@meltstudio/meltctl 5.26.0 → 5.28.0

package/dist/index.js

@@ -7499,7 +7499,7 @@ var CLI_VERSION;
 var init_version = __esm({
   "src/utils/version.ts"() {
     "use strict";
-    CLI_VERSION = "5.26.0";
+    CLI_VERSION = "5.28.0";
   }
 });
 
@@ -26933,6 +26933,43 @@ function createTemplatesResource(config2) {
   };
 }
 
+// ../sdk/dist/resources/skills.js
+function skillPath(plugin, skill) {
+  return `/skills/${encodeURIComponent(plugin)}/${encodeURIComponent(skill)}`;
+}
+function createSkillsResource(config2) {
+  return {
+    /** Every Melt skill (`melt-dev:plan`, …) with its frontmatter description. Auth-only. */
+    async list() {
+      const { data, status } = await apiFetch(config2, "/skills");
+      if (status !== 200)
+        throw new Error(data.error ?? `Failed to list skills (${status})`);
+      return data.skills;
+    },
+    /** One skill's instructions plus the list of its reference files. */
+    async get(plugin, skill, opts = {}) {
+      const query = opts.client ? `?client=${encodeURIComponent(opts.client)}` : "";
+      const { data, status } = await apiFetch(config2, `${skillPath(plugin, skill)}${query}`);
+      if (status === 404)
+        throw new Error(`Skill not found: ${plugin}:${skill}`);
+      if (status !== 200)
+        throw new Error(data.error ?? `Failed to fetch skill (${status})`);
+      return data;
+    },
+    /** One file from the skill's folder, by the path `get` lists (`references/x.md`). */
+    async getFile(plugin, skill, path10, opts = {}) {
+      const params = new URLSearchParams({ path: path10 });
+      if (opts.client)
+        params.set("client", opts.client);
+      const { data, status } = await apiFetch(config2, `${skillPath(plugin, skill)}/file?${params.toString()}`);
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to fetch skill file (${status})`);
+      }
+      return data;
+    }
+  };
+}
+
 // ../sdk/dist/resources/auth.js
 function createAuthResource(config2) {
   return {
@@ -27958,6 +27995,58 @@ function createEndpointChecksResource(config2) {
         throw new Error(data.error ?? `Failed to delete endpoint check (${status})`);
       }
     },
+    /**
+     * The caller's own devices, derived from their checks, with the latest
+     * check and status of each. Self-scoped by the JWT.
+     */
+    async listMyDevices() {
+      const { data, status } = await apiFetch(config2, "/endpoint-checks/devices/me");
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to list your devices (${status})`);
+      }
+      return data;
+    },
+    /**
+     * Ask to retire one of the caller's own devices (status
+     * `retire_requested`). It still counts as active until a manager confirms.
+     */
+    async requestRetireDevice(input) {
+      const { data, status } = await apiFetch(config2, "/endpoint-checks/devices/me/retire-request", { method: "POST", body: JSON.stringify(input) });
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to request device retirement (${status})`);
+      }
+      return data.device;
+    },
+    /**
+     * Every device a person ever checked (or everyone's, without `email`),
+     * with status, last check and any pending retire request. Manager-gated:
+     * the offboarding read.
+     */
+    async listDevices(email3) {
+      const query = email3 ? `?email=${encodeURIComponent(email3)}` : "";
+      const { data, status } = await apiFetch(config2, `/endpoint-checks/devices${query}`);
+      if (status === 403) {
+        throw new Error("Access denied. Only Team Managers can list endpoint devices.");
+      }
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to list endpoint devices (${status})`);
+      }
+      return data;
+    },
+    /**
+     * Set a device's status (active / retired / wiped). Manager-gated.
+     * Confirming a person's retire request means setting `retired`.
