@hasna/skills 0.4.0 → 0.5.1

package/bin/worker.js

@@ -23103,7 +23103,7 @@ import { randomUUID as randomUUID4 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.4.0",
+  version: "0.5.1",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -23135,6 +23135,7 @@ var package_default = {
   files: [
     "dist/",
     "!dist/**/*.test.d.ts",
+    "!dist/**/*.fixture.d.ts",
     "!dist/test-preload.d.ts",
     "!dist/platform",
     "bin/",
@@ -23160,8 +23161,9 @@ var package_default = {
     migrate: "bun run ./src/server/migrate.ts",
     typecheck: "tsc --noEmit",
     "verify:release": "bun run scripts/release-guard.ts",
+    "verify:consumer-types": "bun run scripts/consumer-types.ts",
     prepare: "bun run build:js",
-    prepack: "bun run build && bun run verify:release",
+    prepack: "bun run build && bun run verify:release && bun run verify:consumer-types",
     prepublishOnly: "bun run typecheck && bun run test"
   },
   keywords: [
@@ -23183,6 +23185,7 @@ var package_default = {
   author: "Hasna",
   license: "Apache-2.0",
   devDependencies: {
+    "@hasna/contracts": "1.0.2",
     "@types/bun": "1.3.14",
     "@types/node": "25.2.3",
     "@types/react": "^18.2.0",
@@ -23194,8 +23197,7 @@ var package_default = {
   dependencies: {
     "@aws-sdk/client-ecs": "^3.1079.0",
     "@aws-sdk/client-s3": "^3.1079.0",
-    "@hasna/contracts": "1.0.1",
-    "@hasna/events": "0.1.16",
+    "@hasna/events": "0.1.18",
     "@modelcontextprotocol/sdk": "^1.26.0",
     chalk: "^5.3.0",
     commander: "^12.1.0",
@@ -23745,7 +23747,7 @@ var $NODE_RESPONSE_CHECKSUM_VALIDATION_CONFIG_OPTIONS = NODE_RESPONSE_CHECKSUM_V
 var $getFlexibleChecksumsPlugin = getFlexibleChecksumsPlugin;
 var $resolveFlexibleChecksumsConfig = resolveFlexibleChecksumsConfig;
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
 var import_client23 = __toESM(require_client2(), 1);
 
 // ../../node_modules/.bun/@aws-sdk+middleware-sdk-s3@3.972.75/node_modules/@aws-sdk/middleware-sdk-s3/dist-cjs/submodules/s3/index.js
@@ -24353,7 +24355,7 @@ var $getThrow200ExceptionsPlugin = getThrow200ExceptionsPlugin;
 var $getValidateBucketNamePlugin = getValidateBucketNamePlugin;
 var $resolveS3Config = resolveS3Config;
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
 var import_core = __toESM(require_dist_cjs2(), 1);
 var import_client24 = __toESM(require_client(), 1);
 var import_config29 = __toESM(require_config(), 1);
@@ -24363,17 +24365,17 @@ var import_protocols6 = __toESM(require_protocols(), 1);
 var import_retry4 = __toESM(require_retry(), 1);
 var import_schema2 = __toESM(require_schema(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
 var import_httpAuthSchemes = __toESM(require_httpAuthSchemes(), 1);
 var import_signature_v4_multi_region = __toESM(require_dist_cjs4(), 1);
 var import_client2 = __toESM(require_client(), 1);
 var import_endpoints3 = __toESM(require_endpoints(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/endpointResolver.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/endpointResolver.js
 var import_client = __toESM(require_client2(), 1);
 var import_endpoints2 = __toESM(require_endpoints(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/bdd.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/bdd.js
 var import_endpoints = __toESM(require_endpoints(), 1);
 var aw = "ref";
 var ax = "argv";
@@ -26317,7 +26319,7 @@ var nodes = new Int32Array([
 ]);
 var bdd = import_endpoints.BinaryDecisionDiagram.from(nodes, root, _data.conditions, _data.results);
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/endpointResolver.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/endpointResolver.js
 var cache = new import_endpoints2.EndpointCache({
   size: 50,
   params: [
@@ -26345,7 +26347,7 @@ var defaultEndpointResolver = (endpointParams, context = {}) => {
 };
 import_endpoints2.customEndpointFunctions.aws = import_client.awsEndpointFunctions;
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthSchemeProvider.js
 var createEndpointRuleSetHttpAuthSchemeParametersProvider = (defaultHttpAuthSchemeParametersProvider) => async (config, context, input) => {
   if (!input) {
     throw new Error("Could not find `input` for `defaultEndpointRuleSetHttpAuthSchemeParametersProvider`");
@@ -26461,11 +26463,11 @@ var resolveHttpAuthSchemeConfig = (config) => {
   });
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
 var import_client3 = __toESM(require_client(), 1);
 var import_endpoints4 = __toESM(require_endpoints(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/EndpointParameters.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/endpoint/EndpointParameters.js
 var resolveClientEndpointParameters = (options) => {
   return Object.assign(options, {
     useFipsEndpoint: options.useFipsEndpoint ?? false,
@@ -26491,7 +26493,7 @@ var commonParams = {
   UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commandBuilder.js
 var command = import_client3.makeBuilder(commonParams, "AmazonS3", "S3Client", import_endpoints4.getEndpointPlugin);
 var _ep0 = {
   Bucket: { type: "contextParams", name: "Bucket" },
@@ -26523,10 +26525,10 @@ var _mw11 = (Command, cs, config, o2) => [
   $getSsecPlugin(config)
 ];
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/schemas/schemas_0.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/schemas/schemas_0.js
 var import_schema = __toESM(require_schema(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/models/S3ServiceException.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/models/S3ServiceException.js
 var import_client4 = __toESM(require_client(), 1);
 class S3ServiceException extends import_client4.ServiceException {
   constructor(options) {
@@ -26535,7 +26537,7 @@ class S3ServiceException extends import_client4.ServiceException {
   }
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/models/errors.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/models/errors.js
 class NoSuchUpload extends S3ServiceException {
   name = "NoSuchUpload";
   $fault = "client";
@@ -26813,7 +26815,7 @@ class ObjectAlreadyInActiveTierError extends S3ServiceException {
   }
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/schemas/schemas_0.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/schemas/schemas_0.js
 var _A = "Account";
 var _AAO = "AnalyticsAndOperator";
 var _AC = "AccelerateConfiguration";
@@ -32265,13 +32267,13 @@ var WriteGetObjectResponse$ = [
   () => __Unit
 ];
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/commands/CreateSessionCommand.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/CreateSessionCommand.js
 class CreateSessionCommand extends command(_ep4, _mw0, "CreateSession", CreateSession$) {
 }
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/package.json
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/package.json
 var package_default2 = {
   name: "@aws-sdk/client-s3",
-  version: "3.1126.0",
+  version: "3.1127.0",
   description: "AWS SDK for JavaScript S3 Client for Node.js, Browser and React Native",
   homepage: "https://github.com/aws/aws-sdk-js-v3/tree/main/clients/client-s3",
   license: "Apache-2.0",
@@ -32338,7 +32340,7 @@ var package_default2 = {
     tslib: "^2.6.2"
   },
   devDependencies: {
-    "@aws-sdk/signature-v4-crt": "3.1126.0",
+    "@aws-sdk/signature-v4-crt": "3.1127.0",
     "@smithy/snapshot-testing": "^2.3.2",
     "@tsconfig/node20": "20.1.8",
     "@types/node": "^20.14.8",
@@ -32353,7 +32355,7 @@ var package_default2 = {
   }
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var import_client19 = __toESM(require_client2(), 1);
 var import_httpAuthSchemes3 = __toESM(require_httpAuthSchemes(), 1);
 
@@ -32510,7 +32512,7 @@ var defaultProvider = (init = {}) => memoizeChain([
   }
 ], credentialsTreatedAsExpired);
 var credentialsTreatedAsExpired = (credentials) => credentials?.expiration !== undefined && credentials.expiration.getTime() - Date.now() < 300000;
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var import_checksum2 = __toESM(require_checksum(), 1);
 var import_client20 = __toESM(require_client(), 1);
 var import_config28 = __toESM(require_config(), 1);
@@ -32748,7 +32750,7 @@ var subtle = typeof digest === "function" && typeof sign2 === "function" && type
 var MAX_PENDING_BYTES = 8 * 1024 * 1024;
 var $Sha1 = Sha1Node;
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.shared.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.shared.js
 var import_httpAuthSchemes2 = __toESM(require_httpAuthSchemes(), 1);
 var import_signature_v4_multi_region2 = __toESM(require_dist_cjs4(), 1);
 var import_checksum = __toESM(require_checksum(), 1);
@@ -32800,7 +32802,7 @@ var getRuntimeConfig2 = (config) => {
   };
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeConfig.js
 var getRuntimeConfig3 = (config) => {
   import_client20.emitWarningIfUnsupportedVersion(process.version);
   const defaultsMode = import_config28.resolveDefaultsModeConfig(config);
@@ -32841,12 +32843,12 @@ var getRuntimeConfig3 = (config) => {
   };
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
 var import_client21 = __toESM(require_client2(), 1);
 var import_client22 = __toESM(require_client(), 1);
 var import_protocols5 = __toESM(require_protocols(), 1);
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthExtensionConfiguration.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/auth/httpAuthExtensionConfiguration.js
 var getHttpAuthExtensionConfiguration2 = (runtimeConfig) => {
   const _httpAuthSchemes = runtimeConfig.httpAuthSchemes;
   let _httpAuthSchemeProvider = runtimeConfig.httpAuthSchemeProvider;
@@ -32885,14 +32887,14 @@ var resolveHttpAuthRuntimeConfig2 = (config) => {
   };
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/runtimeExtensions.js
 var resolveRuntimeExtensions2 = (runtimeConfig, extensions) => {
   const extensionConfiguration = Object.assign(import_client21.getAwsRegionExtensionConfiguration(runtimeConfig), import_client22.getDefaultExtensionConfiguration(runtimeConfig), import_protocols5.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration2(runtimeConfig));
   extensions.forEach((extension) => extension.configure(extensionConfiguration));
   return Object.assign(runtimeConfig, import_client21.resolveAwsRegionExtensionConfiguration(extensionConfiguration), import_client22.resolveDefaultRuntimeConfig(extensionConfiguration), import_protocols5.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig2(extensionConfiguration));
 };
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/S3Client.js
 class S3Client extends import_client24.Client {
   config;
   constructor(...[configuration]) {
@@ -32937,15 +32939,15 @@ class S3Client extends import_client24.Client {
   }
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/commands/DeleteObjectCommand.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/DeleteObjectCommand.js
 class DeleteObjectCommand extends command(_ep0, _mw0, "DeleteObject", DeleteObject$) {
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/commands/GetObjectCommand.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/GetObjectCommand.js
 class GetObjectCommand extends command(_ep0, _mw7, "GetObject", GetObject$) {
 }
 
-// ../../node_modules/.bun/@aws-sdk+client-s3@3.1126.0/node_modules/@aws-sdk/client-s3/dist-es/commands/PutObjectCommand.js
+// ../../node_modules/.bun/@aws-sdk+client-s3@3.1127.0/node_modules/@aws-sdk/client-s3/dist-es/commands/PutObjectCommand.js
 class PutObjectCommand extends command(_ep0, _mw11, "PutObject", PutObject$) {
 }
 
@@ -33232,12 +33234,7 @@ import { homedir as homedir2 } from "os";
 import { join as join2, resolve } from "path";
 import { homedir as pathsResolverHomedir } from "os";
 import { join as pathsResolverJoin } from "path";
-var PATHS_RESOLVER_KIND_ENV = {
-  config: "HASNA_CONFIG_HOME",
-  data: "HASNA_DATA_HOME",
-  state: "HASNA_STATE_HOME",
-  cache: "HASNA_CACHE_HOME"
-};
+var PATHS_RESOLVER_DATA_ENV = "HASNA_DATA_HOME";
 var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 function pathsResolverAssertApp(app) {
   if (typeof app !== "string" || app.length === 0) {
@@ -33247,48 +33244,19 @@ function pathsResolverAssertApp(app) {
     throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
   }
 }
-function pathsResolverAssertKind(kind) {
-  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
-    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
-  }
-}
-function pathsResolverBaseDir(kind, options) {
-  pathsResolverAssertKind(kind);
+function pathsResolverDataBaseDir(options) {
   const env = options.env ?? process.env;
-  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  const override = env[PATHS_RESOLVER_DATA_ENV];
   if (typeof override === "string" && override.length > 0)
     return override;
   const home = options.home ?? pathsResolverHomedir();
   const platform = options.platform ?? process.platform;
-  if (platform === "darwin") {
-    switch (kind) {
-      case "config":
-      case "data":
-        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
-      case "cache":
-        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
-      case "state":
-        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
-    }
-  }
-  switch (kind) {
-    case "config":
-      return pathsResolverJoin(home, ".config", "hasna");
-    case "data":
-      return pathsResolverJoin(home, ".local", "share", "hasna");
-    case "state":
-      return pathsResolverJoin(home, ".local", "state", "hasna");
-    case "cache":
-      return pathsResolverJoin(home, ".cache", "hasna");
-  }
+  return platform === "darwin" ? pathsResolverJoin(home, "Library", "Application Support", "Hasna") : pathsResolverJoin(home, ".local", "share", "hasna");
 }
-function pathsResolverResolve(kind, options) {
+function dataDir(options) {
   pathsResolverAssertApp(options.app);
   const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
-  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
-}
-function dataDir(options) {
-  return pathsResolverResolve("data", options);
+  return pathsResolverJoin(pathsResolverDataBaseDir(options), appSegment);
 }
 var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
 var HASNA_SKILLS_HOME_ENV = "HASNA_SKILLS_HOME";

package/dist/admin-contract.d.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v3";
 /** Version of the public, contract-only Skills administration API surface. */
 export declare const SKILLS_ADMIN_API_CONTRACT_VERSION: "1.0.0";
 export declare const SKILLS_ADMIN_ENV_URL: "HASNA_SKILLS_API_URL";
@@ -1561,27 +1561,30 @@ export declare const SkillsAdminListUsersResponseSchema: z.ZodObject<{
     users: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         email: z.ZodString;
-        role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
         organizationId: z.ZodOptional<z.ZodString>;
         metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         createdAt: z.ZodString;
+    } & {
+        role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         id: z.ZodString;
         email: z.ZodString;
-        role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
         organizationId: z.ZodOptional<z.ZodString>;
         metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         createdAt: z.ZodString;
+    } & {
+        role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         id: z.ZodString;
         email: z.ZodString;
-        role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
         organizationId: z.ZodOptional<z.ZodString>;
         metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         createdAt: z.ZodString;
+    } & {
+        role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
     }, z.ZodTypeAny, "passthrough">>, "many">;
     limit: z.ZodNumber;
     offset: z.ZodNumber;
@@ -1589,27 +1592,30 @@ export declare const SkillsAdminListUsersResponseSchema: z.ZodObject<{
     users: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         email: z.ZodString;
-        role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
         organizationId: z.ZodOptional<z.ZodString>;
         metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         createdAt: z.ZodString;
+    } & {
+        role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         id: z.ZodString;
         email: z.ZodString;
-        role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
         organizationId: z.ZodOptional<z.ZodString>;
         metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         createdAt: z.ZodString;
+    } & {
+        role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         id: z.ZodString;
         email: z.ZodString;
-        role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
         organizationId: z.ZodOptional<z.ZodString>;
         metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         createdAt: z.ZodString;
+    } & {
+        role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
     }, z.ZodTypeAny, "passthrough">>, "many">;
     limit: z.ZodNumber;
     offset: z.ZodNumber;
@@ -1617,27 +1623,30 @@ export declare const SkillsAdminListUsersResponseSchema: z.ZodObject<{
     users: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         email: z.ZodString;
-        role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
         organizationId: z.ZodOptional<z.ZodString>;
         metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         createdAt: z.ZodString;
+    } & {
+        role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         id: z.ZodString;
         email: z.ZodString;
-        role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
         organizationId: z.ZodOptional<z.ZodString>;
         metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         createdAt: z.ZodString;
+    } & {
+        role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         id: z.ZodString;
         email: z.ZodString;
-        role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
         organizationId: z.ZodOptional<z.ZodString>;
         metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         createdAt: z.ZodString;
+    } & {
+        role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
     }, z.ZodTypeAny, "passthrough">>, "many">;
     limit: z.ZodNumber;
     offset: z.ZodNumber;
@@ -4405,27 +4414,30 @@ export declare const SKILLS_ADMIN_OPERATIONS: {
             users: z.ZodArray<z.ZodObject<{
                 id: z.ZodString;
                 email: z.ZodString;
-                role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
                 organizationId: z.ZodOptional<z.ZodString>;
                 metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
                 lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 createdAt: z.ZodString;
+            } & {
+                role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
             }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
                 id: z.ZodString;
                 email: z.ZodString;
-                role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
                 organizationId: z.ZodOptional<z.ZodString>;
                 metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
                 lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 createdAt: z.ZodString;
+            } & {
+                role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
             }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
                 id: z.ZodString;
                 email: z.ZodString;
-                role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
                 organizationId: z.ZodOptional<z.ZodString>;
                 metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
                 lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 createdAt: z.ZodString;
+            } & {
+                role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
             }, z.ZodTypeAny, "passthrough">>, "many">;
             limit: z.ZodNumber;
             offset: z.ZodNumber;
@@ -4433,27 +4445,30 @@ export declare const SKILLS_ADMIN_OPERATIONS: {
             users: z.ZodArray<z.ZodObject<{
                 id: z.ZodString;
                 email: z.ZodString;
-                role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
                 organizationId: z.ZodOptional<z.ZodString>;
                 metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
                 lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 createdAt: z.ZodString;
+            } & {
+                role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
             }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
                 id: z.ZodString;
                 email: z.ZodString;
-                role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
                 organizationId: z.ZodOptional<z.ZodString>;
                 metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
                 lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 createdAt: z.ZodString;
+            } & {
+                role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
             }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
                 id: z.ZodString;
                 email: z.ZodString;
-                role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
                 organizationId: z.ZodOptional<z.ZodString>;
                 metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
                 lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 createdAt: z.ZodString;
+            } & {
+                role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
             }, z.ZodTypeAny, "passthrough">>, "many">;
             limit: z.ZodNumber;
             offset: z.ZodNumber;
@@ -4461,27 +4476,30 @@ export declare const SKILLS_ADMIN_OPERATIONS: {
             users: z.ZodArray<z.ZodObject<{
                 id: z.ZodString;
                 email: z.ZodString;
-                role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
                 organizationId: z.ZodOptional<z.ZodString>;
                 metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
                 lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 createdAt: z.ZodString;
+            } & {
+                role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
             }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
                 id: z.ZodString;
                 email: z.ZodString;
-                role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
                 organizationId: z.ZodOptional<z.ZodString>;
                 metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
                 lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 createdAt: z.ZodString;
+            } & {
+                role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
             }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
                 id: z.ZodString;
                 email: z.ZodString;
-                role: z.ZodEnum<["owner", "admin", "member", "viewer"]>;
                 organizationId: z.ZodOptional<z.ZodString>;
                 metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
                 lastLoginAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 createdAt: z.ZodString;
+            } & {
+                role: z.ZodNullable<z.ZodEnum<["owner", "admin", "member", "viewer"]>>;
             }, z.ZodTypeAny, "passthrough">>, "many">;
             limit: z.ZodNumber;
             offset: z.ZodNumber;

package/dist/admin-contract.js

@@ -4249,7 +4249,7 @@ var SkillsAdminSuspendOrganizationResponseSchema = exports_external.object({
   organization: exports_external.object({ id: identifier, slug: exports_external.string().min(1), metadata }).passthrough()
 }).passthrough();
 var SkillsAdminListUsersResponseSchema = exports_external.object({
-  users: exports_external.array(SkillsAdminUserSchema),
+  users: exports_external.array(SkillsAdminUserSchema.extend({ role: SkillsAdminUserSchema.shape.role.nullable() })),
   limit: positiveInt,
   offset: nonNegativeInt
 }).passthrough();

package/dist/cli/cli.test-utils.d.ts

@@ -16,15 +16,17 @@ export declare const PACKAGE_VERSION: string;
 export declare const SLOW_TEST_TIMEOUT = 30000;
 export declare const CLEAN_CLI_HOME: string;
 /**
- * The one line an unconfigured install is allowed to print on stderr.
+ * The one line an opted-in local install is allowed to print on stderr.
  *
- * Local mode announces itself (owner ruling 2026-09-04, hasna/apps#1720): with no
- * credential and no API URL, the CLI says once, per process, that it is running
- * on this machine. That is not the deleted onboarding nudge — it demands no
- * choice and asks no question — but it does mean "stderr is empty" is the wrong
- * assertion for a local command. Use {@link stderrWithoutLocalNotice}, which
- * strips exactly this line and nothing else, so an unexpected warning still
- * fails the test it would have failed before.
+ * Local mode is opt-in only and announces itself (owner ruling 2026-09-04,
+ * hasna/apps#1720; class-patch order 2026-09-06): with the explicit
+ * `HASNA_SKILLS_LOCAL=1` opt-in and no API credential or URL, the CLI says
+ * once, per process, that it is running on this machine. The harness below
+ * passes the opt-in itself, so the suite's local runs are deliberate ones —
+ * and "stderr is empty" remains the wrong assertion for a local command. Use
+ * {@link stderrWithoutLocalNotice}, which strips exactly this line and nothing
+ * else, so an unexpected warning still fails the test it would have failed
+ * before.
  */
 export declare const LOCAL_MODE_NOTICE_MARKER = "skills: local mode";
 /** `stderr` with the single local-mode notice line removed. */

package/dist/cli/commands/customer-profile.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerCustomerProfileCommands(program: Command): void;

package/dist/cli/commands/customer-verification.d.ts

@@ -0,0 +1,5 @@
+export declare class NameInputError extends Error {
+}
+/** OTP enters through stdin, never a new command-line credential argument. */
+export declare function readCode(): Promise<string>;
+export declare function promptCode(): Promise<string | null>;

package/dist/cli/commands/tool-primitives.d.ts

@@ -1,2 +1,2 @@
-import type { Command } from "commander";
+import { type Command } from "commander";
 export declare function registerToolPrimitives(parent: Command): void;

package/dist/cli/commands/workspace-member-mutations.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerWorkspaceMemberMutationCommands(workspace: Command): void;

package/dist/cli/commands/workspace-members.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerWorkspaceMembersCommand(workspace: Command): void;

package/dist/cli/commands/workspace-selection.d.ts

@@ -0,0 +1,11 @@
+import type { Command } from "commander";
+type Options = {
+    email?: string;
+    codeStdin?: boolean;
+    json?: boolean;
+};
+export declare function registerWorkspaceListCommand(workspace: Command): void;
+export declare function loginWorkspace(options: Options & {
+    membershipId: string;
+}): Promise<void>;
+export {};

package/dist/cli/env-assignment.d.ts

@@ -0,0 +1,9 @@
+export declare class EnvAssignmentError extends Error {
+}
+/** Change only exact assignments to one valid key; reject ambiguous layouts before any write. */
+export declare function prepareEnvAssignment(assignment: string, existing: string): {
+    key: string;
+    content: string;
+};
+/** Use one regular-file descriptor; never follow a link or create a file for invalid input. */
+export declare function setEnvAssignment(path: string, assignment: string): string;