@hasna/domains 0.0.47 → 0.1.0

package/dist/mcp/tool-filter.d.ts

@@ -1,4 +1,10 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * Tools that DOMAINS_MCP_SAFE_MODE=1 keeps enabled. Every name here must be a
+ * tool registered in `./index.ts` — `tool-filter.test.ts` pins that, so a
+ * renamed or removed tool cannot leave a dead allow-list entry behind.
+ */
+export declare const READ_ONLY_TOOLS: ReadonlySet<string>;
 export declare function isReadOnlyMcpTool(name: string): boolean;
 export declare function applySafeModeToolFilter(server: McpServer, env?: Record<string, string | undefined>): void;
 //# sourceMappingURL=tool-filter.d.ts.map

package/dist/mcp/tool-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-filter.d.ts","sourceRoot":"","sources":["../../src/mcp/tool-filter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA0CzE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAqD,GAAG,IAAI,CAgB5J"}
+{"version":3,"file":"tool-filter.d.ts","sourceRoot":"","sources":["../../src/mcp/tool-filter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAqC9C,CAAC;AAEH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAqD,GAAG,IAAI,CAgB5J"}

package/dist/sdk/index.d.ts

@@ -1,15 +1,26 @@
-/**
- * @hasna/domains SDK — typed HTTP client generated from the domains-serve
- * OpenAPI document (see `src/server/openapi.ts`, regenerate via the `sdk:gen`
- * script). Client hosted convention: `DOMAINS_API_URL` + `DOMAINS_API_KEY`
- * (a key, never a DSN).
- */
 export * from "./client.js";
+import type { KeychainTierOptions } from "../lib/client-types.js";
 import { DomainsClient, type DomainsClientOptions } from "./client.js";
+type ClientEnv = Record<string, string | undefined>;
+/** Options accepted on top of the generated client options. */
+export interface CreateDomainsClientOptions extends Partial<DomainsClientOptions> {
+    /** Tier-1 identity selection (`--profile`), passed through to the seam. */
+    profile?: string;
+    /**
+     * Tier-3 controls: a `security` runner for tests, or an opt-out on a CI Mac.
+     * Production callers pass nothing — the tier is ambient for `process.env`
+     * and off for a caller-built env.
+     */
+    keychain?: KeychainTierOptions;
+}
 /**
- * Build a `DomainsClient` from the environment.
- * Resolves `DOMAINS_API_URL` (or `HASNA_DOMAINS_API_URL`) and the API key
- * through the @hasna/contracts client credential chain.
+ * Build a `DomainsClient` whose credential and base URL come from the shared
+ * @hasna/contracts resolver.
+ *
+ * Throws when no credential resolves from any tier — the SDK never falls back
+ * to an unauthenticated client or to local data. An EXPLICIT `baseUrl`
+ * argument with no explicit `apiKey` builds an unauthenticated client pinned
+ * to that authority: the ambient fleet key is never attached (#1794).
  */
-export declare function createDomainsClientFromEnv(env?: NodeJS.ProcessEnv, overrides?: Partial<DomainsClientOptions>): DomainsClient;
+export declare function createDomainsClientFromEnv(env?: ClientEnv, overrides?: CreateDomainsClientOptions): DomainsClient;
 //# sourceMappingURL=index.d.ts.map

package/dist/sdk/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,aAAa,CAAC;AAE5B,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEvE;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,SAAS,GAAE,OAAO,CAAC,oBAAoB,CAAM,GAC5C,aAAa,CAOf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAoDA,cAAc,aAAa,CAAC;AAM5B,OAAO,KAAK,EAEV,mBAAmB,EACpB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEvE,KAAK,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAEpD,+DAA+D;AAC/D,MAAM,WAAW,0BAA2B,SAAQ,OAAO,CAAC,oBAAoB,CAAC;IAC/E,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,GAAE,SAAuB,EAC5B,SAAS,GAAE,0BAA+B,GACzC,aAAa,CA6Ef"}