@skillsmith/cli 0.7.1 → 0.7.3

package/dist/src/utils/node-version.js

@@ -1,123 +0,0 @@
-/**
- * SMI-1629: Node version detection with helpful errors
- *
- * Validates the runtime Node.js version against the minimum required
- * version specified in package.json engines field.
- */
-import { readFileSync } from 'fs';
-import { dirname, join } from 'path';
-import { fileURLToPath } from 'url';
-const __dirname = dirname(fileURLToPath(import.meta.url));
-/**
- * Reads the minimum Node.js version from package.json engines field.
- * Falls back to '22.22.0' if not found (SMI-4489 floor).
- */
-function loadMinNodeVersion() {
-    try {
-        const packageJsonPath = join(__dirname, '..', '..', 'package.json');
-        const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
-        const engineConstraint = packageJson.engines?.node ?? '>=22.22.0';
-        // Extract version number from constraint (e.g., ">=22.22.0" -> "22.22.0")
-        return engineConstraint.replace(/[>=<^~\s]/g, '');
-    }
-    catch {
-        // Fallback if package.json can't be read
-        return '22.22.0';
-    }
-}
-const MIN_NODE_VERSION = loadMinNodeVersion();
-/**
- * Returns the minimum required Node.js version.
- *
- * @returns The minimum version string (e.g., "22.0.0")
- */
-export function getMinNodeVersion() {
-    return MIN_NODE_VERSION;
-}
-/**
- * Returns the current Node.js version without the "v" prefix.
- *
- * @returns The current version string (e.g., "22.5.0")
- */
-export function getCurrentNodeVersion() {
-    return process.version.replace(/^v/, '');
-}
-/**
- * Compares two semantic version strings.
- *
- * @param a - First version string (e.g., "22.5.0")
- * @param b - Second version string (e.g., "22.0.0")
- * @returns Positive if a > b, negative if a < b, 0 if equal
- */
-export function compareVersions(a, b) {
-    const parseVersion = (v) => {
-        // Strip pre-release suffix (e.g., "22.0.0-beta.1" -> "22.0.0")
-        const cleanVersion = v.split('-')[0] ?? v;
-        const parts = cleanVersion.split('.').map((p) => parseInt(p, 10) || 0);
-        // Pad to at least 3 parts for consistent comparison
-        while (parts.length < 3) {
-            parts.push(0);
-        }
-        return parts;
-    };
-    const partsA = parseVersion(a);
-    const partsB = parseVersion(b);
-    for (let i = 0; i < Math.max(partsA.length, partsB.length); i++) {
-        const numA = partsA[i] ?? 0;
-        const numB = partsB[i] ?? 0;
-        if (numA > numB)
-            return 1;
-        if (numA < numB)
-            return -1;
-    }
-    return 0;
-}
-/**
- * Formats a helpful error message when the Node.js version is incompatible.
- *
- * @param currentVersion - The current Node.js version
- * @param requiredVersion - The minimum required version
- * @returns A formatted error message with upgrade instructions
- */
-export function formatVersionError(currentVersion, requiredVersion) {
-    return `
-Node.js version mismatch detected.
-
-  Current version:  v${currentVersion}
-  Required version: v${requiredVersion} or higher
-
-Your Node.js version is too old to run this CLI.
-
-To upgrade Node.js, use one of these methods:
-
-  Using nvm (recommended):
-    nvm install ${requiredVersion}
-    nvm use ${requiredVersion}
-
-  Using fnm:
-    fnm install ${requiredVersion}
-    fnm use ${requiredVersion}
-
-  Using volta:
-    volta install node@${requiredVersion}
-
-  Download directly:
-    https://nodejs.org/
-
-After upgrading, verify with: node --version
-`.trim();
-}
-/**
- * Checks if the current Node.js version meets the minimum requirement.
- *
- * @returns null if the version is acceptable, or an error message string if not
- */
-export function checkNodeVersion() {
-    const currentVersion = getCurrentNodeVersion();
-    const minVersion = getMinNodeVersion();
-    if (compareVersions(currentVersion, minVersion) >= 0) {
-        return null;
-    }
-    return formatVersionError(currentVersion, minVersion);
-}
-//# sourceMappingURL=node-version.js.map

package/dist/src/utils/node-version.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"node-version.js","sourceRoot":"","sources":["../../../src/utils/node-version.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAA;AAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAEzD;;;GAGG;AACH,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QACnE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAA;QACtE,MAAM,gBAAgB,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,IAAI,WAAW,CAAA;QACjE,0EAA0E;QAC1E,OAAO,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;QACzC,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,kBAAkB,EAAE,CAAA;AAE7C;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,YAAY,GAAG,CAAC,CAAS,EAAY,EAAE;QAC3C,+DAA+D;QAC/D,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QACtE,oDAAoD;QACpD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACf,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;IAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;IAE9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAE3B,IAAI,IAAI,GAAG,IAAI;YAAE,OAAO,CAAC,CAAA;QACzB,IAAI,IAAI,GAAG,IAAI;YAAE,OAAO,CAAC,CAAC,CAAA;IAC5B,CAAC;IAED,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,cAAsB,EAAE,eAAuB;IAChF,OAAO;;;uBAGc,cAAc;uBACd,eAAe;;;;;;;kBAOpB,eAAe;cACnB,eAAe;;;kBAGX,eAAe;cACnB,eAAe;;;yBAGJ,eAAe;;;;;;CAMvC,CAAC,IAAI,EAAE,CAAA;AACR,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,cAAc,GAAG,qBAAqB,EAAE,CAAA;IAC9C,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAA;IAEtC,IAAI,eAAe,CAAC,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,kBAAkB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;AACvD,CAAC"}

package/dist/src/utils/open-database.d.ts

@@ -1,35 +0,0 @@
-/**
- * @fileoverview Shared CLI database opener — the single schema-safe entry point.
- * @see SMI-4486, SMI-4917
- *
- * `@skillsmith/core` re-exports the BARE `createDatabaseAsync` factory
- * (`db/createDatabase.js`) — it opens a connection but creates NO tables. Every
- * CLI command that touches a table (`skills`, `cache`, `sync_history`, …) MUST
- * call `initializeSchema` first, or it crashes on a fresh DB with errors like
- * `no such table: cache`.
- *
- * Before this helper, each command repeated `createDatabaseAsync` +
- * `initializeSchema` by hand; any command that forgot the second line shipped a
- * first-time-install crash (Bug 1 of SMI-4917 — `search` did exactly this).
- * `openCliDatabase` makes the footgun structurally impossible: it is the one
- * unmissable way a CLI command opens a database.
- */
-import { type DatabaseType } from '@skillsmith/core';
-/**
- * Open a CLI database with the full schema initialized and all migrations
- * applied. Use this everywhere a CLI command needs a database — never call the
- * bare `createDatabaseAsync` directly.
- *
- * @param path - Filesystem path to the SQLite database (e.g. `DEFAULT_DB_PATH`).
- * @param options.readonly - SMI-5139: open read-only for pure-read consumers
- *   (e.g. version lookups). A read-only handle CANNOT run schema DDL, so
- *   `initializeSchema` is skipped — the caller must tolerate an absent schema
- *   (queries on a missing table throw, which read consumers already catch).
- *   This also prevents the WASM `SqlJsDatabaseAdapter` from persisting (writing)
- *   on `close()`, which would throw `EROFS` on an unwritable/absent db path.
- * @returns A connected database. Caller owns `db.close()`.
- */
-export declare function openCliDatabase(path: string, options?: {
-    readonly?: boolean;
-}): Promise<DatabaseType>;
-//# sourceMappingURL=open-database.d.ts.map

package/dist/src/utils/open-database.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"open-database.d.ts","sourceRoot":"","sources":["../../../src/utils/open-database.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAKL,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAA;AAGzB;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/B,OAAO,CAAC,YAAY,CAAC,CAwCvB"}

package/dist/src/utils/open-database.js

@@ -1,73 +0,0 @@
-/**
- * @fileoverview Shared CLI database opener — the single schema-safe entry point.
- * @see SMI-4486, SMI-4917
- *
- * `@skillsmith/core` re-exports the BARE `createDatabaseAsync` factory
- * (`db/createDatabase.js`) — it opens a connection but creates NO tables. Every
- * CLI command that touches a table (`skills`, `cache`, `sync_history`, …) MUST
- * call `initializeSchema` first, or it crashes on a fresh DB with errors like
- * `no such table: cache`.
- *
- * Before this helper, each command repeated `createDatabaseAsync` +
- * `initializeSchema` by hand; any command that forgot the second line shipped a
- * first-time-install crash (Bug 1 of SMI-4917 — `search` did exactly this).
- * `openCliDatabase` makes the footgun structurally impossible: it is the one
- * unmissable way a CLI command opens a database.
- */
-import { createDatabaseAsync, initializeSchema, isCorruptionError, backupCorruptDbFile, } from '@skillsmith/core';
-import { existsSync } from 'node:fs';
-/**
- * Open a CLI database with the full schema initialized and all migrations
- * applied. Use this everywhere a CLI command needs a database — never call the
- * bare `createDatabaseAsync` directly.
- *
- * @param path - Filesystem path to the SQLite database (e.g. `DEFAULT_DB_PATH`).
- * @param options.readonly - SMI-5139: open read-only for pure-read consumers
- *   (e.g. version lookups). A read-only handle CANNOT run schema DDL, so
- *   `initializeSchema` is skipped — the caller must tolerate an absent schema
- *   (queries on a missing table throw, which read consumers already catch).
- *   This also prevents the WASM `SqlJsDatabaseAdapter` from persisting (writing)
- *   on `close()`, which would throw `EROFS` on an unwritable/absent db path.
- * @returns A connected database. Caller owns `db.close()`.
- */
-export async function openCliDatabase(path, options) {
-    // SMI-5139: read-only consumers open read-only and skip schema init (DDL is
-    // impossible on a read-only handle; sql.js close() then skips persist()).
-    // The open itself may throw (native better-sqlite3 read-only-opens of an
-    // absent file throw) — that is the caller's signal to degrade gracefully.
-    if (options?.readonly) {
-        return createDatabaseAsync(path, { readonly: true });
-    }
-    let db;
-    try {
-        db = await createDatabaseAsync(path);
-        initializeSchema(db);
-        return db;
-    }
-    catch (err) {
-        // SMI-4484: backstop for corruption that surfaces during schema init (e.g.
-        // a corrupt page only read once the schema queries run). The sql.js driver
-        // self-heals on open, but a corrupt file opened by the native driver can
-        // still fail here. Back up the bad file and retry once on a fresh DB.
-        if (!isCorruptionError(err) || path === ':memory:' || !existsSync(path)) {
-            throw err;
-        }
-        // Close the handle opened before initializeSchema failed so it is not
-        // leaked before we rebuild.
-        if (db) {
-            try {
-                db.close();
-            }
-            catch {
-                // handle already unusable — nothing more to free
-            }
-        }
-        const backupPath = backupCorruptDbFile(path);
-        console.warn(`[Skillsmith] The local database at ${path} was corrupt and could not be opened. ` +
-            `It has been backed up to ${backupPath} and will be rebuilt on the next sync.`);
-        const fresh = await createDatabaseAsync(path);
-        initializeSchema(fresh);
-        return fresh;
-    }
-}
-//# sourceMappingURL=open-database.js.map

package/dist/src/utils/open-database.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"open-database.js","sourceRoot":"","sources":["../../../src/utils/open-database.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,OAAgC;IAEhC,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,OAAO,mBAAmB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,IAAI,EAA4B,CAAA;IAChC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAA;QACpC,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACpB,OAAO,EAAE,CAAA;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxE,MAAM,GAAG,CAAA;QACX,CAAC;QACD,sEAAsE;QACtE,4BAA4B;QAC5B,IAAI,EAAE,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,CAAC,KAAK,EAAE,CAAA;YACZ,CAAC;YAAC,MAAM,CAAC;gBACP,iDAAiD;YACnD,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;QAC5C,OAAO,CAAC,IAAI,CACV,sCAAsC,IAAI,wCAAwC;YAChF,4BAA4B,UAAU,wCAAwC,CACjF,CAAA;QACD,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAA;QAC7C,gBAAgB,CAAC,KAAK,CAAC,CAAA;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/src/utils/require-tier.d.ts

