@modootoday/pmcp 0.7.1 → 0.8.1

package/dist/{chunk-IJPOJ6PG.js → chunk-K7BX33LH.js}

@@ -1,6 +1,6 @@
 import {
   createSkillServer
-} from "./chunk-C46YCY2I.js";
+} from "./chunk-HB4VJ5VW.js";
 
 // src/stdio.ts
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
@@ -8,10 +8,13 @@ function resolveRoots(argv, cwd) {
   const given = argv.filter((arg) => !arg.startsWith("-"));
   return given.length > 0 ? given : [`${cwd}/node_modules`];
 }
-function serve(catalog) {
+function serve(catalog, serving = {}) {
   const options = {
     ...catalog,
+    ...serving,
     onReject: ({ path, reason }) => process.stderr.write(`pmcp: skipped ${path}: ${reason}
+`),
+    onWarning: ({ path, reason }) => process.stderr.write(`pmcp: warning ${path}: ${reason}
 `)
   };
   serveStdio(() => createSkillServer(options), {
@@ -35,4 +38,4 @@ export {
   serve,
   main
 };
-//# sourceMappingURL=chunk-IJPOJ6PG.js.map
+//# sourceMappingURL=chunk-K7BX33LH.js.map

package/dist/{chunk-KP3TQ3QY.js → chunk-MO3LLVVY.js}

@@ -1,6 +1,6 @@
 import {
   normaliseIntent
-} from "./chunk-C46YCY2I.js";
+} from "./chunk-HB4VJ5VW.js";
 
 // src/cache.ts
 async function openDatabase(path) {
@@ -131,4 +131,4 @@ export {
   DEFAULT_INTENT_CACHE_LIMIT,
   openIntentCache
 };
-//# sourceMappingURL=chunk-KP3TQ3QY.js.map
+//# sourceMappingURL=chunk-MO3LLVVY.js.map

package/dist/{chunk-VBLAH6J2.js → chunk-STBBSQ3R.js}

@@ -1,6 +1,6 @@
 import {
   openDatabase
-} from "./chunk-KP3TQ3QY.js";
+} from "./chunk-MO3LLVVY.js";
 
 // src/embed.ts
 var DEFAULT_MODEL_ID = "Xenova/multilingual-e5-small";
@@ -157,4 +157,4 @@ export {
   encodeEntries,
   openEntryVectors
 };
-//# sourceMappingURL=chunk-VBLAH6J2.js.map
+//# sourceMappingURL=chunk-STBBSQ3R.js.map

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   loadEmbedder,
   openEntryVectors
-} from "./chunk-VBLAH6J2.js";
+} from "./chunk-STBBSQ3R.js";
 import {
   ConfigError,
   ProjectError,
@@ -14,16 +14,18 @@ import {
   readSpec,
   renderFrontmatter,
   spawnRunner,
-  splitFrontmatter
-} from "./chunk-GNJSZCRH.js";
-import "./chunk-KP3TQ3QY.js";
+  splitFrontmatter,
+  validateCatalog,
+  validateSkillDir
+} from "./chunk-DTQAN33I.js";
+import "./chunk-MO3LLVVY.js";
 import {
   serve
-} from "./chunk-IJPOJ6PG.js";
+} from "./chunk-K7BX33LH.js";
 import {
   kindOf,
   readCatalog
-} from "./chunk-C46YCY2I.js";
+} from "./chunk-HB4VJ5VW.js";
 
 // src/cli/command.ts
 var ArgumentError = class extends Error {
@@ -448,10 +450,19 @@ var listCommand = {
 var serveCommand = {
   name: "serve",
   describe: "Run the MCP server on stdio (the default with no command)",
-  usage: "pmcp serve [--root <dir>] [--scope <prefix>] [--marketplace <dir>] [--package <dir>] [--workspace <dir>] [--config <file> | --no-config]",
-  options: [...CATALOG_OPTIONS],
+  usage: "pmcp serve [--root <dir>] [--scope <prefix>] [--marketplace <dir>] [--package <dir>] [--workspace <dir>] [--config <file> | --no-config] [--prompts]",
+  options: [
+    ...CATALOG_OPTIONS,
+    {
+      name: "prompts",
+      describe: "Also offer one prompt per skill, for hosts that turn prompts into commands.",
+      boolean: true
+    }
+  ],
   run(context) {
-    serve(catalogOptionsFrom(context));
+    serve(catalogOptionsFrom(context), {
+      prompts: context.args.flags.has("prompts")
+    });
     return 0;
   }
 };
@@ -2249,6 +2260,33 @@ var doctorCommand = {
   }
 };
 
