@meltstudio/meltctl 5.27.0 → 5.29.0

package/dist/index.js

@@ -7499,7 +7499,7 @@ var CLI_VERSION;
 var init_version = __esm({
   "src/utils/version.ts"() {
     "use strict";
-    CLI_VERSION = "5.27.0";
+    CLI_VERSION = "5.29.0";
   }
 });
 
@@ -27995,6 +27995,87 @@ function createEndpointChecksResource(config2) {
         throw new Error(data.error ?? `Failed to delete endpoint check (${status})`);
       }
     },
+    /**
+     * The caller's own devices, derived from their checks, with the latest
+     * check and status of each. Self-scoped by the JWT.
+     */
+    async listMyDevices() {
+      const { data, status } = await apiFetch(config2, "/endpoint-checks/devices/me");
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to list your devices (${status})`);
+      }
+      return data;
+    },
+    /**
+     * Ask to retire one of the caller's own devices (status
+     * `retire_requested`). It still counts as active until a manager confirms.
+     */
+    async requestRetireDevice(input) {
+      const { data, status } = await apiFetch(config2, "/endpoint-checks/devices/me/retire-request", { method: "POST", body: JSON.stringify(input) });
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to request device retirement (${status})`);
+      }
+      return data.device;
+    },
+    /**
+     * Every device a person ever checked (or everyone's, without `email`),
+     * with status, last check and any pending retire request. Manager-gated:
+     * the offboarding read.
+     */
+    async listDevices(email3) {
+      const query = email3 ? `?email=${encodeURIComponent(email3)}` : "";
+      const { data, status } = await apiFetch(config2, `/endpoint-checks/devices${query}`);
+      if (status === 403) {
+        throw new Error("Access denied. Only Team Managers can list endpoint devices.");
+      }
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to list endpoint devices (${status})`);
+      }
+      return data;
+    },
+    /**
+     * Set a device's status (active / retired / wiped). Manager-gated.
+     * Confirming a person's retire request means setting `retired`.
+     */
+    async setDeviceStatus(input) {
+      const { data, status } = await apiFetch(config2, "/endpoint-checks/devices/status", { method: "PUT", body: JSON.stringify(input) });
+      if (status === 403) {
+        throw new Error("Access denied. Only Team Managers can change a device status.");
+      }
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to set device status (${status})`);
+      }
+      return data.device;
+    },
+    /**
+     * People exempt from the endpoint check (client-managed machines).
+     * Active ones only, unless `includeInactive`. Manager-gated.
+     */
+    async listExemptions(includeInactive = false) {
+      const query = includeInactive ? "?all=true" : "";
+      const { data, status } = await apiFetch(config2, `/endpoint-checks/exemptions${query}`);
+      if (status === 403) {
+        throw new Error("Access denied. Only Team Managers can list endpoint exemptions.");
+      }
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to list endpoint exemptions (${status})`);
+      }
+      return data;
+    },
+    /**
+     * Set (`active: true`) or clear (`active: false`) a person's exemption.
+     * Clearing keeps the row. Manager-gated.
+     */
+    async setExemption(input) {
+      const { data, status } = await apiFetch(config2, "/endpoint-checks/exemptions", { method: "PUT", body: JSON.stringify(input) });
+      if (status === 403) {
+        throw new Error("Access denied. Only Team Managers can change endpoint exemptions.");
+      }
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to set endpoint exemption (${status})`);
+      }
+      return data.exemption;
+    },
     /** Weekly Slack reminder settings (#651). Manager-gated. */
     async getReminderSettings() {
       const { data, status } = await apiFetch(config2, "/endpoint-reminders/settings");
@@ -55245,6 +55326,87 @@ function createEndpointChecksResource2(config2) {
         throw new Error(data.error ?? `Failed to delete endpoint check (${status})`);
       }
     },
+    /**
+     * The caller's own devices, derived from their checks, with the latest
+     * check and status of each. Self-scoped by the JWT.
+     */
+    async listMyDevices() {
+      const { data, status } = await apiFetch2(config2, "/endpoint-checks/devices/me");
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to list your devices (${status})`);
+      }
+      return data;
+    },
+    /**
+     * Ask to retire one of the caller's own devices (status
+     * `retire_requested`). It still counts as active until a manager confirms.
+     */
+    async requestRetireDevice(input) {
+      const { data, status } = await apiFetch2(config2, "/endpoint-checks/devices/me/retire-request", { method: "POST", body: JSON.stringify(input) });
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to request device retirement (${status})`);
+      }
+      return data.device;
+    },
+    /**
+     * Every device a person ever checked (or everyone's, without `email`),
+     * with status, last check and any pending retire request. Manager-gated:
+     * the offboarding read.
+     */
+    async listDevices(email3) {
+      const query = email3 ? `?email=${encodeURIComponent(email3)}` : "";
+      const { data, status } = await apiFetch2(config2, `/endpoint-checks/devices${query}`);
+      if (status === 403) {
+        throw new Error("Access denied. Only Team Managers can list endpoint devices.");
+      }
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to list endpoint devices (${status})`);
+      }
+      return data;
+    },
+    /**
+     * Set a device's status (active / retired / wiped). Manager-gated.
+     * Confirming a person's retire request means setting `retired`.
+     */
+    async setDeviceStatus(input) {
+      const { data, status } = await apiFetch2(config2, "/endpoint-checks/devices/status", { method: "PUT", body: JSON.stringify(input) });
+      if (status === 403) {
+        throw new Error("Access denied. Only Team Managers can change a device status.");
+      }
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to set device status (${status})`);
+      }
+      return data.device;
+    },
+    /**
+     * People exempt from the endpoint check (client-managed machines).
+     * Active ones only, unless `includeInactive`. Manager-gated.
+     */
+    async listExemptions(includeInactive = false) {
+      const query = includeInactive ? "?all=true" : "";
+      const { data, status } = await apiFetch2(config2, `/endpoint-checks/exemptions${query}`);
+      if (status === 403) {
+        throw new Error("Access denied. Only Team Managers can list endpoint exemptions.");
+      }
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to list endpoint exemptions (${status})`);
+      }
+      return data;
+    },
+    /**
+     * Set (`active: true`) or clear (`active: false`) a person's exemption.
+     * Clearing keeps the row. Manager-gated.
+     */
+    async setExemption(input) {
+      const { data, status } = await apiFetch2(config2, "/endpoint-checks/exemptions", { method: "PUT", body: JSON.stringify(input) });
+      if (status === 403) {
+        throw new Error("Access denied. Only Team Managers can change endpoint exemptions.");
+      }
+      if (status !== 200) {
+        throw new Error(data.error ?? `Failed to set endpoint exemption (${status})`);
+      }
+      return data.exemption;
+    },
     /** Weekly Slack reminder settings (#651). Manager-gated. */
     async getReminderSettings() {
       const { data, status } = await apiFetch2(config2, "/endpoint-reminders/settings");
@@ -56806,6 +56968,58 @@ var submitEndpointCheckSchema = external_exports.object(submitEndpointCheckShape
 async function submitEndpointCheck(client, input) {
   return safe(() => client.endpointChecks.submit(input));
 }
+async function listMyEndpointDevices(client) {
+  return safe(() => client.endpointChecks.listMyDevices());
+}
+var requestRetireShape = {
+  deviceKey: external_exports.string().min(1).describe(
+    "The device key from list_my_endpoint_devices (serial, else device name, else model)."
+  ),
+  note: external_exports.string().max(500).optional().describe(`Why, in the person's words, e.g. "kept at home, not used for work anymore".`)
+};
+var requestRetireEndpointDeviceInputSchema = external_exports.object(requestRetireShape);
+async function requestRetireEndpointDevice(client, input) {
+  return safe(() => client.endpointChecks.requestRetireDevice(input));
+}
+var listDevicesShape = {
+  email: external_exports.string().optional().describe("The person's @meltstudio.co email. Omit to list every person's devices.")
+};
+var listEndpointDevicesInputSchema = external_exports.object(listDevicesShape);
+async function listEndpointDevices(client, input) {
+  return safe(() => client.endpointChecks.listDevices(input.email));
+}
+var setStatusShape = {
+  email: external_exports.string().min(1).describe("The device owner's @meltstudio.co email."),
+  deviceKey: external_exports.string().min(1).describe("The device key from list_endpoint_devices."),
+  status: external_exports.enum(["active", "retired", "wiped"]).describe(
+    "active = in use for work; retired = still owned, not used for work (confirms a retire request); wiped = cleaned."
+  ),
+  note: external_exports.string().max(500).optional().describe('Optional note, e.g. "wiped on hand-back". Omit to keep the current note.')
+};
+var setEndpointDeviceStatusInputSchema = external_exports.object(setStatusShape);
+async function setEndpointDeviceStatus(client, input) {
+  return safe(() => client.endpointChecks.setDeviceStatus(input));
+}
+var listExemptionsShape = {
+  includeInactive: external_exports.boolean().optional().describe("Also list cleared exemptions (kept for history). Defaults to active only.")
+};
+var listEndpointExemptionsInputSchema = external_exports.object(listExemptionsShape);
+async function listEndpointExemptions(client, input) {
+  return safe(() => client.endpointChecks.listExemptions(input.includeInactive ?? false));
+}
+var setExemptionShape = {
+  email: external_exports.string().min(1).describe("The person's @meltstudio.co email."),
+  active: external_exports.boolean().describe("true sets the exemption; false clears it (the row is kept)."),
+  reason: external_exports.enum(["client_managed"]).optional().describe(
+    "client_managed = works on a machine the client provides and verifies itself. The default."
