccountWorkspaces, RemoteWorkspaceIdentity, RemoteWorkspaceSession, RemoteAccountWorkspaceDiscovery, RemoteWorkspaceSelectionErrorCode } from "./lib/remote-workspace-selection.js";
 export { WorkspaceContextInputError, WorkspaceIdentityMismatchError } from "./lib/remote-workspace-selection.js";
 export { RemoteWorkspaceSelectionError } from "./lib/remote-client.js";
+export type { LeaveRemoteWorkspace, RemoteWorkspaceLeaveResult, RemoteWorkspaceLeaveErrorCode } from "./lib/remote-workspace-leave.js";
+export { WorkspaceLeaveInputError, RemoteWorkspaceLeaveError, RemoteWorkspaceLeaveUnconfirmedError } from "./lib/remote-workspace-leave.js";

package/dist/index.js

@@ -10450,6 +10450,65 @@ function parseWorkspaceMembersPage(value) {
     return fail();
   return { organizationId: value.organizationId, members, nextCursor: value.nextCursor };
 }
+
+// src/lib/remote-workspace-leave.ts
+class WorkspaceLeaveInputError extends Error {
+  constructor() {
+    super("Confirm leaving the exact observed user and membership with its expected role.");
+    this.name = "WorkspaceLeaveInputError";
+  }
+}
+function workspaceLeaveInput(context, input) {
+  const target = workspaceContext(context);
+  if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).sort().join(",") !== "confirm,expectedRole" || input.confirm !== true)
+    throw new WorkspaceLeaveInputError;
+  const captured = workspaceMemberRemovalInput(target.membershipId, { expectedRole: input.expectedRole });
+  return {
+    context: target,
+    input: { expectedRole: captured.body.expectedRole, confirm: true },
+    body: { membershipId: target.membershipId, expectedRole: captured.body.expectedRole }
+  };
+}
+var workspaceLeaveFailures = {
+  INVALID_REQUEST: [400, "Provide the exact current membership and expected role."],
+  ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+  INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required to leave a workspace."],
+  MEMBERSHIP_ROLE_CHANGED: [409, "Your role changed. Sign in and inspect the workspace before leaving."],
+  LAST_OWNER_REQUIRED: [409, "The workspace must retain another active owner."],
+  LAST_WORKSPACE_REQUIRED: [409, "Another available workspace is required before leaving."],
+  MEMBERSHIP_BUSY: [503, "Membership is busy. Inspect the workspace before another leave action."]
+};
+
+class RemoteWorkspaceLeaveError extends Error {
+  code;
+  status;
+  constructor(code) {
+    super(workspaceLeaveFailures[code][1]);
+    this.code = code;
+    this.name = "RemoteWorkspaceLeaveError";
+    this.status = workspaceLeaveFailures[code][0];
+  }
+}
+
+class RemoteWorkspaceLeaveUnconfirmedError extends Error {
+  code = "WORKSPACE_LEAVE_UNCONFIRMED";
+  constructor() {
+    super("The leave outcome is unconfirmed. Sign in again and inspect available memberships before another action. Do not retry automatically; saved credentials are unchanged.");
+    this.name = "RemoteWorkspaceLeaveUnconfirmedError";
+  }
+}
+function workspaceLeaveFailure(value, status) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const code = value.code;
+  return typeof code === "string" && Object.hasOwn(workspaceLeaveFailures, code) && workspaceLeaveFailures[code][0] === status ? code : null;
+}
+function parseWorkspaceLeaveResult(value, membershipId, organizationId) {
+  const row = value;
+  if (!row || typeof row !== "object" || Array.isArray(row) || row.membershipId !== membershipId || row.organizationId !== organizationId || row.removed !== true || row.signInRequired !== true)
+    throw new RemoteWorkspaceLeaveUnconfirmedError;
+  return { membershipId, organizationId, removed: true, signInRequired: true };
+}
 // src/lib/auth-store.ts
 function getApiUrl(action, env = process.env, options = {}) {
   return requireSkillsApiOrigin(action, env, options);
@@ -10949,6 +11008,30 @@ class RemoteSkillsClient {
     }
     return value;
   }
+  async leaveWorkspace(context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+      throw new RemoteWorkspaceLeaveError("INTERACTIVE_SESSION_REQUIRED");
+    const identity = parseWorkspaceIdentity(value, captured.context.userId);
+    if (identity.user.membershipId !== captured.context.membershipId)
+      throw new WorkspaceIdentityMismatchError;
+    let response, body;
+    try {
+      response = await connection.request("/api/v1/account/workspaces/leave", { method: "POST", body: JSON.stringify(captured.body) });
+      body = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, 4096)));
+    } catch {
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    if (!response.ok) {
+      const code = workspaceLeaveFailure(body, response.status);
+      if (code)
+        throw new RemoteWorkspaceLeaveError(code);
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    return parseWorkspaceLeaveResult(body, captured.context.membershipId, identity.organization.id);
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -12441,7 +12524,7 @@ import { dirname as dirname7, relative as relative4 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.5.1",
+  version: "0.5.2",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -15081,6 +15164,10 @@ class RemoteSkillsAuthClient {
     const captured = workspaceMemberRoleInput(membershipId, input);
     return (await this.sessionClient(email, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
   }
+  async leaveWorkspace(email, code, context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    return (await this.sessionClient(email, code, captured.context)).leaveWorkspace(captured.context, captured.input);
+  }
   async removeWorkspaceMember(email, code, membershipId, input, context) {
     const captured = workspaceMemberRemovalInput(membershipId, input);
     return (await this.sessionClient(email, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
@@ -15273,6 +15360,7 @@ export {
   agentGlobalSkillsDir,
   addSchedule,
   adaptSkillMdForAgent,
+  WorkspaceLeaveInputError,
   WorkspaceIdentityMismatchError,
   WorkspaceContextInputError,
   TOOL_PRIMITIVE_SCHEMA_VERSION,
@@ -15308,6 +15396,8 @@ export {
   SKILLS,
   RemoteWorkspaceSelectionError,
   RemoteWorkspaceMemberError,
+  RemoteWorkspaceLeaveUnconfirmedError,
+  RemoteWorkspaceLeaveError,
   RemoteSkillsClient,
   RemoteSkillsAuthClient,
   RemoteRouteUnsupportedError,

package/dist/lib/remote-auth.d.ts

@@ -1,3 +1,4 @@
+import { type LeaveRemoteWorkspace } from "./remote-workspace-leave.js";
 import { type RemoteWorkspaceContext, type RemoteWorkspaceSession, type RemoteAccountWorkspaceDiscovery } from "./remote-workspace-selection.js";
 import { type RemoteWorkspaceMembersOptions } from "./remote-workspace.js";
 import { type SetRemoteWorkspaceMemberRole, type RemoveRemoteWorkspaceMember } from "./remote-workspace.js";
@@ -46,6 +47,8 @@ export declare class RemoteSkillsAuthClient {
     /** Fresh owner/admin session; explicit context survives default-workspace OTP selection. */
     listWorkspaceMembers(email: string, code: string, options?: RemoteWorkspaceMembersOptions, context?: RemoteWorkspaceContext): Promise<import("./remote-workspace.js").RemoteWorkspaceMembersPage>;
     setWorkspaceMemberRole(email: string, code: string, membershipId: string, input: SetRemoteWorkspaceMemberRole, context?: RemoteWorkspaceContext): Promise<import("./remote-workspace.js").RemoteWorkspaceMemberRoleResult>;
+    /** Fresh verification binds the exact observed incarnation before a single confirmed leave. */
+    leaveWorkspace(email: string, code: string, context: RemoteWorkspaceContext, input: LeaveRemoteWorkspace): Promise<import("./remote-workspace-leave.js").RemoteWorkspaceLeaveResult>;
     removeWorkspaceMember(email: string, code: string, membershipId: string, input: RemoveRemoteWorkspaceMember, context?: RemoteWorkspaceContext): Promise<import("./remote-workspace.js").RemoteWorkspaceMemberRemovalResult>;
     /** Common auth transport used by CLI login, preserving the selected instance through awaits. */
     request(path: string, options?: RequestInit): Promise<any>;