+     */
+    async setDeviceStatus(input) {
+      const { data, status } = await apiFetch(config2, "/endpoint-checks/devices/status", { method: "PUT", body: JSON.stringify(input) });
+      if (status === 403) {
+        throw new Error("Access denied. Only Team Managers can change a device status.");
+      }
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to set device status (${status})`);
+      }
+      return data.device;
+    },
     /** Weekly Slack reminder settings (#651). Manager-gated. */
     async getReminderSettings() {
       const { data, status } = await apiFetch(config2, "/endpoint-reminders/settings");
@@ -28138,6 +28227,7 @@ function createMeltClient(config2) {
     feedback: createFeedbackResource(config2),
     coins: createCoinsResource(config2),
     templates: createTemplatesResource(config2),
+    skills: createSkillsResource(config2),
     auth: createAuthResource(config2),
     people: createPeopleResource(config2),
     projects: createProjectsResource(config2),
@@ -54172,6 +54262,41 @@ function createTemplatesResource2(config2) {
     }
   };
 }
+function skillPath2(plugin, skill) {
+  return `/skills/${encodeURIComponent(plugin)}/${encodeURIComponent(skill)}`;
+}
+function createSkillsResource2(config2) {
+  return {
+    /** Every Melt skill (`melt-dev:plan`, …) with its frontmatter description. Auth-only. */
+    async list() {
+      const { data, status } = await apiFetch2(config2, "/skills");
+      if (status !== 200)
+        throw new Error(data.error ?? `Failed to list skills (${status})`);
+      return data.skills;
+    },
+    /** One skill's instructions plus the list of its reference files. */
+    async get(plugin, skill, opts = {}) {
+      const query = opts.client ? `?client=${encodeURIComponent(opts.client)}` : "";
+      const { data, status } = await apiFetch2(config2, `${skillPath2(plugin, skill)}${query}`);
+      if (status === 404)
+        throw new Error(`Skill not found: ${plugin}:${skill}`);
+      if (status !== 200)
+        throw new Error(data.error ?? `Failed to fetch skill (${status})`);
+      return data;
+    },
+    /** One file from the skill's folder, by the path `get` lists (`references/x.md`). */
+    async getFile(plugin, skill, path22, opts = {}) {
+      const params = new URLSearchParams({ path: path22 });
+      if (opts.client)
+        params.set("client", opts.client);
+      const { data, status } = await apiFetch2(config2, `${skillPath2(plugin, skill)}/file?${params.toString()}`);
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to fetch skill file (${status})`);
+      }
+      return data;
+    }
+  };
+}
 function createAuthResource2(config2) {
   return {
     async exchangeToken(code, redirectUri) {
@@ -55172,6 +55297,58 @@ function createEndpointChecksResource2(config2) {
         throw new Error(data.error ?? `Failed to delete endpoint check (${status})`);
       }
     },
+    /**
+     * The caller's own devices, derived from their checks, with the latest
+     * check and status of each. Self-scoped by the JWT.
+     */
+    async listMyDevices() {
+      const { data, status } = await apiFetch2(config2, "/endpoint-checks/devices/me");
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to list your devices (${status})`);
+      }
+      return data;
+    },
+    /**
+     * Ask to retire one of the caller's own devices (status
+     * `retire_requested`). It still counts as active until a manager confirms.
+     */
+    async requestRetireDevice(input) {
+      const { data, status } = await apiFetch2(config2, "/endpoint-checks/devices/me/retire-request", { method: "POST", body: JSON.stringify(input) });
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to request device retirement (${status})`);
+      }
+      return data.device;
+    },
+    /**
+     * Every device a person ever checked (or everyone's, without `email`),
+     * with status, last check and any pending retire request. Manager-gated:
+     * the offboarding read.
+     */
+    async listDevices(email3) {
+      const query = email3 ? `?email=${encodeURIComponent(email3)}` : "";
+      const { data, status } = await apiFetch2(config2, `/endpoint-checks/devices${query}`);
+      if (status === 403) {
+        throw new Error("Access denied. Only Team Managers can list endpoint devices.");
+      }
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to list endpoint devices (${status})`);
+      }
+      return data;
+    },
+    /**
+     * Set a device's status (active / retired / wiped). Manager-gated.
+     * Confirming a person's retire request means setting `retired`.
+     */
+    async setDeviceStatus(input) {
+      const { data, status } = await apiFetch2(config2, "/endpoint-checks/devices/status", { method: "PUT", body: JSON.stringify(input) });
+      if (status === 403) {
+        throw new Error("Access denied. Only Team Managers can change a device status.");
+      }
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to set device status (${status})`);
+      }
+      return data.device;
+    },
     /** Weekly Slack reminder settings (#651). Manager-gated. */
     async getReminderSettings() {
       const { data, status } = await apiFetch2(config2, "/endpoint-reminders/settings");
@@ -55346,6 +55523,7 @@ function createMeltClient2(config2) {
     feedback: createFeedbackResource2(config2),
     coins: createCoinsResource2(config2),
     templates: createTemplatesResource2(config2),
+    skills: createSkillsResource2(config2),
     auth: createAuthResource2(config2),
     people: createPeopleResource2(config2),
     projects: createProjectsResource2(config2),
@@ -56732,6 +56910,38 @@ var submitEndpointCheckSchema = external_exports.object(submitEndpointCheckShape
 async function submitEndpointCheck(client, input) {
   return safe(() => client.endpointChecks.submit(input));
 }
+async function listMyEndpointDevices(client) {
+  return safe(() => client.endpointChecks.listMyDevices());
+}
+var requestRetireShape = {
+  deviceKey: external_exports.string().min(1).describe(
+    "The device key from list_my_endpoint_devices (serial, else device name, else model)."