+  ),
+  clientName: external_exports.string().max(500).optional().describe('The client whose machine it is. Omit to keep the current one; "" clears it.'),
+  note: external_exports.string().max(500).optional().describe('Optional note, e.g. "client runs SOC 2 checks". Omit to keep the current one.')
+};
+var setEndpointExemptionInputSchema = external_exports.object(setExemptionShape);
+async function setEndpointExemption(client, input) {
+  return safe(() => client.endpointChecks.setExemption(input));
+}
 function registerEndpointCheckTools(server, getClient2) {
   server.registerTool(
     "submit_endpoint_check",
@@ -56816,6 +57030,60 @@ function registerEndpointCheckTools(server, getClient2) {
     },
     withClientArgs(getClient2, submitEndpointCheck)
   );
+  server.registerTool(
+    "list_my_endpoint_devices",
+    {
+      title: "List my endpoint devices",
+      description: "Lists the calling person's own devices, derived from their endpoint checks: label, deviceKey, model, serial, last check date, number of checks and status (active / retire_requested / retired / wiped). Self-scoped from the JWT. melt-company:verify-endpoint calls it after submitting to spot other devices that haven't been checked in a while.",
+      inputSchema: {}
+    },
+    withClient(getClient2, listMyEndpointDevices)
+  );
+  server.registerTool(
+    "request_retire_endpoint_device",
+    {
+      title: "Ask to retire one of my endpoint devices",
+      description: "Asks to retire one of the calling person's OWN devices: one they still have but no longer use for work. Sets status retire_requested; the device still counts for the weekly reminders until a manager confirms it (set_endpoint_device_status with retired). Self-scoped: only the caller's own device keys (from list_my_endpoint_devices) are accepted. Fails for a device already retired or wiped.",
+      inputSchema: requestRetireShape
+    },
+    withClientArgs(getClient2, requestRetireEndpointDevice)
+  );
+  server.registerTool(
+    "list_endpoint_devices",
+    {
+      title: "List endpoint devices (manager)",
+      description: "Every device a person ever checked (or everyone's, without email), with status, last check, the pending retire request (requestedBy / requestedAt / note) and who last set the status. Nothing is ever deleted, so retired and wiped devices are listed too. Use it when offboarding someone to make sure each of their machines is handled, or to find pending retire requests (status retire_requested). Manager-gated.",
+      inputSchema: listDevicesShape
+    },
+    withClientArgs(getClient2, listEndpointDevices)
+  );
+  server.registerTool(
+    "set_endpoint_device_status",
+    {
+      title: "Set an endpoint device status (manager)",
+      description: "Sets a person's device to active, retired or wiped. retired = still owned but not used for work: left out of the endpoint-check reminders and the overdue math, still listed. Setting retired confirms the person's retire request. wiped = the device was cleaned; who and when are recorded. Get the email and deviceKey from list_endpoint_devices. Manager-gated.",
+      inputSchema: setStatusShape
+    },
+    withClientArgs(getClient2, setEndpointDeviceStatus)
+  );
+  server.registerTool(
+    "list_endpoint_exemptions",
+    {
+      title: "List endpoint check exemptions (manager)",
+      description: "Lists the people exempt from the endpoint check because they work on a client-managed machine the client verifies itself (SOC 2 and similar): email, reason, client name, note, and who set it and when. Active ones only unless includeInactive. Exempt people get no reminders and are left out of the overdue and coverage numbers. Manager-gated.",
+      inputSchema: listExemptionsShape
+    },
+    withClientArgs(getClient2, listEndpointExemptions)
+  );
+  server.registerTool(
+    "set_endpoint_exemption",
+    {
+      title: "Set or clear an endpoint check exemption (manager)",
+      description: "Exempts a person from Melt's endpoint check (active true) because they work on a client-managed machine, or clears the exemption (active false; the row is kept for history). While active they get no weekly reminder DM, are never escalated and don't count as overdue on the dashboard. Any checks they already submitted stay. Pass the client's name when known. Manager-gated.",
+      inputSchema: setExemptionShape
+    },
+    withClientArgs(getClient2, setEndpointExemption)
+  );
 }
 async function getSupportEffort(client, input) {
   return safe(async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meltstudio/meltctl",
-  "version": "5.27.0",
+  "version": "5.29.0",
   "description": "AI-first development tooling for Melt teams — companion CLI for the org-distributed Claude Code dev skills",
   "main": "dist/index.js",
   "type": "module",