+// src/commands/validate.ts
+var validateCommand = {
+  name: "validate",
+  describe: "Check skills against the Agent Skills specification: given directories, or every skill the catalog reaches",
+  usage: "pmcp validate [<skill-dir>...] [--root <dir>] [--marketplace <dir>] [--package <dir>] [--workspace <dir>] [--config <file> | --no-config] [--json]",
+  options: [
+    ...CATALOG_OPTIONS,
+    { name: "json", describe: "Emit JSON rather than a table.", boolean: true }
+  ],
+  run(context) {
+    const dirs = context.args.positional;
+    const findings = dirs.length > 0 ? dirs.flatMap(validateSkillDir) : validateCatalog(catalogOptionsFrom(context));
+    const errors = findings.filter((f) => f.level === "error").length;
+    if (context.args.flags.has("json")) {
+      context.ui.data(`${JSON.stringify({ findings }, null, 2)}
+`);
+      return errors > 0 ? 1 : 0;
+    }
+    for (const finding of findings) {
+      const report = finding.level === "error" ? context.ui.error : context.ui.warn;
+      report.call(context.ui, finding.reason, finding.path);
+    }
+    if (findings.length === 0) context.ui.success("every skill is valid");
+    return errors > 0 ? 1 : 0;
+  }
+};
+
 // src/commands/index.ts
 var COMMANDS = [
   serveCommand,
@@ -2262,7 +2300,8 @@ var COMMANDS = [
   installCommand,
   syncCommand,
   projectCommand,
-  doctorCommand
+  doctorCommand,
+  validateCommand
 ];
 var PLANNED = [];
 var GLOBAL = /* @__PURE__ */ new Set(["-q", "--quiet", "--no-color", "--color"]);
@@ -2308,7 +2347,7 @@ function dispatch(argv, options = {}) {
   }
   return run(command, rest, { ui, env, cwd });
 }
-var VERSION = "0.7.1";
+var VERSION = "0.8.1";
 async function run(command, argv, context) {
   try {
     return await command.run({

package/dist/http.d.ts

@@ -1,5 +1,6 @@
-import { S as SkillEntry } from './catalog-5v7jrGwP.js';
-import { E as Embedder, S as SkillServerOptions } from './server-B9GDPRoE.js';
+import { S as SkillEntry } from './catalog-CS0j6-0U.js';
+import { E as Embedder, S as SkillServerOptions } from './server-CLyCpwZb.js';
+import 'zod';
 
 /**
  * The optional encoder and the store for the vectors it produces.
@@ -36,6 +37,19 @@ interface LoadEmbedderOptions {
  */
 declare function loadEmbedder(modelId?: string, options?: LoadEmbedderOptions): Promise<Embedder | null>;
 
+/**
+ * Checks a hosted skills server makes before a request reaches MCP: which browser origins
+ * and Host names may call it, how large a request may be, and how often one caller may call.
+ * Requests without an Origin header are not from a browser page and are not origin-checked.
+ */
+declare const DEFAULT_MAX_REQUEST_BYTES: number;
+interface RateLimitOptions {
+    /** Requests one caller may make in a minute. */
+    readonly perMinute: number;
+    /** Injected by tests. */
+    readonly now?: () => number;
+}
+
 /**
  * The catalog over streamable HTTP, for a hosted skills server.
  *
@@ -67,6 +81,21 @@ interface SkillHttpOptions extends SkillServerOptions {
     readonly challenge?: string;
     /** Encode the catalog at start so find ranks by meaning across languages. */
     readonly semantic?: SkillHttpSemanticOptions;
+    /** One prompt per skill. Off by default: the list grows with the catalog. */
+    readonly prompts?: boolean;
+    /**
+     * Cache scope the Skills extension declares. The catalog is filtered per caller
+     * here, so "private" unless the host knows every caller sees the same list.
+     */
+    readonly cacheScope?: "public" | "private";
+    /** Browser origins, besides the server's own, whose pages may call; others get 403. */
+    readonly allowedOrigins?: readonly string[];
+    /** Host header values the server answers to; unset means any. */
+    readonly allowedHosts?: readonly string[];
+    /** Largest request body accepted; larger ones get 413. */
+    readonly maxRequestBytes?: number;
+    /** Per-caller request ceiling; unset means the host limits rate itself. */
+    readonly rateLimit?: RateLimitOptions;
 }
 declare const DEFAULT_TIERS: readonly string[];
 declare function visibleTo(entries: readonly SkillEntry[], tiers: readonly string[]): SkillEntry[];
@@ -79,4 +108,4 @@ interface SkillHttpHandler {
 }
 declare function createSkillHttpHandler(options: SkillHttpOptions): SkillHttpHandler;
 
-export { DEFAULT_MODEL_ID, DEFAULT_TIERS, Embedder, type SkillCaller, type SkillHttpHandler, type SkillHttpOptions, type SkillHttpSemanticOptions, createSkillHttpHandler, loadEmbedder, visibleTo };
+export { DEFAULT_MAX_REQUEST_BYTES, DEFAULT_MODEL_ID, DEFAULT_TIERS, Embedder, type RateLimitOptions, type SkillCaller, type SkillHttpHandler, type SkillHttpOptions, type SkillHttpSemanticOptions, createSkillHttpHandler, loadEmbedder, visibleTo };

package/dist/http.js

@@ -2,17 +2,120 @@ import {
   DEFAULT_MODEL_ID,
   encodeEntries,
   loadEmbedder
-} from "./chunk-VBLAH6J2.js";
-import "./chunk-KP3TQ3QY.js";
+} from "./chunk-STBBSQ3R.js";
+import "./chunk-MO3LLVVY.js";
 import {
   createSkillServer,
   readCatalog
-} from "./chunk-C46YCY2I.js";
+} from "./chunk-HB4VJ5VW.js";
 
 // src/http.ts
 import {
   createMcpHandler
 } from "@modelcontextprotocol/server";
+
+// src/http-guard.ts
+var DEFAULT_MAX_REQUEST_BYTES = 1024 * 1024;
+var RATE_WINDOW_MS = 6e4;
+var CORS_ALLOW_HEADERS = "authorization, content-type, accept, mcp-session-id, mcp-protocol-version, last-event-id";
+var json = (status, body, headers = {}) => new Response(JSON.stringify(body), {
+  status,
+  headers: { "content-type": "application/json", ...headers }
+});
+function checkOrigin(request, allowedOrigins = []) {
+  const origin = request.headers.get("origin");
+  if (origin === null) return { kind: "none" };
+  if (origin === new URL(request.url).origin) return { kind: "same" };
+  if (allowedOrigins.includes(origin)) return { kind: "allowed", origin };
+  return {
+    kind: "refused",
+    response: json(403, { error: "origin_not_allowed" })
+  };
+}
+function checkHost(request, allowedHosts) {
+  if (!allowedHosts) return void 0;
+  const host = request.headers.get("host") ?? new URL(request.url).host;
+  return allowedHosts.includes(host) ? void 0 : json(403, { error: "host_not_allowed" });
+}
+function corsHeaders(origin) {
+  return {
+    "access-control-allow-origin": origin,
+    "access-control-expose-headers": "mcp-session-id, www-authenticate",
+    vary: "Origin"
+  };
+}
+function preflight(origin) {
+  return new Response(null, {
+    status: 204,
+    headers: {
+      ...corsHeaders(origin),
+      "access-control-allow-methods": "GET, POST, DELETE, OPTIONS",
+      "access-control-allow-headers": CORS_ALLOW_HEADERS,
+      "access-control-max-age": "600"
+    }
+  });
+}
+function withHeaders(response, headers) {
+  const merged = new Headers(response.headers);
+  for (const [name, value] of Object.entries(headers)) merged.set(name, value);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: merged
+  });
+}
+var tooLarge = (max) => json(413, { error: "request_too_large", limit: max });
+async function capBody(request, max) {
+  const declared = Number(request.headers.get("content-length") ?? NaN);
+  if (Number.isFinite(declared) && declared > max) return tooLarge(max);
+  if (!request.body) return request;
+  const reader = request.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > max) {
+      await reader.cancel();
+      return tooLarge(max);
+    }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new Request(request.url, {
+    method: request.method,
+    headers: request.headers,
+    body
+  });
+}
+function createRateLimiter(options) {
+  const now = options.now ?? Date.now;
+  const windows = /* @__PURE__ */ new Map();
+  return (callerId) => {
+    const t = now();
+    const window = windows.get(callerId);
+    if (!window || t - window.start >= RATE_WINDOW_MS) {
+      windows.set(callerId, { start: t, count: 1 });
+      return void 0;
+    }
+    window.count += 1;
+    if (window.count <= options.perMinute) return void 0;
+    const retry = Math.ceil((window.start + RATE_WINDOW_MS - t) / 1e3);
+    return json(
+      429,
+      { error: "rate_limited" },
+      { "retry-after": String(Math.max(retry, 1)) }
+    );
+  };
+}
+
+// src/http.ts
 var DEFAULT_TIERS = ["open", "free"];
 function visibleTo(entries, tiers) {
   const allowed = new Set(tiers);
@@ -50,32 +153,50 @@ function createSkillHttpHandler(options) {
       () => createSkillServer({
         ...options,
         ...embedder && vectors ? { embedder, vectors } : {},
-        loadCatalog: () => visibleTo(all, tiers)
+        loadCatalog: () => visibleTo(all, tiers),
+        skillsExtension: { cacheScope: options.cacheScope ?? "private" }
       })
     );
     handlers.set(key, handler);
     return handler;
   };
-  return {
-    async fetch(request) {
-      const caller = await options.authorize(request);
-      if (!caller) {
-        return new Response(JSON.stringify({ error: "unauthorized" }), {
-          status: 401,
-          headers: {
-            "content-type": "application/json",
-            "www-authenticate": options.challenge ?? "Bearer"
-          }
-        });
-      }
-      return handlerFor(tiersFor(caller)).fetch(request, {
-        authInfo: {
-          token: "",
-          clientId: caller.id,
-          scopes: [],
-          extra: { ...caller.claims }
+  const limit = options.rateLimit ? createRateLimiter(options.rateLimit) : void 0;
+  const serve = async (request) => {
+    const capped = await capBody(
+      request,
+      options.maxRequestBytes ?? DEFAULT_MAX_REQUEST_BYTES
+    );
+    if (capped instanceof Response) return capped;
+    const caller = await options.authorize(capped);
+    if (!caller) {
+      return new Response(JSON.stringify({ error: "unauthorized" }), {
+        status: 401,
+        headers: {
+          "content-type": "application/json",
+          "www-authenticate": options.challenge ?? "Bearer"
         }
       });
+    }
+    const limited = limit?.(caller.id);
+    if (limited) return limited;
+    return handlerFor(tiersFor(caller)).fetch(capped, {
+      authInfo: {
+        token: "",
+        clientId: caller.id,
+        scopes: [],
+        extra: { ...caller.claims }
+      }
+    });
+  };
+  return {
+    async fetch(request) {
+      const wrongHost = checkHost(request, options.allowedHosts);
+      if (wrongHost) return wrongHost;
+      const origin = checkOrigin(request, options.allowedOrigins);
+      if (origin.kind === "refused") return origin.response;
+      if (origin.kind !== "allowed") return serve(request);
+      if (request.method === "OPTIONS") return preflight(origin.origin);
+      return withHeaders(await serve(request), corsHeaders(origin.origin));
     },
     reload() {
       all = load(options);
@@ -87,6 +208,7 @@ function createSkillHttpHandler(options) {
   };
 }
 export {
+  DEFAULT_MAX_REQUEST_BYTES,
   DEFAULT_MODEL_ID,
   DEFAULT_TIERS,
   createSkillHttpHandler,

package/dist/index.d.ts

@@ -1,8 +1,9 @@
-import { I as IntentCache, S as SkillServerOptions, a as SkillTools } from './server-B9GDPRoE.js';
-export { C as CATALOG_PAGE_MAX, b as CATALOG_PAGE_SIZE, c as CallResponse, d as CatalogItem, e as CatalogResponse, D as DEFAULT_FIND_LIMIT, f as DESCRIBE_FILE_LIMIT, E as Embedder, F as FindOptions, g as FindResult, h as IntentCacheStats, K as KindFilter, M as Match, R as READ_BUDGET_BYTES, i as Ranking, j as ReadResult, k as SkillFilters, l as cosine, m as createSkillTools, n as find, o as lexicalScore, p as normaliseIntent } from './server-B9GDPRoE.js';
-import { S as SkillEntry } from './catalog-5v7jrGwP.js';
-export { a as ASSET_KINDS, A as AssetKind, C as CatalogOptions, M as MAX_SKILL_DEPTH, b as SKIPPED_DIRS, d as displayPath, k as kindOf, r as readBody, c as readCatalog, e as readFrontmatter, w as withoutBody } from './catalog-5v7jrGwP.js';
+import { I as IntentCache, S as SkillServerOptions, a as SkillTools } from './server-CLyCpwZb.js';
+export { B as BundleFile, C as CATALOG_PAGE_MAX, b as CATALOG_PAGE_SIZE, c as CallResponse, d as CatalogItem, e as CatalogResponse, f as Classified, D as DEFAULT_FIND_LIMIT, g as DESCRIBE_FILE_LIMIT, E as Embedder, F as FileKind, h as FindOptions, i as FindResult, j as IntentCacheStats, K as KindFilter, M as Match, R as READ_BUDGET_BYTES, k as Ranking, l as ReadResult, m as SkillBundle, n as SkillFile, o as SkillFileContent, p as SkillFileListing, q as SkillFilters, r as bundleResponseSchema, s as bundleSkill, t as catalogResponseSchema, u as classify, v as cosine, w as createSkillTools, x as describeResponseSchema, y as find, z as findResultSchema, A as isUtf8Text, G as lexicalScore, H as listSkillFiles, J as mimeOf, L as normaliseIntent, N as readSkillFile } from './server-CLyCpwZb.js';
+import { S as SkillEntry, C as CatalogOptions } from './catalog-CS0j6-0U.js';
+export { a as ASSET_KINDS, A as AssetKind, M as MAX_SKILL_DEPTH, b as SKIPPED_DIRS, d as displayPath, k as kindOf, r as readBody, c as readCatalog, e as readFrontmatter, w as withoutBody } from './catalog-CS0j6-0U.js';
 import { McpServer } from '@modelcontextprotocol/server';
+import 'zod';
 
 /**
  * Query vectors, kept on disk between sessions.
@@ -36,6 +37,25 @@ declare const DEFAULT_INTENT_CACHE_LIMIT = 4096;
  */
 declare function openIntentCache(options: IntentCacheOptions): Promise<IntentCache | null>;
 
+/**
+ * SKILL.md frontmatter, read as YAML the way a host reads it, and checked against
+ * the Agent Skills specification (https://agentskills.io/specification).
+ */
+type MetadataValue = string | readonly string[];
+/**
+ * Parsed frontmatter. A value with an unquoted ": " is a common authoring slip
+ * the client guide says to recover from by quoting it, so that is retried once.
+ */
+declare function frontmatterObject(source: string): Record<string, unknown> | null;
+declare const NAME_MAX = 64;
+declare const DESCRIPTION_MAX = 1024;
+declare const COMPATIBILITY_MAX = 500;
+/**
+ * What the specification requires of one SKILL.md, as messages; empty when valid.
+ * directory is the name of the folder holding it.
+ */
+declare function specProblems(front: Record<string, unknown> | null, directory: string): string[];
+
 /**
  * Assets laid out as an agent plugin marketplace: a directory holding
  * `.claude-plugin/marketplace.json`, whose plugins keep skills, commands,
@@ -43,16 +63,12 @@ declare function openIntentCache(options: IntentCacheOptions): Promise<IntentCac
  * package.json is involved, which is why the node_modules walk never saw them.
  */
 
-type MetadataValue = string | readonly string[];
 /** Why an asset was left out rather than served. */
 interface Rejection {
     readonly path: string;
     readonly reason: string;
 }
-/**
- * The `metadata:` block of a frontmatter, one level deep: scalars and inline
- * lists. Deeper nesting is skipped rather than half-read.
- */
+/** The `metadata:` map of a frontmatter, one level deep: strings and string lists. */
 declare function readMetadata(source: string): Record<string, MetadataValue>;
 /** The raw frontmatter text between the fences, for skill_describe. */
 declare function readFrontmatterText(source: string): string;
@@ -200,7 +216,7 @@ interface RunResult {
 }
 type Runner = (command: string, args: readonly string[], cwd: string) => RunResult;
 type Status = "ok" | "fail" | "skip";
-interface Finding {
+interface Finding$1 {
     readonly tool: Tool | "project";
     readonly check: string;
     readonly status: Status;
@@ -211,7 +227,7 @@ interface DoctorOptions {
     readonly home: string;
     readonly only?: ReadonlySet<Tool>;
 }
-declare function doctor(spec: ProjectSpec, options: DoctorOptions): Finding[];
+declare function doctor(spec: ProjectSpec, options: DoctorOptions): Finding$1[];
 