+  ),
+  note: external_exports.string().max(500).optional().describe(`Why, in the person's words, e.g. "kept at home, not used for work anymore".`)
+};
+var requestRetireEndpointDeviceInputSchema = external_exports.object(requestRetireShape);
+async function requestRetireEndpointDevice(client, input) {
+  return safe(() => client.endpointChecks.requestRetireDevice(input));
+}
+var listDevicesShape = {
+  email: external_exports.string().optional().describe("The person's @meltstudio.co email. Omit to list every person's devices.")
+};
+var listEndpointDevicesInputSchema = external_exports.object(listDevicesShape);
+async function listEndpointDevices(client, input) {
+  return safe(() => client.endpointChecks.listDevices(input.email));
+}
+var setStatusShape = {
+  email: external_exports.string().min(1).describe("The device owner's @meltstudio.co email."),
+  deviceKey: external_exports.string().min(1).describe("The device key from list_endpoint_devices."),
+  status: external_exports.enum(["active", "retired", "wiped"]).describe(
+    "active = in use for work; retired = still owned, not used for work (confirms a retire request); wiped = cleaned."
+  ),
+  note: external_exports.string().max(500).optional().describe('Optional note, e.g. "wiped on hand-back". Omit to keep the current note.')
+};
+var setEndpointDeviceStatusInputSchema = external_exports.object(setStatusShape);
+async function setEndpointDeviceStatus(client, input) {
+  return safe(() => client.endpointChecks.setDeviceStatus(input));
+}
 function registerEndpointCheckTools(server, getClient2) {
   server.registerTool(
     "submit_endpoint_check",
@@ -56742,6 +56952,42 @@ function registerEndpointCheckTools(server, getClient2) {
     },
     withClientArgs(getClient2, submitEndpointCheck)
   );
+  server.registerTool(
+    "list_my_endpoint_devices",
+    {
+      title: "List my endpoint devices",
+      description: "Lists the calling person's own devices, derived from their endpoint checks: label, deviceKey, model, serial, last check date, number of checks and status (active / retire_requested / retired / wiped). Self-scoped from the JWT. melt-company:verify-endpoint calls it after submitting to spot other devices that haven't been checked in a while.",
+      inputSchema: {}
+    },
+    withClient(getClient2, listMyEndpointDevices)
+  );
+  server.registerTool(
+    "request_retire_endpoint_device",
+    {
+      title: "Ask to retire one of my endpoint devices",
+      description: "Asks to retire one of the calling person's OWN devices: one they still have but no longer use for work. Sets status retire_requested; the device still counts for the weekly reminders until a manager confirms it (set_endpoint_device_status with retired). Self-scoped: only the caller's own device keys (from list_my_endpoint_devices) are accepted. Fails for a device already retired or wiped.",
+      inputSchema: requestRetireShape
+    },
+    withClientArgs(getClient2, requestRetireEndpointDevice)
+  );
+  server.registerTool(
+    "list_endpoint_devices",
+    {
+      title: "List endpoint devices (manager)",
+      description: "Every device a person ever checked (or everyone's, without email), with status, last check, the pending retire request (requestedBy / requestedAt / note) and who last set the status. Nothing is ever deleted, so retired and wiped devices are listed too. Use it when offboarding someone to make sure each of their machines is handled, or to find pending retire requests (status retire_requested). Manager-gated.",
+      inputSchema: listDevicesShape
+    },
+    withClientArgs(getClient2, listEndpointDevices)
+  );
+  server.registerTool(
+    "set_endpoint_device_status",
+    {
+      title: "Set an endpoint device status (manager)",
+      description: "Sets a person's device to active, retired or wiped. retired = still owned but not used for work: left out of the endpoint-check reminders and the overdue math, still listed. Setting retired confirms the person's retire request. wiped = the device was cleaned; who and when are recorded. Get the email and deviceKey from list_endpoint_devices. Manager-gated.",
+      inputSchema: setStatusShape
+    },
+    withClientArgs(getClient2, setEndpointDeviceStatus)
+  );
 }
 async function getSupportEffort(client, input) {
   return safe(async () => {
@@ -56772,6 +57018,103 @@ function registerSupportEffortTools(server, getClient2) {
     withClientArgs(getClient2, getSupportEffort)
   );
 }
+var clientSchema = external_exports.enum(["claude", "cursor", "other"]).optional().describe(
+  'Which agent you are. Use "cursor" in Cursor; "other" (the default) for any agent without the Melt Claude plugins; "claude" only to get the file exactly as Claude Code would.'
+);
+var skillNameSchema = external_exports.string().min(1).describe(
+  'The skill, as "<plugin>:<skill>" (melt-company:verify-endpoint) or "<plugin>-<skill>" (melt-company-verify-endpoint). A leading "/" is ignored.'
