skillvault-publisher 0.11.2 → 0.12.0

package/dist/index.js

@@ -237,10 +237,10 @@ var require_utils = __commonJS({
         sum += a.length;
       }
       const res = new Uint8Array(sum);
-      for (let i = 0, pad3 = 0; i < arrays.length; i++) {
+      for (let i = 0, pad4 = 0; i < arrays.length; i++) {
         const a = arrays[i];
-        res.set(a, pad3);
-        pad3 += a.length;
+        res.set(a, pad4);
+        pad4 += a.length;
       }
       return res;
     }
@@ -1769,10 +1769,10 @@ var require_utils2 = __commonJS({
         sum += a.length;
       }
       const res = new Uint8Array(sum);
-      for (let i = 0, pad3 = 0; i < arrays.length; i++) {
+      for (let i = 0, pad4 = 0; i < arrays.length; i++) {
         const a = arrays[i];
-        res.set(a, pad3);
-        pad3 += a.length;
+        res.set(a, pad4);
+        pad4 += a.length;
       }
       return res;
     }
@@ -3891,11 +3891,11 @@ function __metadata(metadataKey, metadataValue) {
 }
 function __awaiter(thisArg, _arguments, P, generator) {
   function adopt(value) {
-    return value instanceof P ? value : new P(function(resolve10) {
-      resolve10(value);
+    return value instanceof P ? value : new P(function(resolve11) {
+      resolve11(value);
     });
   }
-  return new (P || (P = Promise))(function(resolve10, reject) {
+  return new (P || (P = Promise))(function(resolve11, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -3911,7 +3911,7 @@ function __awaiter(thisArg, _arguments, P, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve10(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve11(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -4102,14 +4102,14 @@ function __asyncValues(o) {
   }, i);
   function verb(n) {
     i[n] = o[n] && function(v) {
-      return new Promise(function(resolve10, reject) {
-        v = o[n](v), settle(resolve10, reject, v.done, v.value);
+      return new Promise(function(resolve11, reject) {
+        v = o[n](v), settle(resolve11, reject, v.done, v.value);
       });
     };
   }
-  function settle(resolve10, reject, d, v) {
+  function settle(resolve11, reject, d, v) {
     Promise.resolve(v).then(function(v2) {
-      resolve10({ value: v2, done: d });
+      resolve11({ value: v2, done: d });
     }, reject);
   }
 }
@@ -5054,9 +5054,9 @@ var require_clone = __commonJS({
           } else if (_instanceof(parent2, nativeSet)) {
             child = new nativeSet();
           } else if (_instanceof(parent2, nativePromise)) {
-            child = new nativePromise(function(resolve10, reject) {
+            child = new nativePromise(function(resolve11, reject) {
               parent2.then(function(value) {
-                resolve10(_clone(value, depth2 - 1));
+                resolve11(_clone(value, depth2 - 1));
               }, function(err) {
                 reject(_clone(err, depth2 - 1));
               });
@@ -145431,7 +145431,7 @@ var require_pdfkit = __commonJS({
         return `${this.ref.id} 0 R`;
       }
     };
-    var pad3 = (str, length) => (Array(length + 1).join("0") + str).slice(-length);
+    var pad4 = (str, length) => (Array(length + 1).join("0") + str).slice(-length);
     var escapableRe = /[\n\r\t\b\f()\\]/g;
     var escapable = {
       "\n": "\\n",
@@ -145487,7 +145487,7 @@ var require_pdfkit = __commonJS({
         } else if (object instanceof PDFAbstractReference || object instanceof PDFTree || object instanceof SpotColor) {
           return object.toString();
         } else if (object instanceof Date) {
-          let string = `D:${pad3(object.getUTCFullYear(), 4)}` + pad3(object.getUTCMonth() + 1, 2) + pad3(object.getUTCDate(), 2) + pad3(object.getUTCHours(), 2) + pad3(object.getUTCMinutes(), 2) + pad3(object.getUTCSeconds(), 2) + "Z";
+          let string = `D:${pad4(object.getUTCFullYear(), 4)}` + pad4(object.getUTCMonth() + 1, 2) + pad4(object.getUTCDate(), 2) + pad4(object.getUTCHours(), 2) + pad4(object.getUTCMinutes(), 2) + pad4(object.getUTCSeconds(), 2) + "Z";
           if (encryptFn) {
             string = encryptFn(Buffer.from(string, "ascii")).toString("binary");
             string = string.replace(escapableRe, (c) => escapable[c]);
@@ -151595,7 +151595,7 @@ function confColor(c) {
   return SV.sirenRed500;
 }
 async function generatePdfReport(data, outputPath) {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     const doc = new import_pdfkit.default({
       size: "A4",
       margins: { top: 72, bottom: 0, left: 56, right: 56 },
@@ -151742,7 +151742,7 @@ async function generatePdfReport(data, outputPath) {
     yPos += 72;
     drawPageFooter(doc, leftMargin, contentWidth, pageWidth, pageNum);
     doc.end();
-    stream.on("finish", resolve10);
+    stream.on("finish", resolve11);
     stream.on("error", reject);
   });
 }
@@ -151804,7 +151804,7 @@ var init_pdf_report = __esm({
 });
 
 // dist/index.js
-import { Command as Command35 } from "commander";
+import { Command as Command36 } from "commander";
 import { readFileSync as readFileSync18 } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname as dirname5, join as join17 } from "node:path";
@@ -151813,6 +151813,7 @@ import { dirname as dirname5, join as join17 } from "node:path";
 import { Command } from "commander";
 import chalk from "chalk";
 import { randomBytes } from "node:crypto";
+import { createInterface } from "node:readline/promises";
 
 // dist/credentials.js
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, rmSync, existsSync as existsSync2, openSync as openSync2, closeSync as closeSync2, unlinkSync as unlinkSync2 } from "node:fs";
@@ -151861,7 +151862,43 @@ function removeKeypair() {
 }
 
 // dist/commands/login.js
-var loginCommand = new Command("login").description("Authenticate with the Skill Vault server").option("--email <email>", "Your publisher account email").option("--token <token>", "Authenticate with a publisher session JWT (Bearer token from dashboard)").option("--license-key <key>", "Authenticate with a license key (customer)").option("--code <code>", "Redeem an invite code after login").option("--server <url>", "Server URL", "https://api.getskillvault.com").action(async (options) => {
+async function chooseFromMultiple(available, publisherFlag) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    if (publisherFlag) {
+      const match = available.find((p) => p.publisher_id === publisherFlag);
+      if (match)
+        return match;
+      console.error(chalk.red(`Publisher ${publisherFlag} not in your accessible list.`));
+    }
+    console.error(chalk.red("Multiple publishers available for this email. Pass --publisher <id> to choose:"));
+    for (const p of available) {
+      console.error(chalk.dim(`  --publisher ${p.publisher_id}  (${p.publisher_name || "unnamed"}, role: ${p.role})`));
+    }
+    process.exit(1);
+  }
+  console.log();
+  console.log(chalk.bold("  This email has access to multiple publishers:"));
+  console.log();
+  available.forEach((p, idx) => {
+    const roleColor = p.role === "owner" ? chalk.green : p.role === "admin" ? chalk.cyan : chalk.dim;
+    console.log(`  ${chalk.bold(`[${idx + 1}]`)} ${p.publisher_name || p.publisher_id}  ${chalk.dim(`(${p.publisher_id})`)}  ${roleColor(p.role)}`);
+  });
+  console.log();
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    while (true) {
+      const answer = (await rl.question(`  Pick a publisher [1-${available.length}]: `)).trim();
+      const idx = parseInt(answer, 10);
+      if (Number.isInteger(idx) && idx >= 1 && idx <= available.length) {
+        return available[idx - 1];
+      }
+      console.log(chalk.red(`  Invalid choice \u2014 enter a number between 1 and ${available.length}`));
+    }
+  } finally {
+    rl.close();
+  }
+}
+var loginCommand = new Command("login").description("Authenticate with the Skill Vault server").option("--email <email>", "Your publisher account email").option("--token <token>", "Authenticate with a publisher session JWT (Bearer token from dashboard)").option("--license-key <key>", "Authenticate with a license key (customer)").option("--code <code>", "Redeem an invite code after login").option("--publisher <id>", "Disambiguate when your email has access to multiple publisher accounts").option("--server <url>", "Server URL", "https://api.getskillvault.com").action(async (options) => {
   try {
     const serverUrl = options.server;
     const publisherToken = options.token || process.env.SKILLVAULT_TOKEN || null;
@@ -151881,22 +151918,52 @@ var loginCommand = new Command("login").description("Authenticate with the Skill
       publisherIdentity = { publisher_id: me.publisher_id, email: me.email, name: me.name };
     } else if (options.email) {
       console.log(chalk.dim(`Authenticating as ${options.email}...`));
+      const body2 = { email: options.email };
+      if (options.publisher)
+        body2.publisher_id = options.publisher;
       const loginRes = await fetch(`${serverUrl}/auth/login`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ email: options.email })
+        body: JSON.stringify(body2)
       });
       if (!loginRes.ok) {
-        const err = await loginRes.json().catch(() => ({ message: loginRes.statusText }));
-        console.error(chalk.red(`Login failed: ${err.message}`));
+        const err = await loginRes.json().catch(() => null);
+        const reason = err?.message || err?.error || loginRes.statusText || `HTTP ${loginRes.status}`;
+        console.error(chalk.red(`Login failed: ${reason}`));
         if (loginRes.status === 404) {
           console.error(chalk.dim("No account found. Create one at https://app.getskillvault.com/login"));
+          console.error(chalk.dim("Or ask a team owner to add your email via `skillvault-publisher team add`."));
         }
         process.exit(1);
       }
       const loginData = await loginRes.json();
-      sessionToken = loginData.session_token;
-      publisherIdentity = { publisher_id: loginData.publisher_id, email: loginData.email, name: loginData.name };
+      if ("multiple_choice" in loginData && loginData.multiple_choice) {
+        const chosen = await chooseFromMultiple(loginData.available_publishers, options.publisher);
+        const retryRes = await fetch(`${serverUrl}/auth/login`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ email: options.email, publisher_id: chosen.publisher_id })
+        });
+        if (!retryRes.ok) {
+          const err = await retryRes.json().catch(() => null);
+          const reason = err?.message || err?.error || retryRes.statusText;
+          console.error(chalk.red(`Login retry failed: ${reason}`));
+          process.exit(1);
+        }
+        const retryData = await retryRes.json();
+        sessionToken = retryData.session_token;
+        publisherIdentity = { publisher_id: retryData.publisher_id, email: retryData.email, name: retryData.name };
+        if (retryData.role && retryData.role !== "owner") {
+          console.log(chalk.dim(`  Logged in as ${chalk.bold(retryData.role)} of ${chosen.publisher_name || retryData.publisher_id}`));
+        }
+      } else {
+        const single = loginData;
+        sessionToken = single.session_token;
+        publisherIdentity = { publisher_id: single.publisher_id, email: single.email, name: single.name };
+        if (single.role && single.role !== "owner") {
+          console.log(chalk.dim(`  Logged in as ${chalk.bold(single.role)} of ${single.publisher_id}`));
+        }
+      }
     } else if (!options.licenseKey) {
       console.error(chalk.red("Publisher identity required."));
       console.error("");
@@ -152003,7 +152070,7 @@ var registerCommand = new Command2("register").description("Create a new publish
     let verified = false;
     const maxAttempts = 120;
     for (let i = 0; i < maxAttempts; i++) {
-      await new Promise((resolve10) => setTimeout(resolve10, 3e3));
+      await new Promise((resolve11) => setTimeout(resolve11, 3e3));
       try {
         const statusRes = await fetch(`${serverUrl}/publishers/${publisher_id}/verification-status`);
         if (statusRes.ok) {
@@ -152094,7 +152161,7 @@ var logoutCommand = new Command3("logout").description("Remove stored credential
 import { Command as Command4 } from "commander";
 import chalk5 from "chalk";
 import { readFileSync as readFileSync6, existsSync as existsSync6, statSync as statSync3 } from "node:fs";
-import { resolve as resolve4, join as join6 } from "node:path";
+import { resolve as resolve5, join as join6 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 
 // ../shared/dist/crypto.js
@@ -152212,7 +152279,7 @@ function readVaultMetadata(data) {
 // ../shared/dist/packer.js
 import { readFileSync as readFileSync3, readdirSync, existsSync as existsSync3 } from "node:fs";
 import { writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "node:fs";
-import { join as join3, relative } from "node:path";
+import { join as join3, relative, resolve as resolve2, isAbsolute, sep } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 var DEFAULT_IGNORE = /* @__PURE__ */ new Set([
   "node_modules",
@@ -152245,10 +152312,12 @@ function collectFiles(dir, base, ignoreSet) {
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
     if (ignoreSet.has(entry.name))
       continue;
+    if (entry.isSymbolicLink())
+      continue;
     const fullPath = join3(dir, entry.name);
     if (entry.isDirectory()) {
       entries.push(...collectFiles(fullPath, base, ignoreSet));
-    } else {
+    } else if (entry.isFile()) {
       entries.push({
         path: relative(base, fullPath),
         content: readFileSync3(fullPath)
@@ -152529,17 +152598,57 @@ function extractPotentialHeartbeats(content) {
   return values;
 }
 
+// ../shared/dist/skill-name.js
+var MAX_SKILL_NAME_LENGTH = 64;
+var ALLOWED_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/;
+var InvalidSkillNameError = class extends Error {
+  reason;
+  name;
+  constructor(reason, name) {
+    super(`invalid skill name: ${reason}`);
+    this.reason = reason;
+    this.name = name;
+    this.name = "InvalidSkillNameError";
+  }
+};
+function validateSkillName(name) {
+  if (typeof name !== "string") {
+    throw new InvalidSkillNameError("must be a string", String(name));
+  }
+  if (name.length === 0) {
+    throw new InvalidSkillNameError("must not be empty", name);
+  }
+  if (name.length > MAX_SKILL_NAME_LENGTH) {
+    throw new InvalidSkillNameError(`exceeds ${MAX_SKILL_NAME_LENGTH} characters`, name);
+  }
+  for (let i = 0; i < name.length; i++) {
+    const code = name.charCodeAt(i);
+    if (code < 32 || code === 127) {
+      throw new InvalidSkillNameError(`contains control character (0x${code.toString(16).padStart(2, "0")})`, name);
+    }
+  }
+  if (name.includes("..")) {
+    throw new InvalidSkillNameError('contains parent-directory segment "..", which is not allowed in path components', name);
+  }
+  if (name.includes("/") || name.includes("\\")) {
+    throw new InvalidSkillNameError("contains a path separator, which is not allowed in skill names", name);
+  }
+  if (!ALLOWED_PATTERN.test(name)) {
+    throw new InvalidSkillNameError(`must match ${ALLOWED_PATTERN.source} (ASCII letters, digits, dashes, underscores; must start with a letter or digit)`, name);
+  }
+}
+
 // dist/session.js
 import chalk4 from "chalk";
 
 // dist/publisher-workspace.js
 import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, existsSync as existsSync4 } from "node:fs";
-import { join as join4, dirname as dirname3, resolve as resolve2 } from "node:path";
+import { join as join4, dirname as dirname3, resolve as resolve3 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 var MANIFEST_DIRNAME = ".skillvault-publisher";
 var MANIFEST_FILENAME = "workspace.json";
 function workspaceRootsFor(dir) {
-  const abs = resolve2(dir);
+  const abs = resolve3(dir);
   const manifestPath = join4(abs, MANIFEST_DIRNAME, MANIFEST_FILENAME);
   return {
     dir: abs,
@@ -152586,7 +152695,7 @@ function saveWorkspace(dir, manifest) {
   writeFileSync4(manifestPath, JSON.stringify(manifest, null, 2), { mode: 420 });
 }
 function findWorkspace(cwd) {
-  const start = resolve2(cwd ?? process.cwd());
+  const start = resolve3(cwd ?? process.cwd());
   const home = homedir3();
   let dir = start;
   while (true) {
@@ -152658,8 +152767,9 @@ async function sessionFetch(ctx, path, options) {
     process.exit(1);
   }
   if (!res.ok) {
-    const err = await res.json().catch(() => ({ message: res.statusText }));
-    process.stderr.write(chalk4.red(`Error: ${err.message}
+    const err = await res.json().catch(() => null);
+    const reason = err?.message || err?.error || res.statusText || `HTTP ${res.status}`;
+    process.stderr.write(chalk4.red(`Error: ${reason}
 `));
     process.exit(1);
   }
@@ -152696,7 +152806,7 @@ function requireCommandContext(opts = {}) {
 
 // dist/publisher-workspaces-registry.js
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync5, statSync as statSync2 } from "node:fs";
-import { dirname as dirname4, join as join5, resolve as resolve3 } from "node:path";
+import { dirname as dirname4, join as join5, resolve as resolve4 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 var REGISTRY_VERSION = 1;
 var MANIFEST_DIRNAME2 = ".skillvault-publisher";
@@ -152730,7 +152840,7 @@ function listWorkspaces() {
   const live = [];
   let pruned = false;
   for (const entry of reg.workspaces) {
-    const path = resolve3(entry.path);
+    const path = resolve4(entry.path);
     let stillThere = false;
     try {
       const st = statSync2(path);
@@ -152755,8 +152865,8 @@ function listWorkspaces() {
 }
 function registerWorkspace(entry) {
   const reg = readRegistry();
-  const normalized = { ...entry, path: resolve3(entry.path) };
-  const idx = reg.workspaces.findIndex((w) => resolve3(w.path) === normalized.path);
+  const normalized = { ...entry, path: resolve4(entry.path) };
+  const idx = reg.workspaces.findIndex((w) => resolve4(w.path) === normalized.path);
   if (idx >= 0) {
     reg.workspaces[idx] = normalized;
   } else {
@@ -152766,9 +152876,9 @@ function registerWorkspace(entry) {
 }
 function unregisterWorkspace(path) {
   const reg = readRegistry();
-  const target = resolve3(path);
+  const target = resolve4(path);
   const before = reg.workspaces.length;
-  reg.workspaces = reg.workspaces.filter((w) => resolve3(w.path) !== target);
+  reg.workspaces = reg.workspaces.filter((w) => resolve4(w.path) !== target);
   if (reg.workspaces.length !== before)
     writeRegistry(reg);
 }
@@ -152798,9 +152908,9 @@ var publishCommand = new Command4("publish").description("Encrypt and publish a
     const config = ctx.config;
     const workspaceCtx = resolveWorkspaceContext({
       workspaceFlag: options.workspace,
-      cwd: directory ? resolve4(directory) : process.cwd()
+      cwd: directory ? resolve5(directory) : process.cwd()
     });
-    const dirPath = options.workspace ? resolve4(options.workspace) : directory ? resolve4(directory) : workspaceCtx?.dir ?? process.cwd();
+    const dirPath = options.workspace ? resolve5(options.workspace) : directory ? resolve5(directory) : workspaceCtx?.dir ?? process.cwd();
     if (!existsSync6(dirPath) || !statSync3(dirPath).isDirectory()) {
       process.stderr.write(chalk5.red(`Error: "${dirPath}" is not a valid directory
 `));
@@ -152821,6 +152931,17 @@ var publishCommand = new Command4("publish").description("Encrypt and publish a
       process.stderr.write(chalk5.red("Error: Skill name required \u2014 set in SKILL.md frontmatter or use --name\n"));
       process.exit(1);
     }
+    try {
+      validateSkillName(skillName);
+    } catch (err) {
+      if (err instanceof InvalidSkillNameError) {
+        process.stderr.write(chalk5.red(`Error: ${err.message}
+`));
+        process.stderr.write(chalk5.dim("Skill names must be ASCII letters, digits, dashes, or underscores (1-64 chars).\n"));
+        process.exit(1);
+      }
+      throw err;
+    }
     if (!description) {
       process.stderr.write(chalk5.red("Error: Description required \u2014 set in SKILL.md frontmatter or use --description\n"));
       process.exit(1);
@@ -153092,7 +153213,7 @@ import chalk6 from "chalk";
 var searchCommand = new Command5("search").description("Search for skills in the registry").argument("<query>", "Search query").option("--type <type>", "Filter by capability type").option("--publisher <publisher>", "Filter by publisher name or ID").option("--mine", "Show only your own published skills").option("--json", "Output results as JSON").action(async (query, options) => {
   try {
     const config = getConfig();
-    const serverUrl = config?.server_url ?? "http://localhost:3001";
+    const serverUrl = config?.server_url ?? "https://api.getskillvault.com";
     let publisherFilter = options.publisher;
     if (options.mine) {
       if (!config) {
@@ -153253,7 +153374,7 @@ var licensesCommand = new Command7("licenses").description("List your active ski
 import { Command as Command8 } from "commander";
 import chalk9 from "chalk";
 import { readFileSync as readFileSync8, existsSync as existsSync7, statSync as statSync4 } from "node:fs";
-import { resolve as resolve5, join as join7 } from "node:path";
+import { resolve as resolve6, join as join7 } from "node:path";
 import { createHash as createHash4 } from "node:crypto";
 function parseFrontmatter2(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -153304,7 +153425,7 @@ var updateCommand = new Command8("update").description("Push a new version of an
   try {
     const ctx = requireSession();
     const config = ctx.config;
-    const dirPath = resolve5(directory);
+    const dirPath = resolve6(directory);
     if (!existsSync7(dirPath) || !statSync4(dirPath).isDirectory()) {
       process.stderr.write(chalk9.red(`Error: "${dirPath}" is not a valid directory
 `));
@@ -153487,6 +153608,14 @@ var whoamiCommand = new Command9("whoami").description("Show current user, activ
     const ctx = requireSession();
     const config = ctx.config;
     const fingerprint = getDeviceFingerprint();
+    let authMe = null;
+    try {
+      const meRes = await fetch(`${config.server_url}/auth/me`, { headers: ctx.headers });
+      if (meRes.ok) {
+        authMe = await meRes.json();
+      }
+    } catch {
+    }
     const response = await fetch(`${config.server_url}/agent/status?agent_id=${encodeURIComponent(config.agent_id)}`, {
       headers: ctx.headers
     });
@@ -153495,29 +153624,48 @@ var whoamiCommand = new Command9("whoami").description("Show current user, activ
         console.log(JSON.stringify({
           host_id: config.host_id,
           agent_id: config.agent_id,
-          ...config.publisher_id ? { publisher_id: config.publisher_id } : {},
-          ...config.email ? { email: config.email } : {},
+          ...authMe ? {
+            publisher_id: authMe.publisher_id,
+            publisher_name: authMe.publisher_name,
+            email: authMe.email,
+            role: authMe.role,
+            is_owner: authMe.is_owner
+          } : {
+            ...config.publisher_id ? { publisher_id: config.publisher_id } : {},
+            ...config.email ? { email: config.email } : {}
+          },
           device_fingerprint: fingerprint,
           server_url: config.server_url,
-          server_status: "unreachable"
+          server_status: "agent_status_unreachable"
         }, null, 2));
         return;
       }
       console.log();
       console.log(chalk10.bold("  Skill Vault Identity"));
       console.log();
-      if (config.publisher_id) {
-        console.log(`  ${"Publisher ID:".padEnd(22)} ${config.publisher_id}`);
-      }
-      if (config.email) {
-        console.log(`  ${"Email:".padEnd(22)} ${config.email}`);
+      if (authMe) {
+        const roleColor = authMe.role === "owner" ? chalk10.green : authMe.role === "admin" ? chalk10.cyan : chalk10.dim;
+        const roleLabel = authMe.role || (authMe.is_owner ? "owner" : "member");
+        console.log(`  ${"You:".padEnd(22)} ${authMe.email}  ${roleColor(`(${roleLabel})`)}`);
+        const publisherDisplay = authMe.publisher_name ? `${authMe.publisher_name}  ${chalk10.dim(`(${authMe.publisher_id})`)}` : authMe.publisher_id;
+        console.log(`  ${"Publisher:".padEnd(22)} ${publisherDisplay}`);
+        if (!authMe.is_owner) {
+          console.log(`  ${chalk10.dim("  (you are a team member of this publisher)".padEnd(22))}`);
+        }
+      } else {
+        if (config.publisher_id) {
+          console.log(`  ${"Publisher ID:".padEnd(22)} ${config.publisher_id}`);
+        }
+        if (config.email) {
+          console.log(`  ${"Email:".padEnd(22)} ${config.email}`);
+        }
       }
       console.log(`  ${"Host ID:".padEnd(22)} ${config.host_id}`);
       console.log(`  ${"Agent ID:".padEnd(22)} ${config.agent_id}`);
       console.log(`  ${"Device Fingerprint:".padEnd(22)} ${fingerprint}`);
       console.log(`  ${"Server:".padEnd(22)} ${config.server_url}`);
       console.log();
-      console.log(chalk10.yellow(`  Server unreachable (${response.status}). Showing local config only.`));
+      console.log(chalk10.yellow(`  Status endpoint unreachable (${response.status}); skipped grants list.`));
       console.log();
       return;
     }
@@ -153538,11 +153686,22 @@ var whoamiCommand = new Command9("whoami").description("Show current user, activ
     console.log();
     console.log(chalk10.bold("  Skill Vault Identity"));
     console.log();
-    if (config.publisher_id) {
-      console.log(`  ${"Publisher ID:".padEnd(22)} ${config.publisher_id}`);
-    }
-    if (config.email) {
-      console.log(`  ${"Email:".padEnd(22)} ${config.email}`);
+    if (authMe) {
+      const roleColor = authMe.role === "owner" ? chalk10.green : authMe.role === "admin" ? chalk10.cyan : chalk10.dim;
+      const roleLabel = authMe.role || (authMe.is_owner ? "owner" : "member");
+      console.log(`  ${"You:".padEnd(22)} ${authMe.email}  ${roleColor(`(${roleLabel})`)}`);
+      const publisherDisplay = authMe.publisher_name ? `${authMe.publisher_name}  ${chalk10.dim(`(${authMe.publisher_id})`)}` : authMe.publisher_id;
+      console.log(`  ${"Publisher:".padEnd(22)} ${publisherDisplay}`);
+      if (!authMe.is_owner) {
+        console.log(`  ${chalk10.dim("  (you are a team member of this publisher)".padEnd(22))}`);
+      }
+    } else {
+      if (config.publisher_id) {
+        console.log(`  ${"Publisher ID:".padEnd(22)} ${config.publisher_id}`);
+      }
+      if (config.email) {
+        console.log(`  ${"Email:".padEnd(22)} ${config.email}`);
+      }
     }
     console.log(`  ${"Host ID:".padEnd(22)} ${data.host_id ?? config.host_id}`);
     console.log(`  ${"Agent ID:".padEnd(22)} ${data.agent_id ?? config.agent_id}`);
@@ -153627,7 +153786,7 @@ var reportCommand = new Command10("report").description("Report a telemetry even
 import { Command as Command11 } from "commander";
 import chalk12 from "chalk";
 import { existsSync as existsSync8, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "node:fs";
-import { resolve as resolve6, join as join8 } from "node:path";
+import { resolve as resolve7, join as join8 } from "node:path";
 function toTitleCase(name) {
   return name.split(/[-_]/).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
 }
@@ -153664,7 +153823,7 @@ var initCommand = new Command11("init").description("Scaffold a new skill direct
     process.stderr.write(chalk12.dim("  skillvault-publisher init my-awesome-skill\n"));
     process.exit(1);
   }
-  const dirPath = resolve6(name);
+  const dirPath = resolve7(name);
   if (existsSync8(dirPath)) {
     process.stderr.write(chalk12.red(`Error: Directory "${name}" already exists.
 `));
@@ -153779,11 +153938,9 @@ var listCommand = new Command13("list").description("List your published skills"
       headers: ctx.headers
     });
     if (!response.ok) {
-      const err = await response.json().catch(() => ({
-        error: "unknown",
-        message: response.statusText
-      }));
-      process.stderr.write(chalk14.red(`Failed to list skills: ${err.message}
+      const err = await response.json().catch(() => null);
+      const reason = err?.message || err?.error || response.statusText || `HTTP ${response.status}`;
+      process.stderr.write(chalk14.red(`Failed to list skills: ${reason}
 `));
       process.exit(1);
     }
@@ -153842,7 +153999,7 @@ var listCommand = new Command13("list").description("List your published skills"
 import { Command as Command14 } from "commander";
 import chalk15 from "chalk";
 import { readFileSync as readFileSync9, existsSync as existsSync9, statSync as statSync5, readdirSync as readdirSync2 } from "node:fs";
-import { resolve as resolve7, join as join9, basename } from "node:path";
+import { resolve as resolve8, join as join9, basename } from "node:path";
 import { createHash as createHash6 } from "node:crypto";
 function parseFrontmatter3(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -153990,7 +154147,7 @@ var publishAllCommand = new Command14("publish-all").description("Discover and p
       skillDirs = entries.map((e) => e.path);
       console.log(chalk15.dim(`Iterating ${skillDirs.length} registered workspace${skillDirs.length === 1 ? "" : "s"}` + (options.current ? " (current account only)" : "") + "..."));
     } else {
-      const rootDir = resolve7(directory);
+      const rootDir = resolve8(directory);
       if (!existsSync9(rootDir) || !statSync5(rootDir).isDirectory()) {
         process.stderr.write(chalk15.red(`Error: "${rootDir}" is not a valid directory
 `));
@@ -154270,12 +154427,12 @@ var inviteListCommand = new Command15("list").description("List all invites").op
     }
     console.log(`Invites (${invites.length}):
 `);
-    const pad3 = (s, n) => s.padEnd(n).slice(0, n);
-    console.log(chalk16.dim(`${pad3("Code", 14)} ${pad3("Email", 30)} ${pad3("Status", 10)} ${pad3("Skills", 25)} ${pad3("Created", 12)}`));
+    const pad4 = (s, n) => s.padEnd(n).slice(0, n);
+    console.log(chalk16.dim(`${pad4("Code", 14)} ${pad4("Email", 30)} ${pad4("Status", 10)} ${pad4("Skills", 25)} ${pad4("Created", 12)}`));
     console.log(chalk16.dim("\u2500".repeat(95)));
     for (const inv of invites) {
       const statusColor = inv.status === "redeemed" ? chalk16.green : inv.status === "expired" ? chalk16.dim : chalk16.yellow;
-      console.log(`${pad3(inv.code, 14)} ${pad3(inv.customer_email || "(open)", 30)} ${statusColor(pad3(inv.status, 10))} ${pad3(inv.capabilities.join(", ") || "(none)", 25)} ${pad3(new Date(inv.created_at).toLocaleDateString(), 12)}`);
+      console.log(`${pad4(inv.code, 14)} ${pad4(inv.customer_email || "(open)", 30)} ${statusColor(pad4(inv.status, 10))} ${pad4(inv.capabilities.join(", ") || "(none)", 25)} ${pad4(new Date(inv.created_at).toLocaleDateString(), 12)}`);
     }
   } catch (err) {
     process.stderr.write(chalk16.red(`Error: ${err instanceof Error ? err.message : String(err)}
@@ -155014,18 +155171,18 @@ var grantsCommand = new Command23("grants").description("List capability grants
     console.log();
     console.log(chalk20.bold("  Capability Grants"));
     console.log();
-    const pad3 = (s, n) => s.padEnd(n).slice(0, n);
-    const header = `${pad3("Grant ID", 22)} ${pad3("Skill", 24)} ${pad3("Customer", 22)} ${pad3("Status", 10)} ${pad3("Granted", 12)} ${"Expires"}`;
+    const pad4 = (s, n) => s.padEnd(n).slice(0, n);
+    const header = `${pad4("Grant ID", 22)} ${pad4("Skill", 24)} ${pad4("Customer", 22)} ${pad4("Status", 10)} ${pad4("Granted", 12)} ${"Expires"}`;
     console.log(`  ${chalk20.dim(header)}`);
     console.log(`  ${chalk20.dim("\u2500".repeat(header.length))}`);
     for (const grant of grants) {
       const statusColor = grant.status === "active" ? chalk20.green : grant.status === "revoked" ? chalk20.red : grant.status === "expired" ? chalk20.yellow : chalk20.white;
       const row = [
-        pad3(grant.id, 22),
-        pad3(grant.capability, 24),
-        pad3(grant.customer_id || "-", 22),
-        statusColor(pad3(grant.status, 10)),
-        pad3(new Date(grant.created_at).toLocaleDateString(), 12),
+        pad4(grant.id, 22),
+        pad4(grant.capability, 24),
+        pad4(grant.customer_id || "-", 22),
+        statusColor(pad4(grant.status, 10)),
+        pad4(new Date(grant.created_at).toLocaleDateString(), 12),
         grant.expires_at ? new Date(grant.expires_at).toLocaleDateString() : "never"
       ].join(" ");
       console.log(`  ${row}`);
@@ -155101,18 +155258,18 @@ var customersCommand = new Command25("customers").description("List your custome
     console.log();
     console.log(chalk22.bold("  Customers"));
     console.log();
-    const pad3 = (s, n) => s.padEnd(n).slice(0, n);
-    const header = `${pad3("Email", 32)}  ${pad3("Skills", 8)}  ${pad3("Loads", 8)}  ${pad3("Status", 10)}  Last Active`;
+    const pad4 = (s, n) => s.padEnd(n).slice(0, n);
+    const header = `${pad4("Email", 32)}  ${pad4("Skills", 8)}  ${pad4("Loads", 8)}  ${pad4("Status", 10)}  Last Active`;
     console.log(`  ${chalk22.dim(header)}`);
     console.log(`  ${chalk22.dim("\u2500".repeat(header.length))}`);
     for (const c of customers) {
       const statusColor = c.status === "active" ? chalk22.green : chalk22.dim;
       const lastActive = c.last_active_at ? new Date(c.last_active_at).toLocaleDateString() : chalk22.dim("never");
       const row = [
-        pad3(c.email, 32),
-        pad3(String(c.skills_count), 8),
-        pad3(String(c.total_loads), 8),
-        statusColor(pad3(c.status, 10)),
+        pad4(c.email, 32),
+        pad4(String(c.skills_count), 8),
+        pad4(String(c.total_loads), 8),
+        statusColor(pad4(c.status, 10)),
         lastActive
       ].join("  ");
       console.log(`  ${row}`);
@@ -155164,15 +155321,15 @@ var analyticsCommand = new Command26("analytics").description("View publisher an
       console.log();
       console.log(chalk23.bold("  Top Skills"));
       console.log();
-      const pad3 = (s, n) => s.padEnd(n).slice(0, n);
-      const header = `${pad3("Skill", 28)}  ${pad3("Decryptions", 14)}  Active Licenses`;
+      const pad4 = (s, n) => s.padEnd(n).slice(0, n);
+      const header = `${pad4("Skill", 28)}  ${pad4("Decryptions", 14)}  Active Licenses`;
       console.log(`  ${chalk23.dim(header)}`);
       console.log(`  ${chalk23.dim("\u2500".repeat(header.length))}`);
       for (const skill of data.top_skills) {
         const stats = statsMap.get(skill.name);
         const row = [
-          pad3(skill.name, 28),
-          pad3(String(skill.decryptions), 14),
+          pad4(skill.name, 28),
+          pad4(String(skill.decryptions), 14),
           String(stats?.active_licenses ?? "-")
         ].join("  ");
         console.log(`  ${row}`);
@@ -155305,8 +155462,8 @@ var auditCommand = new Command28("audit").description("View audit log events").o
     console.log();
     console.log(chalk25.bold("  Audit Log"));
     console.log();
-    const pad3 = (s, n) => s.padEnd(n).slice(0, n);
-    const header = `${pad3("Event Type", 22)} ${pad3("Skill", 24)} ${pad3("Agent", 20)} ${"Time"}`;
+    const pad4 = (s, n) => s.padEnd(n).slice(0, n);
+    const header = `${pad4("Event Type", 22)} ${pad4("Skill", 24)} ${pad4("Agent", 20)} ${"Time"}`;
     console.log(`  ${chalk25.dim(header)}`);
     console.log(`  ${chalk25.dim("\u2500".repeat(header.length))}`);
     for (const event of events) {
@@ -155314,9 +155471,9 @@ var auditCommand = new Command28("audit").description("View audit log events").o
       const agent = event.agent_id ? event.agent_id.slice(0, 18) : "-";
       const time = new Date(event.created_at).toLocaleString();
       const row = [
-        pad3(event.event_type, 22),
-        pad3(skill, 24),
-        pad3(agent, 20),
+        pad4(event.event_type, 22),
+        pad4(skill, 24),
+        pad4(agent, 20),
         time
       ].join(" ");
       console.log(`  ${row}`);
@@ -155771,7 +155928,7 @@ var watchtowerCommand = new Command30("watchtower").description("Watchtower secu
       return;
     }
     const { summary } = data;
-    const pad3 = (s, n) => s.padEnd(n).slice(0, n);
+    const pad4 = (s, n) => s.padEnd(n).slice(0, n);
     console.log();
     console.log(chalk27.bold("  Watchtower \u2014 Security Overview"));
     console.log();
@@ -155780,28 +155937,28 @@ var watchtowerCommand = new Command30("watchtower").description("Watchtower secu
       console.log();
       console.log(chalk27.bold("  Flagged Customers"));
       console.log();
-      const header = `${pad3("Agent ID", 20)}  ${pad3("Risk Score", 12)}  ${pad3("Level", 10)}  ${pad3("Strikes", 9)}  ${pad3("Status", 12)}  Skills`;
+      const header = `${pad4("Agent ID", 20)}  ${pad4("Risk Score", 12)}  ${pad4("Level", 10)}  ${pad4("Strikes", 9)}  ${pad4("Status", 12)}  Skills`;
       console.log(`  ${chalk27.dim(header)}`);
       console.log(`  ${chalk27.dim("\u2500".repeat(header.length))}`);
       for (const c of data.flagged_customers) {
         const agentShort = c.agent_id.length > 18 ? c.agent_id.slice(0, 18) + "\u2026" : c.agent_id;
         let levelColored;
         if (c.risk_level === "critical") {
-          levelColored = chalk27.red.bold(pad3(c.risk_level, 10));
+          levelColored = chalk27.red.bold(pad4(c.risk_level, 10));
         } else if (c.risk_level === "high") {
-          levelColored = chalk27.red(pad3(c.risk_level, 10));
+          levelColored = chalk27.red(pad4(c.risk_level, 10));
         } else if (c.risk_level === "medium") {
-          levelColored = chalk27.yellow(pad3(c.risk_level, 10));
+          levelColored = chalk27.yellow(pad4(c.risk_level, 10));
         } else {
-          levelColored = chalk27.dim(pad3(c.risk_level, 10));
+          levelColored = chalk27.dim(pad4(c.risk_level, 10));
         }
-        const statusColored = c.status === "suspended" ? chalk27.red(pad3(c.status, 12)) : pad3(c.status, 12);
+        const statusColored = c.status === "suspended" ? chalk27.red(pad4(c.status, 12)) : pad4(c.status, 12);
         const skills = c.capabilities.length > 0 ? c.capabilities.join(", ") : chalk27.dim("none");
         const row = [
-          pad3(agentShort, 20),
-          pad3(String(c.risk_score), 12),
+          pad4(agentShort, 20),
+          pad4(String(c.risk_score), 12),
           levelColored,
-          pad3(String(c.strike_count), 9),
+          pad4(String(c.strike_count), 9),
           statusColored,
           skills
         ].join("  ");
@@ -155812,7 +155969,7 @@ var watchtowerCommand = new Command30("watchtower").description("Watchtower secu
       console.log();
       console.log(chalk27.bold("  Recent Security Events"));
       console.log();
-      const header = `${pad3("Event Type", 28)}  ${pad3("Skill", 24)}  ${pad3("Agent", 20)}  Time`;
+      const header = `${pad4("Event Type", 28)}  ${pad4("Skill", 24)}  ${pad4("Agent", 20)}  Time`;
       console.log(`  ${chalk27.dim(header)}`);
       console.log(`  ${chalk27.dim("\u2500".repeat(header.length))}`);
       const events = data.recent_events.slice(0, 10);
@@ -155821,9 +155978,9 @@ var watchtowerCommand = new Command30("watchtower").description("Watchtower secu
         const agent = e.agent_id ? e.agent_id.slice(0, 18) : chalk27.dim("-");
         const time = new Date(e.created_at).toLocaleString();
         const row = [
-          pad3(e.event_type, 28),
-          pad3(skill, 24),
-          pad3(agent, 20),
+          pad4(e.event_type, 28),
+          pad4(skill, 24),
+          pad4(agent, 20),
           time
         ].join("  ");
         console.log(`  ${row}`);
@@ -155936,7 +156093,7 @@ var watermarkDecodeCommand = new Command31("watermark-decode").description("Anal
 import { Command as Command32 } from "commander";
 import chalk29 from "chalk";
 import { existsSync as existsSync14, readFileSync as readFileSync17, statSync as statSync6 } from "node:fs";
-import { resolve as resolve8, join as join15 } from "node:path";
+import { resolve as resolve9, join as join15 } from "node:path";
 function parseFrontmatter4(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!match)
@@ -155958,7 +156115,7 @@ function parseFrontmatter4(content) {
 var linkCommand = new Command32("link").description("Link a skill source directory to your publisher account").argument("[directory]", "Skill directory to link (defaults to CWD)").option("--workspace <path>", "Explicit workspace directory (precedence over positional)").option("--force", "Overwrite an existing link to a different publisher_id").option("--name <name>", "Override skill name (defaults to SKILL.md frontmatter name)").option("--capability <cap>", "Override capability_name (advanced \u2014 usually matches skill name)").action(async (directory, options) => {
   try {
     const ctx = requireSession();
-    const dirPath = options.workspace ? resolve8(options.workspace) : directory ? resolve8(directory) : process.cwd();
+    const dirPath = options.workspace ? resolve9(options.workspace) : directory ? resolve9(directory) : process.cwd();
     if (!existsSync14(dirPath) || !statSync6(dirPath).isDirectory()) {
       process.stderr.write(chalk29.red(`Error: "${dirPath}" is not a valid directory
 `));
@@ -156022,10 +156179,10 @@ var linkCommand = new Command32("link").description("Link a skill source directo
 import { Command as Command33 } from "commander";
 import chalk30 from "chalk";
 import { existsSync as existsSync15, rmSync as rmSync2, statSync as statSync7 } from "node:fs";
-import { resolve as resolve9, join as join16 } from "node:path";
+import { resolve as resolve10, join as join16 } from "node:path";
 var unlinkCommand = new Command33("unlink").description("Remove the workspace link from a skill source directory").argument("[directory]", "Skill directory to unlink (defaults to CWD)").option("--workspace <path>", "Explicit workspace directory (precedence over positional)").option("--keep-registry", "Remove the manifest file but leave the registry entry").action(async (directory, options) => {
   try {
-    const dirPath = options.workspace ? resolve9(options.workspace) : directory ? resolve9(directory) : process.cwd();
+    const dirPath = options.workspace ? resolve10(options.workspace) : directory ? resolve10(directory) : process.cwd();
     if (!existsSync15(dirPath) || !statSync7(dirPath).isDirectory()) {
       process.stderr.write(chalk30.red(`Error: "${dirPath}" is not a valid directory
 `));
@@ -156160,10 +156317,149 @@ workspacesCommand.command("find").description("Print the absolute path of a work
   }
 });
 
+// dist/commands/team.js
+import { Command as Command35 } from "commander";
+import chalk32 from "chalk";
+function formatRole(role) {
+  if (role === "owner")
+    return chalk32.green("owner");
+  if (role === "admin")
+    return chalk32.cyan("admin");
+  return chalk32.dim("member");
+}
+function formatStatus(status) {
+  if (status === "active")
+    return chalk32.green("active");
+  if (status === "pending")
+    return chalk32.yellow("pending");
+  return chalk32.dim(status);
+}
+function pad3(s, n) {
+  const visible = s.replace(/\x1b\[[0-9;]*m/g, "");
+  if (visible.length >= n)
+    return s;
+  return s + " ".repeat(n - visible.length);
+}
+var teamCommand = new Command35("team").description("Manage your publisher team members").option("--json", "Output as JSON").action(async (options) => {
+  try {
+    const ctx = requireSession();
+    const data = await sessionFetch(ctx, `/publishers/${ctx.publisherId}/team`);
+    const members = data.members || [];
+    if (options.json) {
+      console.log(JSON.stringify(members, null, 2));
+      return;
+    }
+    if (members.length === 0) {
+      console.log();
+      console.log(chalk32.dim("  No team members yet. Invite someone:"));
+      console.log(chalk32.cyan("    skillvault-publisher team add <email> [--role member|admin]"));
+      console.log();
+      return;
+    }
+    console.log();
+    console.log(chalk32.bold(`  Team members (${members.length})`));
+    console.log();
+    const header = `${pad3(chalk32.dim("Email"), 36)}  ${pad3(chalk32.dim("Role"), 14)}  ${pad3(chalk32.dim("Status"), 14)}  ${chalk32.dim("Member ID")}`;
+    console.log(`  ${header}`);
+    console.log(`  ${chalk32.dim("\u2500".repeat(80))}`);
+    for (const m of members) {
+      const row = `${pad3(m.email, 36)}  ${pad3(formatRole(m.role), 14)}  ${pad3(formatStatus(m.status), 14)}  ${chalk32.dim(m.id)}`;
+      console.log(`  ${row}`);
+    }
+    console.log();
+    console.log(chalk32.dim(`  Logged in as publisher ${ctx.publisherId}`));
+    console.log();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(chalk32.red(`team list failed: ${message}
+`));
+    process.exit(1);
+  }
+});
+teamCommand.command("add").description("Invite someone to your publisher team. Sends a magic-link email.").argument("<email>", "The email address to invite").option("--role <role>", "Role: member (default) or admin", "member").option("--name <name>", "Display name for the invitee (optional)").option("--json", "Output as JSON").action(async (email, options) => {
+  try {
+    if (!["member", "admin"].includes(options.role)) {
+      process.stderr.write(chalk32.red(`Invalid role "${options.role}". Use --role member or --role admin.
+`));
+      process.exit(1);
+    }
+    const ctx = requireSession();
+    const member = await sessionFetch(ctx, `/publishers/${ctx.publisherId}/team`, {
+      method: "POST",
+      body: { email, role: options.role, name: options.name || null }
+    });
+    if (options.json) {
+      console.log(JSON.stringify(member, null, 2));
+      return;
+    }
+    console.log();
+    console.log(chalk32.green(`  \u2713 Invited ${email} as ${formatRole(options.role)}`));
+    console.log(chalk32.dim(`    Member ID:  ${member.id}`));
+    console.log(chalk32.dim(`    Status:     ${formatStatus(member.status)}`));
+    console.log();
+    console.log(chalk32.dim("  A magic-link invitation email has been sent. The new member can"));
+    console.log(chalk32.dim("  click the link to activate, then run:"));
+    console.log(chalk32.cyan(`    skillvault-publisher login --email ${email}`));
+    console.log();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(chalk32.red(`team add failed: ${message}
+`));
+    process.exit(1);
+  }
+});
+teamCommand.command("remove").description("Remove a team member by email or member ID").argument("<email-or-id>", "The member email address or member ID (tm_xxx)").option("--yes", "Skip confirmation").option("--json", "Output as JSON").action(async (target, options) => {
+  try {
+    const ctx = requireSession();
+    const listData = await sessionFetch(ctx, `/publishers/${ctx.publisherId}/team`);
+    const members = listData.members || [];
+    const member = members.find((m) => m.id === target || m.email === target);
+    if (!member) {
+      process.stderr.write(chalk32.red(`No team member found matching "${target}".
+`));
+      process.stderr.write(chalk32.dim("Run `skillvault-publisher team` to see the current list.\n"));
+      process.exit(1);
+    }
+    if (member.role === "owner") {
+      process.stderr.write(chalk32.red("Cannot remove the owner of a publisher account.\n"));
+      process.exit(1);
+    }
+    if (member.status === "removed") {
+      process.stderr.write(chalk32.yellow(`${member.email} is already removed.
+`));
+      process.exit(0);
+    }
+    if (!options.yes) {
+      console.log();
+      console.log(chalk32.yellow.bold("  Warning: ") + "This will revoke " + chalk32.bold(member.email) + `'s access to publisher ${ctx.publisherId}.`);
+      console.log();
+      console.log(`  Email:    ${chalk32.cyan(member.email)}`);
+      console.log(`  Role:     ${formatRole(member.role)}`);
+      console.log(`  Status:   ${formatStatus(member.status)}`);
+      console.log(`  Added:    ${chalk32.dim(new Date(member.created_at).toLocaleDateString())}`);
+      console.log();
+      console.log(chalk32.dim("  Add --yes to confirm."));
+      console.log();
+      process.exit(0);
+    }
+    await sessionFetch(ctx, `/publishers/${ctx.publisherId}/team/${member.id}`, { method: "DELETE" });
+    if (options.json) {
+      console.log(JSON.stringify({ removed: true, member_id: member.id, email: member.email }, null, 2));
+      return;
+    }
+    console.log(chalk32.green(`  \u2713 Removed ${member.email} from the team`));
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(chalk32.red(`team remove failed: ${message}
+`));
+    process.exit(1);
+  }
+});
+
 // dist/index.js
 var __dirname2 = dirname5(fileURLToPath(import.meta.url));
 var pkg = JSON.parse(readFileSync18(join17(__dirname2, "..", "package.json"), "utf8"));
-var program = new Command35();
+var program = new Command36();
 program.name("skillvault-publisher").description("SkillVault publisher CLI \u2014 publish, manage, and distribute encrypted skills").version(pkg.version).addHelpText("after", `
 
 Getting Started:
@@ -156208,6 +156504,7 @@ program.addCommand(watermarkDecodeCommand);
 program.addCommand(linkCommand);
 program.addCommand(unlinkCommand);
 program.addCommand(workspacesCommand);
+program.addCommand(teamCommand);
 program.parse();
 /*! Bundled license information: