@hasna/skills 0.4.0 → 0.5.0

package/dist/lib/skillinfo.d.ts

@@ -45,7 +45,7 @@ export declare function getSkillDependencyStatus(name: string): SkillDependencyS
  */
 export declare function runSkill(name: string, args: string[], options?: {
     installed?: boolean;
-    stdio?: "inherit" | "pipe";
+    stdio?: "inherit" | "pipe" | "stderr";
     env?: Record<string, string>;
 }): Promise<{
     exitCode: number;

package/dist/mcp/helpers.d.ts

@@ -1,3 +1,24 @@
+/** The shape every tool handler returns; kept structural so registrars need no SDK type import. */
+type McpToolResult = {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+};
+/**
+ * Run a DATA tool behind the fleet ladder's refusal.
+ *
+ * The body is expected to go through `requireSkillsReadAccess()` /
+ * `getBrowseRegistry()` (lib/read-access.ts) before it reads the bundled
+ * catalog or the on-machine corpus. When the ladder refuses — no credential, no
+ * authority, no `HASNA_SKILLS_LOCAL=1` opt-in; an authority with no key; a
+ * deliberate selection that cannot be honoured — the refusal comes back as the
+ * same `AUTH_REQUIRED` result `get_run_status` already gives, never as the
+ * local answer. Any other failure propagates unchanged (the SDK reports it as
+ * a tool error with its message).
+ */
+export declare function readSurface(body: () => Promise<McpToolResult>): Promise<McpToolResult>;
 export declare function stripNulls(obj: Record<string, unknown>): Record<string, unknown>;
 export declare function cacheGet(key: string): unknown | undefined;
 export declare function cacheSet(key: string, value: unknown): void;
@@ -24,3 +45,4 @@ export declare const TOOL_DESCRIPTIONS: Record<string, {
     description: string;
     params: string[];
 }>;
+export {};

package/dist/mcp/index.d.ts

@@ -8,6 +8,22 @@
  *   skills-mcp          # Direct binary
  *   skills-mcp --http   # Streamable HTTP on 127.0.0.1:8836
  */
+/**
+ * FAIL CLOSED AT STARTUP (owner ruling 2026-09-04, hasna/apps#1720; #1720
+ * validation, round 1): the MCP process resolves the fleet ladder BEFORE it
+ * connects any transport. With no credential, no authority and no
+ * `HASNA_SKILLS_LOCAL=1` opt-in it exits 1 with the ladder's one line on
+ * stderr — before `initialize` is answered, before an HTTP port is bound —
+ * mirroring the CLI, which exits 1 on the same machine. Serving the bundled
+ * catalog to an agent host that registered `skills-mcp` on a station without
+ * its credential is the false green the ruling removed. The explicit local
+ * opt-in starts the server and announces local mode once on stderr; a
+ * credential (or a vault pointer the tools complete per call) starts it hosted.
+ *
+ * Every data tool still runs the same gate per call (lib/read-access.ts), so a
+ * credential that disappears mid-process is refused by the next call too.
+ */
+export declare function assertSkillsMcpConfigured(env?: Record<string, string | undefined>): void;
 /**
  * Start the Skills MCP server on stdio (newline-delimited JSON-RPC).
  *

package/dist/sdk/governance-store.d.ts

@@ -51,6 +51,7 @@ export interface GovernanceStore {
         estimatedCents: number;
     }): Promise<CreditReservation>;
     reservationsForRun(orgId: string, runId: string): Promise<CreditReservation[]>;
+    /** First terminal reconciliation wins; retries return that persisted state unchanged. */
     reconcileReservation(reservationId: string, actualCents: number, status: "charged" | "released"): Promise<CreditReservation | null>;
     /** Sum of cost_cents of runs created in the given calendar month (YYYY-MM), plus un-reconciled reservations. */
     monthlySpendCents(orgId: string, monthPrefix: string): Promise<number>;

package/dist/sdk/index.d.ts

@@ -15,7 +15,7 @@
  * — the shared @hasna/contracts ladder — instead of reading an environment
  * variable of its own. See lib/fleet-credentials.ts.
  */
-export { MissingSkillsFleetError, SkillsFleetCredentialError, SKILLS_API_KEY_ENV, SKILLS_API_URL_ENV, SKILLS_APP, configuredSkillsApiUrl, noticeLocalSkillsMode, normalizeSkillsApiOrigin, requireSkillsApiOrigin, requireSkillsFleet, resolveSkillsApiOrigin, resolveSkillsFleet, skillsCredentialFilePath, skillsCredentialFiles, skillsCredentialOrReason, type HostedSkillsFleet, type LocalSkillsFleet, type SkillsFleet, type SkillsFleetErrorCode, type SkillsFleetOptions, } from "../lib/fleet-credentials.js";
+export { MissingSkillsFleetError, SkillsFleetCredentialError, SKILLS_API_KEY_ENV, SKILLS_API_URL_ENV, SKILLS_APP, SKILLS_LOCAL_OPT_IN_ENV_KEYS, configuredSkillsApiUrl, isSkillsLocalOptIn, noticeLocalSkillsMode, normalizeSkillsApiOrigin, requireSkillsApiOrigin, requireSkillsFleet, resolveSkillsApiOrigin, resolveSkillsFleet, selectsSkillsLocalMode, skillsCredentialFilePath, skillsCredentialFiles, skillsCredentialOrReason, type HostedSkillsFleet, type LocalSkillsFleet, type SkillsFleet, type SkillsFleetErrorCode, type SkillsFleetOptions, } from "../lib/fleet-credentials.js";
 export * from "./server.js";
 export * from "./registry.js";
 export * from "./runs.js";
@@ -30,7 +30,10 @@ export * from "./events.js";
 export * from "./spend.js";
 export * from "./offline.js";
 export * from "./execution/index.js";
-export { RemoteSkillsClient, createRemoteSkillsClient, RemoteRequestError, RemoteRouteUnsupportedError } from "../lib/remote-client.js";
+export { RemoteSkillsClient, createRemoteSkillsClient, RemoteRequestError, RemoteRouteUnsupportedError, RemoteCapabilityUnavailableError, RemoteWorkspaceMemberError } from "../lib/remote-client.js";
 export { RemoteCreditApprovalError, type RemoteRunApproval, type RemoteRunQuote, type RemoteCreditPack } from "../lib/remote-account.js";
 export { type RemoteInputFile, type RemoteInputFileDescriptor } from "../lib/remote-files.js";
 export { RemoteSkillsAuthClient, HostedApiError } from "../lib/remote-auth.js";
+export type { RemoteWorkspaceMember, RemoteWorkspaceMembersPage, RemoteWorkspaceMembersOptions } from "../lib/remote-workspace.js";
+export type { SetRemoteWorkspaceMemberRole, RemoveRemoteWorkspaceMember, RemoteWorkspaceMemberRoleResult, RemoteWorkspaceMemberRemovalResult, RemoteWorkspaceMemberErrorCode } from "../lib/remote-workspace.js";
+export type { RemoteCustomerRole, RemoteCustomerProfile, RemoteCurrentWorkspace, UpdateRemoteProfile, UpdateRemoteWorkspace } from "../lib/remote-profile.js";