@skillsmith/core 0.11.4 → 0.11.6

package/dist/src/api/client.toSkill.test.js

@@ -0,0 +1,97 @@
+/**
+ * SMI-5897 (C-15): Unit coverage for `SkillsmithApiClient.toSkill()`'s
+ * security-status field derivation.
+ *
+ * Previously `toSkill()` hardcoded `riskScore: null, securityFindingsCount: 0,
+ * securityScannedAt: null, securityPassed: null` for every API-sourced skill,
+ * discarding the real `security_score`/`quarantined`/`last_scanned_at`/
+ * `security_findings` fields already present on the `ApiSearchResult` it
+ * received — this is why CLI `info`/`search` (which both route through
+ * `toSkill()`) could show "Not scanned" for a skill MCP correctly reported
+ * as passed. `toSkill()` now derives these fields via the same shared
+ * `deriveSecuritySummaryFromApiSkill()` MCP's tools use, so the two surfaces
+ * can't re-diverge (see `api/security-summary.test.ts` for derivation-logic
+ * coverage — this file only asserts `toSkill()` wires it through correctly).
+ *
+ * SMI-5897 (Wave 4 fix): imports `ApiSearchResult` from `./client.types.js` —
+ * `toSkill()`'s ACTUAL parameter type — not `./types.js`, which declares a
+ * different, same-named type (a pre-existing naming collision elsewhere in
+ * this codebase, not something fixed globally here). Importing the wrong
+ * type, combined with the `as ApiSearchResult` cast this fix also removes,
+ * meant the fixture below was never actually type-checked against
+ * `toSkill()`'s real input contract.
+ */
+import { describe, it, expect } from 'vitest';
+import { SkillsmithApiClient } from './client.js';
+function makeApiSearchResult(overrides = {}) {
+    return {
+        id: 'skill-1',
+        name: 'commit',
+        description: 'A commit skill',
+        author: 'anthropic',
+        repo_url: 'https://github.com/anthropic/commit',
+        quality_score: 90,
+        trust_tier: 'verified',
+        tags: ['git'],
+        stars: 10,
+        created_at: '2026-01-01T00:00:00.000Z',
+        updated_at: '2026-01-02T00:00:00.000Z',
+        installable: true,
+        ...overrides,
+    };
+}
+describe('SkillsmithApiClient.toSkill() — security field derivation (SMI-5897 C-15)', () => {
+    it('reports "not scanned" (all-null security fields) when last_scanned_at is null', () => {
+        const result = makeApiSearchResult({
+            last_scanned_at: null,
+            quarantined: false,
+            security_score: null,
+            security_findings: null,
+        });
+        const skill = SkillsmithApiClient.toSkill(result);
+        expect(skill.securityScannedAt).toBeNull();
+        expect(skill.securityPassed).toBeNull();
+        expect(skill.riskScore).toBeNull();
+        expect(skill.securityFindingsCount).toBe(0);
+    });
+    it('reports a real passing scan status instead of a hardcoded "not scanned"', () => {
+        const result = makeApiSearchResult({
+            last_scanned_at: '2026-06-01T00:00:00.000Z',
+            quarantined: false,
+            security_score: 0,
+            security_findings: [],
+        });
+        const skill = SkillsmithApiClient.toSkill(result);
+        // Pre-fix this was unconditionally { securityPassed: null, ... } —
+        // the exact CLI/MCP status-mismatch bug (C-15).
+        expect(skill.securityPassed).toBe(true);
+        expect(skill.securityScannedAt).toBe('2026-06-01T00:00:00.000Z');
+        expect(skill.riskScore).toBe(0);
+        expect(skill.securityFindingsCount).toBe(0);
+    });
+    it('reports a failing scan status (quarantined) instead of a hardcoded "not scanned"', () => {
+        const result = makeApiSearchResult({
+            last_scanned_at: '2026-06-01T00:00:00.000Z',
+            quarantined: true,
+            security_score: 10,
+            security_findings: [{ rule: 'a' }, { rule: 'b' }],
+        });
+        const skill = SkillsmithApiClient.toSkill(result);
+        expect(skill.securityPassed).toBe(false);
+        expect(skill.securityFindingsCount).toBe(2);
+        expect(skill.riskScore).toBe(10);
+    });
+    it('preserves riskScore: null (never fabricates 0) for a scanned-but-unscored skill', () => {
+        const result = makeApiSearchResult({
+            last_scanned_at: '2026-06-01T00:00:00.000Z',
+            quarantined: false,
+            security_score: null,
+            security_findings: null,
+        });
+        const skill = SkillsmithApiClient.toSkill(result);
+        expect(skill.securityPassed).toBeNull();
+        expect(skill.riskScore).toBeNull();
+        expect(skill.securityScannedAt).toBe('2026-06-01T00:00:00.000Z');
+    });
+});
+//# sourceMappingURL=client.toSkill.test.js.map