package/dist/lib/remote-client.d.ts

@@ -1,3 +1,4 @@
+import { type LeaveRemoteWorkspace, type RemoteWorkspaceLeaveResult } from "./remote-workspace-leave.js";
 import { type RemoteWorkspaceContext, type RemoteAccountWorkspaces, type RemoteWorkspaceSession, type RemoteWorkspaceSelectionErrorCode } from "./remote-workspace-selection.js";
 import { type RemoteWorkspaceMembersOptions, type RemoteWorkspaceMembersPage } from "./remote-workspace.js";
 import { type RemoteWorkspaceMemberErrorCode, type SetRemoteWorkspaceMemberRole, type RemoveRemoteWorkspaceMember, type RemoteWorkspaceMemberRoleResult, type RemoteWorkspaceMemberRemovalResult } from "./remote-workspace.js";
@@ -145,6 +146,8 @@ export declare class RemoteSkillsClient {
     /** Removes only this incarnation. A successful tombstone replay is returned unchanged. */
     removeWorkspaceMember(membershipId: string, input: RemoveRemoteWorkspaceMember): Promise<RemoteWorkspaceMemberRemovalResult>;
     private requestWorkspaceMember;
+    /** Leave only the explicitly confirmed current incarnation, once. No credential writes or retries. */
+    leaveWorkspace(context: RemoteWorkspaceContext, input: LeaveRemoteWorkspace): Promise<RemoteWorkspaceLeaveResult>;
     listApiKeys(): Promise<Record<string, unknown>[]>;
     createApiKey(name: string, scopes?: string[]): Promise<{
         key: string;

package/dist/lib/remote-workspace-leave.d.ts

@@ -0,0 +1,52 @@
+import { type RemoteWorkspaceContext } from "./remote-workspace-selection.js";
+import type { RemoteCustomerRole } from "./remote-profile.js";
+export type LeaveRemoteWorkspace = Readonly<{
+    expectedRole: RemoteCustomerRole;
+    confirm: true;
+}>;
+export type RemoteWorkspaceLeaveResult = {
+    organizationId: string;
+    membershipId: string;
+    removed: true;
+    signInRequired: true;
+};
+export declare class WorkspaceLeaveInputError extends Error {
+    constructor();
+}
+export declare function workspaceLeaveInput(context: RemoteWorkspaceContext, input: LeaveRemoteWorkspace): {
+    context: Readonly<{
+        userId: string;
+        membershipId: string;
+    }>;
+    input: {
+        expectedRole: RemoteCustomerRole;
+        confirm: true;
+    };
+    body: {
+        membershipId: string;
+        expectedRole: RemoteCustomerRole;
+    };
+};
+export declare const workspaceLeaveFailures: {
+    readonly INVALID_REQUEST: readonly [400, "Provide the exact current membership and expected role."];
+    readonly ACCOUNT_UNAVAILABLE: readonly [403, "Account is unavailable."];
+    readonly INTERACTIVE_SESSION_REQUIRED: readonly [403, "Fresh interactive sign-in is required to leave a workspace."];
+    readonly MEMBERSHIP_ROLE_CHANGED: readonly [409, "Your role changed. Sign in and inspect the workspace before leaving."];
+    readonly LAST_OWNER_REQUIRED: readonly [409, "The workspace must retain another active owner."];
+    readonly LAST_WORKSPACE_REQUIRED: readonly [409, "Another available workspace is required before leaving."];
+    readonly MEMBERSHIP_BUSY: readonly [503, "Membership is busy. Inspect the workspace before another leave action."];
+};
+export type RemoteWorkspaceLeaveErrorCode = keyof typeof workspaceLeaveFailures;
+export declare class RemoteWorkspaceLeaveError extends Error {
+    readonly code: RemoteWorkspaceLeaveErrorCode;
+    readonly status: number;
+    constructor(code: RemoteWorkspaceLeaveErrorCode);
+}
+export declare class RemoteWorkspaceLeaveUnconfirmedError extends Error {
+    readonly code = "WORKSPACE_LEAVE_UNCONFIRMED";
+    constructor();
+}
+export declare function workspaceLeaveFailure(value: unknown, status: number): RemoteWorkspaceLeaveErrorCode | null;
+export declare function parseWorkspaceLeaveResult(value: unknown, membershipId: string, organizationId: string): RemoteWorkspaceLeaveResult;
+/** A configured profile may constrain an explicit leave, never retarget it. */
+export declare function workspaceLeaveProfileContext(membershipId: string, userId: string | undefined, profile?: RemoteWorkspaceContext): RemoteWorkspaceContext;

package/dist/sdk/index.d.ts

@@ -40,3 +40,5 @@ export type { RemoteCustomerRole, RemoteCustomerProfile, RemoteCurrentWorkspace,
 export type { RemoteWorkspaceContext, RemoteAccountWorkspace, RemoteAccountWorkspaces, RemoteWorkspaceIdentity, RemoteWorkspaceSession, RemoteAccountWorkspaceDiscovery, RemoteWorkspaceSelectionErrorCode } from "../lib/remote-workspace-selection.js";
 export { WorkspaceContextInputError, WorkspaceIdentityMismatchError } from "../lib/remote-workspace-selection.js";
 export { RemoteWorkspaceSelectionError } from "../lib/remote-client.js";
+export type { LeaveRemoteWorkspace, RemoteWorkspaceLeaveResult, RemoteWorkspaceLeaveErrorCode } from "../lib/remote-workspace-leave.js";
+export { WorkspaceLeaveInputError, RemoteWorkspaceLeaveError, RemoteWorkspaceLeaveUnconfirmedError } from "../lib/remote-workspace-leave.js";

package/dist/sdk/index.js

@@ -25462,7 +25462,7 @@ class MissingSkillsFleetError extends Error {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.5.1",
+  version: "0.5.2",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -52360,6 +52360,65 @@ function parseWorkspaceMembersPage(value) {
     return fail();
   return { organizationId: value.organizationId, members, nextCursor: value.nextCursor };
 }
+
+// src/lib/remote-workspace-leave.ts
+class WorkspaceLeaveInputError extends Error {
+  constructor() {
+    super("Confirm leaving the exact observed user and membership with its expected role.");
+    this.name = "WorkspaceLeaveInputError";
+  }
+}
+function workspaceLeaveInput(context, input) {
+  const target = workspaceContext(context);
+  if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).sort().join(",") !== "confirm,expectedRole" || input.confirm !== true)
+    throw new WorkspaceLeaveInputError;
+  const captured = workspaceMemberRemovalInput(target.membershipId, { expectedRole: input.expectedRole });
+  return {
+    context: target,
+    input: { expectedRole: captured.body.expectedRole, confirm: true },
+    body: { membershipId: target.membershipId, expectedRole: captured.body.expectedRole }
+  };
+}
+var workspaceLeaveFailures = {
+  INVALID_REQUEST: [400, "Provide the exact current membership and expected role."],
+  ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+  INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required to leave a workspace."],
+  MEMBERSHIP_ROLE_CHANGED: [409, "Your role changed. Sign in and inspect the workspace before leaving."],
+  LAST_OWNER_REQUIRED: [409, "The workspace must retain another active owner."],
+  LAST_WORKSPACE_REQUIRED: [409, "Another available workspace is required before leaving."],
+  MEMBERSHIP_BUSY: [503, "Membership is busy. Inspect the workspace before another leave action."]
+};
+
+class RemoteWorkspaceLeaveError extends Error {
+  code;
+  status;
+  constructor(code) {
+    super(workspaceLeaveFailures[code][1]);
+    this.code = code;
+    this.name = "RemoteWorkspaceLeaveError";
+    this.status = workspaceLeaveFailures[code][0];
+  }
+}
+
+class RemoteWorkspaceLeaveUnconfirmedError extends Error {
+  code = "WORKSPACE_LEAVE_UNCONFIRMED";
+  constructor() {
+    super("The leave outcome is unconfirmed. Sign in again and inspect available memberships before another action. Do not retry automatically; saved credentials are unchanged.");