@@ -1,38 +0,0 @@
-/**
- * @fileoverview requireTier — CLI license tier gate helper
- * @module @skillsmith/cli/utils/require-tier
- * @see SMI-skill-version-tracking Wave 1
- *
- * Throws a user-friendly error when the current license tier is below
- * the minimum required for a CLI command or flag.
- *
- * Security properties:
- *  - Fail-secure: key present + validation failure → block, never fall back
- *    to community to silently allow access
- *  - SKILLSMITH_SKIP_LICENSE_CHECK=true is a CI/dev escape hatch only; it
- *    must use bracket notation per TypeScript/ESLint index-signature rules
- *  - SKILLSMITH_LICENSE_KEY is read from env but never logged
- */
-import type { LicenseTier } from './license-types.js';
-/**
- * Throw if the current license tier is below minimumTier.
- *
- * Call this at the top of any CLI command or action that requires a paid tier.
- *
- * @param minimumTier - Minimum tier required to use the feature
- * @throws Error with an upgrade prompt when the tier requirement is not met
- * @throws Error when a license key is present but fails validation (fail-secure)
- *
- * @example
- * ```typescript
- * export function createOutdatedCommand(): Command {
- *   return new Command('outdated')
- *     .action(async () => {
- *       await requireTier('individual')
- *       // ... rest of command
- *     })
- * }
- * ```
- */
-export declare function requireTier(minimumTier: LicenseTier): Promise<void>;
-//# sourceMappingURL=require-tier.d.ts.map

package/dist/src/utils/require-tier.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"require-tier.d.ts","sourceRoot":"","sources":["../../../src/utils/require-tier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAkBrD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,WAAW,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BzE"}

package/dist/src/utils/require-tier.js

@@ -1,74 +0,0 @@
-/**
- * @fileoverview requireTier — CLI license tier gate helper
- * @module @skillsmith/cli/utils/require-tier
- * @see SMI-skill-version-tracking Wave 1
- *
- * Throws a user-friendly error when the current license tier is below
- * the minimum required for a CLI command or flag.
- *
- * Security properties:
- *  - Fail-secure: key present + validation failure → block, never fall back
- *    to community to silently allow access
- *  - SKILLSMITH_SKIP_LICENSE_CHECK=true is a CI/dev escape hatch only; it
- *    must use bracket notation per TypeScript/ESLint index-signature rules
- *  - SKILLSMITH_LICENSE_KEY is read from env but never logged
- */
-import { getLicenseStatus } from './license-validation.js';
-/**
- * Ordered license tiers, lowest to highest.
- * Used for tier comparison arithmetic.
- */
-const TIER_ORDER = ['community', 'individual', 'team', 'enterprise'];
-/**
- * Prices for use in upgrade messages
- */
-const TIER_PRICING = {
-    community: '$0/month',
-    individual: '$9.99/month',
-    team: '$25/user/month',
-    enterprise: '$55/user/month',
-};
-/**
- * Throw if the current license tier is below minimumTier.
- *
- * Call this at the top of any CLI command or action that requires a paid tier.
- *
- * @param minimumTier - Minimum tier required to use the feature
- * @throws Error with an upgrade prompt when the tier requirement is not met
- * @throws Error when a license key is present but fails validation (fail-secure)
- *
- * @example
- * ```typescript
- * export function createOutdatedCommand(): Command {
- *   return new Command('outdated')
- *     .action(async () => {
- *       await requireTier('individual')
- *       // ... rest of command
- *     })
- * }
- * ```
- */
-export async function requireTier(minimumTier) {
-    // CI / dev escape hatch — must use bracket notation (TS index-signature rule)
-    if (process.env['SKILLSMITH_SKIP_LICENSE_CHECK'] === 'true') {
-        return;
-    }
-    const status = await getLicenseStatus();
-    // Fail-secure: key present + validation failure → block
-    // Never silently fall back to community when a key was supplied
-    const hasKey = Boolean(process.env['SKILLSMITH_LICENSE_KEY']);
-    if (hasKey && !status.valid) {
-        throw new Error(`License validation failed. ` +
-            `Please check your SKILLSMITH_LICENSE_KEY or visit https://skillsmith.app/account to manage your license.`);
-    }
-    const currentTier = (status.tier ?? 'community');
-    const currentIndex = TIER_ORDER.indexOf(currentTier);
-    const requiredIndex = TIER_ORDER.indexOf(minimumTier);
-    if (currentIndex < requiredIndex) {
-        const pricing = TIER_PRICING[minimumTier];
-        throw new Error(`This feature requires ${minimumTier} tier or higher (${pricing}). ` +
-            `You are currently on the ${currentTier} tier. ` +
-            `Upgrade at https://skillsmith.app/upgrade?tier=${minimumTier}`);
-    }
-}
-//# sourceMappingURL=require-tier.js.map

package/dist/src/utils/require-tier.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"require-tier.js","sourceRoot":"","sources":["../../../src/utils/require-tier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAG1D;;;GAGG;AACH,MAAM,UAAU,GAAkB,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;AAEnF;;GAEG;AACH,MAAM,YAAY,GAAgC;IAChD,SAAS,EAAE,UAAU;IACrB,UAAU,EAAE,aAAa;IACzB,IAAI,EAAE,gBAAgB;IACtB,UAAU,EAAE,gBAAgB;CAC7B,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,WAAwB;IACxD,8EAA8E;IAC9E,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,KAAK,MAAM,EAAE,CAAC;QAC5D,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAA;IAEvC,wDAAwD;IACxD,gEAAgE;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAA;IAC7D,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,6BAA6B;YAC3B,0GAA0G,CAC7G,CAAA;IACH,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,WAAW,CAAgB,CAAA;IAC/D,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACpD,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAErD,IAAI,YAAY,GAAG,aAAa,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;QACzC,MAAM,IAAI,KAAK,CACb,yBAAyB,WAAW,oBAAoB,OAAO,KAAK;YAClE,4BAA4B,WAAW,SAAS;YAChD,kDAAkD,WAAW,EAAE,CAClE,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/src/utils/sanitize.d.ts

@@ -1,30 +0,0 @@
-/**
- * Error output sanitization utilities
- *
- * Removes user-specific paths from error messages to prevent exposing
- * home directory paths in CLI output (prevents E2E hardcoded value detection).
- */
-/**
- * Sanitize error messages to remove user-specific paths
- *
- * Replaces home directory paths with ~ for macOS/Linux/Windows systems.
- * Handles multiple path formats:
- * - Unix/Linux: /home/username/
- * - macOS: /Users/username/
- * - Windows: C:\Users\username\
- *
- * @param error - The error to sanitize (Error object or string)
- * @returns Sanitized error message without user-specific paths
- */
-export declare function sanitizeError(error: unknown): string;
-/**
- * Log error with sanitization
- *
- * Convenience function to log errors with automatic sanitization.
- * Useful for consistent error logging across the CLI.
- *
- * @param prefix - Prefix text before the error (e.g., "Import failed:")
- * @param error - The error to log
- */
-export declare function logSanitizedError(prefix: string, error: unknown): void;
-//# sourceMappingURL=sanitize.d.ts.map

package/dist/src/utils/sanitize.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../src/utils/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgBpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAEtE"}

package/dist/src/utils/sanitize.js

@@ -1,45 +0,0 @@
-/**
- * Error output sanitization utilities
- *
- * Removes user-specific paths from error messages to prevent exposing
- * home directory paths in CLI output (prevents E2E hardcoded value detection).
- */
-import { homedir } from 'os';
-/**
- * Sanitize error messages to remove user-specific paths
- *
- * Replaces home directory paths with ~ for macOS/Linux/Windows systems.
- * Handles multiple path formats:
- * - Unix/Linux: /home/username/
- * - macOS: /Users/username/
- * - Windows: C:\Users\username\
- *
- * @param error - The error to sanitize (Error object or string)
- * @returns Sanitized error message without user-specific paths
- */
-export function sanitizeError(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    const home = homedir();
-    // Escape special regex characters in the home path
-    const escapedHome = home.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    // Replace home directory path with ~ (Unix-like systems)
-    let sanitized = message.replace(new RegExp(escapedHome, 'g'), '~');
-    // Also handle generic patterns for other systems if not already caught
-    sanitized = sanitized.replace(/\/Users\/[^/]+\//g, '~/');
-    sanitized = sanitized.replace(/\/home\/[^/]+\//g, '~/');
-    sanitized = sanitized.replace(/C:\\Users\\[^\\]+\\/gi, '~\\');
-    return sanitized;
-}
-/**
- * Log error with sanitization
- *
- * Convenience function to log errors with automatic sanitization.
- * Useful for consistent error logging across the CLI.
- *
- * @param prefix - Prefix text before the error (e.g., "Import failed:")
- * @param error - The error to log
- */
-export function logSanitizedError(prefix, error) {
-    console.error(prefix, sanitizeError(error));
-}
-//# sourceMappingURL=sanitize.js.map

package/dist/src/utils/sanitize.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../src/utils/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAE5B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;IAEtB,mDAAmD;IACnD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IAE/D,yDAAyD;IACzD,IAAI,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;IAElE,uEAAuE;IACvE,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;IACxD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAA;IACvD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAA;IAE7D,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,KAAc;IAC9D,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;AAC7C,CAAC"}

package/dist/src/utils/skill-name.d.ts

@@ -1,19 +0,0 @@
-/**
- * Shared skill name validation utilities.
- *
- * Used by both `skillsmith author init` and `skillsmith create` to enforce
- * a consistent, registry-safe naming convention across all scaffolding paths.
- */
-/**
- * Valid skill names: lowercase letters, digits, and hyphens only.
- * Must start with a lowercase letter.
- * Matches the Skillsmith registry slug format.
- */
-export declare const VALID_SKILL_NAME_RE: RegExp;
-/**
- * Validate a skill name against the canonical Skillsmith naming convention.
- *
- * @returns `true` if valid, or a string error message if invalid.
- */
-export declare function validateSkillName(name: string): true | string;
-//# sourceMappingURL=skill-name.d.ts.map

package/dist/src/utils/skill-name.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-name.d.ts","sourceRoot":"","sources":["../../../src/utils/skill-name.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAAsB,CAAA;AAEtD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAM7D"}

package/dist/src/utils/skill-name.js

@@ -1,26 +0,0 @@
-/**
- * Shared skill name validation utilities.
- *
- * Used by both `skillsmith author init` and `skillsmith create` to enforce
- * a consistent, registry-safe naming convention across all scaffolding paths.
- */
-/**
- * Valid skill names: lowercase letters, digits, and hyphens only.
- * Must start with a lowercase letter.
- * Matches the Skillsmith registry slug format.
- */
-export const VALID_SKILL_NAME_RE = /^[a-z][a-z0-9-]*$/;
-/**
- * Validate a skill name against the canonical Skillsmith naming convention.
- *
- * @returns `true` if valid, or a string error message if invalid.
- */
-export function validateSkillName(name) {
-    if (!name.trim())
-        return 'Skill name is required';
-    if (!VALID_SKILL_NAME_RE.test(name)) {
-        return 'Skill name must start with a lowercase letter and contain only lowercase letters, digits, and hyphens (e.g. my-skill)';
-    }
-    return true;
-}
-//# sourceMappingURL=skill-name.js.map

package/dist/src/utils/skill-name.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-name.js","sourceRoot":"","sources":["../../../src/utils/skill-name.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAA;AAEtD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,wBAAwB,CAAA;IACjD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,uHAAuH,CAAA;IAChI,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/src/utils/skills-directory.d.ts

@@ -1,95 +0,0 @@
-/**
- * SMI-2713: Extracted from manage.ts — helpers for reading installed skills
- * from the global and local ~/.claude/skills directories.
- */
-import { type TrustTier } from '@skillsmith/core';
-import { type ClientId } from '@skillsmith/core/install';
-export interface InstalledSkill {
-    name: string;
-    path: string;
-    version: string | null;
-    trustTier: TrustTier;
-    installDate: string;
-    hasUpdates: boolean;
-    /**
-     * SMI-4578: which client's directory this skill was discovered under.
-     * `'local'` = repo-local `./.claude/skills`. Other values are
-     * `ClientId` from the multi-client install table.
-     */
-    installedVia: ClientId | 'local';
-}
-/**
- * Get skills from a specific directory.
- *
- * When dbPath is provided, opens the skill_versions table to determine
- * whether a newer content hash has been recorded since the skill was installed.
- * Falls back to hasUpdates: false when the database is unavailable.
- *
- * @param skillsDir   Directory to scan for installed skills
- * @param dbPath      Optional path to the Skillsmith SQLite database
- * @param installedVia SMI-4578: which client (or `'local'`) this directory
- *                    represents — propagated onto each returned skill so
- *                    callers can render "installed via Cursor" badges.
- */
-export declare function getSkillsFromDirectory(skillsDir: string, dbPath?: string, installedVia?: ClientId | 'local'): Promise<InstalledSkill[]>;
-/**
- * Per-harness/skill entry produced by {@link getInstalledSkillsPerHarness}.
- * Feeds the cross-harness inventory builder (SMI-5390).
- *
- * `contentHash` is the sha256 hex digest of the skill's raw SKILL.md
- * content — used by the inventory service for registry drift detection.
- * It is `null` when SKILL.md is absent or unreadable.
- */
-export interface HarnessSkillEntry {
-    /** Which harness directory the skill was found under. */
-    harness: ClientId | 'local';
-    /**
-     * Skill identifier: the `id` front-matter field when present (conventionally
-     * `author/name`), falling back to the `name` field, then the directory name.
-     */
-    skillId: string;
-    /** Installed version string, or `null` if absent. */
-    version: string | null;
-    /** sha256 hex digest of SKILL.md content; `null` if unreadable. */
-    contentHash: string | null;
-    /** Absolute path to the skill directory. */
-    path: string;
-}
-/**
- * Returns one {@link HarnessSkillEntry} per (harness × skill) observed on
- * disk, deduplicated by realpath only.
- *
- * Unlike {@link getInstalledSkills}, this function:
- * - Does **not** deduplicate by skill name — the same skill present under two
- *   distinct harness directories appears as two rows (different `path`).
- * - Does deduplicate by realpath — a symlinked alias such as
- *   `~/.agents/skills/foo` → `~/.claude/skills/foo` collapses to one row.
- * - Enriches each surviving entry with a sha256 `contentHash` computed from
- *   the SKILL.md content, for registry drift detection.
- *
- * Precedence order (first realpath wins when a symlink is detected): local
- * (repo) > claude-code > cursor > copilot > windsurf > agents. Inherits the
- * SMI-4578 ordering so local overrides are still respected.
- *
- * @see SMI-5390
- */
-export declare function getInstalledSkillsPerHarness(): Promise<HarnessSkillEntry[]>;
-/**
- * Get list of installed skills across every client directory.
- *
- * SMI-4578: scans the union of `CLIENT_NATIVE_PATHS` (claude-code,
- * cursor, copilot, windsurf, agents) plus repo-local
- * `./.claude/skills`. Results are deduplicated by `realpath` so a
- * symlinked `~/.agents/skills/foo` pointing at `~/.claude/skills/foo`
- * is reported once. Each entry carries `installedVia` so the caller
- * can render "installed via Cursor" badges.
- *
- * Precedence (first wins after dedup): local (repo) > claude-code >
- * cursor > copilot > windsurf > agents. This keeps the SMI-1630
- * promise that repo-local overrides global.
- *
- * @param dbPath Optional path to the Skillsmith SQLite database for
- *               update detection.
- */
-export declare function getInstalledSkills(dbPath?: string): Promise<InstalledSkill[]>;
-//# sourceMappingURL=skills-directory.d.ts.map

package/dist/src/utils/skills-directory.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"skills-directory.d.ts","sourceRoot":"","sources":["../../../src/utils/skills-directory.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAIL,KAAK,QAAQ,EACd,MAAM,0BAA0B,CAAA;AAGjC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,SAAS,EAAE,SAAS,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,OAAO,CAAA;IACnB;;;;OAIG;IACH,YAAY,EAAE,QAAQ,GAAG,OAAO,CAAA;CACjC;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,YAAY,GAAE,QAAQ,GAAG,OAA0B,GAClD,OAAO,CAAC,cAAc,EAAE,CAAC,CAsG3B;AAgBD;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAA;IAC3B;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,mEAAmE;IACnE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAA;CACb;AAuBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAyCjF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAwCnF"}