package/dist/src/api/client.toSkill.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.toSkill.test.js","sourceRoot":"","sources":["../../../src/api/client.toSkill.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAGjD,SAAS,mBAAmB,CAAC,YAAsC,EAAE;IACnE,OAAO;QACL,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,gBAAgB;QAC7B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,qCAAqC;QAC/C,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,UAAU;QACtB,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,KAAK,EAAE,EAAE;QACT,UAAU,EAAE,0BAA0B;QACtC,UAAU,EAAE,0BAA0B;QACtC,WAAW,EAAE,IAAI;QACjB,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACzF,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAEjD,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAA;QACvC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,eAAe,EAAE,0BAA0B;YAC3C,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,CAAC;YACjB,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAEjD,mEAAmE;QACnE,gDAAgD;QAChD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;QAChE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,eAAe,EAAE,0BAA0B;YAC3C,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,EAAE;YAClB,iBAAiB,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;SAClD,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAEjD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,eAAe,EAAE,0BAA0B;YAC3C,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAEjD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAA;QACvC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/api/client.token-refresh.d.ts

@@ -1,3 +1,11 @@
 export declare function tryRefreshToken(): Promise<string | null>;
 export declare function loadStoredAccessToken(): Promise<string | null>;
+/**
+ * Resolve the signed-in user's Supabase access token, refreshing it if it has
+ * expired (or is within `TOKEN_EXPIRY_SKEW_MS` of expiring).
+ *
+ * @returns the access token, or null when no credentials are stored on this
+ *          machine (or the stored refresh token is no longer valid).
+ */
+export declare function resolveFreshAccessToken(): Promise<string | null>;
 //# sourceMappingURL=client.token-refresh.d.ts.map

package/dist/src/api/client.token-refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.token-refresh.d.ts","sourceRoot":"","sources":["../../../src/api/client.token-refresh.ts"],"names":[],"mappings":"AAOA,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAS9D;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIpE"}
+{"version":3,"file":"client.token-refresh.d.ts","sourceRoot":"","sources":["../../../src/api/client.token-refresh.ts"],"names":[],"mappings":"AAOA,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAS9D;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIpE;AAcD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKtE"}

package/dist/src/api/client.token-refresh.js

@@ -16,4 +16,30 @@ export async function loadStoredAccessToken() {
         return null;
     return creds.accessToken;
 }
+/**
+ * SMI-5905 Wave 1: refresh a token this many ms before its recorded expiry.
+ *
+ * Extracted from `packages/mcp-server/src/tools/team-resolver.ts`'s
+ * `resolveUserAccessToken()` (originally SMI-4292) so a 2nd consumer (the
+ * CLI, via a future private-registry command) can resolve "the signed-in
+ * user's fresh access token" without depending on mcp-server. team-resolver.ts
+ * now delegates to `resolveFreshAccessToken()` below — same skew constant,
+ * same refresh-or-null fallback, no behavior change for its existing callers.
+ */
+const TOKEN_EXPIRY_SKEW_MS = 60_000;
+/**
+ * Resolve the signed-in user's Supabase access token, refreshing it if it has
+ * expired (or is within `TOKEN_EXPIRY_SKEW_MS` of expiring).
+ *
+ * @returns the access token, or null when no credentials are stored on this
+ *          machine (or the stored refresh token is no longer valid).
+ */
+export async function resolveFreshAccessToken() {
+    const creds = await loadCredentials();
+    if (!creds)
+        return null;
+    if (Date.now() < creds.expiresAt - TOKEN_EXPIRY_SKEW_MS)
+        return creds.accessToken;
+    return tryRefreshToken();
+}
 //# sourceMappingURL=client.token-refresh.js.map

package/dist/src/api/client.token-refresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.token-refresh.js","sourceRoot":"","sources":["../../../src/api/client.token-refresh.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AAEvC,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC9D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAE3B,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACjC,OAAO,SAAS,CAAC,WAAW,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO,KAAK,CAAC,WAAW,CAAA;AAC1B,CAAC"}
+{"version":3,"file":"client.token-refresh.js","sourceRoot":"","sources":["../../../src/api/client.token-refresh.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AAEvC,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC9D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAE3B,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACjC,OAAO,SAAS,CAAC,WAAW,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO,KAAK,CAAC,WAAW,CAAA;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAG,MAAM,CAAA;AAEnC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,oBAAoB;QAAE,OAAO,KAAK,CAAC,WAAW,CAAA;IACjF,OAAO,eAAe,EAAE,CAAA;AAC1B,CAAC"}