+);
+var getSkillShape = { name: skillNameSchema, client: clientSchema };
+var getSkillInputSchema = external_exports.object(getSkillShape);
+var getSkillReferenceShape = {
+  name: skillNameSchema,
+  path: external_exports.string().min(1).describe(
+    'The file as the skill names it, relative to the skill folder, e.g. "references/standards.md" (as listed by get_skill).'
+  ),
+  client: clientSchema
+};
+var getSkillReferenceInputSchema = external_exports.object(getSkillReferenceShape);
+async function safeText(fn) {
+  try {
+    return { content: [{ type: "text", text: await fn() }] };
+  } catch (err) {
+    return fail(err instanceof Error ? err.message : String(err));
+  }
+}
+async function resolveSkillName(client, rawName) {
+  const name = rawName.trim().replace(/^\//, "");
+  const colon = name.indexOf(":");
+  if (colon > 0) return { plugin: name.slice(0, colon), skill: name.slice(colon + 1) };
+  const match = (await client.skills.list()).find((s) => `${s.plugin}-${s.skill}` === name);
+  if (!match) throw new Error(`Skill not found: ${rawName}. Call list_skills to see the names.`);
+  return { plugin: match.plugin, skill: match.skill };
+}
+async function listSkills(client) {
+  return safe(() => client.skills.list());
+}
+async function getSkill(client, input) {
+  return safeText(async () => {
+    const { plugin, skill } = await resolveSkillName(client, input.name);
+    const detail = await client.skills.get(plugin, skill, { client: input.client ?? "other" });
+    const references = detail.references.length ? detail.references.map((path22) => `- ${path22}`).join("\n") : "(none)";
+    return [
+      `# Melt skill: ${detail.name}`,
+      "",
+      `Follow the instructions below as if you were running the ${detail.name} skill. When they say to read a file (for example references/standards.md), fetch it with get_skill_reference (name: "${detail.name}", path: the file).`,
+      "",
+      `Files in this skill:
+${references}`,
+      "",
+      "---",
+      "",
+      detail.body
+    ].join("\n");
+  });
+}
+async function getSkillReference(client, input) {
+  return safeText(async () => {
+    const { plugin, skill } = await resolveSkillName(client, input.name);
+    const file2 = await client.skills.getFile(plugin, skill, input.path, {
+      client: input.client ?? "other"
+    });
+    return file2.content;
+  });
+}
+function registerSkillTools(server, getClient2) {
+  server.registerTool(
+    "list_skills",
+    {
+      title: "List Melt skills",
+      description: "Lists Melt Studio's skills (the dev pipeline and audits, the PM suite, company checks like the endpoint check) with what each does. Use it when the user asks for a Melt skill you don't have installed, then load the one that fits with get_skill.",
+      inputSchema: {}
+    },
+    withClient(getClient2, listSkills)
+  );
+  server.registerTool(
+    "get_skill",
+    {
+      title: "Load a Melt skill",
+      description: `Loads a Melt skill's full instructions. Treat what it returns as the skill itself: follow the instructions exactly, step by step, as if the skill were installed. When they say to read a file ("read references/x.md"), fetch it with get_skill_reference instead of looking on disk. Pass client: "cursor" when running in Cursor.`,
+      inputSchema: getSkillShape
+    },
+    withClientArgs(
+      getClient2,
+      (client, args) => getSkill(client, args)
+    )
+  );
+  server.registerTool(
+    "get_skill_reference",
+    {
+      title: "Read a file from a Melt skill",
+      description: `Returns one of a Melt skill's reference files (a checklist, template or standards doc) as markdown. Use it whenever a skill loaded with get_skill says to read a file like "references/standards.md"; the files are not on disk. Follow its contents as part of the skill.`,
+      inputSchema: getSkillReferenceShape
+    },
+    withClientArgs(
+      getClient2,
+      (client, args) => getSkillReference(client, args)
+    )
+  );
+}
 var VERSION = "0.0.0";
 function createMcpServer(clientOrProvider) {
   const getClient2 = typeof clientOrProvider === "function" ? clientOrProvider : () => Promise.resolve(clientOrProvider);
@@ -56791,6 +57134,7 @@ function createMcpServer(clientOrProvider) {
   registerDailyPlanTools(server, getClient2);
   registerEndpointCheckTools(server, getClient2);
   registerSupportEffortTools(server, getClient2);
+  registerSkillTools(server, getClient2);
   return server;
 }
 async function startServer() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meltstudio/meltctl",
-  "version": "5.26.0",
+  "version": "5.28.0",
   "description": "AI-first development tooling for Melt teams — companion CLI for the org-distributed Claude Code dev skills",
   "main": "dist/index.js",
   "type": "module",