+    this.name = "RemoteWorkspaceLeaveUnconfirmedError";
+  }
+}
+function workspaceLeaveFailure(value, status) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const code = value.code;
+  return typeof code === "string" && Object.hasOwn(workspaceLeaveFailures, code) && workspaceLeaveFailures[code][0] === status ? code : null;
+}
+function parseWorkspaceLeaveResult(value, membershipId, organizationId) {
+  const row = value;
+  if (!row || typeof row !== "object" || Array.isArray(row) || row.membershipId !== membershipId || row.organizationId !== organizationId || row.removed !== true || row.signInRequired !== true)
+    throw new RemoteWorkspaceLeaveUnconfirmedError;
+  return { membershipId, organizationId, removed: true, signInRequired: true };
+}
 // src/lib/auth-store.ts
 function getApiUrl(action, env = process.env, options = {}) {
   return requireSkillsApiOrigin(action, env, options);
@@ -52815,6 +52874,30 @@ class RemoteSkillsClient {
     }
     return value;
   }
+  async leaveWorkspace(context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+      throw new RemoteWorkspaceLeaveError("INTERACTIVE_SESSION_REQUIRED");
+    const identity = parseWorkspaceIdentity(value, captured.context.userId);
+    if (identity.user.membershipId !== captured.context.membershipId)
+      throw new WorkspaceIdentityMismatchError;
+    let response, body;
+    try {
+      response = await connection.request("/api/v1/account/workspaces/leave", { method: "POST", body: JSON.stringify(captured.body) });
+      body = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, 4096)));
+    } catch {
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    if (!response.ok) {
+      const code = workspaceLeaveFailure(body, response.status);
+      if (code)
+        throw new RemoteWorkspaceLeaveError(code);
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    return parseWorkspaceLeaveResult(body, captured.context.membershipId, identity.organization.id);
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -53370,6 +53453,10 @@ class RemoteSkillsAuthClient {
     const captured = workspaceMemberRoleInput(membershipId, input);
     return (await this.sessionClient(email, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
   }
+  async leaveWorkspace(email, code, context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    return (await this.sessionClient(email, code, captured.context)).leaveWorkspace(captured.context, captured.input);
+  }
   async removeWorkspaceMember(email, code, membershipId, input, context) {
     const captured = workspaceMemberRemovalInput(membershipId, input);
     return (await this.sessionClient(email, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
@@ -53453,6 +53540,7 @@ export {
   assertDurableTarget,
   assertDurableStore,
   artifactStorageSeam,
+  WorkspaceLeaveInputError,
   WorkspaceIdentityMismatchError,
   WorkspaceContextInputError,
   SqliteSkillsStore,
@@ -53465,6 +53553,8 @@ export {
   SKILLS_API_KEY_ENV,
   RemoteWorkspaceSelectionError,
   RemoteWorkspaceMemberError,
+  RemoteWorkspaceLeaveUnconfirmedError,
+  RemoteWorkspaceLeaveError,
   RemoteSkillsClient,
   RemoteSkillsAuthClient,
   RemoteRouteUnsupportedError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {