@qawolf/cli 1.24.0 → 1.26.0

package/dist/runner-sdk.js

@@ -5494,9 +5494,34 @@ var bigintProcessor = (_schema, ctx, _json, _params) => {
     throw new Error("BigInt cannot be represented in JSON Schema");
   }
 };
+var symbolProcessor = (_schema, ctx, _json, _params) => {
+  if (ctx.unrepresentable === "throw") {
+    throw new Error("Symbols cannot be represented in JSON Schema");
+  }
+};
+var nullProcessor = (_schema, ctx, json, _params) => {
+  if (ctx.target === "openapi-3.0") {
+    json.type = "string";
+    json.nullable = true;
+    json.enum = [null];
+  } else {
+    json.type = "null";
+  }
+};
+var undefinedProcessor = (_schema, ctx, _json, _params) => {
+  if (ctx.unrepresentable === "throw") {
+    throw new Error("Undefined cannot be represented in JSON Schema");
+  }
+};
+var voidProcessor = (_schema, ctx, _json, _params) => {
+  if (ctx.unrepresentable === "throw") {
+    throw new Error("Void cannot be represented in JSON Schema");
+  }
+};
 var neverProcessor = (_schema, _ctx, json, _params) => {
   json.not = {};
 };
+var anyProcessor = (_schema, _ctx, _json, _params) => {};
 var unknownProcessor = (_schema, _ctx, _json, _params) => {};
 var dateProcessor = (_schema, ctx, _json, _params) => {
   if (ctx.unrepresentable === "throw") {
@@ -5550,16 +5575,71 @@ var literalProcessor = (schema, ctx, json, _params) => {
     json.enum = vals;
   }
 };
+var nanProcessor = (_schema, ctx, _json, _params) => {
+  if (ctx.unrepresentable === "throw") {
+    throw new Error("NaN cannot be represented in JSON Schema");
+  }
+};
+var templateLiteralProcessor = (schema, _ctx, json, _params) => {
+  const _json = json;
+  const pattern = schema._zod.pattern;
+  if (!pattern)
+    throw new Error("Pattern not found in template literal");
+  _json.type = "string";
+  _json.pattern = pattern.source;
+};
+var fileProcessor = (schema, _ctx, json, _params) => {
+  const _json = json;
+  const file = {
+    type: "string",
+    format: "binary",
+    contentEncoding: "binary"
+  };
+  const { minimum, maximum, mime } = schema._zod.bag;
+  if (minimum !== undefined)
+    file.minLength = minimum;
+  if (maximum !== undefined)
+    file.maxLength = maximum;
+  if (mime) {
+    if (mime.length === 1) {
+      file.contentMediaType = mime[0];
+      Object.assign(_json, file);
+    } else {
+      Object.assign(_json, file);
+      _json.anyOf = mime.map((m) => ({ contentMediaType: m }));
+    }
+  } else {
+    Object.assign(_json, file);
+  }
+};
+var successProcessor = (_schema, _ctx, json, _params) => {
+  json.type = "boolean";
+};
 var customProcessor = (_schema, ctx, _json, _params) => {
   if (ctx.unrepresentable === "throw") {
     throw new Error("Custom types cannot be represented in JSON Schema");
   }
 };
+var functionProcessor = (_schema, ctx, _json, _params) => {
+  if (ctx.unrepresentable === "throw") {
+    throw new Error("Function types cannot be represented in JSON Schema");
+  }
+};
 var transformProcessor = (_schema, ctx, _json, _params) => {
   if (ctx.unrepresentable === "throw") {
     throw new Error("Transforms cannot be represented in JSON Schema");
   }
 };
+var mapProcessor = (_schema, ctx, _json, _params) => {
+  if (ctx.unrepresentable === "throw") {
+    throw new Error("Map cannot be represented in JSON Schema");
+  }
+};
+var setProcessor = (_schema, ctx, _json, _params) => {
+  if (ctx.unrepresentable === "throw") {
+    throw new Error("Set cannot be represented in JSON Schema");
+  }
+};
 var arrayProcessor = (schema, ctx, _json, params) => {
   const json = _json;
   const def = schema._zod.def;
@@ -5640,6 +5720,48 @@ var intersectionProcessor = (schema, ctx, json, params) => {
   ];
   json.allOf = allOf;
 };
+var tupleProcessor = (schema, ctx, _json, params) => {
+  const json = _json;
+  const def = schema._zod.def;
+  json.type = "array";
+  const prefixPath = ctx.target === "draft-2020-12" ? "prefixItems" : "items";
+  const restPath = ctx.target === "draft-2020-12" ? "items" : ctx.target === "openapi-3.0" ? "items" : "additionalItems";
+  const prefixItems = def.items.map((x, i) => process2(x, ctx, {
+    ...params,
+    path: [...params.path, prefixPath, i]
+  }));
+  const rest = def.rest ? process2(def.rest, ctx, {
+    ...params,
+    path: [...params.path, restPath, ...ctx.target === "openapi-3.0" ? [def.items.length] : []]
+  }) : null;
+  if (ctx.target === "draft-2020-12") {
+    json.prefixItems = prefixItems;
+    if (rest) {
+      json.items = rest;
+    }
+  } else if (ctx.target === "openapi-3.0") {
+    json.items = {
+      anyOf: prefixItems
+    };
+    if (rest) {
+      json.items.anyOf.push(rest);
+    }
+    json.minItems = prefixItems.length;
+    if (!rest) {
+      json.maxItems = prefixItems.length;
+    }
+  } else {
+    json.items = prefixItems;
+    if (rest) {
+      json.additionalItems = rest;
+    }
+  }
+  const { minimum, maximum } = schema._zod.bag;
+  if (typeof minimum === "number")
+    json.minItems = minimum;
+  if (typeof maximum === "number")
+    json.maxItems = maximum;
+};
 var recordProcessor = (schema, ctx, _json, params) => {
   const json = _json;
   const def = schema._zod.def;
@@ -5736,6 +5858,12 @@ var readonlyProcessor = (schema, ctx, json, params) => {
   seen.ref = def.innerType;
   json.readOnly = true;
 };
+var promiseProcessor = (schema, ctx, _json, params) => {
+  const def = schema._zod.def;
+  process2(def.innerType, ctx, params);
+  const seen = ctx.seen.get(schema);
+  seen.ref = def.innerType;
+};
 var optionalProcessor = (schema, ctx, _json, params) => {
   const def = schema._zod.def;
   process2(def.innerType, ctx, params);
@@ -5748,6 +5876,81 @@ var lazyProcessor = (schema, ctx, _json, params) => {
   const seen = ctx.seen.get(schema);
   seen.ref = innerType;
 };
+var allProcessors = {
+  string: stringProcessor,
+  number: numberProcessor,
+  boolean: booleanProcessor,
+  bigint: bigintProcessor,
+  symbol: symbolProcessor,
+  null: nullProcessor,
+  undefined: undefinedProcessor,
+  void: voidProcessor,
+  never: neverProcessor,
+  any: anyProcessor,
+  unknown: unknownProcessor,
+  date: dateProcessor,
+  enum: enumProcessor,
+  literal: literalProcessor,
+  nan: nanProcessor,
+  template_literal: templateLiteralProcessor,
+  file: fileProcessor,
+  success: successProcessor,
+  custom: customProcessor,
+  function: functionProcessor,
+  transform: transformProcessor,
+  map: mapProcessor,
+  set: setProcessor,
+  array: arrayProcessor,
+  object: objectProcessor,
+  union: unionProcessor,
+  intersection: intersectionProcessor,
+  tuple: tupleProcessor,
+  record: recordProcessor,
+  nullable: nullableProcessor,
+  nonoptional: nonoptionalProcessor,
+  default: defaultProcessor,
+  prefault: prefaultProcessor,
+  catch: catchProcessor,
+  pipe: pipeProcessor,
+  readonly: readonlyProcessor,
+  promise: promiseProcessor,
+  optional: optionalProcessor,
+  lazy: lazyProcessor
+};
+function toJSONSchema(input, params) {
+  if ("_idmap" in input) {
+    const registry = input;
+    const ctx = initializeContext({ ...params, processors: allProcessors });
+    const defs = {};
+    for (const entry of registry._idmap.entries()) {
+      const [_, schema] = entry;
+      process2(schema, ctx);
+    }
+    const schemas = {};
+    const external = {
+      registry,
+      uri: params?.uri,
+      defs
+    };
+    ctx.external = external;
+    for (const entry of registry._idmap.entries()) {
+      const [key, schema] = entry;
+      extractDefs(ctx, schema);
+      schemas[key] = finalize(ctx, schema);
+    }
+    if (Object.keys(defs).length > 0) {
+      const defsSegment = ctx.target === "draft-2020-12" ? "$defs" : "definitions";
+      schemas.__shared = {
+        [defsSegment]: defs
+      };
+    }
+    return { schemas };
+  }
+  const ctx = initializeContext({ ...params, processors: allProcessors });
+  process2(input, ctx);
+  extractDefs(ctx, input);
+  return finalize(ctx, input);
+}
 // node_modules/zod/v4/classic/iso.js
 var exports_iso = {};
 __export(exports_iso, {
@@ -6790,6 +6993,10 @@ var makeEmailResourceSchema = () => resource({
   replyTo: array(namedAddressSchema).optional(),
   text: string2().optional().describe("The plain text body.")
 }, { urlFieldDescription: emailUrlFieldDescription });
+var makeEmailAddressResourceSchema = () => resource({
+  address: string2().describe("The inbox address. Mail sent to any plus-suffixed form, such as inbox+abc@example.com, lands in the same inbox."),
+  isDefault: boolean2().describe("Whether this is the workspace's default inbox address.")
+}, { urlFieldDescription: emailUrlFieldDescription });
 
 // node_modules/@qawolf/api-contracts/dist/v1/identity/organization.js
 var identityOrganization = object({
@@ -6833,6 +7040,10 @@ var identityResponse = union([
     user: never().optional()
   }).transform(({ organization }) => ({ organization }))
 ]);
+// node_modules/@qawolf/api-contracts/dist/v1/identity/organizations.js
+var identityOrganizationsResponse = object({
+  organizations: array(identityOrganization)
+});
 // node_modules/@qawolf/api-contracts/dist/v1/ids.js
 var defaultIdSchemas = {
   aiTask: string2().min(1).describe("The id of the AI task."),
@@ -7010,6 +7221,8 @@ var runnerNameSchema = _enum([
   "android",
   "ios"
 ]);
+var runnerWorkspaceRequirement = "Required when the credential is not bound to a single workspace, such as a user API key or an OAuth connection whose organization owns several.";
+var runnerWorkspaceIdDescription = `The workspace the runner belongs to. ${runnerWorkspaceRequirement}`;
 var runnerIdSchema = string2().min(1).max(63).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "A runner id may contain only lowercase letters, digits and dashes, and must start and end with a letter or digit.");
 var makeRunnerSchema = () => object({
   gpuAccelerated: boolean2().describe("Whether the runner was placed on GPU hardware. Chosen by QA Wolf from the team's configuration and what the fleet can provide, not requested."),
@@ -7038,10 +7251,11 @@ var inspectRequestSchema = discriminatedUnion("what", [
     what: literal("variable")
   })
 ]);
-var makeInspectOnRunnerContract = () => {
+var makeInspectOnRunnerContract = (ids) => {
   const input = object({
     id: runnerIdSchema.describe("Id of the runner to inspect."),
-    request: inspectRequestSchema
+    request: inspectRequestSchema,
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     object({
@@ -7189,10 +7403,11 @@ var inspectMobileAnswerSchema = discriminatedUnion("what", [
     what: literal("elements")
   })
 ]);
-var makeInspectMobileOnRunnerContract = () => {
+var makeInspectMobileOnRunnerContract = (ids) => {
   const input = object({
     id: runnerIdSchema.describe("Id of the runner to inspect."),
-    request: inspectMobileRequestSchema
+    request: inspectMobileRequestSchema,
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     inspectMobileAnswerSchema,
@@ -7278,20 +7493,26 @@ var screenFailureReasons = [
 var screenNotReadyDescription = "`screen-not-ready` if the runner has a screen that cannot serve this instant. Retry in a second or two: the desktop restarts when a run changes the display size, and it serves one see-or-act request at a time, so a screenshot or action already in flight is the usual reason. Do not submit a run to clear this — a run may restart the display and discard what is on it.";
 var screenNeedsARunDescription = "`screen-needs-a-run` if the runner's virtual desktop has never started. Waiting will not change this and retrying is pointless — call `runner.runFlow` with a flow that opens a browser, then ask for the screen again. On a runner image with a browser that has never run anything, any `runner.performAction` also starts the browser itself. Evaluating a snippet does not start the desktop.";
 var runnerHasNoScreenDescription = "`runner-has-no-screen` if this runner is not one that runs a browser on a virtual desktop. Nothing about it can be seen or driven, and retrying will never help — launch a `playwright` runner instead.";
+var screenshotImageSchema = string2().min(1).describe("The screenshot, as a base64-encoded JPEG. Decode it and write the bytes to a `.jpg` file — writing this string to the file leaves you with base64 text rather than an image.");
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/performAction.js
 var unreachableDescription = "`runner-unreachable` if the runner could not be reached: it may still be starting, it may have terminated after inactivity, or it may have stopped answering mid-action. This does not mean the action was not performed — take a screenshot before repeating it.";
 var notSupportedOnMobileDescription = "`action-not-supported-on-mobile` if the runner is a mobile device and this action has no touchscreen equivalent: `double_click`, `scroll`, `move`, `keypress` and `navigate`, and a `click` whose `button` is not `left`, are all pointer-device concepts a touchscreen has nothing to offer for. `click` taps, `drag` swipes between its path's first and last point, and `type` types into whatever the last tap focused.";
+var withScreenshotDescription = "With `withScreenshot: true`, the answer also carries `imageJpegBase64`: a screenshot taken after the action, once the screen has changed from just before it or half a second has passed, whichever comes first. One call instead of `runner.performAction` followed by `runner.takeScreenshot`, with no fixed wait in between. Anything animating on the page counts as a change. The action itself is performed exactly as without the option; if the screen could serve no frame after it — a display restart, or a `navigate` on a desktop that is still starting — the action's result comes back without `imageJpegBase64`, so take a screenshot separately rather than repeating the action. On a mobile runner the screenshot is the device's own, taken right after a performed action.";
 var maxActionErrorMessageLength = 1000;
-var makePerformActionOnRunnerContract = () => {
+var makePerformActionOnRunnerContract = (ids) => {
   const input = object({
     action: browserActionSchema.describe("The action to perform. Coordinates are pixels on the screenshot's own coordinate space."),
-    id: runnerIdSchema.describe("Id of the runner to act on.")
+    id: runnerIdSchema.describe("Id of the runner to act on."),
+    withScreenshot: boolean2().optional().describe("Also answer with a screenshot taken after the action, once the screen has changed or half a second has passed. Saves the separate `runner.takeScreenshot` call and its fixed wait."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
+  const screenshotAfterAction = screenshotImageSchema.optional();
   const failure = discriminatedUnion("failureReason", [
     object({
       errorMessage: string2().max(maxActionErrorMessageLength).describe("What stopped the action from taking effect."),
       failureReason: literal("action-failed"),
+      imageJpegBase64: screenshotAfterAction,
       outcome: literal("failure")
     }),
     makeRunnerFailureSchema([
@@ -7301,11 +7522,14 @@ var makePerformActionOnRunnerContract = () => {
     ])
   ]);
   const output = discriminatedUnion("outcome", [
-    object({ outcome: literal("success") }),
+    object({
+      imageJpegBase64: screenshotAfterAction,
+      outcome: literal("success")
+    }),
     failure
   ]);
   return {
-    description: `Perform one raw browser action on an interactive runner: click, double_click, move, drag, scroll, keypress, type, or navigate. Coordinates are whole pixels on the runner's virtual desktop, in the same space as \`runner.takeScreenshot\`. One action per request, and the runner serves one at a time. The action shapes follow the computer-use vocabulary, minus \`screenshot\` (use \`runner.takeScreenshot\`) and \`wait\` (delay on the caller's side). A success means the action took effect. \`action-failed\`, with a reason, if it reached the runner and did not take effect. On a runner image with a browser, the first action on a runner that has never run anything starts its browser and waits for it, so it can take up to a minute to answer — no \`runner.runFlow\` is needed before acting; if the browser is still starting when the wait runs out, the answer is \`screen-not-ready\` and retrying converges. On a mobile runner, the same \`screen-needs-a-run\` and \`screen-not-ready\` outcomes mean no Appium session has started yet, or it did not answer this instant; \`runner.runFlow\` is what starts one, same as a browser. \`screen-needs-a-run\` if the browser could not be started that way — usually a runner whose runs all finished without starting its desktop; call \`runner.runFlow\` with a flow that opens a browser. ${screenNotReadyDescription} A \`navigate\` does not go through the screen, so a screen that is not ready does not stop it. ${runnerHasNoScreenDescription} ${notSupportedOnMobileDescription} ${unreachableDescription}`,
+    description: `Perform one raw browser action on an interactive runner: click, double_click, move, drag, scroll, keypress, type, or navigate. Coordinates are whole pixels on the runner's virtual desktop, in the same space as \`runner.takeScreenshot\`. One action per request, and the runner serves one at a time. The action shapes follow the computer-use vocabulary, minus \`screenshot\` (use \`runner.takeScreenshot\`) and \`wait\` (delay on the caller's side). A success means the action took effect. \`action-failed\`, with a reason, if it reached the runner and did not take effect. On a runner image with a browser, the first action on a runner that has never run anything starts its browser and waits for it, so it can take up to a minute to answer — no \`runner.runFlow\` is needed before acting; if the browser is still starting when the wait runs out, the answer is \`screen-not-ready\` and retrying converges. On a mobile runner, the same \`screen-needs-a-run\` and \`screen-not-ready\` outcomes mean no Appium session has started yet, or it did not answer this instant; \`runner.runFlow\` is what starts one, same as a browser. \`screen-needs-a-run\` if the browser could not be started that way — usually a runner whose runs all finished without starting its desktop; call \`runner.runFlow\` with a flow that opens a browser. ${screenNotReadyDescription} A \`navigate\` does not go through the screen, so a screen that is not ready does not stop it. ${runnerHasNoScreenDescription} ${notSupportedOnMobileDescription} ${withScreenshotDescription} ${unreachableDescription}`,
     input,
     kind: "write",
     name: "runner.performAction",
@@ -7331,9 +7555,11 @@ var makeAgentGetContract = (ids) => {
     replies: array(agentReplySchema).describe("Everything the AI has said so far, oldest first. A reply carrying choices is a question the work is blocked on."),
     sessionId: ids.chatSession,
     status: agentSessionStatusSchema
-  }, { urlFieldDescription: "Absolute URL of the session in the QA Wolf app." });
+  }, {
+    urlFieldDescription: "Absolute URL of the live session in the QA Wolf app."
+  });
   return {
-    description: 'Read what the QA Wolf AI has said and whether it is still working. Poll this after agent.send until the status settles. A status of "waiting-for-you" means the last reply is a question the work is blocked on, and answering it with agent.send is what unblocks it. Replies accumulate, so a caller that polls repeatedly sees the earlier ones again.',
+    description: 'Monitor a QA Wolf AI session by reading its status and replies. After agent.send, share the returned session URL before monitoring. Wait 30 to 60 seconds between checks; do not call this in a tight loop. Replies accumulate, so compare them with what you have already seen. Continue monitoring silently when the status and replies are unchanged; do not narrate waiting, announce the next check, or ask whether to keep monitoring. Report only substantive new progress, questions, blockers, or the final outcome. A status of "waiting-for-you" means the last reply is a question the work is blocked on, and answering it with agent.send is what unblocks it. Surface an explicit request for user input even if the status still says "working". Include the session URL when reporting a blocker or final outcome. On "completed", stop status checks and verify the requested result before claiming success. For new flows, validation, publication in the target environment, and readiness are separate checks; a Git push or final reply does not prove the flow is active. If every requested result is verified but status remains "working", report the mismatch and stop monitoring. Stop on "failed" or "cancelled" and report any confirmed partial result.',
     input,
     kind: "read",
     name: "agent.get",
@@ -7352,9 +7578,11 @@ var makeAgentSendContract = (ids) => {
   const output = resource({
     sessionId: ids.chatSession.describe("Follow the work by passing this to agent.get."),
     status: agentSessionStatusSchema
-  }, { urlFieldDescription: "Absolute URL of the session in the QA Wolf app." });
+  }, {
+    urlFieldDescription: "Absolute URL of the live session in the QA Wolf app."
+  });
   return {
-    description: "Ask the QA Wolf AI to do a piece of work in plain language, such as covering a user journey, investigating a failing run, or fixing a broken flow. This is the one verb that starts work from nothing: every other write acts on a flow, run or issue that already exists. Answers as soon as the request is accepted, with the id to follow it by, because the work runs for minutes to tens of minutes. Poll agent.get for progress, and send here again to answer a question or add context to work already running.",
+    description: "Start or continue work with the QA Wolf AI and return a live session URL to share with the user. Use it to cover a user journey, investigate a failing run, or fix a broken flow. This is the one verb that starts work from nothing: every other write acts on a flow, run or issue that already exists. Returns sessionId, status, and url as soon as the request is accepted; work can take minutes to tens of minutes. After each send, make the next action a normal user-visible assistant message containing the exact returned url, before any tool call or wait. Tool output and internal reasoning do not count as sharing the link. Do not run a timer or monitoring call alongside this send. Acceptance does not mean the work is complete. Then monitor the session with agent.get, reporting new progress, blockers, and the final outcome rather than unchanged status. Send here again to answer a question or add context to the same session.",
     input,
     kind: "write",
     name: "agent.send",
@@ -7457,10 +7685,7 @@ var makeListEmailAddressesContract = (ids) => {
     ...makePaginationInputFields({ defaultLimit: 20, maxLimit: 50 })
   });
   const output = object({
-    addresses: array(resource({
-      address: string2().describe("The inbox address. Mail sent to any plus-suffixed form, such as inbox+abc@example.com, lands in the same inbox."),
-      isDefault: boolean2().describe("Whether this is the workspace's default inbox address.")
-    }, { urlFieldDescription: emailUrlFieldDescription })).describe("The workspace's permanent inbox addresses, alphabetical."),
+    addresses: array(makeEmailAddressResourceSchema()).describe("The workspace's permanent inbox addresses, alphabetical."),
     nextCursor: nextCursorSchema
   });
   return {
@@ -7472,6 +7697,28 @@ var makeListEmailAddressesContract = (ids) => {
   };
 };
 
+// node_modules/@qawolf/api-contracts/dist/v1/email/registerAddress.js
+var hasNoPlusSuffix = (address) => {
+  const [localPart] = address.split("@");
+  return localPart !== undefined && !localPart.includes("+");
+};
+var makeRegisterEmailAddressContract = (ids) => {
+  const input = object({
+    address: email2().refine(hasNoPlusSuffix, {
+      message: "Register the base address. Mail to a plus-suffixed form lands in the base inbox."
+    }).describe("The inbox address to register. Its domain must be one QA Wolf serves for the workspace."),
+    workspaceId: ids.workspace.optional().describe("The workspace to register the address in. Required when authenticating with an organization or user API key.")
+  });
+  const output = makeEmailAddressResourceSchema();
+  return {
+    description: "Register an inbox address for the workspace. Registering an address the workspace already has changes nothing. A refusal names the domains the workspace can use.",
+    input,
+    kind: "write",
+    name: "email.registerAddress",
+    output
+  };
+};
+
 // node_modules/@qawolf/api-contracts/dist/v1/email/send.js
 var recipientsSchema = array(email2()).max(50);
 var maxAttachments = 10;
@@ -8112,14 +8359,31 @@ var makeReattemptRunContract = (ids) => {
   };
 };
 
+// node_modules/@qawolf/api-contracts/dist/v1/run/stop.js
+var makeStopRunContract = (ids) => {
+  const input = object({ runId: ids.run });
+  const output = resource({
+    runId: ids.run,
+    status: _enum(["accepted", "already-finished", "execution-not-found"]).describe('"accepted" means stopping was requested; poll run.get for the final result. "already-finished" means the run has already finished and its result is unchanged. "execution-not-found" means the run exists but no execution was found to stop; it may still be starting or may no longer be available. No stop request was accepted in that case.')
+  }, { urlFieldDescription: "Absolute URL of the run page." });
+  return {
+    description: "Stop a run, including its queued flows and automatic retries. Stopping is asynchronous. Repeated requests are safe, and finished runs keep their results. A run that is still being created returns not found; retry once run.get returns the run. If run.get returns a different runId, use that ID. Poll run.get for results.",
+    input,
+    kind: "write",
+    name: "run.stop",
+    output
+  };
+};
+
 // node_modules/@qawolf/api-contracts/dist/v1/runner/evaluateSnippet.js
 var maxSnippetCodeLength = 64 * 1024;
-var makeEvaluateSnippetOnRunnerContract = () => {
+var makeEvaluateSnippetOnRunnerContract = (ids) => {
   const input = object({
     code: string2().min(1).max(maxSnippetCodeLength).describe("The code to evaluate against the runner's live page, in the scope of `filePath` when one is given."),
     filePath: runFilePathSchema.optional().describe("Path of the file the snippet is evaluated in the scope of. Omit to evaluate a snippet that imports nothing of yours."),
     files: runFilesSchema.optional().describe("The file named by `filePath` and everything it imports. A runner holds no copy of your project, so a snippet's scope has to travel with it."),
-    id: runnerIdSchema.describe("Id of the runner to evaluate the snippet on.")
+    id: runnerIdSchema.describe("Id of the runner to evaluate the snippet on."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   }).refine((request) => request.filePath === undefined || Object.hasOwn(request.files ?? {}, request.filePath), {
     error: "A snippet naming a file must carry that file in files.",
     path: ["files"]
@@ -8145,9 +8409,10 @@ var makeEvaluateSnippetOnRunnerContract = () => {
 };
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/get.js
-var makeGetRunnerContract = () => {
+var makeGetRunnerContract = (ids) => {
   const input = object({
-    id: runnerIdSchema.describe("Id of the runner to look up.")
+    id: runnerIdSchema.describe("Id of the runner to look up."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = object({
     id: runnerIdSchema.describe("Id of the runner the call addressed."),
@@ -8165,10 +8430,11 @@ var makeGetRunnerContract = () => {
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/highlightSelector.js
 var maxHighlightSelectorLength = 2000;
-var makeHighlightSelectorOnRunnerContract = () => {
+var makeHighlightSelectorOnRunnerContract = (ids) => {
   const input = object({
     id: runnerIdSchema.describe("Id of the runner to highlight on."),
-    selector: string2().max(maxHighlightSelectorLength).describe("The selector to highlight. An empty string clears whatever is highlighted.")
+    selector: string2().max(maxHighlightSelectorLength).describe("The selector to highlight. An empty string clears whatever is highlighted."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     object({
@@ -8203,12 +8469,13 @@ var makeHighlightSelectorOnRunnerContract = () => {
 // node_modules/@qawolf/api-contracts/dist/v1/runner/importPackage.js
 var maxPackageNameLength = 214;
 var maxPackageVersionLength = 256;
-var makeImportPackageOnRunnerContract = () => {
+var makeImportPackageOnRunnerContract = (ids) => {
   const input = object({
     id: runnerIdSchema.describe("Id of the runner to install into."),
     npmDependencies: record(string2(), string2()).describe("The run's current npm dependencies, so the install resolves against them."),
     packageName: string2().min(1).max(maxPackageNameLength),
-    packageVersion: string2().min(1).max(maxPackageVersionLength)
+    packageVersion: string2().min(1).max(maxPackageVersionLength),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     object({ outcome: literal("success") }),
@@ -8228,10 +8495,11 @@ var makeImportPackageOnRunnerContract = () => {
 };
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/index.js
-var makeLaunchRunnerContract = () => {
+var makeLaunchRunnerContract = (ids) => {
   const input = object({
     id: runnerIdSchema.describe("Id to launch the runner under, chosen by the caller. Launching the same id again returns the runner already running under it."),
-    runnerName: runnerNameSchema.optional().describe("The runner family to launch. Defaults to the standard web family, playwright.")
+    runnerName: runnerNameSchema.optional().describe("The runner family to launch. Defaults to the standard web family, playwright."),
+    workspaceId: ids.workspace.optional().describe(`The workspace to launch the runner in. ${runnerWorkspaceRequirement}`)
   });
   const output = makeRunnerSchema().extend({
     alreadyRunning: boolean2().describe("True when a runner was already running under this id and was returned unchanged, so no second runner was started and nothing new is billed. Not an error either way."),
@@ -8245,9 +8513,10 @@ var makeLaunchRunnerContract = () => {
     output
   };
 };
-var makeTerminateRunnerContract = () => {
+var makeTerminateRunnerContract = (ids) => {
   const input = object({
-    id: runnerIdSchema.describe("Id of the runner to terminate.")
+    id: runnerIdSchema.describe("Id of the runner to terminate."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = object({
     id: runnerIdSchema.describe("Id of the runner the call addressed."),
@@ -8264,14 +8533,16 @@ var makeTerminateRunnerContract = () => {
 };
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/list.js
-var makeListRunnersContract = () => {
-  const input = object({});
+var makeListRunnersContract = (ids) => {
+  const input = object({
+    workspaceId: ids.workspace.optional().describe(`The workspace whose runners to list. ${runnerWorkspaceRequirement}`)
+  });
   const output = object({
     outcome: literal("success"),
     runners: array(makeRunnerSchema()).describe("The runners running right now, in no particular order. Each entry carries the same fields a launch reports, so any of them can be addressed like a runner you launched yourself.")
   });
   return {
-    description: "List the runners running on the caller's team right now. Takes no arguments: the API key already names the team. A runner that was terminated, or that terminated on its own after inactivity, is not listed, because the run system keeps no record of a runner once it is gone. This is a lookup: it never starts a runner, and it does not reset a runner's inactivity clock the way reading its journal does. It is how to find a runner launched from another machine or in an earlier session, when the id it was launched under is no longer at hand.",
+    description: "List the runners running on the caller's team right now. A team API key already names the team and sends nothing; a credential bound to no single workspace names one in `workspaceId`. A runner that was terminated, or that terminated on its own after inactivity, is not listed, because the run system keeps no record of a runner once it is gone. This is a lookup: it never starts a runner, and it does not reset a runner's inactivity clock the way reading its journal does. It is how to find a runner launched from another machine or in an earlier session, when the id it was launched under is no longer at hand.",
     input,
     kind: "read",
     name: "runner.list",
@@ -8281,11 +8552,12 @@ var makeListRunnersContract = () => {
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/promoteSnapshot.js
 var maxSnapshotPathLength = 1024;
-var makePromoteSnapshotOnRunnerContract = () => {
+var makePromoteSnapshotOnRunnerContract = (ids) => {
   const input = object({
     baselinePath: string2().min(1).max(maxSnapshotPathLength).describe("The baseline to replace, as named in the image diff."),
     id: runnerIdSchema.describe("Id of the runner holding the screenshot."),
-    screenshotPath: string2().min(1).max(maxSnapshotPathLength).describe("The screenshot to promote, as named in the image diff.")
+    screenshotPath: string2().min(1).max(maxSnapshotPathLength).describe("The screenshot to promote, as named in the image diff."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     object({ outcome: literal("success") }),
@@ -8308,10 +8580,11 @@ var makePromoteSnapshotOnRunnerContract = () => {
 };
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/readJournal.js
-var makeReadRunnerJournalContract = () => {
+var makeReadRunnerJournalContract = (ids) => {
   const input = readJournalRequestSchema.extend({
     id: runnerIdSchema.describe("Id of the runner to read the journal of."),
-    stream: journalStreamSchema.describe(`The stream to read. QA Wolf writes ${knownJournalStreams.join(", ")}; an unwritten stream reads as empty rather than as an error.`)
+    stream: journalStreamSchema.describe(`The stream to read. QA Wolf writes ${knownJournalStreams.join(", ")}; an unwritten stream reads as empty rather than as an error.`),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     readJournalResponseSchema.extend({ outcome: literal("success") }),
@@ -8346,7 +8619,8 @@ var makeRunFlowOnRunnerContract = (ids) => {
     files: runFilesSchema.describe("Every file the run needs keyed by its path — the flow file, everything it imports, package.json and tsconfig.json. A runner holds no copy of your project, so what runs is exactly what is sent here."),
     id: runnerIdSchema.describe("Id of the runner to run the flow on."),
     selection: runSelectionSchema.optional().describe("Run only these lines, inside the page the runner is already on, instead of running the whole flow from a fresh browser. Omit to run the whole entry point."),
-    unchangedFiles: unchangedFilesSchema.optional().describe("Files this runner already holds from an earlier run, keyed by path with a hex SHA-256 of the content it should hold. Send this to make `files` only what changed. The runner refuses with `needs-full-sync` if it holds none of a referenced path, so it never runs something other than what was asked for. Omit it to send every file.")
+    unchangedFiles: unchangedFilesSchema.optional().describe("Files this runner already holds from an earlier run, keyed by path with a hex SHA-256 of the content it should hold. Send this to make `files` only what changed. The runner refuses with `needs-full-sync` if it holds none of a referenced path, so it never runs something other than what was asked for. Omit it to send every file."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   }).refine((request) => request.env === undefined || request.environmentId === undefined, {
     error: "Send env or environmentId, not both. An environment's variables are taken as they are stored, so there is no order in which the two would combine.",
     path: ["environmentId"]
@@ -8398,9 +8672,10 @@ var makeRunFlowOnRunnerContract = (ids) => {
 };
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/stopRun.js
-var makeStopRunOnRunnerContract = () => {
+var makeStopRunOnRunnerContract = (ids) => {
   const input = object({
-    id: runnerIdSchema.describe("Id of the runner to stop the run on.")
+    id: runnerIdSchema.describe("Id of the runner to stop the run on."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     object({
@@ -8419,13 +8694,14 @@ var makeStopRunOnRunnerContract = () => {
 };
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/takeScreenshot.js
-var makeTakeScreenshotOnRunnerContract = () => {
+var makeTakeScreenshotOnRunnerContract = (ids) => {
   const input = object({
-    id: runnerIdSchema.describe("Id of the runner to take a screenshot of.")
+    id: runnerIdSchema.describe("Id of the runner to take a screenshot of."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     object({
-      imageJpegBase64: string2().min(1).describe("The screenshot, as a base64-encoded JPEG. Decode it and write the bytes to a `.jpg` file — writing this string to the file leaves you with base64 text rather than an image."),
+      imageJpegBase64: screenshotImageSchema,
       outcome: literal("success")
     }),
     makeRunnerFailureSchema([
@@ -8479,6 +8755,7 @@ var makeContractsV1 = (ids) => {
       get: makeGetEmailContract(resolvedIds),
       getAttachment: makeGetEmailAttachmentContract(resolvedIds),
       listAddresses: makeListEmailAddressesContract(resolvedIds),
+      registerAddress: makeRegisterEmailAddressContract(resolvedIds),
       send: makeSendEmailContract(resolvedIds)
     },
     environment: {
@@ -8510,24 +8787,25 @@ var makeContractsV1 = (ids) => {
       diagnose: makeDiagnoseRunContract(resolvedIds),
       find: makeFindRunsContract(resolvedIds),
       get: makeGetRunContract(resolvedIds),
-      reattempt: makeReattemptRunContract(resolvedIds)
+      reattempt: makeReattemptRunContract(resolvedIds),
+      stop: makeStopRunContract(resolvedIds)
     },
     runner: {
-      evaluateSnippet: makeEvaluateSnippetOnRunnerContract(),
-      get: makeGetRunnerContract(),
-      highlightSelector: makeHighlightSelectorOnRunnerContract(),
-      importPackage: makeImportPackageOnRunnerContract(),
-      inspect: makeInspectOnRunnerContract(),
-      inspectMobile: makeInspectMobileOnRunnerContract(),
-      launch: makeLaunchRunnerContract(),
-      list: makeListRunnersContract(),
-      performAction: makePerformActionOnRunnerContract(),
-      promoteSnapshot: makePromoteSnapshotOnRunnerContract(),
-      readJournal: makeReadRunnerJournalContract(),
+      evaluateSnippet: makeEvaluateSnippetOnRunnerContract(resolvedIds),
+      get: makeGetRunnerContract(resolvedIds),
+      highlightSelector: makeHighlightSelectorOnRunnerContract(resolvedIds),
+      importPackage: makeImportPackageOnRunnerContract(resolvedIds),
+      inspect: makeInspectOnRunnerContract(resolvedIds),
+      inspectMobile: makeInspectMobileOnRunnerContract(resolvedIds),
+      launch: makeLaunchRunnerContract(resolvedIds),
+      list: makeListRunnersContract(resolvedIds),
+      performAction: makePerformActionOnRunnerContract(resolvedIds),
+      promoteSnapshot: makePromoteSnapshotOnRunnerContract(resolvedIds),
+      readJournal: makeReadRunnerJournalContract(resolvedIds),
       runFlow: makeRunFlowOnRunnerContract(resolvedIds),
-      stopRun: makeStopRunOnRunnerContract(),
-      takeScreenshot: makeTakeScreenshotOnRunnerContract(),
-      terminate: makeTerminateRunnerContract()
+      stopRun: makeStopRunOnRunnerContract(resolvedIds),
+      takeScreenshot: makeTakeScreenshotOnRunnerContract(resolvedIds),
+      terminate: makeTerminateRunnerContract(resolvedIds)
     },
     tag: {
       create: makeCreateTagContract(resolvedIds),
@@ -8537,11 +8815,82 @@ var makeContractsV1 = (ids) => {
 };
 var publicContractsV1 = makeContractsV1(defaultIdSchemas);
 
+// src/core/pluralize.ts
+function pluralize(count, singular, plural = `${singular}s`) {
+  return `${String(count)} ${count === 1 ? singular : plural}`;
+}
+
 // src/core/formatSeconds.ts
 function formatSeconds(ms) {
   return `${Math.round(ms / 1000)}s`;
 }
 
+// src/core/messages/authErrors.ts
+var authErrorMessages = {
+  identity: {
+    invalidOrUnauthorized: "API key is invalid or unauthorized",
+    unexpectedFormat: "Could not verify API key: unexpected response format",
+    couldNotVerify: (detail, status) => `Could not verify API key: ${detail || `HTTP ${status}`}`,
+    couldNotVerifyNetwork: (cause) => `Could not verify API key: ${cause}`,
+    timedOut: (timeoutMs) => `Could not verify API key: the QA Wolf API did not answer within ${formatSeconds(timeoutMs)}.`
+  },
+  request: {
+    rejected401: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 401). Check your API key.`,
+    rejected402: (noun) => `QA Wolf API refused the${noun ? ` ${noun}` : ""} request (HTTP 402): billing prevented it.`,
+    rejected403: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 403). Check that your API key has access to this environment.`,
+    notFound404: (noun) => `QA Wolf API could not find ${noun ? `${noun} for that environment` : "that environment"} (HTTP 404). Check the --env value.`,
+    failedWithStatus: (status, noun) => `QA Wolf API${noun ? ` ${noun}` : ""} request failed (HTTP ${status}).`,
+    networkUnreachable: (baseUrl, noun) => `Could not reach the QA Wolf API at ${baseUrl}${noun ? ` to fetch ${noun}` : ""}. Check your network connection and QAWOLF_HOST_URL.`,
+    timedOut: (timeoutMs, noun) => `The QA Wolf API${noun ? ` ${noun}` : ""} request timed out after ${formatSeconds(timeoutMs)}. The work may still be finishing on the platform.`,
+    unexpectedResponse: (noun) => `Unexpected${noun ? ` ${noun}` : ""} response from the QA Wolf API.`
+  },
+  workos: {
+    unexpectedResponse: "WorkOS returned an unexpected response",
+    unexpectedResponseWithStatus: (status) => `WorkOS returned an unexpected response (HTTP ${status})`,
+    unreachable: (detail) => `Could not reach WorkOS: ${detail}`,
+    redirected: "WorkOS answered with a redirect, which the CLI does not follow for a sign-in request",
+    noClientForSession: "This session names no WorkOS client"
+  },
+  bundle: {
+    linkExpired: "The flow bundle download link has expired. Please run `qawolf flows pull` again to refresh.",
+    failedWithStatus: (status) => `Could not download the flow bundle (HTTP ${status}).`,
+    networkUnreachable: "Could not reach the flow bundle storage. Check your network connection and try again.",
+    timedOut: (timeoutMs) => `Downloading the flow bundle stalled — no data arrived for ${formatSeconds(timeoutMs)}. Please try again.`,
+    malformed: "The flow bundle download was malformed. Please run `qawolf flows pull` again."
+  }
+};
+
+// src/core/messages/whoami.ts
+var whoamiMessages = {
+  source: (source) => `Source: ${source}`,
+  authFailed: (source, error) => `Authentication failed (source: ${source}): ${error}`,
+  authenticatedAs: (teamName, source) => `Authenticated as ${teamName} (source: ${source})`,
+  teamNote: (input) => [
+    `Workspace: ${input.team.name}`,
+    `ID:        ${input.team.id}`,
+    input.team.slug ? `Slug:      ${input.team.slug}` : undefined,
+    input.teamUrl ? `URL:       ${input.teamUrl}` : undefined,
+    `Source:    ${input.source}`
+  ].filter((line) => Boolean(line)).join(`
+`),
+  organizationNote: (input) => [
+    `Organization: ${input.organization.name}`,
+    `ID:           ${input.organization.id}`,
+    `Source:       ${input.source}`
+  ].join(`
+`),
+  activeWorkspace: (workspaceId, found) => found ? `${found.workspace} (${found.organization})` : `${workspaceId} — no longer in reach; run 'qawolf auth switch'`,
+  userNote: (input) => [
+    `User:         ${input.user.email}`,
+    `ID:           ${input.user.id}`,
+    `Organization: ${input.organization.name}`,
+    input.activeWorkspace ? `Workspace:    ${input.activeWorkspace}` : undefined,
+    input.organizations.length > 0 ? `Workspaces:   ${input.organizations.map((o) => `${o.name}: ${o.workspaces.map((w) => w.name).join(", ")}`).join(" | ")}` : undefined,
+    `Source:       ${input.source}`
+  ].filter((line) => Boolean(line)).join(`
+`)
+};
+
 // src/core/messages/auth.ts
 var authMessages = {
   title: "QA Wolf Authentication",
@@ -8559,7 +8908,47 @@ var authMessages = {
   whoamiFailed: "Not authenticated",
   login: {
     nonInteractive: "auth login requires an interactive terminal. Set the QAWOLF_API_KEY environment variable for CI authentication.",
-    reAuthPrompt: "You are already authenticated. Re-authenticate?"
+    reAuthPrompt: "You are already authenticated. Re-authenticate?",
+    chooseMethod: "How do you want to sign in?",
+    methodBrowser: "Browser",
+    methodBrowserHint: "Sign in with your QA Wolf account",
+    methodApiKey: "API key",
+    methodApiKeyHint: "Paste a team key — needed for flows pull and flows run",
+    apiKeyPrecedence: {
+      env: "QAWOLF_API_KEY is set, and an API key takes precedence over a browser session. Commands continue to use that key until you unset the variable.",
+      stored: "A stored API key takes precedence over a browser session. Commands continue to use that key until you run 'qawolf auth logout' and sign in again."
+    }
+  },
+  device: {
+    unavailable: "This QA Wolf deployment does not offer browser sign-in. Run 'qawolf auth login' again and choose 'API key'.",
+    configUnreachable: "Could not ask this QA Wolf deployment whether it offers browser sign-in. Check your connection, then try again.",
+    confirmCode: (userCode) => `Your code is ${userCode}`,
+    visitUrl: (url) => `Confirm it at ${url}`,
+    visitUrlPlain: (url) => `Or go to ${url} and enter the code`,
+    openFailed: (url) => `Could not open a browser automatically. Open ${url} yourself to continue.`,
+    waiting: "Waiting for you to finish in the browser",
+    signedIn: (email) => `Signed in as ${email}.`,
+    failed: {
+      "access-denied": "The sign-in request was rejected.",
+      expired: "The sign-in request expired. Run 'qawolf auth login' to retry.",
+      timeout: "The sign-in request timed out. Run 'qawolf auth login' to retry.",
+      network: "Could not reach WorkOS to complete sign-in.",
+      unavailable: "Could not start browser sign-in.",
+      cancelled: "Sign-in cancelled."
+    }
+  },
+  workspace: {
+    chooseOrganization: "Which organization do you want to work in?",
+    choose: "Which workspace do you want to use?",
+    workspaceCount: (count) => pluralize(count, "workspace"),
+    working: (organization, workspace) => `Working in ${workspace} (${organization}).`,
+    none: "This account reaches no organizations yet.",
+    cancelled: "Workspace not changed.",
+    notSignedIn: "Workspace switching needs a browser sign-in. Run 'qawolf auth login' and choose Browser.",
+    sessionExpired: "Your session could not be renewed. Run 'qawolf auth login' to sign in again.",
+    nonInteractive: "auth switch needs an interactive terminal, or set QAWOLF_WORKSPACE to name a workspace.",
+    sessionChanged: "The stored sign-in changed while you made your choice. Run the command again.",
+    saveFailed: (detail) => `Could not save the workspace choice: ${detail}`
   },
   logout: {
     title: "Log Out",
@@ -8571,58 +8960,8 @@ var authMessages = {
     success: "Logged out successfully.",
     cancelled: "Logout cancelled."
   },
-  errors: {
-    identity: {
-      invalidOrUnauthorized: "API key is invalid or unauthorized",
-      unexpectedFormat: "Could not verify API key: unexpected response format",
-      couldNotVerify: (detail, status) => `Could not verify API key: ${detail || `HTTP ${status}`}`,
-      couldNotVerifyNetwork: (cause) => `Could not verify API key: ${cause}`,
-      timedOut: (timeoutMs) => `Could not verify API key: the QA Wolf API did not answer within ${formatSeconds(timeoutMs)}.`
-    },
-    request: {
-      rejected401: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 401). Check your API key.`,
-      rejected402: (noun) => `QA Wolf API refused the${noun ? ` ${noun}` : ""} request (HTTP 402): billing prevented it.`,
-      rejected403: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 403). Check that your API key has access to this environment.`,
-      notFound404: (noun) => `QA Wolf API could not find ${noun ? `${noun} for that environment` : "that environment"} (HTTP 404). Check the --env value.`,
-      failedWithStatus: (status, noun) => `QA Wolf API${noun ? ` ${noun}` : ""} request failed (HTTP ${status}).`,
-      networkUnreachable: (baseUrl, noun) => `Could not reach the QA Wolf API at ${baseUrl}${noun ? ` to fetch ${noun}` : ""}. Check your network connection and QAWOLF_HOST_URL.`,
-      timedOut: (timeoutMs, noun) => `The QA Wolf API${noun ? ` ${noun}` : ""} request timed out after ${formatSeconds(timeoutMs)}. The work may still be finishing on the platform.`,
-      unexpectedResponse: (noun) => `Unexpected${noun ? ` ${noun}` : ""} response from the QA Wolf API.`
-    },
-    bundle: {
-      linkExpired: "The flow bundle download link has expired. Please run `qawolf flows pull` again to refresh.",
-      failedWithStatus: (status) => `Could not download the flow bundle (HTTP ${status}).`,
-      networkUnreachable: "Could not reach the flow bundle storage. Check your network connection and try again.",
-      timedOut: (timeoutMs) => `Downloading the flow bundle stalled — no data arrived for ${formatSeconds(timeoutMs)}. Please try again.`,
-      malformed: "The flow bundle download was malformed. Please run `qawolf flows pull` again."
-    }
-  },
-  whoami: {
-    source: (source) => `Source: ${source}`,
-    authFailed: (source, error) => `Authentication failed (source: ${source}): ${error}`,
-    authenticatedAs: (teamName, source) => `Authenticated as ${teamName} (source: ${source})`,
-    teamNote: (input) => [
-      `Team:   ${input.team.name}`,
-      `ID:     ${input.team.id}`,
-      input.team.slug ? `Slug:   ${input.team.slug}` : undefined,
-      input.teamUrl ? `URL:    ${input.teamUrl}` : undefined,
-      `Source: ${input.source}`
-    ].filter((line) => Boolean(line)).join(`
-`),
-    organizationNote: (input) => [
-      `Organization: ${input.organization.name}`,
-      `ID:           ${input.organization.id}`,
-      `Source:       ${input.source}`
-    ].join(`
-`),
-    userNote: (input) => [
-      `User:         ${input.user.email}`,
-      `ID:           ${input.user.id}`,
-      `Organization: ${input.organization.name}`,
-      `Source:       ${input.source}`
-    ].join(`
-`)
-  }
+  errors: authErrorMessages,
+  whoami: whoamiMessages
 };
 // src/core/messages/toolNotFound.ts
 var installRemedy = "Run `qawolf install` to install the runtime dependencies.";
@@ -8638,11 +8977,6 @@ ${installRemedy}`;
 function packageLoadFailed(pkg, envDir, detail) {
   return toolNotRunnable(`Could not load ${pkg} from ${envDir}`, detail);
 }
-// src/core/pluralize.ts
-function pluralize(count, singular, plural = `${singular}s`) {
-  return `${String(count)} ${count === 1 ? singular : plural}`;
-}
-
 // src/core/messages/flows.ts
 var flowsMessages = {
   title: "Flows",
@@ -10365,6 +10699,176 @@ function makeDefaultFs() {
   };
 }
 
+// src/core/publicApi/flagKind.ts
+function flagKind(schema) {
+  if (schema.type === "string")
+    return { ok: true, kind: "string" };
+  if (schema.type === "number" || schema.type === "integer") {
+    return { ok: true, kind: "number" };
+  }
+  if (schema.type === "boolean")
+    return { ok: true, kind: "boolean" };
+  if (schema.type === "array") {
+    if (schema.items?.type !== "string") {
+      return {
+        ok: false,
+        reason: "only string arrays can be expressed as flags"
+      };
+    }
+    return { ok: true, kind: "string-array" };
+  }
+  if (schema.type === "object") {
+    if (schema.properties) {
+      return {
+        ok: false,
+        reason: "nested objects cannot be expressed as flags"
+      };
+    }
+    if (typeof schema.additionalProperties === "object" && schema.additionalProperties.type === "string") {
+      return { ok: true, kind: "key-value-record" };
+    }
+    return { ok: false, reason: "nested objects cannot be expressed as flags" };
+  }
+  return {
+    ok: false,
+    reason: `type ${schema.type ?? "unknown"} cannot be expressed as a flag`
+  };
+}
+
+// src/core/publicApi/objectShape.ts
+var asObjectShape = (schema) => schema.type === "object" && schema.properties ? { properties: schema.properties, required: new Set(schema.required) } : undefined;
+function mergeIntersection(members) {
+  const shape = { properties: {}, required: new Set };
+  for (const member of members) {
+    const memberShape = asObjectShape(member);
+    if (!memberShape) {
+      return {
+        ok: false,
+        field: "",
+        reason: "intersection members must be object schemas"
+      };
+    }
+    for (const [field, fieldSchema] of Object.entries(memberShape.properties)) {
+      if (field in shape.properties) {
+        return {
+          ok: false,
+          field,
+          reason: "field appears in multiple intersection members"
+        };
+      }
+      shape.properties[field] = fieldSchema;
+      if (memberShape.required.has(field))
+        shape.required.add(field);
+    }
+  }
+  return { ok: true, shape };
+}
+function mergeUnion(branches) {
+  const shapes = [];
+  for (const branch of branches) {
+    const branchShape = asObjectShape(branch);
+    if (!branchShape) {
+      return {
+        ok: false,
+        field: "",
+        reason: "union branches must be object schemas"
+      };
+    }
+    shapes.push(branchShape);
+  }
+  const shape = { properties: {}, required: new Set };
+  for (const branchShape of shapes) {
+    for (const [field, fieldSchema] of Object.entries(branchShape.properties)) {
+      const existing = shape.properties[field];
+      if (!existing) {
+        shape.properties[field] = { ...fieldSchema };
+        continue;
+      }
+      const kinds = [flagKind(existing), flagKind(fieldSchema)];
+      if (kinds[0]?.ok && kinds[1]?.ok) {
+        if (kinds[0].kind !== kinds[1].kind) {
+          return {
+            ok: false,
+            field,
+            reason: "field has conflicting types across union branches"
+          };
+        }
+      } else if (JSON.stringify({ ...existing, description: undefined }) !== JSON.stringify({ ...fieldSchema, description: undefined })) {
+        return {
+          ok: false,
+          field,
+          reason: "field has conflicting object schemas across union branches"
+        };
+      }
+      if (!existing.description && fieldSchema.description) {
+        existing.description = fieldSchema.description;
+      }
+    }
+  }
+  const discriminator = Object.keys(shape.properties).find((field) => {
+    const values = shapes.map((branch) => branch.properties[field]?.const);
+    return values.every((value) => typeof value === "string") && new Set(values).size === shapes.length && shapes.every((branch) => branch.required.has(field));
+  });
+  for (const [field, fieldSchema] of Object.entries(shape.properties)) {
+    const occurrences = shapes.filter((branch) => (field in branch.properties));
+    if (occurrences.length === shapes.length && occurrences.every((branch) => branch.required.has(field))) {
+      shape.required.add(field);
+    }
+    if (field === discriminator) {
+      const values = shapes.map((branch) => branch.properties[field]?.const);
+      fieldSchema.description = `One of: ${values.join(", ")}`;
+    }
+  }
+  return { ok: true, shape };
+}
+function toObjectShape(schema) {
+  if (schema.allOf)
+    return mergeIntersection(schema.allOf);
+  const branches = schema.oneOf ?? schema.anyOf;
+  if (branches)
+    return mergeUnion(branches);
+  const shape = asObjectShape(schema);
+  if (shape)
+    return { ok: true, shape };
+  return {
+    ok: false,
+    field: "",
+    reason: "contract input must be an object schema"
+  };
+}
+
+// src/shell/platform/applyWorkspaceId.ts
+var acceptsWorkspace = new WeakMap;
+function takesWorkspaceId(inputSchema) {
+  const cached = acceptsWorkspace.get(inputSchema);
+  if (cached !== undefined)
+    return cached;
+  let accepted = false;
+  try {
+    const jsonSchema = toJSONSchema(inputSchema, {
+      io: "input"
+    });
+    const shape = toObjectShape(jsonSchema);
+    accepted = shape.ok && "workspaceId" in shape.shape.properties;
+  } catch {
+    accepted = false;
+  }
+  acceptsWorkspace.set(inputSchema, accepted);
+  return accepted;
+}
+function applyWorkspaceId(inputSchema, input, workspaceId) {
+  if (!workspaceId)
+    return input;
+  if (typeof input !== "object" || input === null)
+    return input;
+  const existing = input.workspaceId;
+  if (existing !== undefined)
+    return input;
+  if (!takesWorkspaceId(inputSchema))
+    return input;
+  return { ...input, workspaceId };
+}
+
 // src/shell/platform/parseErrorBody.ts
 var defaultMaxLength = 1024;
 function asRecord(value) {
@@ -10497,7 +11001,7 @@ function callPublicApi(trpc, contract, input, options) {
 }
 function makeCallPublicApiMethod(trpc, deps, readBackoffMs) {
   return async (contract, input, options) => requestWithRetry({
-    call: () => callPublicApi(trpc, contract, input, options),
+    call: () => callPublicApi(trpc, contract, applyWorkspaceId(contract.input, input, deps.workspaceId), options),
     backoffMs: contract.kind === "read" ? readBackoffMs : [],
     describe: (err) => describeRequestError(err, deps.baseUrl, contract.name),
     sleep: deps.sleep
@@ -11497,10 +12001,16 @@ async function downloadBundle(signedUrl, deps) {
   return { ok: true, value: { tmpArchive } };
 }
 
-// src/shell/platform/getIdentity.ts
+// src/shell/platform/organizations.ts
+function parseOrganizationsResponse(json) {
+  const parsed = identityOrganizationsResponse.safeParse(json);
+  return parsed.success ? parsed.data.organizations : undefined;
+}
+
+// src/shell/platform/getAccessibleOrganizations.ts
 var timeoutMs = 1e4;
-async function getIdentity(apiKey, deps) {
-  const url = `${deps.baseUrl}/api/v0/identity`;
+async function getAccessibleOrganizations(apiKey, deps) {
+  const url = `${deps.baseUrl}/api/v0/identity/organizations`;
   let response;
   try {
     response = await deps.fetch(url, {
@@ -11511,6 +12021,51 @@ async function getIdentity(apiKey, deps) {
     if (isTimeoutError(error)) {
       return { ok: false, error: { kind: "timeout", timeoutMs } };
     }
+    return { ok: false, error: { kind: "network", cause: toError(error) } };
+  }
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    return {
+      ok: false,
+      error: { kind: "http", status: response.status, body }
+    };
+  }
+  let json;
+  try {
+    json = await response.json();
+  } catch (error) {
+    if (isTimeoutError(error)) {
+      return { ok: false, error: { kind: "timeout", timeoutMs } };
+    }
+    json = undefined;
+  }
+  const organizations = parseOrganizationsResponse(json);
+  if (!organizations) {
+    return {
+      ok: false,
+      error: {
+        kind: "parse",
+        cause: Error("organizations response did not match the contract")
+      }
+    };
+  }
+  return { ok: true, data: organizations };
+}
+
+// src/shell/platform/getIdentity.ts
+var timeoutMs2 = 1e4;
+async function getIdentity(apiKey, deps) {
+  const url = `${deps.baseUrl}/api/v0/identity`;
+  let response;
+  try {
+    response = await deps.fetch(url, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(timeoutMs2)
+    });
+  } catch (error) {
+    if (isTimeoutError(error)) {
+      return { ok: false, error: { kind: "timeout", timeoutMs: timeoutMs2 } };
+    }
     return {
       ok: false,
       error: { kind: "network", cause: toError(error) }
@@ -11528,7 +12083,7 @@ async function getIdentity(apiKey, deps) {
     json = await response.json();
   } catch (error) {
     if (isTimeoutError(error)) {
-      return { ok: false, error: { kind: "timeout", timeoutMs } };
+      return { ok: false, error: { kind: "timeout", timeoutMs: timeoutMs2 } };
     }
     json = undefined;
   }
@@ -11539,6 +12094,24 @@ async function getIdentity(apiKey, deps) {
   return { ok: true, data: parsed.data };
 }
 
+// src/shell/platform/identityMethods.ts
+function createIdentityMethods(apiKey, deps, backoffMs) {
+  return {
+    getIdentity: () => requestWithRetry({
+      call: () => getIdentity(apiKey, deps),
+      backoffMs,
+      describe: describeIdentityError,
+      sleep: deps.sleep
+    }),
+    getAccessibleOrganizations: () => requestWithRetry({
+      call: () => getAccessibleOrganizations(apiKey, deps),
+      backoffMs,
+      describe: describeIdentityError,
+      sleep: deps.sleep
+    })
+  };
+}
+
 // src/shell/platform/types.ts
 var environmentListItemSchema = object({
   envId: string2(),
@@ -11821,6 +12394,34 @@ async function writeTeamStorageAssets(args, deps) {
   }
 }
 
+// src/shell/platform/teamStorageMethods.ts
+function createTeamStorageMethods(trpc, deps, fs, getIdentity) {
+  async function list() {
+    if (deps.workspaceId !== undefined) {
+      return listTeamStorageFiles(trpc, { teamId: deps.workspaceId }, deps);
+    }
+    const identity = await getIdentity();
+    if (!identity.ok)
+      return identity;
+    if (!("team" in identity.value)) {
+      return {
+        ok: false,
+        error: flowsMessages.pull.teamStorageRequiresTeamKey
+      };
+    }
+    return listTeamStorageFiles(trpc, { teamId: identity.value.team.id }, deps);
+  }
+  return {
+    listTeamStorageFiles: list,
+    async syncTeamStorageAssets(assetsAbs, opts) {
+      const files = await list();
+      if (!files.ok)
+        return files;
+      return downloadTeamStorageAssets({ assetsAbs, files: files.value }, { fetch: deps.fetch, fs, onProgress: opts?.onProgress });
+    }
+  };
+}
+
 // src/shell/platform/createPlatformClient.ts
 var requestBackoffMs2 = [500, 1500];
 function createPlatformClient(apiKey, deps) {
@@ -11837,15 +12438,10 @@ function createPlatformClient(apiKey, deps) {
       return result;
     return { ok: true, value: { signedUrl: result.value.url } };
   }
+  const identityMethods = createIdentityMethods(apiKey, deps, requestBackoffMs2);
   return {
-    async getIdentity() {
-      return requestWithRetry({
-        call: () => getIdentity(apiKey, deps),
-        backoffMs: requestBackoffMs2,
-        describe: describeIdentityError,
-        sleep: deps.sleep
-      });
-    },
+    ...identityMethods,
+    ...createTeamStorageMethods(trpc, deps, fs, identityMethods.getIdentity),
     getFlowsBundleUrl: getFlowsBundleUrlImpl,
     callPublicApi: makeCallPublicApiMethod(trpc, deps, requestBackoffMs2),
     async getEnvVars(envId) {
@@ -11859,24 +12455,6 @@ function createPlatformClient(apiKey, deps) {
         return result;
       return { ok: true, value: result.value.environmentVariables };
     },
-    async listTeamStorageFiles() {
-      const identity = await this.getIdentity();
-      if (!identity.ok)
-        return identity;
-      if (!("team" in identity.value)) {
-        return {
-          ok: false,
-          error: flowsMessages.pull.teamStorageRequiresTeamKey
-        };
-      }
-      return listTeamStorageFiles(trpc, { teamId: identity.value.team.id }, deps);
-    },
-    async syncTeamStorageAssets(assetsAbs, opts) {
-      const files = await this.listTeamStorageFiles();
-      if (!files.ok)
-        return files;
-      return downloadTeamStorageAssets({ assetsAbs, files: files.value }, { fetch: deps.fetch, fs, onProgress: opts?.onProgress });
-    },
     async downloadBundle(envId) {
       const urlResult = await getFlowsBundleUrlImpl(envId);
       if (!urlResult.ok)
@@ -12599,4 +13177,4 @@ export {
   createRunnerSdk
 };
 
-//# debugId=231C026DA9D7E0DD64756E2164756E21
+//# debugId=1D5281D81CC3C81164756E2164756E21