@hasna/skills 0.5.1 → 0.5.3

package/bin/index.js

@@ -36860,7 +36860,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.5.1",
+    version: "0.5.3",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -39323,10 +39323,45 @@ var init_skill_validation = __esm(() => {
   VALID_BIN_COMMAND = /^[a-z0-9][a-z0-9._-]*$/;
 });
 
+// src/lib/skill-entry-path.ts
+class SkillEntryPaths {
+  files = new Set;
+  directories = new Set;
+  add(path, maxBytes, invalid, limit) {
+    if (path.length > maxBytes)
+      limit();
+    const encoded = new TextEncoder().encode(path);
+    if (encoded.byteLength > maxBytes)
+      limit();
+    if (new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(encoded) !== path)
+      invalid("Invalid UTF-8 entry path");
+    if (!path || /[\\:\x00-\x1f\x7f]/u.test(path))
+      invalid("Unsafe entry path");
+    if (path.split("/").some((segment) => !segment || segment === "." || segment === ".."))
+      invalid("Unsafe entry path segment");
+    const key = path.normalize("NFC").toLowerCase().normalize("NFC");
+    if (this.files.has(key) || this.directories.has(key))
+      invalid("Duplicate or conflicting entry path");
+    const parents = key.split("/");
+    parents.pop();
+    while (parents.length) {
+      const parent = parents.join("/");
+      if (this.files.has(parent))
+        invalid("Conflicting entry file ancestor");
+      this.directories.add(parent);
+      parents.pop();
+    }
+    this.files.add(key);
+  }
+}
+
 // src/lib/skill-hash.ts
 import { createHash } from "crypto";
 import { existsSync as existsSync9, readdirSync as readdirSync4, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
 import { join as join9, sep } from "path";
+function excludedHashEntry(name, directory) {
+  return name.startsWith(".") || directory && HASH_EXCLUDE_DIRS.has(name);
+}
 function normalizeLineEndings(content) {
   return content.replace(/\r\n/g, `
 `).replace(/\r/g, `
@@ -39397,7 +39432,7 @@ function collectDirectory(files, dir, rel) {
     if (stats.isSymbolicLink())
       continue;
     if (stats.isDirectory()) {
-      if (HASH_EXCLUDE_DIRS.has(entry))
+      if (excludedHashEntry(entry, true))
         continue;
       collectDirectory(files, absolute, childRel);
     } else if (stats.isFile()) {
@@ -39407,26 +39442,34 @@ function collectDirectory(files, dir, rel) {
 }
 function collectFile(files, absolute, rel) {
   const buffer = readFileSync5(absolute);
+  files.push(normalizeBundleFile(rel.split(sep).join("/"), buffer));
+}
+function normalizeBundleFile(rel, buffer) {
   if (rel === "skill.json") {
-    files.push({ rel: rel.split(sep).join("/"), content: new TextEncoder().encode(canonicalizeManifest(new TextDecoder().decode(buffer))) });
-    return;
+    return { rel, content: new TextEncoder().encode(canonicalizeManifest(new TextDecoder().decode(buffer))) };
   }
   if (looksLikeText(buffer)) {
     const normalized = normalizeLineEndings(new TextDecoder().decode(buffer));
-    files.push({ rel: rel.split(sep).join("/"), content: new TextEncoder().encode(normalized) });
-    return;
+    return { rel, content: new TextEncoder().encode(normalized) };
   }
-  files.push({ rel: rel.split(sep).join("/"), content: buffer });
+  return { rel, content: buffer };
 }
 function computeContentHash(skillPath) {
-  const hash = createHash(CONTENT_HASH_ALGORITHM);
-  for (const file of collectBundleFiles(skillPath)) {
-    hash.update(new TextEncoder().encode(file.rel));
-    hash.update(new TextEncoder().encode(`\x00${file.content.length}\x00`));
-    hash.update(file.content);
-    hash.update(new TextEncoder().encode("\x00"));
+  return hashBundleFiles(collectBundleFiles(skillPath));
+}
+function* bundleHashParts(files) {
+  for (const file of files) {
+    yield new TextEncoder().encode(file.rel);
+    yield new TextEncoder().encode(`\x00${file.content.length}\x00`);
+    yield file.content;
+    yield new TextEncoder().encode("\x00");
   }
-  hash.update(new TextEncoder().encode("\x00"));
+  yield new TextEncoder().encode("\x00");
+}
+function hashBundleFiles(files) {
+  const hash = createHash(CONTENT_HASH_ALGORITHM);
+  for (const part of bundleHashParts(files))
+    hash.update(part);
   return hash.digest("hex");
 }
 function verifyContentHash(skillPath, manifest) {
@@ -39463,7 +39506,7 @@ function hashSkillMarkdown(content) {
 function hashSkillMarkdownFile(path) {
   return hashSkillMarkdown(readFileSync5(path, "utf-8"));
 }
-var CONTENT_HASH_ALGORITHM = "sha256", HASH_EXCLUDE_DIRS, HASH_COVERAGE;
+var CONTENT_HASH_ALGORITHM = "sha256", HASH_EXCLUDE_DIRS, HASH_COVERAGE, CONTENT_HASH_LIMITS, typedArrayPrototype, byteLengthOf, bufferOf;
 var init_skill_hash = __esm(() => {
   HASH_EXCLUDE_DIRS = new Set([".git", "node_modules", "dist", "build", ".turbo"]);
   HASH_COVERAGE = [
@@ -39477,6 +39520,20 @@ var init_skill_hash = __esm(() => {
     "assets",
     "references"
   ];
+  CONTENT_HASH_LIMITS = Object.freeze({
+    entries: 1024,
+    rawBytes: 64 * 1024 * 1024,
+    normalizedBytes: 64 * 1024 * 1024,
+    fileBytes: 16 * 1024 * 1024,
+    normalizedFileBytes: 16 * 1024 * 1024,
+    pathBytes: 100,
+    manifestBytes: 16 * 1024,
+    manifestDepth: 64,
+    timeoutMs: 5000
+  });
+  typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
+  byteLengthOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteLength").get;
+  bufferOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer").get;
 });
 
 // src/lib/portable-skills-types.ts
@@ -49045,50 +49102,210 @@ var init_read_access = __esm(() => {
   init_remote_registry();
 });
 
+// src/lib/remote-invitations.ts
+function invitationFailure(value, status) {
+  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(invitationFailures, value.code))
+    return null;
+  const code = value.code;
+  return invitationFailures[code][0] === status ? code : null;
+}
+function invitationId(value) {
+  return uuid(value) ? value : inputFailure();
+}
+function invitationInput(action, input) {
+  if (!record(input))
+    return inputFailure();
+  const keys2 = {
+    list: ["after"],
+    get: ["invitationId"],
+    issue: ["email", "role", "idempotencyKey", "confirm"],
+    resend: ["invitationId", "expectedGeneration", "idempotencyKey", "confirm"],
+    revoke: ["invitationId", "expectedGeneration", "confirm"],
+    accept: ["invitationId", "token", "confirm"]
+  };
+  if (Object.keys(input).some((key) => !keys2[action].includes(key)) || action !== "list" && keys2[action].some((key) => !Object.hasOwn(input, key)))
+    return inputFailure();
+  const value = { ...input };
+  if (action === "list") {
+    if (value.after !== undefined && !uuid(value.after))
+      return inputFailure();
+  }
+  if (["get", "resend", "revoke", "accept"].includes(action) && !uuid(value.invitationId))
+    return inputFailure();
+  if (!["list", "get"].includes(action) && value.confirm !== true)
+    return inputFailure();
+  if (["issue", "resend"].includes(action) && !uuid(value.idempotencyKey))
+    return inputFailure();
+  if (action === "issue") {
+    if (typeof value.email !== "string")
+      return inputFailure();
+    value.email = value.email.trim().toLowerCase();
+    if (!email(value.email) || !role(value.role))
+      return inputFailure();
+  }
+  if (["resend", "revoke"].includes(action) && (!Number.isInteger(value.expectedGeneration) || Number(value.expectedGeneration) < 1 || Number(value.expectedGeneration) > 10))
+    return inputFailure();
+  if (action === "accept" && (typeof value.token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value.token)))
+    return inputFailure();
+  return value;
+}
+function invitationRequest(action, input) {
+  const base2 = "/api/v1/workspace/invitations", value = input;
+  const { confirm: _confirm, invitationId: id, ...body } = value;
+  if (action === "list")
+    return { path: base2 + (value.after ? `?after=${value.after}` : ""), method: "GET" };
+  if (action === "get")
+    return { path: `${base2}/${id}`, method: "GET" };
+  if (action === "accept")
+    return { path: "/api/v1/account/invitations/accept", method: "POST", body: JSON.stringify({ invitationId: id, token: value.token }) };
+  return { path: action === "issue" ? base2 : `${base2}/${id}${action === "resend" ? "/resend" : ""}`, method: action === "revoke" ? "DELETE" : "POST", body: JSON.stringify(body) };
+}
+function invalid() {
+  throw new RemoteWorkspaceInvitationReadError;
+}
+function projection(v, organizationId) {
+  if (!record(v) || !uuid(v.id) || v.organizationId !== organizationId || !email(v.email) || v.email !== v.email.trim().toLowerCase() || !role(v.role) || !Number.isInteger(v.generation) || Number(v.generation) < 1 || Number(v.generation) > 10 || typeof v.status !== "string" || !["pending", "expired", "accepted", "revoked"].includes(v.status) || !timestamp(v.expiresAt) || !timestamp(v.createdAt) || !record(v.delivery) || typeof v.delivery.state !== "string" || !["queued", "sending", "uncertain", "provider_accepted", "failed", "cancelled"].includes(v.delivery.state) || !Number.isInteger(v.delivery.attempts) || Number(v.delivery.attempts) < 0 || Number(v.delivery.attempts) > 5)
+    return invalid();
+  return {
+    id: v.id,
+    organizationId,
+    email: v.email,
+    role: v.role,
+    generation: Number(v.generation),
+    status: v.status,
+    expiresAt: v.expiresAt,
+    createdAt: v.createdAt,
+    delivery: { state: v.delivery.state, attempts: Number(v.delivery.attempts) }
+  };
+}
+function parseInvitationResult(action, value, input, organizationId) {
+  if (!record(value))
+    return invalid();
+  const request = input;
+  if (action === "accept") {
+    if (!uuid(value.organizationId) || !uuid(value.membershipId) || value.accepted !== true || typeof value.changed !== "boolean")
+      return invalid();
+    return { organizationId: value.organizationId, membershipId: value.membershipId, accepted: true, changed: value.changed };
+  }
+  if (action === "list") {
+    if (value.organizationId !== organizationId || !Array.isArray(value.invitations) || value.invitations.length > 50 || value.nextCursor !== null && !uuid(value.nextCursor))
+      return invalid();
+    const invitations = value.invitations.map((v) => projection(v, organizationId));
+    if (invitations.some((v, n) => v.id <= String(n ? invitations[n - 1].id : request.after ?? "")) || value.nextCursor !== null && (invitations.length !== 50 || value.nextCursor !== invitations.at(-1)?.id))
+      return invalid();
+    return { organizationId, invitations, nextCursor: value.nextCursor };
+  }
+  const invitation = projection(value.invitation, organizationId);
+  if (action !== "issue" && invitation.id !== request.invitationId)
+    return invalid();
+  if (action === "get")
+    return { invitation };
+  if (typeof value.changed !== "boolean")
+    return invalid();
+  if (action === "issue" && (invitation.email !== request.email || invitation.role !== request.role || value.changed && invitation.generation !== 1))
+    return invalid();
+  if (action === "resend" && (value.changed ? invitation.generation !== Number(request.expectedGeneration) + 1 : invitation.generation <= Number(request.expectedGeneration)))
+    return invalid();
+  if (action === "revoke" && (invitation.status !== "revoked" || invitation.generation < Number(request.expectedGeneration) || value.changed && invitation.generation !== request.expectedGeneration))
+    return invalid();
+  return { invitation, changed: value.changed };
+}
+var WorkspaceInvitationInputError, invitationFailures, RemoteWorkspaceInvitationError, RemoteWorkspaceInvitationUnconfirmedError, RemoteWorkspaceInvitationReadError, record = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), role = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), email = (v) => typeof v === "string" && v.length <= 254 && !/[\p{Cc}\p{Cs}\u2028\u2029\s]/u.test(v) && /^[^@]+@[^@]+\.[^@]+$/.test(v), timestamp = (v) => typeof v === "string" && v.length <= 40 && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d{1,6})?(?:Z|[+-]\d\d:\d\d)$/.test(v) && Number.isFinite(Date.parse(v)), inputFailure = () => {
+  throw new WorkspaceInvitationInputError;
+};
+var init_remote_invitations = __esm(() => {
+  WorkspaceInvitationInputError = class WorkspaceInvitationInputError extends Error {
+    code = "INVITATION_INPUT_INVALID";
+    constructor() {
+      super("Provide only the documented invitation fields, exact lowercase IDs, expected generation and explicit confirmation. Issue and resend require your stable idempotency key.");
+      this.name = "WorkspaceInvitationInputError";
+    }
+  };
+  invitationFailures = {
+    INVALID_REQUEST: [400, "Invitation parameters were refused."],
+    ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required."],
+    WORKSPACE_ADMIN_REQUIRED: [403, "A current workspace owner or admin is required."],
+    INVITATION_FORBIDDEN: [403, "Your current role cannot manage this invitation."],
+    INVITATION_UNAVAILABLE: [404, "Invitation is unavailable for this account."],
+    INVITATION_CHANGED: [409, "Invitation changed. Read its current generation before another action."],
+    INVITATION_EXISTS: [409, "A pending invitation already exists. Read current invitations."],
+    ALREADY_MEMBER: [409, "An active membership already exists. An invitation cannot change its role."],
+    IDEMPOTENCY_CONFLICT: [409, "This request key was used for different invitation parameters. Reconcile the original request."],
+    INVITATION_LIMIT: [429, "Invitation limit reached. Wait before issuing or resending."],
+    INVITATION_BUSY: [503, "Invitation is busy. Read its state before another action."],
+    INVITATION_DELIVERY_UNAVAILABLE: [503, "Invitation email delivery is unavailable."]
+  };
+  RemoteWorkspaceInvitationError = class RemoteWorkspaceInvitationError extends Error {
+    code;
+    status;
+    constructor(code) {
+      super(invitationFailures[code][1]);
+      this.code = code;
+      this.name = "RemoteWorkspaceInvitationError";
+      this.status = invitationFailures[code][0];
+    }
+  };
+  RemoteWorkspaceInvitationUnconfirmedError = class RemoteWorkspaceInvitationUnconfirmedError extends Error {
+    code = "INVITATION_UNCONFIRMED";
+    constructor() {
+      super("The invitation outcome is unconfirmed. Read current invitations or memberships. Reconcile issue/resend only with the same request key, parameters, server and membership; never generate a new key or retry automatically. Saved credentials are unchanged.");
+      this.name = "RemoteWorkspaceInvitationUnconfirmedError";
+    }
+  };
+  RemoteWorkspaceInvitationReadError = class RemoteWorkspaceInvitationReadError extends Error {
+    code = "INVITATION_READ_FAILED";
+    constructor() {
+      super("Unable to read a valid invitation result. Check the selected server, account, current membership and permissions.");
+      this.name = "RemoteWorkspaceInvitationReadError";
+    }
+  };
+});
+
 // src/lib/remote-workspace-selection.ts
 function workspaceExpectedUserId(value) {
-  if (!uuid(value))
+  if (!uuid2(value))
     throw new WorkspaceContextInputError;
   return value;
 }
 function workspaceContext(value) {
-  if (!record(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid(value.userId) || !uuid(value.membershipId))
+  if (!record2(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid2(value.userId) || !uuid2(value.membershipId))
     throw new WorkspaceContextInputError;
   return { userId: value.userId, membershipId: value.membershipId };
 }
-function invalid() {
+function invalid2() {
   throw new Error(invalidWorkspaceResult);
 }
 function organization(v) {
-  if (!record(v) || !uuid(v.id) || !text(v.slug) || !text(v.name))
-    return invalid();
+  if (!record2(v) || !uuid2(v.id) || !text(v.slug) || !text(v.name))
+    return invalid2();
   return { id: v.id, slug: v.slug, name: v.name };
 }
 function parseAccountWorkspaces(value) {
-  if (!record(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
-    return invalid();
+  if (!record2(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
+    return invalid2();
   const workspaces = value.workspaces.map((v) => {
-    if (!record(v) || !uuid(v.membershipId) || !role(v.role) || typeof v.current !== "boolean")
-      return invalid();
+    if (!record2(v) || !uuid2(v.membershipId) || !role2(v.role) || typeof v.current !== "boolean")
+      return invalid2();
     return { membershipId: v.membershipId, organization: organization(v.organization), role: v.role, current: v.current };
   });
   if (workspaces.filter((w) => w.current).length !== 1 || new Set(workspaces.map((w) => w.membershipId)).size !== workspaces.length || new Set(workspaces.map((w) => w.organization.id)).size !== workspaces.length)
-    return invalid();
+    return invalid2();
   return { workspaces };
 }
 function parseWorkspaceIdentity(value, expectedUserId) {
-  if (!record(value))
-    return invalid();
+  if (!record2(value))
+    return invalid2();
   const user = value.user;
-  if (!record(user) || !uuid(user.id) || !uuid(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role(user.role))
-    return invalid();
+  if (!record2(user) || !uuid2(user.id) || !uuid2(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role2(user.role))
+    return invalid2();
   if (user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
   return { user: { id: user.id, membershipId: user.membershipId, email: user.email, displayName: user.displayName, role: user.role }, organization: organization(value.organization) };
 }
 function sessionToken(value) {
   if (typeof value !== "string" || !value || value.length > 8192 || /[^\x21-\x7e]/.test(value) || value.startsWith("sk_"))
-    return invalid();
+    return invalid2();
   return value;
 }
 function parseWorkspaceSession(value, expected) {
@@ -49098,20 +49315,20 @@ function parseWorkspaceSession(value, expected) {
   return { token: sessionToken(value.token), ...identity2 };
 }
 function parseWorkspaceLogin(value, expectedUserId) {
-  const user = record(value) && value.user;
-  if (!record(value) || !record(user) || !uuid(user.id))
-    return invalid();
+  const user = record2(value) && value.user;
+  if (!record2(value) || !record2(user) || !uuid2(user.id))
+    return invalid2();
   if (expectedUserId !== undefined && user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
   return { token: sessionToken(value.token), userId: user.id };
 }
 function workspaceSelectionFailure(value, status) {
-  if (!record(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
+  if (!record2(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
     return null;
   const code = value.code;
   return workspaceSelectionFailures[code][0] === status ? code : null;
 }
-var record = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), text = (v, max2 = 1024) => typeof v === "string" && !!v.trim() && v.length <= max2 && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v), role = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), invalidWorkspaceResult = "The server returned an invalid workspace selection result.", WorkspaceContextInputError, WorkspaceIdentityMismatchError, workspaceSelectionFailures;
+var record2 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid2 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), text = (v, max2 = 1024) => typeof v === "string" && !!v.trim() && v.length <= max2 && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v), role2 = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), invalidWorkspaceResult = "The server returned an invalid workspace selection result.", WorkspaceContextInputError, WorkspaceIdentityMismatchError, workspaceSelectionFailures;
 var init_remote_workspace_selection = __esm(() => {
   WorkspaceContextInputError = class WorkspaceContextInputError extends Error {
     constructor() {
@@ -49137,7 +49354,7 @@ var init_remote_workspace_selection = __esm(() => {
 
 // src/lib/remote-workspace.ts
 function workspaceMembersQuery(options = {}) {
-  if (!record2(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+  if (!record3(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
     throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
   const query = new URLSearchParams;
   if (options.limit !== undefined)
@@ -49146,14 +49363,14 @@ function workspaceMembersQuery(options = {}) {
     query.set("cursor", options.cursor);
   return query.size ? `?${query}` : "";
 }
-function timestamp(value) {
+function timestamp2(value) {
   if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}Z$/.test(value))
     return false;
   const time = Date.parse(value);
   return Number.isFinite(time) && new Date(time).toISOString().slice(0, 23) === value.slice(0, 23);
 }
 function parseMember(row, fail2) {
-  if (!record2(row) || !uuid2(row.membershipId) || !uuid2(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp(row.createdAt))
+  if (!record3(row) || !uuid3(row.membershipId) || !uuid3(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp2(row.createdAt))
     return fail2();
   return {
     membershipId: row.membershipId,
@@ -49165,12 +49382,12 @@ function parseMember(row, fail2) {
   };
 }
 function mutationInput(membershipId, input, roleChange) {
-  if (typeof membershipId !== "string" || !uuid2(membershipId) || membershipId !== membershipId.toLowerCase() || !record2(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+  if (typeof membershipId !== "string" || !uuid3(membershipId) || membershipId !== membershipId.toLowerCase() || !record3(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
     throw new WorkspaceMemberInputError;
-  const expectedRole = input.expectedRole, role2 = roleChange ? input.role : undefined;
-  if (!isRole(expectedRole) || roleChange && !isRole(role2))
+  const expectedRole = input.expectedRole, role3 = roleChange ? input.role : undefined;
+  if (!isRole(expectedRole) || roleChange && !isRole(role3))
     throw new WorkspaceMemberInputError;
-  return { membershipId, role: role2, expectedRole };
+  return { membershipId, role: role3, expectedRole };
 }
 function workspaceMemberRoleInput(membershipId, input) {
   const value = mutationInput(membershipId, input, true);
@@ -49180,24 +49397,24 @@ function workspaceMemberRemovalInput(membershipId, input) {
   const value = mutationInput(membershipId, input, false);
   return { membershipId: value.membershipId, body: { expectedRole: value.expectedRole } };
 }
-function parseWorkspaceMemberRoleResult(value, membershipId, role2) {
+function parseWorkspaceMemberRoleResult(value, membershipId, role3) {
   const fail2 = () => {
     throw new Error(invalidMemberResult);
   };
-  if (!record2(value) || !uuid2(value.organizationId) || typeof value.changed !== "boolean")
+  if (!record3(value) || !uuid3(value.organizationId) || typeof value.changed !== "boolean")
     return fail2();
   const member = parseMember(value.member, fail2);
-  if (member.membershipId !== membershipId || member.role !== role2)
+  if (member.membershipId !== membershipId || member.role !== role3)
     return fail2();
   return { organizationId: value.organizationId, member, changed: value.changed };
 }
 function parseWorkspaceMemberRemovalResult(value, membershipId) {
-  if (!record2(value) || !uuid2(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+  if (!record3(value) || !uuid3(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
     throw new Error(invalidMemberResult);
   return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
 }
 function workspaceMemberFailure(value, status) {
-  if (!record2(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+  if (!record3(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
     return null;
   const code = value.code;
   return workspaceMemberFailures[code][0] === status ? code : null;
@@ -49206,14 +49423,14 @@ function parseWorkspaceMembersPage(value) {
   const fail2 = () => {
     throw new Error("The server returned an invalid workspace roster.");
   };
-  if (!record2(value) || !uuid2(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+  if (!record3(value) || !uuid3(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
     return fail2();
   const members = value.members.map((row) => parseMember(row, fail2));
   if (new Set(members.map((row) => row.membershipId)).size !== members.length)
     return fail2();
   return { organizationId: value.organizationId, members, nextCursor: value.nextCursor };
 }
-var record2 = (value) => !!value && typeof value === "object" && !Array.isArray(value), cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value), uuid2 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value), isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value), WorkspaceMemberInputError, invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.", workspaceMemberFailures;
+var record3 = (value) => !!value && typeof value === "object" && !Array.isArray(value), cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value), uuid3 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value), isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value), WorkspaceMemberInputError, invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.", workspaceMemberFailures;
 var init_remote_workspace = __esm(() => {
   WorkspaceMemberInputError = class WorkspaceMemberInputError extends Error {
     constructor() {
@@ -49235,6 +49452,75 @@ var init_remote_workspace = __esm(() => {
   };
 });
 
+// src/lib/remote-workspace-leave.ts
+function workspaceLeaveInput(context, input) {
+  const target = workspaceContext(context);
+  if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).sort().join(",") !== "confirm,expectedRole" || input.confirm !== true)
+    throw new WorkspaceLeaveInputError;
+  const captured = workspaceMemberRemovalInput(target.membershipId, { expectedRole: input.expectedRole });
+  return {
+    context: target,
+    input: { expectedRole: captured.body.expectedRole, confirm: true },
+    body: { membershipId: target.membershipId, expectedRole: captured.body.expectedRole }
+  };
+}
+function workspaceLeaveFailure(value, status) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const code = value.code;
+  return typeof code === "string" && Object.hasOwn(workspaceLeaveFailures, code) && workspaceLeaveFailures[code][0] === status ? code : null;
+}
+function parseWorkspaceLeaveResult(value, membershipId, organizationId) {
+  const row = value;
+  if (!row || typeof row !== "object" || Array.isArray(row) || row.membershipId !== membershipId || row.organizationId !== organizationId || row.removed !== true || row.signInRequired !== true)
+    throw new RemoteWorkspaceLeaveUnconfirmedError;
+  return { membershipId, organizationId, removed: true, signInRequired: true };
+}
+function workspaceLeaveProfileContext(membershipId, userId, profile) {
+  const observed = profile === undefined ? undefined : workspaceContext(profile);
+  const target = workspaceContext({ userId: userId ?? observed?.userId, membershipId });
+  if (observed && (observed.userId !== target.userId || observed.membershipId !== target.membershipId))
+    throw new WorkspaceIdentityMismatchError;
+  return target;
+}
+var WorkspaceLeaveInputError, workspaceLeaveFailures, RemoteWorkspaceLeaveError, RemoteWorkspaceLeaveUnconfirmedError;
+var init_remote_workspace_leave = __esm(() => {
+  init_remote_workspace_selection();
+  init_remote_workspace();
+  WorkspaceLeaveInputError = class WorkspaceLeaveInputError extends Error {
+    constructor() {
+      super("Confirm leaving the exact observed user and membership with its expected role.");
+      this.name = "WorkspaceLeaveInputError";
+    }
+  };
+  workspaceLeaveFailures = {
+    INVALID_REQUEST: [400, "Provide the exact current membership and expected role."],
+    ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required to leave a workspace."],
+    MEMBERSHIP_ROLE_CHANGED: [409, "Your role changed. Sign in and inspect the workspace before leaving."],
+    LAST_OWNER_REQUIRED: [409, "The workspace must retain another active owner."],
+    LAST_WORKSPACE_REQUIRED: [409, "Another available workspace is required before leaving."],
+    MEMBERSHIP_BUSY: [503, "Membership is busy. Inspect the workspace before another leave action."]
+  };
+  RemoteWorkspaceLeaveError = class RemoteWorkspaceLeaveError extends Error {
+    code;
+    status;
+    constructor(code) {
+      super(workspaceLeaveFailures[code][1]);
+      this.code = code;
+      this.name = "RemoteWorkspaceLeaveError";
+      this.status = workspaceLeaveFailures[code][0];
+    }
+  };
+  RemoteWorkspaceLeaveUnconfirmedError = class RemoteWorkspaceLeaveUnconfirmedError extends Error {
+    code = "WORKSPACE_LEAVE_UNCONFIRMED";
+    constructor() {
+      super("The leave outcome is unconfirmed. Sign in again and inspect available memberships before another action. Do not retry automatically; saved credentials are unchanged.");
+      this.name = "RemoteWorkspaceLeaveUnconfirmedError";
+    }
+  };
+});
+
 // src/lib/auth-store.ts
 import { chmodSync, existsSync as existsSync17, mkdirSync as mkdirSync7, readFileSync as readFileSync12, renameSync as renameSync4, statSync as statSync9, unlinkSync, writeFileSync as writeFileSync7 } from "fs";
 import { basename as basename4, dirname as dirname6, join as join18 } from "path";
@@ -49253,14 +49539,14 @@ function readIdentity(env3 = process.env) {
     const parsed = JSON.parse(readFileSync12(getIdentityFilePath(env3), "utf-8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
-    const record3 = parsed;
+    const record4 = parsed;
     const selected = resolveSkillsApiOrigin(env3)?.origin;
-    const bound = typeof record3.apiUrl === "string" ? record3.apiUrl : readCredentialValue(SKILLS_BOUND_API_URL, env3) ?? readStoredApiUrl(env3) ?? defaultFleetGatewayBaseUrl("skills");
+    const bound = typeof record4.apiUrl === "string" ? record4.apiUrl : readCredentialValue(SKILLS_BOUND_API_URL, env3) ?? readStoredApiUrl(env3) ?? defaultFleetGatewayBaseUrl("skills");
     if (selected && normalizeSkillsApiOrigin(bound) !== selected)
       return {};
     const identity2 = {};
     for (const field of ["email", "orgId", "orgSlug", "userId"]) {
-      const value = record3[field];
+      const value = record4[field];
       if (typeof value === "string" && value.length > 0)
         identity2[field] = value;
     }
@@ -49409,44 +49695,44 @@ var init_auth_store = __esm(() => {
 
 // src/lib/remote-run-contract.ts
 function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
-  const record3 = isRecord3(payload) ? payload : {};
+  const record4 = isRecord3(payload) ? payload : {};
   return {
     contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
-    ...pickString(record3, "id"),
-    skill: pickStringValue(record3, "skill") ?? fallbackSkill,
-    ...pickString(record3, "requestedSlug"),
-    ...pickString(record3, "status"),
-    ...pickNumber(record3, "exitCode"),
-    ...pickString(record3, "correlationId"),
-    ...pickString(record3, "createdAt"),
-    ...pickString(record3, "startedAt"),
-    ...pickString(record3, "completedAt"),
-    ...pickNumber(record3, "durationMs"),
-    ...pickString(record3, "outputType"),
-    ...hasOwn(record3, "outputPreview") ? { outputPreview: record3.outputPreview } : {},
-    ...pickString(record3, "errorCode"),
-    ...pickString(record3, "errorMessage"),
-    ...pickString(record3, "error"),
-    ...pickString(record3, "code"),
-    ...hasOwn(record3, "details") ? { details: record3.details } : {}
+    ...pickString(record4, "id"),
+    skill: pickStringValue(record4, "skill") ?? fallbackSkill,
+    ...pickString(record4, "requestedSlug"),
+    ...pickString(record4, "status"),
+    ...pickNumber(record4, "exitCode"),
+    ...pickString(record4, "correlationId"),
+    ...pickString(record4, "createdAt"),
+    ...pickString(record4, "startedAt"),
+    ...pickString(record4, "completedAt"),
+    ...pickNumber(record4, "durationMs"),
+    ...pickString(record4, "outputType"),