 /**
  * Links each package's path-scoped rule file into .claude/rules/<dir>/. One level
@@ -225,60 +241,119 @@ declare class ProjectError extends Error {
 declare function deriveName(dir: string, strip: readonly string[]): string;
 
 /**
- * The five tools, spoken over MCP.
+ * One catalog skill as the Skills extension (SEP-2640) describes it: frontmatter
+ * plus a complete manifest of its files with sha256 digests and sizes.
+ */
+
+interface SkillResource {
+    readonly uri: string;
+    readonly digest: string;
+    readonly size: number;
+}
+interface SkillExtensionEntry {
+    readonly uri: string;
+    readonly frontmatter: Readonly<Record<string, unknown>>;
+    readonly resources: readonly SkillResource[];
+}
+/**
+ * The extension's entry, or null when the skill cannot be served under SEP-2640:
+ * not a directory with SKILL.md, frontmatter that breaks the Agent Skills
+ * specification, a name unlike its path, or over the per-skill limits. Such a
+ * skill stays reachable through the skill_* tools.
+ */
+declare function extensionEntry(entry: SkillEntry): SkillExtensionEntry | null;
+
+/**
+ * The Skills extension's methods, skills/list and skills/get. Their files are
+ * served by the skill:// resources (resources.ts), which every surface shares.
+ */
+
+declare const SKILLS_EXTENSION = "io.modelcontextprotocol/skills";
+interface SkillsExtensionOptions {
+    /**
+     * "public" when every caller sees the same catalog; "private" when the list is
+     * filtered per caller, as it is behind authorization.
+     */
+    readonly cacheScope?: "public" | "private";
+}
+/** Declares the extension and its methods. Must run before the server connects. */
+declare function registerSkillsExtension(server: McpServer, skills: () => readonly SkillEntry[], options?: SkillsExtensionOptions): void;
+
+/**
+ * skill:// URIs for skill files. The authority names this server's namespace and
+ * resolves to nothing; the path is the catalog name, then the file inside it.
+ */
+
+declare const skillFileUri: (entry: Pick<SkillEntry, "name">, file?: string) => string;
+/**
+ * The catalog entry and relative file a URI names, matched against the entries
+ * the caller may see. Names contain slashes, so the longest matching name wins.
+ */
+declare function resolveSkillFileUri(uri: string, entries: readonly SkillEntry[]): {
+    entry: SkillEntry;
+    file: string;
+} | null;
+
+/**
+ * The catalog, spoken over MCP: the skill_* tools, skill:// resources, the
+ * Skills extension and, when asked for, one prompt per skill.
  *
- * Thin on purpose: every decision is in `createSkillTools`, and this file only
- * names the tools and shapes their arguments. A consumer that wants the same
- * operations from a hook or a script uses the tools directly and never speaks
- * a protocol.
+ * Thin on purpose: every decision is in createSkillTools and the modules under
+ * tools/ and files/; this file only composes them on one server.
  */
 
 /** Reported to the host on connect. */
 declare const SERVER_NAME = "pmcp";
+declare const SERVER_VERSION = "0.8.1";
 /**
- * Registers the five tools on a server.
+ * Registers the skill_* tools on a server.
  *
  * Exported separately from the stdio entry so a consumer already running an MCP
  * server can add these to it rather than starting a second process.
  */
 declare function registerSkillTools(server: McpServer, tools: SkillTools): McpServer;
+interface SkillMcpOptions extends SkillServerOptions {
+    /** One prompt per skill, for hosts that offer prompts as commands. Off by default. */
+    readonly prompts?: boolean;
+    readonly skillsExtension?: SkillsExtensionOptions;
+}
 /**
- * A server with the five tools and the Skills extension registered.
+ * A server with everything registered.
  *
  * The catalog is read on first use rather than here, so a host that connects
  * and never asks pays nothing for the walk.
  */
-declare function createSkillServer(options: SkillServerOptions): McpServer;
+declare function createSkillServer(options: SkillMcpOptions): McpServer;
 
-/**
- * The MCP Skills extension (SEP-2640): `skills/list`, `skills/get` and the
- * skill files as `skill://pmcp/<name>/<file>` resources, so a host that speaks
- * the extension loads skills natively instead of through the skill_* tools.
- */
+/** Checks skill directories against the Agent Skills specification. */
 
-declare const SKILLS_EXTENSION = "io.modelcontextprotocol/skills";
-interface SkillResource {
-    readonly uri: string;
-    readonly digest: string;
-    readonly size: number;
-}
-interface SkillExtensionEntry {
-    readonly uri: string;
-    readonly frontmatter: Readonly<Record<string, unknown>>;
-    readonly resources: readonly SkillResource[];
+interface Finding {
+    readonly path: string;
+    readonly reason: string;
+    /** error: the skill is left out or breaks a MUST; warning: served anyway. */
+    readonly level: "error" | "warning";
 }
-declare const skillUri: (entry: Pick<SkillEntry, "name">, file?: string) => string;
+/** One skill directory, or the SKILL.md inside it. */
+declare function validateSkillDir(dir: string): Finding[];
+/** Every skill the catalog options reach, with what loading reported. */
+declare function validateCatalog(options: CatalogOptions): Finding[];
+
 /**
- * The extension's entry for one catalog skill, or null when the skill cannot
- * be served under SEP-2640: not a directory with SKILL.md, a frontmatter name
- * that is missing, invalid or unlike its path, or over the per-skill limits.
- * Such a skill stays reachable through the skill_* tools.
+ * skill:// resources: every file of every skill the caller may see. The tools,
+ * the Skills extension and resource links all resolve here, over the same
+ * caller-filtered catalog, so nothing a caller cannot list can be read.
  */
-declare function extensionEntry(entry: SkillEntry): SkillExtensionEntry | null;
+
+declare function registerSkillResources(server: McpServer, skills: () => readonly SkillEntry[]): void;
+
 /**
- * Declares the extension and its methods on a server, over the skills the
- * catalog function returns. Must run before the server connects.
+ * One prompt per skill, for hosts that offer prompts as commands: the Agent
+ * Skills "user-explicit activation" path. Off unless the host asks for it,
+ * because the list grows with the catalog.
  */
-declare function registerSkillsExtension(server: McpServer, skills: () => readonly SkillEntry[]): void;
 
-export { CONFIG_FILE, type CatalogSection, ConfigError, DEFAULT_INTENT_CACHE_LIMIT, type Finding, IntentCache, type IntentCacheOptions, LOCK_FILE, type McpServerSpec, type MetadataValue, type Output, type PackageRulesSpec, type ProjectConfig, ProjectError, type ProjectResult, type ProjectSpec, type Rejection, type Runner, SERVER_NAME, SKILLS_EXTENSION, SkillEntry, type SkillExtensionEntry, type SkillResource, SkillServerOptions, SkillTools, TOOLS, type Tool, assetRoot, createSkillServer, deadGlobs, deriveName, doctor, extensionEntry, findConfig, openIntentCache, plan, project, readConfig, readFrontmatterText, readMarketplace, readMetadata, readSpec, registerSkillTools, registerSkillsExtension, skillUri };
+/** Prompt names travel into host command names, so they stay to a plain set. */
+declare const promptName: (entry: Pick<SkillEntry, "name">) => string;
+declare function registerSkillPrompts(server: McpServer, tools: SkillTools): void;
+
+export { COMPATIBILITY_MAX, CONFIG_FILE, CatalogOptions, type CatalogSection, ConfigError, DEFAULT_INTENT_CACHE_LIMIT, DESCRIPTION_MAX, type Finding$1 as Finding, IntentCache, type IntentCacheOptions, LOCK_FILE, type McpServerSpec, type MetadataValue, NAME_MAX, type Output, type PackageRulesSpec, type ProjectConfig, ProjectError, type ProjectResult, type ProjectSpec, type Rejection, type Runner, SERVER_NAME, SERVER_VERSION, SKILLS_EXTENSION, SkillEntry, type SkillExtensionEntry, type SkillMcpOptions, type SkillResource, SkillServerOptions, SkillTools, TOOLS, type Tool, type Finding as ValidationFinding, assetRoot, createSkillServer, deadGlobs, deriveName, doctor, extensionEntry, findConfig, openIntentCache, frontmatterObject as parseSkillFrontmatter, plan, project, promptName, readConfig, readFrontmatterText, readMarketplace, readMetadata, readSpec, registerSkillPrompts, registerSkillResources, registerSkillTools, registerSkillsExtension, resolveSkillFileUri, skillFileUri, skillFileUri as skillUri, specProblems, validateCatalog, validateSkillDir };