@skillsmith/core 0.11.3 → 0.11.5

package/dist/src/api/client.token-refresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.token-refresh.js","sourceRoot":"","sources":["../../../src/api/client.token-refresh.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AAEvC,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC9D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAE3B,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACjC,OAAO,SAAS,CAAC,WAAW,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO,KAAK,CAAC,WAAW,CAAA;AAC1B,CAAC"}
+{"version":3,"file":"client.token-refresh.js","sourceRoot":"","sources":["../../../src/api/client.token-refresh.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AAEvC,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC9D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAE3B,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACjC,OAAO,SAAS,CAAC,WAAW,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO,KAAK,CAAC,WAAW,CAAA;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAG,MAAM,CAAA;AAEnC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,oBAAoB;QAAE,OAAO,KAAK,CAAC,WAAW,CAAA;IACjF,OAAO,eAAe,EAAE,CAAA;AAC1B,CAAC"}

package/dist/src/api/client.token-refresh.test.js

@@ -70,4 +70,86 @@ describe('client.token-refresh', () => {
         expect(result).toBeNull();
     });
 });
+// SMI-5905 Wave 1: resolveFreshAccessToken() — extracted from team-resolver.ts's
+// resolveUserAccessToken() (TOKEN_EXPIRY_SKEW_MS=60s). team-resolver.ts now delegates to this
+// function unchanged, so these cases are the authoritative coverage for the skew logic.
+describe('resolveFreshAccessToken (SMI-5905)', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('RFT-1: returns accessToken directly when well within expiry (no refresh)', async () => {
+        const { loadCredentials, refreshAccessToken } = await import('../config/token-credentials.js');
+        const { resolveFreshAccessToken } = await import('./client.token-refresh.js');
+        vi.mocked(loadCredentials).mockResolvedValue({
+            accessToken: 'fresh_at',
+            refreshToken: 'fresh_rt',
+            expiresAt: Date.now() + 3_600_000, // 1h out — far outside the 60s skew window
+            version: 2,
+        });
+        const result = await resolveFreshAccessToken();
+        expect(result).toBe('fresh_at');
+        expect(refreshAccessToken).not.toHaveBeenCalled();
+    });
+    it('RFT-2: returns null when no credentials are stored (no refresh attempted)', async () => {
+        const { loadCredentials, refreshAccessToken } = await import('../config/token-credentials.js');
+        const { resolveFreshAccessToken } = await import('./client.token-refresh.js');
+        vi.mocked(loadCredentials).mockResolvedValue(null);
+        const result = await resolveFreshAccessToken();
+        expect(result).toBeNull();
+        expect(refreshAccessToken).not.toHaveBeenCalled();
+    });
+    it('RFT-3: expiry-skew boundary — refreshes within the 60s skew window', async () => {
+        const { loadCredentials, refreshAccessToken, storeCredentials } = await import('../config/token-credentials.js');
+        const { resolveFreshAccessToken } = await import('./client.token-refresh.js');
+        vi.mocked(loadCredentials).mockResolvedValue({
+            accessToken: 'about_to_expire_at',
+            refreshToken: 'still_valid_rt',
+            expiresAt: Date.now() + 30_000, // 30s out — inside the 60s skew window
+            version: 2,
+        });
+        vi.mocked(refreshAccessToken).mockResolvedValue({
+            accessToken: 'refreshed_at',
+            refreshToken: 'refreshed_rt',
+            expiresAt: Date.now() + 3_600_000,
+            version: 2,
+        });
+        vi.mocked(storeCredentials).mockResolvedValue(undefined);
+        const result = await resolveFreshAccessToken();
+        expect(result).toBe('refreshed_at');
+        expect(refreshAccessToken).toHaveBeenCalledWith('still_valid_rt');
+        expect(storeCredentials).toHaveBeenCalledWith(expect.objectContaining({ accessToken: 'refreshed_at' }));
+    });
+    it('RFT-4: an already-expired token also refreshes (not just the skew window)', async () => {
+        const { loadCredentials, refreshAccessToken, storeCredentials } = await import('../config/token-credentials.js');
+        const { resolveFreshAccessToken } = await import('./client.token-refresh.js');
+        vi.mocked(loadCredentials).mockResolvedValue({
+            accessToken: 'expired_at',
+            refreshToken: 'expired_rt',
+            expiresAt: Date.now() - 1_000,
+            version: 2,
+        });
+        vi.mocked(refreshAccessToken).mockResolvedValue({
+            accessToken: 'new_at',
+            refreshToken: 'new_rt',
+            expiresAt: Date.now() + 3_600_000,
+            version: 2,
+        });
+        vi.mocked(storeCredentials).mockResolvedValue(undefined);
+        const result = await resolveFreshAccessToken();
+        expect(result).toBe('new_at');
+    });
+    it('RFT-5: returns null when the refresh token itself is no longer valid', async () => {
+        const { loadCredentials, refreshAccessToken } = await import('../config/token-credentials.js');
+        const { resolveFreshAccessToken } = await import('./client.token-refresh.js');
+        vi.mocked(loadCredentials).mockResolvedValue({
+            accessToken: 'about_to_expire_at',
+            refreshToken: 'dead_rt',
+            expiresAt: Date.now() + 30_000,
+            version: 2,
+        });
+        vi.mocked(refreshAccessToken).mockResolvedValue(null);
+        const result = await resolveFreshAccessToken();
+        expect(result).toBeNull();
+    });
+});
 //# sourceMappingURL=client.token-refresh.test.js.map

package/dist/src/api/client.token-refresh.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.token-refresh.test.js","sourceRoot":"","sources":["../../../src/api/client.token-refresh.test.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAE7D,EAAE,CAAC,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;IACxB,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC3B,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC1B,CAAC,CAAC,CAAA;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAC7D,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAChD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAErE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YAC5B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC;YAC9C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAC/B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAExD,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;QAEtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC7B,MAAM,CAAC,kBAAkB,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAA;QACzD,MAAM,CAAC,gBAAgB,CAAC,CAAC,oBAAoB,CAC3C,MAAM,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAC/D,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC1E,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAErE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAElD,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC9F,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAErE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YAC5B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAErD,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC1E,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE3E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,WAAW;YACxB,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAC/B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC1E,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE3E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAElD,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"client.token-refresh.test.js","sourceRoot":"","sources":["../../../src/api/client.token-refresh.test.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAE7D,EAAE,CAAC,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;IACxB,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC3B,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC1B,CAAC,CAAC,CAAA;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAC7D,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAChD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAErE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YAC5B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC;YAC9C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAC/B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAExD,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;QAEtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC7B,MAAM,CAAC,kBAAkB,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAA;QACzD,MAAM,CAAC,gBAAgB,CAAC,CAAC,oBAAoB,CAC3C,MAAM,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAC/D,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC1E,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAErE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAElD,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC9F,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAErE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YAC5B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAErD,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC1E,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE3E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,WAAW;YACxB,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAC/B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC1E,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE3E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAElD,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,iFAAiF;AACjF,8FAA8F;AAC9F,wFAAwF;AACxF,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC9F,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE7E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,UAAU;YACvB,YAAY,EAAE,UAAU;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,2CAA2C;YAC9E,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAE9C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC/B,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC9F,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE7E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAElD,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAE9C,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QACzB,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAC7D,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAChD,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE7E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,oBAAoB;YACjC,YAAY,EAAE,gBAAgB;YAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,uCAAuC;YACvE,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC;YAC9C,WAAW,EAAE,cAAc;YAC3B,YAAY,EAAE,cAAc;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACjC,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAExD,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAE9C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACnC,MAAM,CAAC,kBAAkB,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAA;QACjE,MAAM,CAAC,gBAAgB,CAAC,CAAC,oBAAoB,CAC3C,MAAM,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CACzD,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAC7D,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAChD,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE7E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,YAAY;YACzB,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC;YAC9C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACjC,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAExD,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAE9C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC9F,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE7E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,oBAAoB;YACjC,YAAY,EAAE,SAAS;YACvB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;YAC9B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAErD,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAE9C,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/api/index.d.ts

@@ -7,7 +7,9 @@
  * SMI-1300: API types matching OpenAPI spec
  */
 export { SkillsmithApiClient, createApiClient, generateAnonymousId, ApiClientError, type ApiClientConfig, type ApiResponse, type ApiErrorResponse, type ApiSearchResult, type RecommendationRequest, type TelemetryEvent, } from './client.js';
+export { getPrivateRegistrySkillContent, type PrivateRegistrySkillContent, type PrivateRegistryGetErrorCode, type PrivateRegistryGetResult, type GetPrivateRegistrySkillContentParams, } from './client.private-registry.js';
 export { EventBatcher, createEventBatcher, type EventBatcherOptions, type BatchFlushFn, } from './event-batcher.js';
+export { deriveSecuritySummaryFromApiSkill, deriveSecuritySummaryFromSkillRow, } from './security-summary.js';
 export { ApiCache, createCache, getGlobalCache, DEFAULT_TTL, type CacheConfig, type CacheStats, } from './cache.js';
 export { API_TRUST_TIERS, API_CATEGORIES } from './types.js';
 export type { ApiTrustTier, ApiCategory, ApiProjectType, ApiSkill, ApiSearchResult as OpenApiSearchResult, RecommendedSkill, SearchParams, SearchResponse, SearchResponseMeta, RecommendParams, RecommendResponse, RecommendResponseMeta, SkillResponse, HealthStatus, TelemetryEventType, TelemetryMetadata, TelemetryEventPayload, TelemetryResponse, ApiErrorResponse as OpenApiErrorResponse, RateLimitInfo, ApiClientOptions, ApiResponse as OpenApiResponse, } from './types.js';

package/dist/src/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,GACpB,MAAM,aAAa,CAAA;AAGpB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAA;AAM3B,OAAO,EACL,QAAQ,EACR,WAAW,EACX,cAAc,EACd,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAA;AAMnB,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE5D,YAAY,EAEV,YAAY,EACZ,WAAW,EACX,cAAc,EAEd,QAAQ,EACR,eAAe,IAAI,mBAAmB,EACtC,gBAAgB,EAEhB,YAAY,EACZ,cAAc,EACd,kBAAkB,EAElB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EAErB,aAAa,EAEb,YAAY,EAEZ,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EAEjB,gBAAgB,IAAI,oBAAoB,EAExC,aAAa,EAEb,gBAAgB,EAEhB,WAAW,IAAI,eAAe,GAC/B,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,GACpB,MAAM,aAAa,CAAA;AAIpB,OAAO,EACL,8BAA8B,EAC9B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,oCAAoC,GAC1C,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAA;AAO3B,OAAO,EACL,iCAAiC,EACjC,iCAAiC,GAClC,MAAM,uBAAuB,CAAA;AAM9B,OAAO,EACL,QAAQ,EACR,WAAW,EACX,cAAc,EACd,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAA;AAMnB,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE5D,YAAY,EAEV,YAAY,EACZ,WAAW,EACX,cAAc,EAEd,QAAQ,EACR,eAAe,IAAI,mBAAmB,EACtC,gBAAgB,EAEhB,YAAY,EACZ,cAAc,EACd,kBAAkB,EAElB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EAErB,aAAa,EAEb,YAAY,EAEZ,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EAEjB,gBAAgB,IAAI,oBAAoB,EAExC,aAAa,EAEb,gBAAgB,EAEhB,WAAW,IAAI,eAAe,GAC/B,MAAM,YAAY,CAAA"}

package/dist/src/api/index.js

@@ -10,8 +10,17 @@
 // API Client
 // ============================================================================
 export { SkillsmithApiClient, createApiClient, generateAnonymousId, ApiClientError, } from './client.js';
+// SMI-5905 Wave 4: private-registry content fetch — the CLI's only transport
+// to `private_registry_skills.content` (see client.private-registry.ts header).
+export { getPrivateRegistrySkillContent, } from './client.private-registry.js';
 // SMI-4119: Event batching
 export { EventBatcher, createEventBatcher, } from './event-batcher.js';
+// SMI-5897 (C-15): shared security-summary derivation — CLI (`toSkill()`)
+// and MCP tool call sites both import this instead of independently
+// reconstructing the passed/riskScore/findingsCount/scannedAt logic.
+// SMI-5897 (Wave 4 fix): sibling `deriveSecuritySummaryFromSkillRow()` for
+// the local-DB-shaped (pre-computed field) call sites.
+export { deriveSecuritySummaryFromApiSkill, deriveSecuritySummaryFromSkillRow, } from './security-summary.js';
 // ============================================================================
 // API Cache
 // ============================================================================

package/dist/src/api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,cAAc,GAOf,MAAM,aAAa,CAAA;AAEpB,2BAA2B;AAC3B,OAAO,EACL,YAAY,EACZ,kBAAkB,GAGnB,MAAM,oBAAoB,CAAA;AAE3B,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,OAAO,EACL,QAAQ,EACR,WAAW,EACX,cAAc,EACd,WAAW,GAGZ,MAAM,YAAY,CAAA;AAEnB,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,cAAc,GAOf,MAAM,aAAa,CAAA;AAEpB,6EAA6E;AAC7E,gFAAgF;AAChF,OAAO,EACL,8BAA8B,GAK/B,MAAM,8BAA8B,CAAA;AAErC,2BAA2B;AAC3B,OAAO,EACL,YAAY,EACZ,kBAAkB,GAGnB,MAAM,oBAAoB,CAAA;AAE3B,0EAA0E;AAC1E,oEAAoE;AACpE,qEAAqE;AACrE,2EAA2E;AAC3E,uDAAuD;AACvD,OAAO,EACL,iCAAiC,EACjC,iCAAiC,GAClC,MAAM,uBAAuB,CAAA;AAE9B,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,OAAO,EACL,QAAQ,EACR,WAAW,EACX,cAAc,EACd,WAAW,GAGZ,MAAM,YAAY,CAAA;AAEnB,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}

package/dist/src/api/security-summary.d.ts

@@ -0,0 +1,73 @@
+/**
+ * @fileoverview Shared derivation of a `SecuritySummary` from an API skill row,
+ * and from a pre-computed local-DB-shaped skill row.
+ * @module @skillsmith/core/api/security-summary
+ * @see SMI-4240: original inline derivation in mcp-server's get-skill.ts
+ * @see SMI-5562: extracted to mcp-server's utils/security-summary.ts so
+ *   get-skill.ts, recommend.ts, and search.ts share a single implementation
+ *   instead of triplicating the logic.
+ * @see SMI-5897 (C-15): moved here from mcp-server so `SkillsmithApiClient.toSkill()`
+ *   (CLI path) can share the exact same derivation instead of hardcoding
+ *   `riskScore: null, securityFindingsCount: 0, securityScannedAt: null,
+ *   securityPassed: null` for every API-sourced skill — which caused CLI
+ *   `info`/`search` to show "Not scanned" for skills MCP correctly reported
+ *   as passed. Both `toSkill()` and mcp-server's tool call sites now import
+ *   this one function, so the two surfaces cannot re-diverge.
+ * @see SMI-5897 (Wave 4 fix): `deriveSecuritySummaryFromSkillRow()` added
+ *   alongside `deriveSecuritySummaryFromApiSkill()` — the local-DB-path
+ *   sibling for the SAME undefined-when-never-scanned contract, but over the
+ *   pre-computed `securityPassed`/`riskScore`/`securityFindingsCount`/
+ *   `securityScannedAt` field shape (as opposed to the raw API row's
+ *   `last_scanned_at`/`quarantined`/`security_score`/`security_findings`
+ *   columns). `recommend.helpers.ts`'s `buildDbFallbackRecommendation` had
+ *   this exact ternary inline already; `search.helpers.ts`'s
+ *   `mapLocalSkillToSearchResult` and `get-skill.ts`'s local-DB branch built
+ *   the security object unconditionally, violating the contract for a
+ *   never-scanned skill. All three now share this one function.
+ */
+import type { ApiSkill } from './types.js';
+import type { SecuritySummary } from '../types.js';
+/**
+ * Derive a `SecuritySummary` from an API skill row's flat security columns.
+ *
+ * Returns `undefined` when the skill has never been scanned
+ * (`last_scanned_at == null`) — never scanned is a distinct state from
+ * "scanned but no verdict" and callers must not conflate the two by
+ * shipping a placeholder `{ passed: null, ... }` object for skills that
+ * were never scanned at all.
+ *
+ * `security_findings_count` is not a stored column — `findingsCount` is
+ * always derived from the length of the `security_findings` jsonb array
+ * (defensively 0 when the value is missing or not an array).
+ *
+ * @param apiSkill - Object carrying the flat security columns from an
+ *   `ApiSkill`/`ApiSearchResult` row (registry API response shape).
+ * @returns The derived summary, or `undefined` when never scanned.
+ */
+export declare function deriveSecuritySummaryFromApiSkill(apiSkill: Pick<ApiSkill, 'last_scanned_at' | 'quarantined' | 'security_score' | 'security_findings'>): SecuritySummary | undefined;
+/**
+ * Derive a `SecuritySummary` from a local-DB-shaped skill row's PRE-COMPUTED
+ * flat security fields (`securityPassed`/`riskScore`/`securityFindingsCount`/
+ * `securityScannedAt` — a different shape from {@link deriveSecuritySummaryFromApiSkill}'s
+ * raw API-row columns).
+ *
+ * Same contract as {@link deriveSecuritySummaryFromApiSkill}: returns
+ * `undefined` when the skill has never been scanned (`securityScannedAt ==
+ * null`) — never scanned is a distinct state from "scanned but no verdict"
+ * and callers must not conflate the two by shipping a placeholder
+ * `{ passed: null, ... }` object for skills that were never scanned at all.
+ * `passed`/`riskScore` pass through RAW — never coerce/default to a
+ * fabricated value, which would misread as "confirmed clean/scanned."
+ *
+ * @param skill - Object carrying the pre-computed flat security fields
+ *   present on both a local `Skill` repository row and `SkillData`
+ *   (mcp-server's recommend matcher shape).
+ * @returns The derived summary, or `undefined` when never scanned.
+ */
+export declare function deriveSecuritySummaryFromSkillRow(skill: {
+    securityPassed: boolean | null;
+    riskScore: number | null;
+    securityFindingsCount: number;
+    securityScannedAt: string | null;
+}): SecuritySummary | undefined;
+//# sourceMappingURL=security-summary.d.ts.map

package/dist/src/api/security-summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-summary.d.ts","sourceRoot":"","sources":["../../../src/api/security-summary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,IAAI,CACZ,QAAQ,EACR,iBAAiB,GAAG,aAAa,GAAG,gBAAgB,GAAG,mBAAmB,CAC3E,GACA,eAAe,GAAG,SAAS,CAa7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,cAAc,EAAE,OAAO,GAAG,IAAI,CAAA;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,qBAAqB,EAAE,MAAM,CAAA;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC,GAAG,eAAe,GAAG,SAAS,CAW9B"}

package/dist/src/api/security-summary.js

@@ -0,0 +1,88 @@
+/**
+ * @fileoverview Shared derivation of a `SecuritySummary` from an API skill row,
+ * and from a pre-computed local-DB-shaped skill row.
+ * @module @skillsmith/core/api/security-summary
+ * @see SMI-4240: original inline derivation in mcp-server's get-skill.ts
+ * @see SMI-5562: extracted to mcp-server's utils/security-summary.ts so
+ *   get-skill.ts, recommend.ts, and search.ts share a single implementation
+ *   instead of triplicating the logic.
+ * @see SMI-5897 (C-15): moved here from mcp-server so `SkillsmithApiClient.toSkill()`
+ *   (CLI path) can share the exact same derivation instead of hardcoding
+ *   `riskScore: null, securityFindingsCount: 0, securityScannedAt: null,
+ *   securityPassed: null` for every API-sourced skill — which caused CLI
+ *   `info`/`search` to show "Not scanned" for skills MCP correctly reported
+ *   as passed. Both `toSkill()` and mcp-server's tool call sites now import
+ *   this one function, so the two surfaces cannot re-diverge.
+ * @see SMI-5897 (Wave 4 fix): `deriveSecuritySummaryFromSkillRow()` added
+ *   alongside `deriveSecuritySummaryFromApiSkill()` — the local-DB-path
+ *   sibling for the SAME undefined-when-never-scanned contract, but over the
+ *   pre-computed `securityPassed`/`riskScore`/`securityFindingsCount`/
+ *   `securityScannedAt` field shape (as opposed to the raw API row's
+ *   `last_scanned_at`/`quarantined`/`security_score`/`security_findings`
+ *   columns). `recommend.helpers.ts`'s `buildDbFallbackRecommendation` had
+ *   this exact ternary inline already; `search.helpers.ts`'s
+ *   `mapLocalSkillToSearchResult` and `get-skill.ts`'s local-DB branch built
+ *   the security object unconditionally, violating the contract for a
+ *   never-scanned skill. All three now share this one function.
+ */
+/**
+ * Derive a `SecuritySummary` from an API skill row's flat security columns.
+ *
+ * Returns `undefined` when the skill has never been scanned
+ * (`last_scanned_at == null`) — never scanned is a distinct state from
+ * "scanned but no verdict" and callers must not conflate the two by
+ * shipping a placeholder `{ passed: null, ... }` object for skills that
+ * were never scanned at all.
+ *
+ * `security_findings_count` is not a stored column — `findingsCount` is
+ * always derived from the length of the `security_findings` jsonb array
+ * (defensively 0 when the value is missing or not an array).
+ *
+ * @param apiSkill - Object carrying the flat security columns from an
+ *   `ApiSkill`/`ApiSearchResult` row (registry API response shape).
+ * @returns The derived summary, or `undefined` when never scanned.
+ */
+export function deriveSecuritySummaryFromApiSkill(apiSkill) {
+    if (apiSkill.last_scanned_at == null) {
+        return undefined;
+    }
+    return {
+        passed: apiSkill.quarantined === true ? false : apiSkill.security_score == null ? null : true,
+        riskScore: apiSkill.security_score ?? null,
+        findingsCount: Array.isArray(apiSkill.security_findings)
+            ? apiSkill.security_findings.length
+            : 0,
+        scannedAt: apiSkill.last_scanned_at,
+    };
+}
+/**
+ * Derive a `SecuritySummary` from a local-DB-shaped skill row's PRE-COMPUTED
+ * flat security fields (`securityPassed`/`riskScore`/`securityFindingsCount`/
+ * `securityScannedAt` — a different shape from {@link deriveSecuritySummaryFromApiSkill}'s
+ * raw API-row columns).
+ *
+ * Same contract as {@link deriveSecuritySummaryFromApiSkill}: returns
+ * `undefined` when the skill has never been scanned (`securityScannedAt ==
+ * null`) — never scanned is a distinct state from "scanned but no verdict"
+ * and callers must not conflate the two by shipping a placeholder
+ * `{ passed: null, ... }` object for skills that were never scanned at all.
+ * `passed`/`riskScore` pass through RAW — never coerce/default to a
+ * fabricated value, which would misread as "confirmed clean/scanned."
+ *
+ * @param skill - Object carrying the pre-computed flat security fields
+ *   present on both a local `Skill` repository row and `SkillData`
+ *   (mcp-server's recommend matcher shape).
+ * @returns The derived summary, or `undefined` when never scanned.
+ */
+export function deriveSecuritySummaryFromSkillRow(skill) {
+    if (skill.securityScannedAt == null) {
+        return undefined;
+    }
+    return {
+        passed: skill.securityPassed,
+        riskScore: skill.riskScore,
+        findingsCount: skill.securityFindingsCount,
+        scannedAt: skill.securityScannedAt,
+    };
+}
+//# sourceMappingURL=security-summary.js.map

package/dist/src/api/security-summary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-summary.js","sourceRoot":"","sources":["../../../src/api/security-summary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iCAAiC,CAC/C,QAGC;IAED,IAAI,QAAQ,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;QACrC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC7F,SAAS,EAAE,QAAQ,CAAC,cAAc,IAAI,IAAI;QAC1C,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACtD,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM;YACnC,CAAC,CAAC,CAAC;QACL,SAAS,EAAE,QAAQ,CAAC,eAAe;KACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iCAAiC,CAAC,KAKjD;IACC,IAAI,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;QACpC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,cAAc;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,qBAAqB;QAC1C,SAAS,EAAE,KAAK,CAAC,iBAAiB;KACnC,CAAA;AACH,CAAC"}

package/dist/src/api/security-summary.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * SMI-5562: Unit coverage for the shared security-summary derivation helper,
+ * extracted from get-skill.ts's inline derivation (SMI-4240).
+ * SMI-5897 (C-15): moved from packages/mcp-server/src/utils/security-summary.test.ts
+ * to packages/core so the CLI (`SkillsmithApiClient.toSkill()`) and MCP tool
+ * call sites share and test one implementation.
+ */
+export {};
+//# sourceMappingURL=security-summary.test.d.ts.map

package/dist/src/api/security-summary.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-summary.test.d.ts","sourceRoot":"","sources":["../../../src/api/security-summary.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/src/api/security-summary.test.js

@@ -0,0 +1,94 @@
+/**
+ * SMI-5562: Unit coverage for the shared security-summary derivation helper,
+ * extracted from get-skill.ts's inline derivation (SMI-4240).
+ * SMI-5897 (C-15): moved from packages/mcp-server/src/utils/security-summary.test.ts
+ * to packages/core so the CLI (`SkillsmithApiClient.toSkill()`) and MCP tool
+ * call sites share and test one implementation.
+ */
+import { describe, it, expect } from 'vitest';
+import { deriveSecuritySummaryFromApiSkill } from './security-summary.js';
+describe('deriveSecuritySummaryFromApiSkill', () => {
+    it('returns undefined when the skill has never been scanned (last_scanned_at null)', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: null,
+            quarantined: false,
+            security_score: null,
+            security_findings: null,
+        });
+        expect(result).toBeUndefined();
+    });
+    it('returns undefined when last_scanned_at is undefined', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: undefined,
+            quarantined: undefined,
+            security_score: undefined,
+            security_findings: undefined,
+        });
+        expect(result).toBeUndefined();
+    });
+    it('returns passed: false when quarantined, regardless of security_score', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: '2026-06-01T00:00:00.000Z',
+            quarantined: true,
+            // A low score would otherwise read as "clean" — quarantined must win.
+            security_score: 0,
+            security_findings: [],
+        });
+        expect(result?.passed).toBe(false);
+    });
+    it('returns passed: null when scanned but no security_score is recorded yet', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: '2026-06-01T00:00:00.000Z',
+            quarantined: false,
+            security_score: null,
+            security_findings: null,
+        });
+        expect(result?.passed).toBeNull();
+        expect(result?.riskScore).toBeNull();
+    });
+    it('returns passed: true for a clean scanned skill with a recorded score', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: '2026-06-01T00:00:00.000Z',
+            quarantined: false,
+            security_score: 0,
+            security_findings: [],
+        });
+        expect(result).toEqual({
+            passed: true,
+            riskScore: 0,
+            findingsCount: 0,
+            scannedAt: '2026-06-01T00:00:00.000Z',
+        });
+    });
+    it('derives findingsCount from the security_findings array length', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: '2026-06-01T00:00:00.000Z',
+            quarantined: false,
+            security_score: 42,
+            security_findings: [{ rule: 'a' }, { rule: 'b' }, { rule: 'c' }],
+        });
+        expect(result?.findingsCount).toBe(3);
+    });
+    it('defaults findingsCount to 0 when security_findings is not an array', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: '2026-06-01T00:00:00.000Z',
+            quarantined: false,
+            security_score: 10,
+            // Defensive non-array case — should never happen at runtime (jsonb column),
+            // but the derivation must not throw or miscount.
+            security_findings: undefined,
+        });
+        expect(result?.findingsCount).toBe(0);
+    });
+    it('passes riskScore through as null (never a fabricated 0) when unscored', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: '2026-06-01T00:00:00.000Z',
+            quarantined: false,
+            security_score: null,
+            security_findings: [{ rule: 'pending-review' }],
+        });
+        expect(result?.riskScore).toBeNull();
+        expect(result?.findingsCount).toBe(1);
+    });
+});
+//# sourceMappingURL=security-summary.test.js.map

package/dist/src/api/security-summary.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-summary.test.js","sourceRoot":"","sources":["../../../src/api/security-summary.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAA;AAEzE,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,SAAS;YAC1B,WAAW,EAAE,SAAS;YACtB,cAAc,EAAE,SAAS;YACzB,iBAAiB,EAAE,SAAS;SAC7B,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,0BAA0B;YAC3C,WAAW,EAAE,IAAI;YACjB,sEAAsE;YACtE,cAAc,EAAE,CAAC;YACjB,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,0BAA0B;YAC3C,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QACjC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,0BAA0B;YAC3C,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,CAAC;YACjB,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,CAAC;YACZ,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,0BAA0B;SACtC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,0BAA0B;YAC3C,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,EAAE;YAClB,iBAAiB,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;SACjE,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,0BAA0B;YAC3C,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,EAAE;YAClB,4EAA4E;YAC5E,iDAAiD;YACjD,iBAAiB,EAAE,SAAS;SAC7B,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,0BAA0B;YAC3C,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;SAChD,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAA;QACpC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/config/config-atomic-write.d.ts

@@ -17,9 +17,17 @@
  *     principle observe a partially-written file.
  *
  * This module fixes both:
- *  - {@link acquireConfigLock} serializes ALL writers (cross-process, via a
- *    create-exclusive `.lock` sentinel file) so a caller's full
- *    read-modify-write sequence is one atomic critical section.
+ *  - {@link acquireConfigLock} serializes ALL writers (cross-process) so a
+ *    caller's full read-modify-write sequence is one atomic critical
+ *    section. SMI-5883 Wave 2: this is now a thin wrapper over the shared
+ *    two-level {@link acquireOwnedLock} primitive (`owned-lock.ts`) —
+ *    staleness is determined by OWNER LIVENESS (not file age), and a stale
+ *    lock is reclaimed only from inside a second, strict-no-auto-reclaim
+ *    lock that serializes reclaim decisions. The prior age-based
+ *    `STALE_LOCK_AGE_MS` force-clear is REMOVED, not tuned — a lock held
+ *    legitimately longer than any timeout now correctly times out instead
+ *    of being force-cleared out from under its live holder. See
+ *    `owned-lock.ts`'s module docstring for the full soundness argument.
  *  - {@link atomicWriteFile} writes to a temp file in the same directory,
  *    then `renameSync`s it into place — POSIX guarantees `rename(2)` is
  *    atomic, so a concurrent reader (which never needs the lock — only
@@ -27,14 +35,26 @@
  *    never a torn write.
  */
 /**
- * Acquire an exclusive, cross-process lock guarding `configPath`.
+ * Acquire an exclusive, cross-process lock guarding `configPath`. Thin
+ * wrapper over {@link acquireOwnedLock} (SMI-5883 Wave 2) — preserves this
+ * function's signature and its `${configPath}.lock` path so no caller needs
+ * to change. Behaviour deltas vs the pre-SMI-5883 implementation (each
+ * covered by a test in `config-atomic-write.test.ts`):
  *
- * Uses atomic create-exclusive (the `wx` flag — fails with `EEXIST` if the
- * lock file already exists) as the mutual-exclusion primitive: portable
- * (identical behavior on macOS/Linux/Windows) and needs no extra
- * dependency. Retries with a short backoff until `LOCK_ACQUIRE_TIMEOUT_MS`
- * elapses. If the held lock is older than `STALE_LOCK_AGE_MS` it is assumed
- * abandoned by a crashed process and force-cleared once, then retried.
+ *  1. A stale lock is cleared on OWNER DEATH, not on AGE. A lock held by a
+ *     live process for longer than the old 10s threshold is no longer
+ *     force-cleared — it now correctly waits, then times out.
+ *  2. A legacy bare-PID lock (this module's OWN pre-SMI-5883 on-disk format)
+ *     is no longer cleared at all — `StuckLockError { reason:
+ *     'unreclaimable_legacy' }` (D-5: a legacy claim carries no `host`, so
+ *     "dead on this host" cannot establish "dead").
+ *  3. The on-disk lock content changes from a bare PID to a v1 JSON record.
+ *     No in-repo consumer parses it directly (only this module's own
+ *     `acquireConfigLock`/release touch the file).
+ *  4. The timeout message keeps the stable prefix "Timed out waiting for
+ *     config lock" (via `label: 'config lock'`) so existing assertions
+ *     still match, with the failure reason and the manual unstick procedure
+ *     appended.
  *
  * @param configPath - Path to the config file being guarded (NOT the lock
  * file itself — the lock file is `${configPath}.lock`).

package/dist/src/config/config-atomic-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-atomic-write.d.ts","sourceRoot":"","sources":["../../../src/config/config-atomic-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AA2CH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,MAAgC,GAC1C,MAAM,IAAI,CAmDZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAarF"}
+{"version":3,"file":"config-atomic-write.d.ts","sourceRoot":"","sources":["../../../src/config/config-atomic-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAeH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,MAAgC,GAC1C,MAAM,IAAI,CAEZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAarF"}