+    ...hasOwn(record4, "outputPreview") ? { outputPreview: record4.outputPreview } : {},
+    ...pickString(record4, "errorCode"),
+    ...pickString(record4, "errorMessage"),
+    ...pickString(record4, "error"),
+    ...pickString(record4, "code"),
+    ...hasOwn(record4, "details") ? { details: record4.details } : {}
   };
 }
 function isRecord3(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function hasOwn(record3, key) {
-  return Object.prototype.hasOwnProperty.call(record3, key);
+function hasOwn(record4, key) {
+  return Object.prototype.hasOwnProperty.call(record4, key);
 }
-function pickString(record3, key) {
-  const value = pickStringValue(record3, key);
+function pickString(record4, key) {
+  const value = pickStringValue(record4, key);
   return value === undefined ? {} : { [key]: value };
 }
-function pickStringValue(record3, key) {
-  const value = record3[key];
+function pickStringValue(record4, key) {
+  const value = record4[key];
   return typeof value === "string" ? value : undefined;
 }
-function pickNumber(record3, key) {
-  const value = record3[key];
+function pickNumber(record4, key) {
+  const value = record4[key];
   return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
 }
 var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
@@ -49888,6 +50174,77 @@ class RemoteSkillsClient {
     }
     return value;
   }
+  async leaveWorkspace(context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+      throw new RemoteWorkspaceLeaveError("INTERACTIVE_SESSION_REQUIRED");
+    const identity2 = parseWorkspaceIdentity(value, captured.context.userId);
+    if (identity2.user.membershipId !== captured.context.membershipId)
+      throw new WorkspaceIdentityMismatchError;
+    let response, body;
+    try {
+      response = await connection.request("/api/v1/account/workspaces/leave", { method: "POST", body: JSON.stringify(captured.body) });
+      body = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, 4096)));
+    } catch {
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    if (!response.ok) {
+      const code = workspaceLeaveFailure(body, response.status);
+      if (code)
+        throw new RemoteWorkspaceLeaveError(code);
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    return parseWorkspaceLeaveResult(body, captured.context.membershipId, identity2.organization.id);
+  }
+  listWorkspaceInvitations(context, options = {}) {
+    return this.requestWorkspaceInvitation(context, "list", options);
+  }
+  getWorkspaceInvitation(context, invitationId2) {
+    return this.requestWorkspaceInvitation(context, "get", { invitationId: invitationId2 });
+  }
+  issueWorkspaceInvitation(context, input) {
+    return this.requestWorkspaceInvitation(context, "issue", input);
+  }
+  resendWorkspaceInvitation(context, invitationId2, input) {
+    return this.requestWorkspaceInvitation(context, "resend", { ...input, invitationId: invitationId2 });
+  }
+  revokeWorkspaceInvitation(context, invitationId2, input) {
+    return this.requestWorkspaceInvitation(context, "revoke", { ...input, invitationId: invitationId2 });
+  }
+  acceptWorkspaceInvitation(context, invitationId2, input) {
+    return this.requestWorkspaceInvitation(context, "accept", { ...input, invitationId: invitationId2 });
+  }
+  async requestWorkspaceInvitation(context, action, input) {
+    const target = workspaceContext(context), captured = invitationInput(action, input);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const identityValue = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!identityValue || typeof identityValue !== "object" || identityValue.authMethod !== "jwt")
+      throw new RemoteWorkspaceInvitationError("INTERACTIVE_SESSION_REQUIRED");
+    const identity2 = parseWorkspaceIdentity(identityValue, target.userId);
+    if (identity2.user.membershipId !== target.membershipId)
+      throw new WorkspaceIdentityMismatchError;
+    const request = invitationRequest(action, captured), read = action === "list" || action === "get";
+    let response, value;
+    try {
+      response = await connection.request(request.path, { method: request.method, ...request.body ? { body: request.body } : {}, credentials: "omit" });
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 64 * 1024 : 4096)));
+    } catch {
+      throw read ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+    }
+    if (!response.ok) {
+      const code = invitationFailure(value, response.status);
+      if (code)
+        throw new RemoteWorkspaceInvitationError(code);
+      throw read ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+    }
+    try {
+      return parseInvitationResult(action, value, captured, identity2.organization.id);
+    } catch {
+      throw read ? new RemoteWorkspaceInvitationReadError : new RemoteWorkspaceInvitationUnconfirmedError;
+    }
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -50138,13 +50495,13 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record3, field) {
-  if (record3[field] === undefined)
+function requireOptionalString(record4, field) {
+  if (record4[field] === undefined)
     return;
-  if (typeof record3[field] !== "string") {
+  if (typeof record4[field] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field} must be a string when present)`);
   }
-  return record3[field];
+  return record4[field];
 }
 function isVersionRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -50166,19 +50523,19 @@ function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record3 = entry;
-  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  const record4 = entry;
+  const slug = typeof record4.slug === "string" && record4.slug.trim() ? record4.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record3.metadata !== undefined) {
-    if (!record3.metadata || typeof record3.metadata !== "object" || Array.isArray(record3.metadata)) {
+  if (record4.metadata !== undefined) {
+    if (!record4.metadata || typeof record4.metadata !== "object" || Array.isArray(record4.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record3.metadata;
+    metadata = record4.metadata;
   }
-  const pinnedAt = requireOptionalString(record3, "pinnedAt");
+  const pinnedAt = requireOptionalString(record4, "pinnedAt");
   return {
     slug,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -50195,16 +50552,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record3 = entry;
-  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  const record4 = entry;
+  const slug = typeof record4.slug === "string" && record4.slug.trim() ? record4.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug,
-    ...requireOptionalString(record3, "name") !== undefined ? { name: requireOptionalString(record3, "name") } : {},
-    ...requireOptionalString(record3, "version") !== undefined ? { version: requireOptionalString(record3, "version") } : {},
-    ...requireOptionalString(record3, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record3, "updatedAt") } : {}
+    ...requireOptionalString(record4, "name") !== undefined ? { name: requireOptionalString(record4, "name") } : {},
+    ...requireOptionalString(record4, "version") !== undefined ? { version: requireOptionalString(record4, "version") } : {},
+    ...requireOptionalString(record4, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record4, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -50257,12 +50614,12 @@ function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record3 = payload;
-  if (!Array.isArray(record3.skills)) {
+  const record4 = payload;
+  if (!Array.isArray(record4.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record3.skills.map(normalizeSkillSummary);
-  const nextCursor = record3.nextCursor === undefined || record3.nextCursor === null ? null : record3.nextCursor;
+  const skills = record4.skills.map(normalizeSkillSummary);
+  const nextCursor = record4.nextCursor === undefined || record4.nextCursor === null ? null : record4.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -50277,6 +50634,8 @@ function createRemoteSkillsClientReadOnly(env3 = process.env) {
 }
 var RemoteRouteUnsupportedError, RemoteRequestError, RemoteWorkspaceMemberError, RemoteWorkspaceSelectionError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 var init_remote_client = __esm(() => {
+  init_remote_invitations();
+  init_remote_workspace_leave();
   init_remote_workspace_selection();
   init_remote_workspace();
   init_remote_workspace();
@@ -50560,7 +50919,129 @@ function concat2(chunks) {
   }
   return merged;
 }
-var BLOCK = 512, ANY_SEGMENT_EXCLUDES, ROOT_EXCLUDES, TOOL_SIDECAR_FILENAMES, CREDENTIAL_FILENAMES, CREDENTIAL_EXTENSIONS, ENV_TEMPLATE_NAMES, NON_DOTENV_EXTENSIONS;
+function invalidBundle(message) {
+  throw new SkillBundleInspectionError("BUNDLE_INVALID", message);
+}
+
+class BoundedTarReader {
+  limits;
+  check;
+  header = new Uint8Array(BLOCK);
+  headerOffset = 0;
+  pending;
+  bodyOffset = 0;
+  padding = 0;
+  zeroBlocks = 0;
+  entries = [];
+  paths = new SkillEntryPaths;
+  fileBytes = 0;
+  constructor(limits, check) {
+    this.limits = limits;
+    this.check = check;
+  }
+  push(chunk2) {
+    let offset = 0;
+    while (offset < chunk2.byteLength) {
+      this.check();
+      if (this.pending) {
+        const count = Math.min(this.pending.bytes.byteLength - this.bodyOffset, chunk2.byteLength - offset);
+        this.pending.bytes.set(chunk2.subarray(offset, offset + count), this.bodyOffset);
+        offset += count;
+        this.bodyOffset += count;
+        if (this.bodyOffset === this.pending.bytes.byteLength) {
+          this.entries.push(this.pending);
+          this.pending = undefined;
+        }
+      } else if (this.padding) {
+        const count = Math.min(this.padding, chunk2.byteLength - offset);
+        if (chunk2.subarray(offset, offset + count).some((byte) => byte !== 0))
+          invalidBundle("Nonzero tar body padding");
+        offset += count;
+        this.padding -= count;
+      } else {
+        const count = Math.min(BLOCK - this.headerOffset, chunk2.byteLength - offset);
+        this.header.set(chunk2.subarray(offset, offset + count), this.headerOffset);
+        offset += count;
+        this.headerOffset += count;
+        if (this.headerOffset === BLOCK) {
+          this.readHeader();
+          this.headerOffset = 0;
+        }
+      }
+    }
+  }
+  finish() {
+    this.check();
+    if (this.pending || this.padding || this.headerOffset || this.zeroBlocks < 2)
+      invalidBundle("Truncated tar bundle");
+    return this.entries;
+  }
+  readHeader() {
+    this.check();
+    const h = this.header;
+    if (h.every((byte) => byte === 0)) {
+      this.zeroBlocks++;
+      return;
+    }
+    if (this.zeroBlocks)
+      invalidBundle("Nonzero tar data after terminator");
+    if (this.entries.length >= this.limits.entries)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle entry limit exceeded");
+    let checksum = 0;
+    for (let i = 0;i < BLOCK; i++)
+      checksum += i >= 148 && i < 156 ? 32 : h[i];
+    if (tarOctal(h.subarray(148, 156)) !== checksum)
+      invalidBundle("Invalid tar header checksum");
+    if (new TextDecoder().decode(h.subarray(257, 265)) !== "ustar\x00" + "00")
+      invalidBundle("Unsupported tar format");
+    if (h[156] !== 48 && h[156] !== 0 || h.subarray(157, 257).some((b) => b !== 0) || h.subarray(345).some((b) => b !== 0))
+      invalidBundle("Unsupported tar entry or path prefix");
+    const mode = tarOctal(h.subarray(100, 108));
+    if (mode > 511)
+      invalidBundle("Unsupported tar permission bits");
+    tarOctal(h.subarray(108, 116));
+    tarOctal(h.subarray(116, 124));
+    tarOctal(h.subarray(136, 148));
+    const size2 = tarOctal(h.subarray(124, 136));
+    if (size2 > this.limits.fileBytes || this.fileBytes + size2 > this.limits.decompressedBytes) {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle file byte limit exceeded");
+    }
+    const name = h.subarray(0, 100);
+    const end = name.indexOf(0);
+    if (end !== -1 && name.subarray(end).some((b) => b !== 0))
+      invalidBundle("Invalid tar path padding");
+    const raw = end === -1 ? name : name.subarray(0, end);
+    if (raw.byteLength > this.limits.pathBytes)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    let path;
+    try {
+      path = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw);
+    } catch {
+      return invalidBundle("Invalid UTF-8 bundle path");
+    }
+    this.paths.add(path, this.limits.pathBytes, invalidBundle, () => {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    });
+    this.fileBytes += size2;
+    this.pending = { path, mode, bytes: new Uint8Array(new ArrayBuffer(size2)) };
+    this.bodyOffset = 0;
+    this.padding = (BLOCK - size2 % BLOCK) % BLOCK;
+    if (!size2) {
+      this.entries.push(this.pending);
+      this.pending = undefined;
+    }
+  }
+}
+function tarOctal(field) {
+  const text2 = new TextDecoder().decode(field);
+  if (!/^[0-7]+[\0 ]*$/.test(text2))
+    invalidBundle("Invalid tar octal field");
+  const value = Number.parseInt(text2, 8);
+  if (!Number.isSafeInteger(value))
+    invalidBundle("Tar integer is out of range");
+  return value;
+}
+var BLOCK = 512, ANY_SEGMENT_EXCLUDES, ROOT_EXCLUDES, TOOL_SIDECAR_FILENAMES, CREDENTIAL_FILENAMES, CREDENTIAL_EXTENSIONS, ENV_TEMPLATE_NAMES, NON_DOTENV_EXTENSIONS, SKILL_BUNDLE_INSPECTION_LIMITS, SkillBundleInspectionError;
 var init_skill_bundle = __esm(() => {
   ANY_SEGMENT_EXCLUDES = new Set([
     ".git",
@@ -50684,6 +51165,22 @@ var init_skill_bundle = __esm(() => {
     "tar",
     "wasm"
   ]);
+  SKILL_BUNDLE_INSPECTION_LIMITS = Object.freeze({
+    compressedBytes: 16 * 1024 * 1024,
+    decompressedBytes: 64 * 1024 * 1024,
+    entries: 1024,
+    fileBytes: 16 * 1024 * 1024,
+    pathBytes: 100,
+    timeoutMs: 5000
+  });
+  SkillBundleInspectionError = class SkillBundleInspectionError extends Error {
+    code;
+    constructor(code, message) {
+      super(message);
+      this.code = code;
+      this.name = "SkillBundleInspectionError";
+    }
+  };
 });
 
 // src/lib/skill-version.ts
@@ -51052,16 +51549,16 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
   }
   return { path: target, created };
 }
-function writePullMarker(dir, record3) {
+function writePullMarker(dir, record4) {
   const marker = {
     managedBy: "@hasna/skills",
-    skill: record3.skill,
-    source: record3.source ?? "pull",
-    ...record3.version ? { version: record3.version } : {},
-    ...record3.contentHash ? { contentHash: record3.contentHash } : {},
-    ...record3.sourceCommit ? { sourceCommit: record3.sourceCommit } : {},
-    ...record3.signature ? { signature: record3.signature } : {},
-    ...record3.revisionId ? { revisionId: record3.revisionId } : {},
+    skill: record4.skill,
+    source: record4.source ?? "pull",
+    ...record4.version ? { version: record4.version } : {},
+    ...record4.contentHash ? { contentHash: record4.contentHash } : {},
+    ...record4.sourceCommit ? { sourceCommit: record4.sourceCommit } : {},
+    ...record4.signature ? { signature: record4.signature } : {},
+    ...record4.revisionId ? { revisionId: record4.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
   writeFileSync8(join20(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
@@ -51076,19 +51573,19 @@ async function safeMeta(client, slug) {
   }
   if (!raw || typeof raw !== "object")
     return null;
-  const record3 = raw;
-  const kind = record3.kind === "instruction" || record3.kind === "executable" ? record3.kind : undefined;
-  const tags = Array.isArray(record3.tags) ? record3.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
+  const record4 = raw;
+  const kind = record4.kind === "instruction" || record4.kind === "executable" ? record4.kind : undefined;
+  const tags = Array.isArray(record4.tags) ? record4.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
   return {
-    ...str(record3.displayName) ? { displayName: str(record3.displayName) } : {},
-    ...str(record3.description) ? { description: str(record3.description) } : {},
-    ...str(record3.category) ? { category: str(record3.category) } : {},
+    ...str(record4.displayName) ? { displayName: str(record4.displayName) } : {},
+    ...str(record4.description) ? { description: str(record4.description) } : {},
+    ...str(record4.category) ? { category: str(record4.category) } : {},
     ...tags && tags.length ? { tags } : {},
-    ...str(record3.version) ? { version: str(record3.version) } : {},
+    ...str(record4.version) ? { version: str(record4.version) } : {},
     ...kind ? { kind } : {},
-    ...REVISION_ID_PATTERN.test(str(record3.revisionId) ?? "") ? { revisionId: str(record3.revisionId) } : {},
-    ...typeof record3.skillMd === "string" && record3.skillMd.length > 0 ? { skillMd: record3.skillMd } : {},
-    ...str(record3.publishedSource) ? { publishedSource: str(record3.publishedSource) } : {}
+    ...REVISION_ID_PATTERN.test(str(record4.revisionId) ?? "") ? { revisionId: str(record4.revisionId) } : {},
+    ...typeof record4.skillMd === "string" && record4.skillMd.length > 0 ? { skillMd: record4.skillMd } : {},
+    ...str(record4.publishedSource) ? { publishedSource: str(record4.publishedSource) } : {}
   };
 }
 function pickCorpusOptions(options) {
@@ -51097,8 +51594,8 @@ function pickCorpusOptions(options) {
 function extractSlug(entry) {
   if (!entry || typeof entry !== "object")
     return;
-  const record3 = entry;
-  return str(record3.slug) ?? str(record3.name);
+  const record4 = entry;
+  return str(record4.slug) ?? str(record4.name);
 }
 function dedupe(values2) {
   return [...new Set(values2)];
@@ -53421,8 +53918,8 @@ function writeRollbackRecord(mode, entries, appDir = getDataDir()) {
   const dir = join24(appDir, ROLLBACK_DIRNAME);
   mkdirSync9(dir, { recursive: true });
   const file = join24(dir, `${mode}-${Date.now()}.json`);
-  const record3 = { version: 1, mode, timestamp: new Date().toISOString(), entries };
-  writeFileSync10(file, `${JSON.stringify(record3, null, 2)}
+  const record4 = { version: 1, mode, timestamp: new Date().toISOString(), entries };
+  writeFileSync10(file, `${JSON.stringify(record4, null, 2)}
 `);
   return file;
 }
@@ -54300,7 +54797,7 @@ function createSkillRun(params, targetDir = process.cwd()) {
   mkdirSync10(logsDir, { recursive: true });
   mkdirSync10(exportDir, { recursive: true });
   mkdirSync10(join27(root, "tmp"), { recursive: true });
-  const record3 = {
+  const record4 = {
     id,
     skill: skillName,
     status: params.status ?? "running",
@@ -54318,10 +54815,10 @@ function createSkillRun(params, targetDir = process.cwd()) {
       logsDir: toProjectRelative(targetDir, logsDir)
     }
   };
-  const context = { targetDir, runDir, exportDir, logsDir, record: record3 };
+  const context = { targetDir, runDir, exportDir, logsDir, record: record4 };
   writeRunRecord(context);
   writeArtifactsManifest(context, []);
-  appendRunEvent(context, "created", { status: record3.status });
+  appendRunEvent(context, "created", { status: record4.status });
   return context;
 }
 function completeSkillRun(context, patch) {
@@ -54371,9 +54868,9 @@ function listSkillRuns(targetDir = process.cwd(), limit = 50) {
     if (!statSync14(dayDir).isDirectory())
       continue;
     for (const runId of readdirSync13(dayDir).sort().reverse()) {
-      const record3 = readRunRecord(join27(dayDir, runId));
-      if (record3)
-        records.push(record3);
+      const record4 = readRunRecord(join27(dayDir, runId));
+      if (record4)
+        records.push(record4);
       if (records.length >= limit)
         return records;
     }
@@ -54385,9 +54882,9 @@ function findSkillRun(runId, targetDir = process.cwd()) {
   if (!existsSync25(runsRoot))
     return null;
   for (const day of readdirSync13(runsRoot)) {
-    const record3 = readRunRecord(join27(runsRoot, day, runId));
-    if (record3)
-      return record3;
+    const record4 = readRunRecord(join27(runsRoot, day, runId));
+    if (record4)
+      return record4;
   }
   return null;
 }
@@ -55223,11 +55720,11 @@ function datetime(args) {
   const timeRegex2 = `${time2}(?:${opts.join("|")})`;
   return new RegExp(`^${dateSource}T(?:${timeRegex2})$`);
 }
-var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid3 = (version) => {
+var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid4 = (version) => {
   if (!version)
     return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000)$/;
   return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
-}, email, _emoji = `^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`, ipv4, ipv6, cidrv4, cidrv6, base64, base64url, hostname, e164, dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`, date, string2 = (params) => {
+}, email2, _emoji = `^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`, ipv4, ipv6, cidrv4, cidrv6, base64, base64url, hostname, e164, dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`, date, string2 = (params) => {
   const regex2 = params ? `[\\s\\S]{${params?.minimum ?? 0},${params?.maximum ?? ""}}` : `[\\s\\S]*`;
   return new RegExp(`^${regex2}$`);
 }, integer, number, boolean, _null, lowercase, uppercase;
@@ -55240,7 +55737,7 @@ var init_regexes = __esm(() => {
   nanoid = /^[a-zA-Z0-9_-]{21}$/;
   duration = /^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/;
   guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
-  email = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
+  email2 = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
   ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
   ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})$/;
   cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -56017,13 +56514,13 @@ var init_schemas = __esm(() => {
       const v = versionMap[def.version];
       if (v === undefined)
         throw new Error(`Invalid UUID version: "${def.version}"`);
-      def.pattern ?? (def.pattern = uuid3(v));
+      def.pattern ?? (def.pattern = uuid4(v));
     } else
-      def.pattern ?? (def.pattern = uuid3());
+      def.pattern ?? (def.pattern = uuid4());
     $ZodStringFormat.init(inst, def);
   });
   $ZodEmail = /* @__PURE__ */ $constructor("$ZodEmail", (inst, def) => {
-    def.pattern ?? (def.pattern = email);
+    def.pattern ?? (def.pattern = email2);
     $ZodStringFormat.init(inst, def);
   });
   $ZodURL = /* @__PURE__ */ $constructor("$ZodURL", (inst, def) => {
@@ -58499,7 +58996,7 @@ function intersection2(left, right) {
     right
   });
 }
-function record3(keyType, valueType, params) {
+function record4(keyType, valueType, params) {
   return new ZodRecord2({
     type: "record",
     keyType,
@@ -59200,7 +59697,7 @@ var init_types2 = __esm(() => {
   });
   FormElicitationCapabilitySchema = intersection2(object2({
     applyDefaults: boolean2().optional()
-  }), record3(string3(), unknown()));
+  }), record4(string3(), unknown()));
   ElicitationCapabilitySchema = preprocess((value) => {
     if (value && typeof value === "object" && !Array.isArray(value)) {
       if (Object.keys(value).length === 0) {
@@ -59211,7 +59708,7 @@ var init_types2 = __esm(() => {
   }, intersection2(object2({
     form: FormElicitationCapabilitySchema.optional(),
     url: AssertObjectSchema.optional()
-  }), record3(string3(), unknown()).optional()));
+  }), record4(string3(), unknown()).optional()));
   ClientTasksCapabilitySchema = looseObject({
     list: AssertObjectSchema.optional(),
     cancel: AssertObjectSchema.optional(),
@@ -59234,7 +59731,7 @@ var init_types2 = __esm(() => {
     }).optional()
   });
   ClientCapabilitiesSchema = object2({
-    experimental: record3(string3(), AssertObjectSchema).optional(),
+    experimental: record4(string3(), AssertObjectSchema).optional(),
     sampling: object2({
       context: AssertObjectSchema.optional(),
       tools: AssertObjectSchema.optional()
@@ -59244,7 +59741,7 @@ var init_types2 = __esm(() => {
       listChanged: boolean2().optional()
     }).optional(),
     tasks: ClientTasksCapabilitySchema.optional(),
-    extensions: record3(string3(), AssertObjectSchema).optional()
+    extensions: record4(string3(), AssertObjectSchema).optional()
   });
   InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
     protocolVersion: string3(),
@@ -59256,7 +59753,7 @@ var init_types2 = __esm(() => {
     params: InitializeRequestParamsSchema
   });
   ServerCapabilitiesSchema = object2({
-    experimental: record3(string3(), AssertObjectSchema).optional(),
+    experimental: record4(string3(), AssertObjectSchema).optional(),
     logging: AssertObjectSchema.optional(),
     completions: AssertObjectSchema.optional(),
     prompts: object2({
@@ -59270,7 +59767,7 @@ var init_types2 = __esm(() => {
       listChanged: boolean2().optional()
     }).optional(),
     tasks: ServerTasksCapabilitySchema.optional(),
-    extensions: record3(string3(), AssertObjectSchema).optional()
+    extensions: record4(string3(), AssertObjectSchema).optional()
   });
   InitializeResultSchema = ResultSchema.extend({
     protocolVersion: string3(),
@@ -59357,7 +59854,7 @@ var init_types2 = __esm(() => {
   ResourceContentsSchema = object2({
     uri: string3(),
     mimeType: optional(string3()),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   TextResourceContentsSchema = ResourceContentsSchema.extend({
     text: string3()
@@ -59462,7 +59959,7 @@ var init_types2 = __esm(() => {
   });
   GetPromptRequestParamsSchema = BaseRequestParamsSchema.extend({
     name: string3(),
-    arguments: record3(string3(), string3()).optional()
+    arguments: record4(string3(), string3()).optional()
   });
   GetPromptRequestSchema = RequestSchema.extend({
     method: literal("prompts/get"),
@@ -59472,34 +59969,34 @@ var init_types2 = __esm(() => {
     type: literal("text"),
     text: string3(),
     annotations: AnnotationsSchema.optional(),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   ImageContentSchema = object2({
     type: literal("image"),
     data: Base64Schema,
     mimeType: string3(),
     annotations: AnnotationsSchema.optional(),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   AudioContentSchema = object2({
     type: literal("audio"),
     data: Base64Schema,
     mimeType: string3(),
     annotations: AnnotationsSchema.optional(),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   ToolUseContentSchema = object2({
     type: literal("tool_use"),
     name: string3(),
     id: string3(),
-    input: record3(string3(), unknown()),
-    _meta: record3(string3(), unknown()).optional()
+    input: record4(string3(), unknown()),
+    _meta: record4(string3(), unknown()).optional()
   });
   EmbeddedResourceSchema = object2({
     type: literal("resource"),
     resource: union2([TextResourceContentsSchema, BlobResourceContentsSchema]),
     annotations: AnnotationsSchema.optional(),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   ResourceLinkSchema = ResourceSchema.extend({
     type: literal("resource_link")
@@ -59539,17 +60036,17 @@ var init_types2 = __esm(() => {
     description: string3().optional(),
     inputSchema: object2({
       type: literal("object"),
-      properties: record3(string3(), AssertObjectSchema).optional(),
+      properties: record4(string3(), AssertObjectSchema).optional(),
       required: array(string3()).optional()
     }).catchall(unknown()),
     outputSchema: object2({
       type: literal("object"),
-      properties: record3(string3(), AssertObjectSchema).optional(),
+      properties: record4(string3(), AssertObjectSchema).optional(),
       required: array(string3()).optional()
     }).catchall(unknown()).optional(),
     annotations: ToolAnnotationsSchema.optional(),
     execution: ToolExecutionSchema.optional(),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   ListToolsRequestSchema = PaginatedRequestSchema.extend({
     method: literal("tools/list")
@@ -59559,7 +60056,7 @@ var init_types2 = __esm(() => {
   });
   CallToolResultSchema = ResultSchema.extend({
     content: array(ContentBlockSchema).default([]),
-    structuredContent: record3(string3(), unknown()).optional(),
+    structuredContent: record4(string3(), unknown()).optional(),
     isError: boolean2().optional()
   });
   CompatibilityCallToolResultSchema = CallToolResultSchema.or(ResultSchema.extend({
@@ -59567,7 +60064,7 @@ var init_types2 = __esm(() => {
   }));
   CallToolRequestParamsSchema = TaskAugmentedRequestParamsSchema.extend({
     name: string3(),
-    arguments: record3(string3(), unknown()).optional()
+    arguments: record4(string3(), unknown()).optional()
   });
   CallToolRequestSchema = RequestSchema.extend({
     method: literal("tools/call"),
@@ -59616,7 +60113,7 @@ var init_types2 = __esm(() => {
     content: array(ContentBlockSchema).default([]),
     structuredContent: object2({}).loose().optional(),
     isError: boolean2().optional(),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   SamplingContentSchema = discriminatedUnion("type", [TextContentSchema, ImageContentSchema, AudioContentSchema]);
   SamplingMessageContentBlockSchema = discriminatedUnion("type", [
@@ -59629,7 +60126,7 @@ var init_types2 = __esm(() => {
   SamplingMessageSchema = object2({
     role: RoleSchema,
     content: union2([SamplingMessageContentBlockSchema, array(SamplingMessageContentBlockSchema)]),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   CreateMessageRequestParamsSchema = TaskAugmentedRequestParamsSchema.extend({
     messages: array(SamplingMessageSchema),
@@ -59742,7 +60239,7 @@ var init_types2 = __esm(() => {
     message: string3(),
     requestedSchema: object2({
       type: literal("object"),
-      properties: record3(string3(), PrimitiveSchemaDefinitionSchema),
+      properties: record4(string3(), PrimitiveSchemaDefinitionSchema),
       required: array(string3()).optional()
     })
   });
@@ -59766,7 +60263,7 @@ var init_types2 = __esm(() => {
   });
   ElicitResultSchema = ResultSchema.extend({
     action: _enum(["accept", "decline", "cancel"]),
-    content: preprocess((val) => val === null ? undefined : val, record3(string3(), union2([string3(), number2(), boolean2(), array(string3())])).optional())
+    content: preprocess((val) => val === null ? undefined : val, record4(string3(), union2([string3(), number2(), boolean2(), array(string3())])).optional())
   });
   ResourceTemplateReferenceSchema = object2({
     type: literal("ref/resource"),
@@ -59783,7 +60280,7 @@ var init_types2 = __esm(() => {
       value: string3()
     }),
     context: object2({
-      arguments: record3(string3(), string3()).optional()
+      arguments: record4(string3(), string3()).optional()
     }).optional()
   });
   CompleteRequestSchema = RequestSchema.extend({
@@ -59800,7 +60297,7 @@ var init_types2 = __esm(() => {
   RootSchema = object2({
     uri: string3().startsWith("file://"),
     name: string3().optional(),
-    _meta: record3(string3(), unknown()).optional()
+    _meta: record4(string3(), unknown()).optional()
   });
   ListRootsRequestSchema = RequestSchema.extend({
     method: literal("roots/list"),
@@ -67464,8 +67961,8 @@ var require_multipleOf = __commonJS((exports) => {
       const { gen, data, schemaCode, it } = cxt;
       const prec = it.opts.multipleOfPrecision;
       const res = gen.let("res");
-      const invalid2 = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
-      cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid2}))`);
+      const invalid3 = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
+      cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid3}))`);
     }
   };
   exports.default = def;
@@ -73542,6 +74039,107 @@ var init_storage_tools = __esm(() => {
   init_helpers();
 });
 
+// src/lib/remote-invitation-recovery.ts
+function invitationEmailIds(invitationId2, challengeId) {
+  if (!uuid5(invitationId2) || !uuid5(challengeId))
+    throw new InvitationEmailInputError;
+  return { invitationId: invitationId2, challengeId };
+}
+function invitationEmailInput(action, input) {
+  const keys2 = ["invitationId", "token", "challengeId", "confirm", ...action === "accept" ? ["code"] : []];
+  if (!record6(input) || Object.keys(input).length !== keys2.length || keys2.some((key) => !Object.hasOwn(input, key)))
+    throw new InvitationEmailInputError;
+  const value = { ...input };
+  const ids = invitationEmailIds(value.invitationId, value.challengeId);
+  if (value.confirm !== true || typeof value.token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value.token) || action === "accept" && (typeof value.code !== "string" || !/^\d{6}$/.test(value.code)))
+    throw new InvitationEmailInputError;
+  return { ...ids, token: value.token, confirm: true, ...action === "accept" ? { code: value.code } : {} };
+}
+async function requestInvitationEmail(origin, action, input) {
+  const value = invitationEmailInput(action, input);
+  let target;
+  try {
+    target = normalizeSkillsApiOrigin(origin);
+  } catch {
+    throw new InvitationEmailInputError;
+  }
+  const body = JSON.stringify({ invitationId: value.invitationId, token: value.token, challengeId: value.challengeId, ...action === "accept" ? { code: value.code } : {} });
+  try {
+    const response = await fetch(`${target}/api/v1/account/invitations/email-${action}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body,
+      credentials: "omit",
+      redirect: "error",
+      cache: "no-store",
+      referrerPolicy: "no-referrer",
+      signal: AbortSignal.timeout(15000)
+    });
+    const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 4096)));
+    if (!response.ok && record6(parsed) && typeof parsed.code === "string" && Object.hasOwn(refusals, parsed.code)) {
+      const code = parsed.code;
+      if (response.status === refusals[code][0])
+        throw new RemoteInvitationEmailError(code);
+    }
+    if (!record6(parsed))
+      throw new RemoteInvitationEmailUnconfirmedError(action);
+    if (action === "challenge" && response.status === 202 && parsed.challengeId === value.challengeId && parsed.expiresIn === 600 && typeof parsed.message === "string" && parsed.message.length <= 256) {
+      return { challengeId: value.challengeId, message: "If this invitation is eligible, a verification code will arrive. Delivery is not confirmed.", expiresIn: 600 };
+    }
+    if (action === "accept" && response.status === 200 && uuid5(parsed.organizationId) && uuid5(parsed.membershipId) && parsed.accepted === true && parsed.changed === true && parsed.signInRequired === true) {
+      return { organizationId: parsed.organizationId, membershipId: parsed.membershipId, accepted: true, changed: true, signInRequired: true };
+    }
+  } catch (error2) {
+    if (error2 instanceof RemoteInvitationEmailError)
+      throw error2;
+  }
+  throw new RemoteInvitationEmailUnconfirmedError(action);
+}
+function invitationEmailCustomerError(error2) {
+  if (error2 instanceof InvitationEmailInputError || error2 instanceof RemoteInvitationEmailError || error2 instanceof RemoteInvitationEmailUnconfirmedError)
+    return { code: error2.code, error: error2.message };
+  return { code: "INVITATION_EMAIL_UNAVAILABLE", error: "Unable to prepare this recovery action. Check the explicit server and stable profile. No credential was saved." };
+}
+var InvitationEmailInputError, refusals, RemoteInvitationEmailError, RemoteInvitationEmailUnconfirmedError, record6 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid5 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
+var init_remote_invitation_recovery = __esm(() => {
+  init_fleet_credentials();
+  init_remote_files();
+  InvitationEmailInputError = class InvitationEmailInputError extends Error {
+    code = "INVITATION_EMAIL_INPUT_INVALID";
+    constructor() {
+      super("Use an explicit Skills API URL, exact invitation and retained challenge IDs, secret input, and deliberate confirmation.");
+      this.name = "InvitationEmailInputError";
+    }
+  };
+  refusals = {
+    INVALID_REQUEST: [400, "Invitation recovery parameters were refused."],
+    ORIGIN_REQUIRED: [403, "Invitation recovery requires the configured site origin."],
+    INVITATION_PROOF_UNAVAILABLE: [401, "Invitation proof is unavailable. Sign in or explicitly request another recovery code."],
+    RATE_LIMITED: [429, "Invitation verification is rate limited. Wait before another deliberate action."],
+    INVITATION_BUSY: [503, "Invitation is busy. Sign in to check membership before another deliberate action."],
+    INVITATION_DELIVERY_UNAVAILABLE: [503, "Invitation recovery is unavailable on this service."]
+  };
+  RemoteInvitationEmailError = class RemoteInvitationEmailError extends Error {
+    code;
+    status;
+    constructor(code) {
+      super(refusals[code][1]);
+      this.code = code;
+      this.name = "RemoteInvitationEmailError";
+      this.status = refusals[code][0];
+    }
+  };
+  RemoteInvitationEmailUnconfirmedError = class RemoteInvitationEmailUnconfirmedError extends Error {
+    action;
+    code = "INVITATION_EMAIL_UNCONFIRMED";
+    constructor(action) {
+      super(action === "challenge" ? "The recovery challenge outcome is unconfirmed. Retain the same invitation, challenge ID and server. Check your inbox; never rotate the challenge or retry automatically. No delivery is confirmed." : "Invitation acceptance is unconfirmed. Use fresh ordinary sign-in to inspect available memberships. Do not retry acceptance automatically; explicitly request another recovery code only if needed. Saved credentials are unchanged.");
+      this.action = action;
+      this.name = "RemoteInvitationEmailUnconfirmedError";
+    }
+  };
+});
+
 // src/lib/remote-auth.ts
 async function requestAuthApi(instance, path, options) {
   const url = normalizeSkillsApiOrigin(instance);
@@ -73564,10 +74162,10 @@ async function requestAuthApi(instance, path, options) {
   const text2 = await res.text();
   const body = text2 ? parseJsonBody(text2) : {};
   if (!res.ok) {
-    const record5 = isRecord5(body) ? body : {};
-    const detail = typeof record5.detail === "string" ? record5.detail : undefined;
-    const error2 = typeof record5.error === "string" ? record5.error : undefined;
-    const code = typeof record5.code === "string" ? record5.code : undefined;
+    const record7 = isRecord5(body) ? body : {};
+    const detail = typeof record7.detail === "string" ? record7.detail : undefined;
+    const error2 = typeof record7.error === "string" ? record7.error : undefined;
+    const code = typeof record7.code === "string" ? record7.code : undefined;
     throw new HostedApiError(detail || error2 || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -73601,11 +74199,17 @@ class RemoteSkillsAuthClient {
   constructor(apiUrl) {
     this.apiOrigin = normalizeSkillsApiOrigin(apiUrl);
   }
-  requestCode(email2) {
-    return this.request("/api/auth/login", { method: "POST", body: JSON.stringify({ email: email2 }) });
+  requestInvitationEmailChallenge(input) {
+    return requestInvitationEmail(this.apiOrigin, "challenge", input);
+  }
+  acceptInvitationEmailChallenge(input) {
+    return requestInvitationEmail(this.apiOrigin, "accept", input);
   }
-  verifyCode(email2, code) {
-    return this.request("/api/auth/verify", { method: "POST", body: JSON.stringify({ email: email2, code }) });
+  requestCode(email3) {
+    return this.request("/api/auth/login", { method: "POST", body: JSON.stringify({ email: email3 }) });
+  }
+  verifyCode(email3, code) {
+    return this.request("/api/auth/verify", { method: "POST", body: JSON.stringify({ email: email3, code }) });
   }
   startDevice() {
     return this.request("/api/auth/device/start", { method: "POST", body: JSON.stringify({ client: "skills-sdk" }) });
@@ -73613,34 +74217,34 @@ class RemoteSkillsAuthClient {
   pollDevice(deviceCode) {
     return this.request("/api/auth/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) });
   }
-  async sessionClient(email2, code, context) {
+  async sessionClient(email3, code, context) {
     if (context !== undefined) {
       const target = workspaceContext(context), apiOrigin2 = this.apiOrigin;
-      const session = await this.switchWorkspace(email2, code, target);
+      const session = await this.switchWorkspace(email3, code, target);
       return new RemoteSkillsClient(session.token, apiOrigin2);
     }
     const apiOrigin = this.apiOrigin;
-    if (!email2.includes("@") || !/^\d{6}$/.test(code))
+    if (!email3.includes("@") || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
-    const login = await this.verifyCode(email2, code);
+    const login = await this.verifyCode(email3, code);
     if (!login || typeof login.token !== "string" || !login.token)
       throw new Error("The server did not return an authorized account session");
     return new RemoteSkillsClient(login.token, apiOrigin);
   }
-  async listAccountWorkspaces(email2, code, expectedUserId) {
-    const login = await this.workspaceLogin(email2, code, expectedUserId);
+  async listAccountWorkspaces(email3, code, expectedUserId) {
+    const login = await this.workspaceLogin(email3, code, expectedUserId);
     const result2 = await new RemoteSkillsClient(login.token, login.apiOrigin).listAccountWorkspaces(login.userId);
     return { userId: login.userId, ...result2 };
   }
-  async switchWorkspace(email2, code, context) {
+  async switchWorkspace(email3, code, context) {
     const target = workspaceContext(context);
-    const login = await this.workspaceLogin(email2, code, target.userId);
+    const login = await this.workspaceLogin(email3, code, target.userId);
     return new RemoteSkillsClient(login.token, login.apiOrigin).switchWorkspace(target);
   }
-  async workspaceLogin(email2, code, expectedUserId) {
+  async workspaceLogin(email3, code, expectedUserId) {
     const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
     const apiOrigin = this.apiOrigin;
-    if (typeof email2 !== "string" || !email2.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
+    if (typeof email3 !== "string" || !email3.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
     let response;
     try {
@@ -73650,7 +74254,7 @@ class RemoteSkillsAuthClient {
         credentials: "omit",
         signal: AbortSignal.timeout(15000),
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ email: email2, code })
+        body: JSON.stringify({ email: email3, code })
       });
     } catch {
       throw new HostedApiError("Unable to verify the Skills account.");
@@ -73667,36 +74271,67 @@ class RemoteSkillsAuthClient {
     }
     return { ...parseWorkspaceLogin(value, expected), apiOrigin };
   }
-  async createApiKey(email2, code, name, scopes, context) {
+  async listWorkspaceInvitations(email3, code, context, options = {}) {
+    const target = workspaceContext(context), captured = invitationInput("list", options);
+    return (await this.sessionClient(email3, code, target)).listWorkspaceInvitations(target, captured);
+  }
+  async getWorkspaceInvitation(email3, code, context, invitationId2) {
+    const target = workspaceContext(context), captured = invitationInput("get", { invitationId: invitationId2 });
+    return (await this.sessionClient(email3, code, target)).getWorkspaceInvitation(target, captured.invitationId);
+  }
+  async issueWorkspaceInvitation(email3, code, context, input) {
+    const target = workspaceContext(context), captured = invitationInput("issue", input);
+    return (await this.sessionClient(email3, code, target)).issueWorkspaceInvitation(target, captured);
+  }
+  async resendWorkspaceInvitation(email3, code, context, invitationId2, input) {
+    const target = workspaceContext(context), captured = invitationInput("resend", { ...input, invitationId: invitationId2 });
+    const { invitationId: id, ...options } = captured;
+    return (await this.sessionClient(email3, code, target)).resendWorkspaceInvitation(target, id, options);
+  }
+  async revokeWorkspaceInvitation(email3, code, context, invitationId2, input) {
+    const target = workspaceContext(context), captured = invitationInput("revoke", { ...input, invitationId: invitationId2 });
+    const { invitationId: id, ...options } = captured;
+    return (await this.sessionClient(email3, code, target)).revokeWorkspaceInvitation(target, id, options);
+  }
+  async acceptWorkspaceInvitation(email3, code, context, invitationId2, input) {
+    const target = workspaceContext(context), captured = invitationInput("accept", { ...input, invitationId: invitationId2 });
+    const { invitationId: id, ...options } = captured;
+    return (await this.sessionClient(email3, code, target)).acceptWorkspaceInvitation(target, id, options);
+  }
+  async createApiKey(email3, code, name, scopes, context) {
     const capturedScopes = scopes === undefined ? undefined : [...scopes];
-    return (await this.sessionClient(email2, code, context)).createApiKey(name, capturedScopes);
+    return (await this.sessionClient(email3, code, context)).createApiKey(name, capturedScopes);
   }
-  async listApiKeys(email2, code, context) {
-    return (await this.sessionClient(email2, code, context)).listApiKeys();
+  async listApiKeys(email3, code, context) {
+    return (await this.sessionClient(email3, code, context)).listApiKeys();
   }
-  async revokeApiKey(email2, code, keyId, context) {
-    return (await this.sessionClient(email2, code, context)).revokeApiKey(keyId);
+  async revokeApiKey(email3, code, keyId, context) {
+    return (await this.sessionClient(email3, code, context)).revokeApiKey(keyId);
   }
-  async updateProfile(email2, code, input, context) {
+  async updateProfile(email3, code, input, context) {
     const body = customerNamePatch(input, "displayName");
-    return (await this.sessionClient(email2, code, context)).updateProfile({ displayName: body.displayName });
+    return (await this.sessionClient(email3, code, context)).updateProfile({ displayName: body.displayName });
   }
-  async updateCurrentWorkspace(email2, code, input, context) {
+  async updateCurrentWorkspace(email3, code, input, context) {
     const body = customerNamePatch(input, "name");
-    return (await this.sessionClient(email2, code, context)).updateCurrentWorkspace({ name: body.name });
+    return (await this.sessionClient(email3, code, context)).updateCurrentWorkspace({ name: body.name });
   }
-  async listWorkspaceMembers(email2, code, options = {}, context) {
+  async listWorkspaceMembers(email3, code, options = {}, context) {
     workspaceMembersQuery(options);
     const captured = { ...options };
-    return (await this.sessionClient(email2, code, context)).listWorkspaceMembers(captured);
+    return (await this.sessionClient(email3, code, context)).listWorkspaceMembers(captured);
   }
-  async setWorkspaceMemberRole(email2, code, membershipId, input, context) {
+  async setWorkspaceMemberRole(email3, code, membershipId, input, context) {
     const captured = workspaceMemberRoleInput(membershipId, input);
-    return (await this.sessionClient(email2, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
+    return (await this.sessionClient(email3, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
+  }
+  async leaveWorkspace(email3, code, context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    return (await this.sessionClient(email3, code, captured.context)).leaveWorkspace(captured.context, captured.input);
   }
-  async removeWorkspaceMember(email2, code, membershipId, input, context) {
+  async removeWorkspaceMember(email3, code, membershipId, input, context) {
     const captured = workspaceMemberRemovalInput(membershipId, input);
-    return (await this.sessionClient(email2, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
+    return (await this.sessionClient(email3, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
   }
   request(path, options) {
     if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
@@ -73706,6 +74341,9 @@ class RemoteSkillsAuthClient {
 }
 var MAX_ERROR_DETAIL_LENGTH = 200, HostedApiError;
 var init_remote_auth = __esm(() => {
+  init_remote_invitation_recovery();
+  init_remote_invitations();
+  init_remote_workspace_leave();
   init_remote_workspace_selection();
   init_remote_files();
   init_remote_workspace();
@@ -73851,20 +74489,20 @@ async function prepareWorkspaceEnrollment(membershipId, source = process.env) {
   return {
     profile,
     origin,
-    async complete(email2, code) {
+    async complete(email3, code) {
       unchanged2();
-      if (!email2.includes("@") || !/^\d{6}$/.test(code))
+      if (!email3.includes("@") || !/^\d{6}$/.test(code))
         return fail2("A fresh email and six-digit verification code are required.");
-      if (expected && expected.user.email.toLowerCase() !== email2.toLowerCase())
+      if (expected && expected.user.email.toLowerCase() !== email3.toLowerCase())
         return fail2("This profile belongs to another account. Use a different profile or ordinary replacement login.");
       let issued = false;
       try {
-        const result2 = await new RemoteSkillsAuthClient(origin).verifyCode(email2, code);
+        const result2 = await new RemoteSkillsAuthClient(origin).verifyCode(email3, code);
         const login = parseWorkspaceLogin(result2, expected?.user.id);
         if (result2.firstLogin === true)
           return fail2("This sign-in created a new account using the server signup policy. Finish ordinary account login before enrolling a workspace profile.");
         const session = await new RemoteSkillsClient(login.token, origin).switchWorkspace({ userId: login.userId, membershipId });
-        if (session.user.email.toLowerCase() !== email2.toLowerCase())
+        if (session.user.email.toLowerCase() !== email3.toLowerCase())
           return fail2("The verified account does not match the requested email.");
         if (session.user.role === "viewer")
           return fail2("Viewer memberships cannot enroll API keys.");
@@ -73948,8 +74586,103 @@ var init_workspace_profile = __esm(() => {
   };
 });
 
+// src/lib/invitation-customer-action.ts
+function invitationProfileContext(userId, membershipId, profile) {
+  const target = workspaceContext({ userId, membershipId });
+  if (profile && (profile.userId !== target.userId || profile.membershipId !== target.membershipId))
+    throw new WorkspaceIdentityMismatchError;
+  return target;
+}
+async function invokeFreshInvitation(client, email3, code, context, action, input) {
+  const target = workspaceContext(context), captured = invitationInput(action, input);
+  let result2;
+  switch (action) {
+    case "list":
+      result2 = await client.listWorkspaceInvitations(email3, code, target, captured);
+      break;
+    case "get":
+      result2 = await client.getWorkspaceInvitation(email3, code, target, captured.invitationId);
+      break;
+    case "issue":
+      result2 = await client.issueWorkspaceInvitation(email3, code, target, captured);
+      break;
+    case "resend": {
+      const { invitationId: invitationId2, ...options } = captured;
+      result2 = await client.resendWorkspaceInvitation(email3, code, target, invitationId2, options);
+      break;
+    }
+    case "revoke": {
+      const { invitationId: invitationId2, ...options } = captured;
+      result2 = await client.revokeWorkspaceInvitation(email3, code, target, invitationId2, options);
+      break;
+    }
+    case "accept": {
+      const { invitationId: invitationId2, ...options } = captured;
+      result2 = await client.acceptWorkspaceInvitation(email3, code, target, invitationId2, options);
+      break;
+    }
+    default:
+      throw new WorkspaceInvitationInputError;
+  }
+  return result2;
+}
+function invitationCustomerError(error2) {
+  if (error2 instanceof WorkspaceInvitationInputError || error2 instanceof RemoteWorkspaceInvitationError || error2 instanceof RemoteWorkspaceInvitationUnconfirmedError || error2 instanceof RemoteWorkspaceInvitationReadError)
+    return { code: error2.code, error: error2.message };
+  return { code: "INVITATION_VERIFICATION_FAILED", error: "Invitation verification failed. Check the selected server, profile, exact user and current membership, then obtain a fresh code. No invitation result was confirmed; saved credentials are unchanged." };
+}
+var init_invitation_customer_action = __esm(() => {
+  init_remote_workspace_selection();
+  init_remote_invitations();
+});
+
+// src/mcp/remote-invitation-tools.ts
+function registerRemoteInvitationTools(server) {
+  const uuid6 = exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/);
+  const verification = { userId: uuid6, membershipId: uuid6, email: exports_external.string().email().max(254), code: exports_external.string().regex(/^\d{6}$/) };
+  const schemas4 = {
+    list: exports_external.object({ ...verification, after: uuid6.optional() }).strict(),
+    get: exports_external.object({ ...verification, invitationId: uuid6 }).strict(),
+    issue: exports_external.object({ ...verification, recipient: exports_external.string().email().max(254), role: exports_external.enum(["owner", "admin", "member", "viewer"]), idempotencyKey: uuid6, confirm: exports_external.literal(true) }).strict(),
+    resend: exports_external.object({ ...verification, invitationId: uuid6, expectedGeneration: exports_external.number().int().min(1).max(10), idempotencyKey: uuid6, confirm: exports_external.literal(true) }).strict(),
+    revoke: exports_external.object({ ...verification, invitationId: uuid6, expectedGeneration: exports_external.number().int().min(1).max(10), confirm: exports_external.literal(true) }).strict(),
+    accept: exports_external.object({ ...verification, invitationId: uuid6, token: exports_external.string().regex(/^[A-Za-z0-9_-]{43}$/).describe("Secret from the invitation email; supplied only in the MCP request, never returned or saved."), confirm: exports_external.literal(true) }).strict()
+  };
+  for (const action of ["list", "get", "issue", "resend", "revoke", "accept"]) {
+    const read = action === "list" || action === "get";
+    server.registerTool(action === "list" ? "list_workspace_invitations" : `${action}_workspace_invitation`, {
+      title: `${action[0].toUpperCase() + action.slice(1)} Workspace Invitation${action === "list" ? "s" : ""}`,
+      description: "Use fresh verification bound to the exact observed user/current membership and any selected profile. Mutations require confirm=true; issue/resend require a stable caller request key. Never retry uncertain outcomes automatically. Acceptance does not switch workspace or create credentials. Zero-membership account recovery is not supported by this flow.",
+      annotations: { destructiveHint: !read, idempotentHint: true, readOnlyHint: read },
+      inputSchema: schemas4[action]
+    }, async (value) => {
+      try {
+        const { userId, membershipId, email: email3, code, recipient, ...rest2 } = value;
+        const input = invitationInput(action, action === "issue" ? { ...rest2, email: recipient } : rest2);
+        const context = invitationProfileContext(String(userId), String(membershipId));
+        const target = await captureProfileWorkspace("Manage invitations");
+        invitationProfileContext(context.userId, context.membershipId, target.context);
+        target.unchanged();
+        return mcpJson(await invokeFreshInvitation(new RemoteSkillsAuthClient(target.origin), String(email3), String(code), context, action, input));
+      } catch (error2) {
+        const result2 = invitationCustomerError(error2);
+        return mcpError(result2.code, result2.error);
+      }
+    });
+  }
+}
+var init_remote_invitation_tools = __esm(() => {
+  init_zod();
+  init_remote_auth();
+  init_workspace_profile();
+  init_invitation_customer_action();
+  init_remote_invitations();
+  init_helpers();
+});
+
 // src/mcp/remote-customer-tools.ts
 function registerRemoteCustomerTools(server) {
+  registerRemoteInvitationTools(server);
   const memberRole = exports_external.enum(["owner", "admin", "member", "viewer"]);
   const memberInput = {
     membershipId: exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/),
@@ -73957,13 +74690,25 @@ function registerRemoteCustomerTools(server) {
     email: exports_external.string().email(),
     code: exports_external.string().regex(/^\d{6}$/)
   };
+  server.registerTool("leave_workspace", {
+    title: "Leave Current Workspace",
+    description: "Leave exactly the observed user and membership with confirm=true and fresh verification. The server enforces last-owner and last-workspace safeguards. Sign in again afterwards; no automatic retry or saved-profile deletion.",
+    annotations: { destructiveHint: true, idempotentHint: false, readOnlyHint: false },
+    inputSchema: exports_external.object({ ...memberInput, userId: memberInput.membershipId, confirm: exports_external.literal(true) }).strict()
+  }, async ({ membershipId, userId, expectedRole, email: email3, code, confirm }) => {
+    try {
+      return mcpJson(await freshAccount("Leave workspace", (client, context) => client.leaveWorkspace(email3, code, workspaceLeaveProfileContext(membershipId, userId, context), { expectedRole, confirm })));
+    } catch (error2) {
+      return error2 instanceof RemoteWorkspaceLeaveError || error2 instanceof RemoteWorkspaceLeaveUnconfirmedError ? mcpError(error2.code, error2.message) : mcpError("WORKSPACE_LEAVE_UNCONFIRMED", "Leaving could not be confirmed. Check the selected profile and exact membership, sign in again and inspect available workspaces before another action. Do not retry automatically; saved credentials are unchanged.");
+    }
+  });
   server.registerTool("set_workspace_member_role", {
     title: "Set Current Workspace Member Role",
     description: "Change exactly this membership incarnation with its observed expectedRole and fresh verification. The server enforces owner/admin policy. No automatic refresh or retry; saved credentials stay unchanged.",
     inputSchema: exports_external.object({ ...memberInput, role: memberRole }).strict()
-  }, async ({ membershipId, role: role2, expectedRole, email: email2, code }) => {
+  }, async ({ membershipId, role: role3, expectedRole, email: email3, code }) => {
     try {
-      return mcpJson(await freshAccount("Set workspace member role", (client, context) => client.setWorkspaceMemberRole(email2, code, membershipId, { role: role2, expectedRole }, context)));
+      return mcpJson(await freshAccount("Set workspace member role", (client, context) => client.setWorkspaceMemberRole(email3, code, membershipId, { role: role3, expectedRole }, context)));
     } catch (error2) {
       return memberError(error2);
     }
@@ -73972,9 +74717,9 @@ function registerRemoteCustomerTools(server) {
     title: "Remove Current Workspace Member",
     description: "Remove exactly this membership incarnation using its observed expectedRole and fresh verification. Self-removal is unavailable. A retry cannot remove a later replacement membership; saved credentials stay unchanged.",
     inputSchema: exports_external.object(memberInput).strict()
-  }, async ({ membershipId, expectedRole, email: email2, code }) => {
+  }, async ({ membershipId, expectedRole, email: email3, code }) => {
     try {
-      return mcpJson(await freshAccount("Remove workspace member", (client, context) => client.removeWorkspaceMember(email2, code, membershipId, { expectedRole }, context)));
+      return mcpJson(await freshAccount("Remove workspace member", (client, context) => client.removeWorkspaceMember(email3, code, membershipId, { expectedRole }, context)));
     } catch (error2) {
       return memberError(error2);
     }
@@ -73988,9 +74733,9 @@ function registerRemoteCustomerTools(server) {
       limit: exports_external.number().int().min(1).max(100).optional(),
       cursor: exports_external.string().regex(/^[A-Za-z0-9_-]{1,512}$/).optional()
     }).strict()
-  }, async ({ email: email2, code, limit, cursor: cursor2 }) => {
+  }, async ({ email: email3, code, limit, cursor: cursor2 }) => {
     try {
-      return mcpJson(await freshAccount("List workspace members", (client, context) => client.listWorkspaceMembers(email2, code, { limit, cursor: cursor2 }, context)));
+      return mcpJson(await freshAccount("List workspace members", (client, context) => client.listWorkspaceMembers(email3, code, { limit, cursor: cursor2 }, context)));
     } catch {
       return mcpError("WORKSPACE_MEMBERS_FAILED", "Unable to list workspace members. Check the selected server, owner/admin permissions, pagination and fresh verification code.");
     }
@@ -74000,9 +74745,9 @@ function registerRemoteCustomerTools(server) {
       title: kind === "profile" ? "Update Account Display Name" : "Update Workspace Name",
       description: "Update only the name on the explicitly selected Skills server using fresh email OTP. Workspace changes require an owner/admin. Saved credentials are unchanged.",
       inputSchema: exports_external.object({ name: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }).strict()
-    }, async ({ name, email: email2, code }) => {
+    }, async ({ name, email: email3, code }) => {
       try {
-        return mcpJson(await freshAccount("Update customer name", async (client, context) => kind === "profile" ? client.updateProfile(email2, code, { displayName: name }, context) : client.updateCurrentWorkspace(email2, code, { name }, context)));
+        return mcpJson(await freshAccount("Update customer name", async (client, context) => kind === "profile" ? client.updateProfile(email3, code, { displayName: name }, context) : client.updateCurrentWorkspace(email3, code, { name }, context)));
       } catch {
         return mcpError("NAME_UPDATE_FAILED", "Unable to update the name. Check the selected server, name, permissions and fresh verification code.");
       }
@@ -74022,9 +74767,9 @@ function registerRemoteCustomerTools(server) {
     title: "List API Keys",
     description: "List account API keys using fresh email OTP reauthentication.",
     inputSchema: { email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }
-  }, async ({ email: email2, code }) => {
+  }, async ({ email: email3, code }) => {
     try {
-      return mcpJson(await freshAccount("List API keys", (client, context) => client.listApiKeys(email2, code, context)));
+      return mcpJson(await freshAccount("List API keys", (client, context) => client.listApiKeys(email3, code, context)));
     } catch {
       return mcpError("KEY_LIST_FAILED", "Unable to list API keys. Check the selected profile, server, account and fresh verification code.");
     }
@@ -74033,9 +74778,9 @@ function registerRemoteCustomerTools(server) {
     title: "Revoke API Key",
     description: "Revoke an account API key using fresh email OTP reauthentication.",
     inputSchema: { key_id: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }
-  }, async ({ key_id, email: email2, code }) => {
+  }, async ({ key_id, email: email3, code }) => {
     try {
-      return mcpJson(await freshAccount("Revoke API key", (client, context) => client.revokeApiKey(email2, code, key_id, context)));
+      return mcpJson(await freshAccount("Revoke API key", (client, context) => client.revokeApiKey(email3, code, key_id, context)));
     } catch {
       return mcpError("KEY_REVOKE_FAILED", "Unable to revoke this API key. Check the selected profile, key, account and fresh verification code.");
     }
@@ -74044,10 +74789,10 @@ function registerRemoteCustomerTools(server) {
     title: "Create API Key",
     description: "Create an API key using fresh email OTP reauthentication; returns its secret once. A stored API key cannot grant this authority.",
     inputSchema: { name: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/), scopes: exports_external.array(exports_external.string()).optional() }
-  }, async ({ name, email: email2, code, scopes }) => {
+  }, async ({ name, email: email3, code, scopes }) => {
     const capturedScopes = scopes === undefined ? undefined : [...scopes];
     try {
-      return mcpJson(await freshAccount("Create API key", (client, context) => client.createApiKey(email2, code, name, capturedScopes, context)));
+      return mcpJson(await freshAccount("Create API key", (client, context) => client.createApiKey(email3, code, name, capturedScopes, context)));
     } catch {
       return mcpError("KEY_CREATION_FAILED", "API key creation could not be confirmed. Check the selected profile and workspace keys before retrying; a lost response may still have created a key.");
     }
@@ -74089,15 +74834,22 @@ async function freshAccount(action, operation) {
   return operation(new RemoteSkillsAuthClient(target.origin), target.context);
 }
 var init_remote_customer_tools = __esm(() => {
+  init_remote_invitation_tools();
   init_zod();
   init_remote_auth();
   init_workspace_profile();
   init_remote_customer_operations();
   init_remote_client();
+  init_remote_workspace_leave();
   init_helpers();
 });
 
 // src/mcp/server.ts
+var exports_server = {};
+__export(exports_server, {
+  server: () => server,
+  buildServer: () => buildServer
+});
 function buildServer() {
   const server = new McpServer({
     name: "skills",
@@ -74124,371 +74876,10 @@ var init_server3 = __esm(() => {
   server = buildServer();
 });
 
-// ../../node_modules/.bun/@hono+node-server@1.19.17+2145b681a064c8e9/node_modules/@hono/node-server/dist/index.mjs
-import { Readable } from "stream";
-import crypto2 from "crypto";
-var GlobalRequest, Request, newHeadersFromIncoming = (incoming) => {
-  const headerRecord = [];
-  const rawHeaders = incoming.rawHeaders;
-  for (let i = 0;i < rawHeaders.length; i += 2) {
-    const { [i]: key, [i + 1]: value } = rawHeaders;
-    if (key.charCodeAt(0) !== 58) {
-      headerRecord.push([key, value]);
-    }
-  }
-  return new Headers(headerRecord);
-}, wrapBodyStream, newRequestFromIncoming = (method2, url, headers, incoming, abortController) => {
-  const init = {
-    method: method2,
-    headers,
-    signal: abortController.signal
-  };
-  if (method2 === "TRACE") {
-    init.method = "GET";
-    const req = new Request(url, init);
-    Object.defineProperty(req, "method", {
-      get() {
-        return "TRACE";
-      }
-    });
-    return req;
-  }
-  if (!(method2 === "GET" || method2 === "HEAD")) {
-    if ("rawBody" in incoming && incoming.rawBody instanceof Buffer) {
-      init.body = new ReadableStream({
-        start(controller) {
-          controller.enqueue(incoming.rawBody);
-          controller.close();
-        }
-      });
-    } else if (incoming[wrapBodyStream]) {
-      let reader;
-      init.body = new ReadableStream({
-        async pull(controller) {
-          try {
-            reader ||= Readable.toWeb(incoming).getReader();
-            const { done, value } = await reader.read();
-            if (done) {
-              controller.close();
-            } else {
-              controller.enqueue(value);
-            }
-          } catch (error2) {
-            controller.error(error2);
-          }
-        }
-      });
-    } else {
-      init.body = Readable.toWeb(incoming);
-    }
-  }
-  return new Request(url, init);
-}, getRequestCache, requestCache, incomingKey, urlKey, headersKey, abortControllerKey, getAbortController, requestPrototype, responseCache, getResponseCache, cacheKey, GlobalResponse, Response2, outgoingEnded, incomingDraining, MAX_DRAIN_BYTES;
-var init_dist = __esm(() => {
-  GlobalRequest = global.Request;
-  Request = class extends GlobalRequest {
-    constructor(input, options) {
-      if (typeof input === "object" && getRequestCache in input) {
-        input = input[getRequestCache]();
-      }
-      if (typeof options?.body?.getReader !== "undefined") {
-        options.duplex ??= "half";
-      }
-      super(input, options);
-    }
-  };
-  wrapBodyStream = Symbol("wrapBodyStream");
-  getRequestCache = Symbol("getRequestCache");
-  requestCache = Symbol("requestCache");
-  incomingKey = Symbol("incomingKey");
-  urlKey = Symbol("urlKey");
-  headersKey = Symbol("headersKey");
-  abortControllerKey = Symbol("abortControllerKey");
-  getAbortController = Symbol("getAbortController");
-  requestPrototype = {
-    get method() {
-      return this[incomingKey].method || "GET";
-    },
-    get url() {
-      return this[urlKey];
-    },
-    get headers() {
-      return this[headersKey] ||= newHeadersFromIncoming(this[incomingKey]);
-    },
-    [getAbortController]() {
-      this[getRequestCache]();
-      return this[abortControllerKey];
-    },
-    [getRequestCache]() {
-      this[abortControllerKey] ||= new AbortController;
-      return this[requestCache] ||= newRequestFromIncoming(this.method, this[urlKey], this.headers, this[incomingKey], this[abortControllerKey]);
-    }
-  };
-  [
-    "body",
-    "bodyUsed",
-    "cache",
-    "credentials",
-    "destination",
-    "integrity",
-    "mode",
-    "redirect",
-    "referrer",
-    "referrerPolicy",
-    "signal",
-    "keepalive"
-  ].forEach((k) => {
-    Object.defineProperty(requestPrototype, k, {
-      get() {
-        return this[getRequestCache]()[k];
-      }
-    });
-  });
-  ["arrayBuffer", "blob", "clone", "formData", "json", "text"].forEach((k) => {
-    Object.defineProperty(requestPrototype, k, {
-      value: function() {
-        return this[getRequestCache]()[k]();
-      }
-    });
-  });
-  Object.defineProperty(requestPrototype, Symbol.for("nodejs.util.inspect.custom"), {
-    value: function(depth, options, inspectFn) {
-      const props = {
-        method: this.method,
-        url: this.url,
-        headers: this.headers,
-        nativeRequest: this[requestCache]
-      };
-      return `Request (lightweight) ${inspectFn(props, { ...options, depth: depth == null ? null : depth - 1 })}`;
-    }
-  });
-  Object.setPrototypeOf(requestPrototype, Request.prototype);
-  responseCache = Symbol("responseCache");
-  getResponseCache = Symbol("getResponseCache");
-  cacheKey = Symbol("cache");
-  GlobalResponse = global.Response;
-  Response2 = class _Response {
-    #body;
-    #init;
-    [getResponseCache]() {
-      delete this[cacheKey];
-      return this[responseCache] ||= new GlobalResponse(this.#body, this.#init);
-    }
-    constructor(body, init) {
-      let headers;
-      this.#body = body;
-      if (init instanceof _Response) {
-        const cachedGlobalResponse = init[responseCache];
-        if (cachedGlobalResponse) {
-          this.#init = cachedGlobalResponse;
-          this[getResponseCache]();
-          return;
-        } else {
-          this.#init = init.#init;
-          headers = new Headers(init.#init.headers);
-        }
-      } else {
-        this.#init = init;
-      }
-      if (typeof body === "string" || typeof body?.getReader !== "undefined" || body instanceof Blob || body instanceof Uint8Array) {
-        this[cacheKey] = [init?.status || 200, body, headers || init?.headers];
-      }
-    }
-    get headers() {
-      const cache3 = this[cacheKey];
-      if (cache3) {
-        if (!(cache3[2] instanceof Headers)) {
-          cache3[2] = new Headers(cache3[2] || { "content-type": "text/plain; charset=UTF-8" });
-        }
-        return cache3[2];
-      }
-      return this[getResponseCache]().headers;
-    }
-    get status() {
-      return this[cacheKey]?.[0] ?? this[getResponseCache]().status;
-    }
-    get ok() {
-      const status = this.status;
-      return status >= 200 && status < 300;
-    }
-  };
-  ["body", "bodyUsed", "redirected", "statusText", "trailers", "type", "url"].forEach((k) => {
-    Object.defineProperty(Response2.prototype, k, {
-      get() {
-        return this[getResponseCache]()[k];
-      }
-    });
-  });
-  ["arrayBuffer", "blob", "clone", "formData", "json", "text"].forEach((k) => {
-    Object.defineProperty(Response2.prototype, k, {
-      value: function() {
-        return this[getResponseCache]()[k]();
-      }
-    });
-  });
-  Object.defineProperty(Response2.prototype, Symbol.for("nodejs.util.inspect.custom"), {
-    value: function(depth, options, inspectFn) {
-      const props = {
-        status: this.status,
-        headers: this.headers,
-        ok: this.ok,
-        nativeResponse: this[responseCache]
-      };
-      return `Response (lightweight) ${inspectFn(props, { ...options, depth: depth == null ? null : depth - 1 })}`;
-    }
-  });
-  Object.setPrototypeOf(Response2, GlobalResponse);
-  Object.setPrototypeOf(Response2.prototype, GlobalResponse.prototype);
-  if (typeof global.crypto === "undefined") {
-    global.crypto = crypto2;
-  }
-  outgoingEnded = Symbol("outgoingEnded");
-  incomingDraining = Symbol("incomingDraining");
-  MAX_DRAIN_BYTES = 64 * 1024 * 1024;
-});
-
-// ../../node_modules/.bun/content-type@1.0.5/node_modules/content-type/index.js
-var require_content_type = __commonJS((exports) => {
-  /*!
-   * content-type
-   * Copyright(c) 2015 Douglas Christopher Wilson
-   * MIT Licensed
-   */
-  var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g;
-  var TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/;
-  var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-  var QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g;
-  var QUOTE_REGEXP = /([\\"])/g;
-  var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-  exports.format = format;
-  exports.parse = parse6;
-  function format(obj) {
-    if (!obj || typeof obj !== "object") {
-      throw new TypeError("argument obj is required");
-    }
-    var parameters = obj.parameters;
-    var type = obj.type;
-    if (!type || !TYPE_REGEXP.test(type)) {
-      throw new TypeError("invalid type");
-    }
-    var string5 = type;
-    if (parameters && typeof parameters === "object") {
-      var param;
-      var params = Object.keys(parameters).sort();
-      for (var i = 0;i < params.length; i++) {
-        param = params[i];
-        if (!TOKEN_REGEXP.test(param)) {
-          throw new TypeError("invalid parameter name");
-        }
-        string5 += "; " + param + "=" + qstring(parameters[param]);
-      }
-    }
-    return string5;
-  }
-  function parse6(string5) {
-    if (!string5) {
-      throw new TypeError("argument string is required");
-    }
-    var header = typeof string5 === "object" ? getcontenttype(string5) : string5;
-    if (typeof header !== "string") {
-      throw new TypeError("argument string is required to be a string");
-    }
-    var index = header.indexOf(";");
-    var type = index !== -1 ? header.slice(0, index).trim() : header.trim();
-    if (!TYPE_REGEXP.test(type)) {
-      throw new TypeError("invalid media type");
-    }
-    var obj = new ContentType(type.toLowerCase());
-    if (index !== -1) {
-      var key;
-      var match;
-      var value;
-      PARAM_REGEXP.lastIndex = index;
-      while (match = PARAM_REGEXP.exec(header)) {
-        if (match.index !== index) {
-          throw new TypeError("invalid parameter format");
-        }
-        index += match[0].length;
-        key = match[1].toLowerCase();
-        value = match[2];
-        if (value.charCodeAt(0) === 34) {
-          value = value.slice(1, -1);
-          if (value.indexOf("\\") !== -1) {
-            value = value.replace(QESC_REGEXP, "$1");
-          }
-        }
-        obj.parameters[key] = value;
-      }
-      if (index !== header.length) {
-        throw new TypeError("invalid parameter format");
-      }
-    }
-    return obj;
-  }
-  function getcontenttype(obj) {
-    var header;
-    if (typeof obj.getHeader === "function") {
-      header = obj.getHeader("content-type");
-    } else if (typeof obj.headers === "object") {
-      header = obj.headers && obj.headers["content-type"];
-    }
-    if (typeof header !== "string") {
-      throw new TypeError("content-type header is missing from object");
-    }
-    return header;
-  }
-  function qstring(val) {
-    var str2 = String(val);
-    if (TOKEN_REGEXP.test(str2)) {
-      return str2;
-    }
-    if (str2.length > 0 && !TEXT_REGEXP.test(str2)) {
-      throw new TypeError("invalid parameter value");
-    }
-    return '"' + str2.replace(QUOTE_REGEXP, "\\$1") + '"';
-  }
-  function ContentType(type) {
-    this.parameters = Object.create(null);
-    this.type = type;
-  }
-});
-
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
-var import_content_type;
-var init_mediaType = __esm(() => {
-  import_content_type = __toESM(require_content_type(), 1);
-});
-
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/sseKeepAlive.js
-var MAX_TIMER_DELAY_MS;
-var init_sseKeepAlive = __esm(() => {
-  MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
-});
-
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
-var init_webStandardStreamableHttp = __esm(() => {
-  init_mediaType();
-  init_sseKeepAlive();
-  init_types2();
-});
-
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.0+2b91fc17bf64bdfd/node_modules/@modelcontextprotocol/sdk/dist/esm/server/streamableHttp.js
-var init_streamableHttp = __esm(() => {
-  init_dist();
-  init_webStandardStreamableHttp();
-});
-
-// src/mcp/http.ts
-var init_http = __esm(() => {
-  init_streamableHttp();
-  init_server3();
-});
-
 // src/mcp/index.ts
 var exports_mcp = {};
 __export(exports_mcp, {
   startMcpStdio: () => startMcpStdio,
-  buildServer: () => buildServer,
   assertSkillsMcpConfigured: () => assertSkillsMcpConfigured
 });
 function printHelp() {
@@ -74499,6 +74890,7 @@ MCP server for ${package_default.name}
 Options:
   -V, --version  output the version number
   -h, --help     display help for command
+  --invitation-recovery --stdio  expose only anonymous invitation recovery tools
   --stdio        run newline-delimited JSON-RPC for agent hosts
   --http         run Streamable HTTP transport on 127.0.0.1 (default; port 8836)
   --port <n>     HTTP port (--http or MCP_HTTP=1)`);
@@ -74515,23 +74907,21 @@ function assertSkillsMcpConfigured(env3 = process.env) {
 }
 async function startMcpStdio() {
   assertSkillsMcpConfigured();
-  const server2 = buildServer();
+  const { buildServer: buildServer2 } = await Promise.resolve().then(() => (init_server3(), exports_server));
+  const server2 = buildServer2();
   await server2.connect(new StdioServerTransport);
 }
 var args;
 var init_mcp2 = __esm(() => {
   init_stdio2();
   init_package();
-  init_server3();
-  init_http();
   init_fleet_credentials();
-  init_server3();
   args = process.argv.slice(2);
-  if (args.includes("--help") || args.includes("-h")) {
+  if (!args.some((value) => value.startsWith("--invitation-recovery")) && (args.includes("--help") || args.includes("-h"))) {
     printHelp();
     process.exit(0);
   }
-  if (args.includes("--version") || args.includes("-V")) {
+  if (!args.some((value) => value.startsWith("--invitation-recovery")) && (args.includes("--version") || args.includes("-V"))) {
     console.log(package_default.version);
     process.exit(0);
   }
@@ -77403,10 +77793,10 @@ async function handleRegistrySync(options) {
     await writeJson2(artifact, 2);
     return;
   }
-  const invalid2 = artifact.summary.invalidSkillCount ?? "not checked";
+  const invalid3 = artifact.summary.invalidSkillCount ?? "not checked";
   console.log(source_default.green(`Registry sync artifact written to ${options.output}`));
   console.log(source_default.dim(`  Skills: ${artifact.summary.skillCount}`));
-  console.log(source_default.dim(`  Invalid: ${invalid2}`));
+  console.log(source_default.dim(`  Invalid: ${invalid3}`));
 }
 function registerPull(parent) {
   parent.command("pull").argument("[names...]", "Skills to pull from the configured instance (name or name@version)").option("--all", "Pull every skill the instance serves", false).option("--for-machine", "Prepare this machine with the instance's full catalog (implies --all)", false).option("--json", "Output results as JSON", false).description("Fetch skills from the configured Skills instance into this machine's corpus").action(async (names, options) => {
@@ -77626,21 +78016,21 @@ async function readPublishRevision(client, slug) {
     throw new PushSkillError("Publishing was refused because the current skill revision could not be verified.", ["Check the configured instance and connection, then retry the push. No upload was attempted."]);
   }
   const body = lookup.body;
-  const record5 = body !== null && typeof body === "object" && !Array.isArray(body) ? body : undefined;
-  const nestedError = record5?.error;
-  const code = typeof record5?.code === "string" ? record5.code : nestedError !== null && typeof nestedError === "object" && !Array.isArray(nestedError) ? nestedError.code : undefined;
+  const record7 = body !== null && typeof body === "object" && !Array.isArray(body) ? body : undefined;
+  const nestedError = record7?.error;
+  const code = typeof record7?.code === "string" ? record7.code : nestedError !== null && typeof nestedError === "object" && !Array.isArray(nestedError) ? nestedError.code : undefined;
   if (lookup.status === 404 && code === "SKILL_NOT_FOUND")
     return;
   if (lookup.status < 200 || lookup.status >= 300) {
     throw new PushSkillError(`Publishing was refused because the current skill lookup failed: HTTP ${lookup.status}.`, ["Only an explicit SKILL_NOT_FOUND response establishes an initial publish. Check access and server compatibility before retrying."]);
   }
-  const revision = record5?.revisionId;
-  if (record5?.publicationState === "catalogue-only") {
-    if (record5.name === slug && (record5.slug === undefined || record5.slug === slug) && revision === null)
+  const revision = record7?.revisionId;
+  if (record7?.publicationState === "catalogue-only") {
+    if (record7.name === slug && (record7.slug === undefined || record7.slug === slug) && revision === null)
       return;
     throw new PushSkillError("Publishing was refused because the catalogue-only response had contradictory identity or revision state.", ["Check the configured instance and server compatibility. No upload was attempted."]);
   }
-  if (record5?.slug !== slug || typeof revision !== "string" || revision.length === 0 || revision !== revision.trim() || !/^[\x21-\x7e]+$/.test(revision)) {
+  if (record7?.slug !== slug || typeof revision !== "string" || revision.length === 0 || revision !== revision.trim() || !/^[\x21-\x7e]+$/.test(revision)) {
     throw new PushSkillError("Publishing was refused because the current skill response did not contain a matching slug and valid revision.", ["Check the configured instance and server compatibility. No upload was attempted."]);
   }
   return revision;
@@ -78014,22 +78404,22 @@ function authIdentityPayload(authSource, live, cached2, offline = false) {
   const data = recordField(root.data);
   const user = recordField(root.user) ?? recordField(data?.user);
   const organization2 = recordField(root.organization) ?? recordField(root.org) ?? recordField(data?.organization);
-  const email2 = stringField2(user?.email) ?? cached2?.email;
+  const email3 = stringField2(user?.email) ?? cached2?.email;
   const orgSlug = stringField2(organization2?.slug) ?? cached2?.orgSlug;
   const orgName = stringField2(organization2?.name);
   const userId = stringField2(user?.id) ?? cached2?.userId;
   const orgId = stringField2(organization2?.id) ?? cached2?.orgId;
-  const role2 = stringField2(user?.role);
+  const role3 = stringField2(user?.role);
   return {
     status: "authenticated",
     authSource,
     ...offline ? { offline: true } : {},
-    ...email2 ? { email: email2 } : {},
+    ...email3 ? { email: email3 } : {},
     ...orgSlug ? { organization: orgSlug } : {},
     ...orgName ? { organizationName: orgName } : {},
     ...userId ? { userId } : {},
     ...orgId ? { orgId } : {},
-    ...role2 ? { role: role2 } : {}
+    ...role3 ? { role: role3 } : {}
   };
 }
 function printWhoami(payload) {
@@ -78106,7 +78496,7 @@ function printLoginSuccess(loginResult, json) {
     console.log(source_default.dim(`  API key saved to ${getAuthFilePath()}`));
   }
 }
-async function doLogin(email2, code, json) {
+async function doLogin(email3, code, json) {
   const env3 = { ...process.env };
   let origin;
   try {
@@ -78115,7 +78505,7 @@ async function doLogin(email2, code, json) {
     writeCommandError(error2, "Configure a Skills API before signing in", json);
     return;
   }
-  if (!email2 || !email2.includes("@")) {
+  if (!email3 || !email3.includes("@")) {
     writeCommandError(new Error("Invalid email"), "Invalid email", json);
     process.exitCode = 1;
     return;
@@ -78127,7 +78517,7 @@ async function doLogin(email2, code, json) {
     try {
       sendRes = await apiRequest("/api/auth/login", {
         method: "POST",
-        body: JSON.stringify({ email: email2 })
+        body: JSON.stringify({ email: email3 })
       }, origin);
     } catch (err) {
       writeCommandError(err, "Failed to request login code", json);
@@ -78138,9 +78528,9 @@ async function doLogin(email2, code, json) {
       return;
     }
     if (!json)
-      console.log(source_default.green("\u2713 Code sent to " + email2));
+      console.log(source_default.green("\u2713 Code sent to " + email3));
     if (json || !isTTY) {
-      console.log(JSON.stringify({ status: "code_sent", email: email2, message: "Check email for 6-digit code, then run: skills auth login --email " + email2 + " --code <CODE>" }));
+      console.log(JSON.stringify({ status: "code_sent", email: email3, message: "Check email for 6-digit code, then run: skills auth login --email " + email3 + " --code <CODE>" }));
       return;
     }
     const answer = await prompt(source_default.bold("Code: "));
@@ -78152,7 +78542,7 @@ async function doLogin(email2, code, json) {
   try {
     verifyRes = await apiRequest("/api/auth/verify", {
       method: "POST",
-      body: JSON.stringify({ email: email2, code })
+      body: JSON.stringify({ email: email3, code })
     }, origin);
   } catch (err) {
     writeCommandError(err, "Failed to verify login code", json);
@@ -78199,13 +78589,13 @@ async function doApiKeyLogin(apiKey, json) {
     return;
   }
   const identity2 = authIdentityPayload("stored", whoami);
-  const email2 = stringField2(identity2.email);
+  const email3 = stringField2(identity2.email);
   const orgId = stringField2(identity2.orgId);
   const orgSlug = stringField2(identity2.organization);
   const userId = stringField2(identity2.userId);
   saveAuthConfig({
     apiKey: trimmed,
-    ...email2 ? { email: email2 } : {},
+    ...email3 ? { email: email3 } : {},
     ...orgId ? { orgId } : {},
     ...orgSlug ? { orgSlug } : {},
     ...userId ? { userId } : {}
@@ -78375,8 +78765,8 @@ function registerAuth(parent) {
       await doDeviceLogin(options);
       return;
     }
-    let email2 = options.email;
-    if (!email2 && isTTY && !options.json) {
+    let email3 = options.email;
+    if (!email3 && isTTY && !options.json) {
       const existing = authForPrompt();
       if (existing) {
         console.log(source_default.dim(`Already signed in as ${existing.email}`));
@@ -78387,17 +78777,17 @@ function registerAuth(parent) {
       const answer = await prompt(source_default.bold("Email: "));
       if (answer === null)
         return;
-      email2 = answer;
+      email3 = answer;
     }
-    if (!email2) {
+    if (!email3) {
       writeCommandError(new Error("Email required. Use: skills auth login --email you@example.com"), "Email required", options.json);
       return;
     }
-    await doLogin(email2, options.code, options.json);
+    await doLogin(email3, options.code, options.json);
   });
   auth.command("signup").description("Create or sign in with your email (passwordless)").option("--email <email>", "Email address (non-interactive)").option("--code <code>", "Verification code (non-interactive)").option("--json", "Output result as JSON without prompting", false).action(async (options) => {
-    let email2 = options.email;
-    if (!email2 && isTTY && !options.json) {
+    let email3 = options.email;
+    if (!email3 && isTTY && !options.json) {
       const existing = authForPrompt();
       if (existing) {
         console.log(source_default.dim(`Already signed in as ${existing.email}`));
@@ -78408,9 +78798,9 @@ function registerAuth(parent) {
       const answer = await prompt(source_default.bold("Email: "));
       if (answer === null)
         return;
-      email2 = answer;
+      email3 = answer;
     }
-    if (!email2) {
+    if (!email3) {
       const error2 = "Email required. Use: skills auth signup --email you@example.com";
       if (options.json)
         console.log(JSON.stringify({ error: error2 }));
@@ -78419,7 +78809,7 @@ function registerAuth(parent) {
       process.exitCode = 1;
       return;
     }
-    await doLogin(email2, options.code, options.json);
+    await doLogin(email3, options.code, options.json);
   });
   auth.command("logout").description("Remove this profile's stored credentials; injected keys remain configured").option("--json", "Output as JSON", false).action((options) => {
     const { stillResolves } = clearAuthConfig();
@@ -78485,6 +78875,332 @@ var init_auth = __esm(() => {
   CONFIG_HINT_STATUSES = new Set([401, 403, 404, 405, 501]);
 });
 
+// src/lib/invitation-recovery-target.ts
+function prepareInvitationRecoveryTarget(source = process.env) {
+  const env3 = { ...source }, names = ["HASNA_SKILLS_API_URL", "SKILLS_API_URL"];
+  const urls = names.map((name) => env3[name]?.trim()).filter((value) => !!value);
+  if (!urls.length)
+    throw new InvitationEmailInputError;
+  let origin;
+  try {
+    const normalized = urls.map(normalizeSkillsApiOrigin);
+    if (normalized.some((value) => value !== normalized[0]))
+      throw new InvitationEmailInputError;
+    origin = normalized[0];
+  } catch {
+    throw new InvitationEmailInputError;
+  }
+  const unchangedFiles = captureSkillsCredentialFiles(skillsProfileCredentialFiles(env3));
+  return { origin, unchanged() {
+    unchangedFiles();
+    if ([...names, "HASNA_PROFILE", "HASNA_HOME", "HOME"].some((name) => source[name] !== env3[name]))
+      throw new InvitationEmailInputError;
+  } };
+}
+var init_invitation_recovery_target = __esm(() => {
+  init_fleet_credentials();
+  init_instance_credentials();
+  init_remote_invitation_recovery();
+});
+
+// src/cli/commands/invitation-verification.ts
+import { emitKeypressEvents as emitKeypressEvents2 } from "readline";
+async function readInvitationSecrets() {
+  if (process.stdin.isTTY)
+    throw new NameInputError("Pipe the six-digit code and invitation token on two separate lines with --secrets-stdin.");
+  let text2 = "";
+  for await (const chunk2 of process.stdin) {
+    text2 += chunk2.toString();
+    if (text2.length > 64)
+      throw new NameInputError("Supply only the code and invitation token on two separate lines.");
+  }
+  const matched = /^(\d{6})\r?\n([A-Za-z0-9_-]{43})(?:\r?\n)?$/.exec(text2);
+  if (!matched)
+    throw new NameInputError("Supply only the code and invitation token on two separate lines.");
+  return { code: matched[1], token: matched[2] };
+}
+function promptInvitationToken() {
+  return promptInvitationProof("token");
+}
+function promptInvitationRecoveryCode() {
+  return promptInvitationProof("code");
+}
+function promptInvitationProof(kind) {
+  const length = kind === "token" ? 43 : 6;
+  const label = kind === "token" ? "invitation token" : "recovery code";
+  const character = kind === "token" ? /^[A-Za-z0-9_-]$/ : /^\d$/;
+  const { stdin, stderr: output } = process, wasRaw = stdin.isRaw, wasFlowing = stdin.readableFlowing;
+  return new Promise((resolve5) => {
+    let value = "", settled = false, overflow = false;
+    const finish = (answer) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      stdin.off("keypress", keypress);
+      stdin.off("end", cancel);
+      process.off("SIGINT", cancel);
+      stdin.setRawMode(wasRaw);
+      if (wasFlowing !== true)
+        stdin.pause();
+      output.write(`
+`);
+      if (answer === null)
+        process.exitCode = 130;
+      resolve5(answer);
+    };
+    const cancel = () => finish(null);
+    const keypress = (text2, key) => {
+      if (key.ctrl && ["c", "d"].includes(key.name ?? "") || key.name === "escape")
+        return cancel();
+      if (key.name === "return" || key.name === "enter") {
+        if (overflow) {
+          value = "";
+          overflow = false;
+          output.write(`
+Enter exactly ${length} ${label} characters: `);
+          return;
+        }
+        if (value.length === length)
+          return finish(value);
+        output.write(`
+Enter the complete ${label}: `);
+        value = "";
+        return;
+      }
+      if (overflow)
+        return;
+      if (key.name === "backspace") {
+        if (value) {
+          value = value.slice(0, -1);
+          output.write("\b \b");
+        }
+      } else if (character.test(text2)) {
+        if (value.length === length) {
+          overflow = true;
+          output.write(`
+The ${label} is too long. Press Enter to start again.`);
+        } else {
+          value += text2;
+          output.write("*");
+        }
+      } else if (text2 && !key.ctrl && !key.meta) {
+        overflow = true;
+        output.write(`
+The ${label} contains invalid characters. Press Enter to start again.`);
+      }
+    };
+    const timer = setTimeout(cancel, 5 * 60 * 1000);
+    emitKeypressEvents2(stdin);
+    stdin.setRawMode(true);
+    stdin.on("keypress", keypress);
+    stdin.once("end", cancel);
+    process.once("SIGINT", cancel);
+    output.write(kind === "token" ? "Enter the invitation token from your email: " : "Enter the six-digit recovery code from your email: ");
+    stdin.resume();
+  });
+}
+var init_invitation_verification = __esm(() => {
+  init_customer_verification();
+});
+
+// src/cli/commands/invitation-recovery.ts
+async function readToken() {
+  if (process.stdin.isTTY)
+    throw new InvitationEmailInputError;
+  let value = "";
+  for await (const chunk2 of process.stdin) {
+    value += chunk2.toString();
+    if (value.length > 45)
+      throw new InvitationEmailInputError;
+  }
+  const matched = /^([A-Za-z0-9_-]{43})(?:\r?\n)?$/.exec(value);
+  if (!matched)
+    throw new InvitationEmailInputError;
+  return matched[1];
+}
+function registerInvitationRecoveryCommands(invitations) {
+  for (const action of ["challenge", "accept"]) {
+    const command = invitations.createCommand(`email-${action}`).argument("<invitation-id>").allowExcessArguments(false).enablePositionalOptions().configureOutput({ writeErr: () => {
+      process.stderr.write(`Invitation recovery arguments were refused. Supply proof only through masked input or the documented stdin flags.
+`);
+    } }).description(action === "challenge" ? "Request an eligibility-neutral recovery code; does not confirm delivery" : "Accept with invitation proof; requires ordinary sign-in afterward").requiredOption("--challenge-id <id>", "Your retained challenge UUID; generate it before the request and keep the same exact context").requiredOption("--confirm", "Confirm this exact invitation recovery action").option(action === "challenge" ? "--token-stdin" : "--secrets-stdin", action === "challenge" ? "Read the invitation token from one stdin line" : "Read the recovery code then invitation token from two stdin lines").option("--json", "Output only validated results").action(async (invitationId2, options) => {
+      try {
+        if (options.confirm !== true)
+          throw new InvitationEmailInputError;
+        const ids = invitationEmailIds(invitationId2, options.challengeId), target = prepareInvitationRecoveryTarget();
+        const piped = action === "challenge" ? options.tokenStdin : options.secretsStdin;
+        if (!piped && (options.json || !process.stdin.isTTY || !process.stderr.isTTY))
+          throw new InvitationEmailInputError;
+        let token, code = null;
+        if (piped && action === "accept")
+          ({ token, code } = await readInvitationSecrets());
+        else if (piped)
+          token = await readToken();
+        else {
+          token = await promptInvitationToken();
+          if (token === null)
+            return;
+          if (action === "accept") {
+            code = await promptInvitationRecoveryCode();
+            if (code === null)
+              return;
+          }
+        }
+        target.unchanged();
+        const client = new RemoteSkillsAuthClient(target.origin);
+        const result2 = action === "challenge" ? await client.requestInvitationEmailChallenge({ ...ids, token, confirm: true }) : await client.acceptInvitationEmailChallenge({ ...ids, token, code, confirm: true });
+        console.log(JSON.stringify(result2, null, options.json ? undefined : 2));
+      } catch (error2) {
+        const result2 = invitationEmailCustomerError(error2);
+        if (options.json)
+          console.log(JSON.stringify(result2));
+        else
+          console.error(result2.error);
+        process.exitCode = 1;
+      }
+    });
+    invitations.addCommand(command);
+  }
+}
+var init_invitation_recovery = __esm(() => {
+  init_remote_auth();
+  init_invitation_recovery_target();
+  init_remote_invitation_recovery();
+  init_invitation_verification();
+});
+
+// src/cli/commands/workspace-invitations.ts
+function registerWorkspaceInvitationCommands(workspace) {
+  const invitations = workspace.command("invitations").description("Manage workspace invitations with fresh verification and unchanged saved credentials");
+  registerInvitationRecoveryCommands(invitations);
+  for (const action of ["list", "get", "issue", "resend", "revoke", "accept"]) {
+    const targeted = ["get", "resend", "revoke", "accept"].includes(action), mutation = !["list", "get"].includes(action);
+    const command = invitations.command(action + (targeted ? " <invitation-id>" : "")).allowExcessArguments(false).description(action === "accept" ? "Accept a received invitation; does not switch workspace or create credentials" : `${action} invitations in the exact observed workspace`).requiredOption("--user-id <id>", "Observed account ID from workspace list").requiredOption("--membership-id <id>", "Exact observed current membership; must match any selected profile").requiredOption("--email <email>", "Account email for fresh verification").option("--json", "Output the validated result as JSON");
+    if (mutation)
+      command.requiredOption("--confirm", "Confirm this exact invitation action");
+    if (action === "list")
+      command.option("--after <id>", "Exact nextCursor from the previous page");
+    if (action === "issue")
+      command.requiredOption("--recipient <email>", "Invitation recipient").requiredOption("--role <role>", "owner, admin, member or viewer");
+    if (action === "issue" || action === "resend")
+      command.requiredOption("--idempotency-key <id>", "Your stable request UUID; reuse only with the same original context and parameters");
+    if (action === "resend" || action === "revoke")
+      command.requiredOption("--expected-generation <number>", "Generation you observed before confirming");
+    if (action === "accept")
+      command.option("--secrets-stdin", "Read a fresh six-digit code and invitation token on two separate stdin lines");
+    else
+      command.option("--code-stdin", "Read a previously requested six-digit verification code from stdin");
+    command.action(async (...args2) => {
+      const id = targeted ? String(args2[0]) : undefined, options = args2[targeted ? 1 : 0];
+      try {
+        if (mutation && options.confirm !== true)
+          throw new WorkspaceInvitationInputError;
+        let input = action === "list" ? { ...options.after === undefined ? {} : { after: options.after } } : action === "get" ? { invitationId: id } : action === "issue" ? { email: options.recipient, role: options.role, idempotencyKey: options.idempotencyKey, confirm: true } : action === "resend" ? { invitationId: id, expectedGeneration: Number(options.expectedGeneration), idempotencyKey: options.idempotencyKey, confirm: true } : action === "revoke" ? { invitationId: id, expectedGeneration: Number(options.expectedGeneration), confirm: true } : { invitationId: id, token: "", confirm: true };
+        if (action === "accept")
+          invitationId(id);
+        else
+          input = invitationInput(action, input);
+        const context = invitationProfileContext(options.userId, options.membershipId);
+        if (!options.email.includes("@"))
+          throw new NameInputError("Provide the verified account email.");
+        const stdin = action === "accept" ? options.secretsStdin : options.codeStdin;
+        if (!stdin && (options.json || !process.stdin.isTTY || !process.stderr.isTTY))
+          throw new NameInputError(action === "accept" ? "Use --secrets-stdin with a fresh code and invitation token on two separate lines." : "Use --code-stdin with a fresh verification code.");
+        const target = await prepareProfileWorkspace("Manage invitations").resolve();
+        invitationProfileContext(context.userId, context.membershipId, target.context);
+        const client = new RemoteSkillsAuthClient(target.origin);
+        let code, token = null;
+        if (action === "accept" && stdin)
+          ({ code, token } = await readInvitationSecrets());
+        else {
+          if (action === "accept") {
+            token = await promptInvitationToken();
+            if (token === null)
+              return;
+          }
+          if (stdin)
+            code = await readCode();
+          else {
+            await client.requestCode(options.email);
+            code = await promptCode();
+          }
+        }
+        if (code === null)
+          return;
+        if (action === "accept")
+          input = invitationInput("accept", { invitationId: id, token, confirm: true });
+        target.unchanged();
+        const result2 = await invokeFreshInvitation(client, options.email, code, context, action, input);
+        console.log(JSON.stringify(result2, null, options.json ? undefined : 2));
+      } catch (error2) {
+        const result2 = error2 instanceof NameInputError ? { code: "INVITATION_INPUT_INVALID", error: error2.message } : invitationCustomerError(error2);
+        if (options.json)
+          console.log(JSON.stringify(result2));
+        else
+          console.error(result2.error);
+        process.exitCode = 1;
+      }
+    });
+  }
+}
+var init_workspace_invitations = __esm(() => {
+  init_invitation_recovery();
+  init_workspace_profile();
+  init_remote_auth();
+  init_invitation_customer_action();
+  init_remote_invitations();
+  init_customer_verification();
+  init_invitation_verification();
+});
+
+// src/cli/commands/workspace-leave.ts
+function registerWorkspaceLeaveCommand(workspace) {
+  workspace.command("leave <membership-id>").allowExcessArguments(false).description("Leave exactly this membership after fresh verification; saved profiles stay unchanged").requiredOption("--expected-role <role>", "Observed role: owner, admin, member or viewer").requiredOption("--email <email>", "Account email for fresh verification").requiredOption("--confirm", "Confirm losing access through this membership and signing in again").option("--user-id <id>", "Observed user ID; required without a named workspace profile").option("--code-stdin", "Read a previously requested six-digit verification code from stdin").option("--json", "Output the confirmed result as JSON").action(async (membershipId, options) => {
+    try {
+      if (options.confirm !== true)
+        throw new WorkspaceLeaveInputError;
+      const pending = prepareProfileWorkspace("Leave workspace");
+      const target = await pending.resolve();
+      const captured = workspaceLeaveInput(workspaceLeaveProfileContext(membershipId, options.userId, target.context), { expectedRole: options.expectedRole, confirm: true });
+      if (!options.email.includes("@"))
+        throw new NameInputError("Provide the verified account email.");
+      if (!options.codeStdin && (options.json || !process.stdin.isTTY || !process.stderr.isTTY))
+        throw new NameInputError("Use --code-stdin with a fresh verification code for noninteractive leave actions.");
+      const client = new RemoteSkillsAuthClient(target.origin);
+      let code;
+      if (options.codeStdin)
+        code = await readCode();
+      else {
+        await client.requestCode(options.email);
+        code = await promptCode();
+      }
+      if (code === null)
+        return;
+      target.unchanged();
+      const result2 = await client.leaveWorkspace(options.email, code, captured.context, captured.input);
+      if (options.json)
+        console.log(JSON.stringify(result2));
+      else
+        console.log("Workspace membership left. Sign in again to an available workspace. Saved credentials are unchanged; this membership's credentials no longer grant access.");
+    } catch (error2) {
+      const known = error2 instanceof RemoteWorkspaceLeaveError || error2 instanceof RemoteWorkspaceLeaveUnconfirmedError;
+      const message = known || error2 instanceof WorkspaceLeaveInputError || error2 instanceof NameInputError ? error2.message : "Leaving could not be confirmed. Check the selected profile and exact membership, sign in again and inspect available workspaces before another action. Do not retry automatically; saved credentials are unchanged.";
+      if (options.json)
+        console.log(JSON.stringify({ error: message, ...known ? { code: error2.code } : {} }));
+      else
+        console.error(message);
+      process.exitCode = 1;
+    }
+  });
+}
+var init_workspace_leave = __esm(() => {
+  init_workspace_profile();
+  init_remote_auth();
+  init_remote_workspace_leave();
+  init_customer_verification();
+});
+
 // src/cli/commands/workspace-members.ts
 function registerWorkspaceMembersCommand(workspace) {
   workspace.command("members").allowExcessArguments(false).description("List the current workspace roster with fresh owner/admin verification").requiredOption("--email <email>", "Account email for fresh verification").option("--code-stdin", "Read a previously requested six-digit verification code from stdin").option("--limit <count>", "Page size from 1 to 100 (server default: 50)").option("--cursor <cursor>", "Unchanged nextCursor from the preceding page").option("--json", "Output the complete page as JSON").action(async (options) => {
@@ -78609,6 +79325,8 @@ function registerCustomerProfileCommands(program2) {
   registerWorkspaceListCommand(workspace);
   registerWorkspaceMembersCommand(workspace);
   registerWorkspaceMemberMutationCommands(workspace);
+  registerWorkspaceLeaveCommand(workspace);
+  registerWorkspaceInvitationCommands(workspace);
   const commands = [
     { kind: "account", command: account.command("update") },
     { kind: "workspace", command: workspace.command("update") }
@@ -78651,10 +79369,12 @@ function registerCustomerProfileCommands(program2) {
   }
 }
 var init_customer_profile = __esm(() => {
+  init_workspace_invitations();
   init_workspace_profile();
   init_workspace_selection();
   init_remote_auth();
   init_customer_verification();
+  init_workspace_leave();
   init_workspace_members();
   init_workspace_member_mutations();
 });
@@ -78851,14 +79571,14 @@ function resolveCorpusRootReadOnly(options) {
   }
   return { root: join39(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
 }
-function remoteRowToSkill(record5) {
-  const slug = typeof record5.slug === "string" ? record5.slug : typeof record5.name === "string" ? record5.name : undefined;
+function remoteRowToSkill(record7) {
+  const slug = typeof record7.slug === "string" ? record7.slug : typeof record7.name === "string" ? record7.name : undefined;
   if (!slug)
     return;
   return {
     slug,
-    version: typeof record5.version === "string" ? record5.version : undefined,
-    sha256: typeof record5.bundleSha256 === "string" && record5.bundleSha256 ? record5.bundleSha256 : undefined
+    version: typeof record7.version === "string" ? record7.version : undefined,
+    sha256: typeof record7.bundleSha256 === "string" && record7.bundleSha256 ? record7.bundleSha256 : undefined
   };
 }
 function recheckLocalSide(plannedLocal, localDir, ops = {