package/dist/src/api/client.token-refresh.test.js

@@ -70,4 +70,86 @@ describe('client.token-refresh', () => {
         expect(result).toBeNull();
     });
 });
+// SMI-5905 Wave 1: resolveFreshAccessToken() — extracted from team-resolver.ts's
+// resolveUserAccessToken() (TOKEN_EXPIRY_SKEW_MS=60s). team-resolver.ts now delegates to this
+// function unchanged, so these cases are the authoritative coverage for the skew logic.
+describe('resolveFreshAccessToken (SMI-5905)', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('RFT-1: returns accessToken directly when well within expiry (no refresh)', async () => {
+        const { loadCredentials, refreshAccessToken } = await import('../config/token-credentials.js');
+        const { resolveFreshAccessToken } = await import('./client.token-refresh.js');
+        vi.mocked(loadCredentials).mockResolvedValue({
+            accessToken: 'fresh_at',
+            refreshToken: 'fresh_rt',
+            expiresAt: Date.now() + 3_600_000, // 1h out — far outside the 60s skew window
+            version: 2,
+        });
+        const result = await resolveFreshAccessToken();
+        expect(result).toBe('fresh_at');
+        expect(refreshAccessToken).not.toHaveBeenCalled();
+    });
+    it('RFT-2: returns null when no credentials are stored (no refresh attempted)', async () => {
+        const { loadCredentials, refreshAccessToken } = await import('../config/token-credentials.js');
+        const { resolveFreshAccessToken } = await import('./client.token-refresh.js');
+        vi.mocked(loadCredentials).mockResolvedValue(null);
+        const result = await resolveFreshAccessToken();
+        expect(result).toBeNull();
+        expect(refreshAccessToken).not.toHaveBeenCalled();
+    });
+    it('RFT-3: expiry-skew boundary — refreshes within the 60s skew window', async () => {
+        const { loadCredentials, refreshAccessToken, storeCredentials } = await import('../config/token-credentials.js');
+        const { resolveFreshAccessToken } = await import('./client.token-refresh.js');
+        vi.mocked(loadCredentials).mockResolvedValue({
+            accessToken: 'about_to_expire_at',
+            refreshToken: 'still_valid_rt',
+            expiresAt: Date.now() + 30_000, // 30s out — inside the 60s skew window
+            version: 2,
+        });
+        vi.mocked(refreshAccessToken).mockResolvedValue({
+            accessToken: 'refreshed_at',
+            refreshToken: 'refreshed_rt',
+            expiresAt: Date.now() + 3_600_000,
+            version: 2,
+        });
+        vi.mocked(storeCredentials).mockResolvedValue(undefined);
+        const result = await resolveFreshAccessToken();
+        expect(result).toBe('refreshed_at');
+        expect(refreshAccessToken).toHaveBeenCalledWith('still_valid_rt');
+        expect(storeCredentials).toHaveBeenCalledWith(expect.objectContaining({ accessToken: 'refreshed_at' }));
+    });
+    it('RFT-4: an already-expired token also refreshes (not just the skew window)', async () => {
+        const { loadCredentials, refreshAccessToken, storeCredentials } = await import('../config/token-credentials.js');
+        const { resolveFreshAccessToken } = await import('./client.token-refresh.js');
+        vi.mocked(loadCredentials).mockResolvedValue({
+            accessToken: 'expired_at',
+            refreshToken: 'expired_rt',
+            expiresAt: Date.now() - 1_000,
+            version: 2,
+        });
+        vi.mocked(refreshAccessToken).mockResolvedValue({
+            accessToken: 'new_at',
+            refreshToken: 'new_rt',
+            expiresAt: Date.now() + 3_600_000,
+            version: 2,
+        });
+        vi.mocked(storeCredentials).mockResolvedValue(undefined);
+        const result = await resolveFreshAccessToken();
+        expect(result).toBe('new_at');
+    });
+    it('RFT-5: returns null when the refresh token itself is no longer valid', async () => {
+        const { loadCredentials, refreshAccessToken } = await import('../config/token-credentials.js');
+        const { resolveFreshAccessToken } = await import('./client.token-refresh.js');
+        vi.mocked(loadCredentials).mockResolvedValue({
+            accessToken: 'about_to_expire_at',
+            refreshToken: 'dead_rt',
+            expiresAt: Date.now() + 30_000,
+            version: 2,
+        });
+        vi.mocked(refreshAccessToken).mockResolvedValue(null);
+        const result = await resolveFreshAccessToken();
+        expect(result).toBeNull();
+    });
+});
 //# sourceMappingURL=client.token-refresh.test.js.map

package/dist/src/api/client.token-refresh.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.token-refresh.test.js","sourceRoot":"","sources":["../../../src/api/client.token-refresh.test.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAE7D,EAAE,CAAC,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;IACxB,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC3B,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC1B,CAAC,CAAC,CAAA;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAC7D,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAChD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAErE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YAC5B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC;YAC9C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAC/B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAExD,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;QAEtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC7B,MAAM,CAAC,kBAAkB,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAA;QACzD,MAAM,CAAC,gBAAgB,CAAC,CAAC,oBAAoB,CAC3C,MAAM,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAC/D,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC1E,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAErE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAElD,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC9F,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAErE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YAC5B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAErD,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC1E,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE3E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,WAAW;YACxB,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAC/B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC1E,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE3E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAElD,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"client.token-refresh.test.js","sourceRoot":"","sources":["../../../src/api/client.token-refresh.test.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAE7D,EAAE,CAAC,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;IACxB,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC3B,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC1B,CAAC,CAAC,CAAA;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAC7D,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAChD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAErE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YAC5B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC;YAC9C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAC/B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAExD,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;QAEtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC7B,MAAM,CAAC,kBAAkB,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAA;QACzD,MAAM,CAAC,gBAAgB,CAAC,CAAC,oBAAoB,CAC3C,MAAM,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAC/D,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC1E,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAErE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAElD,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC9F,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAErE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YAC5B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAErD,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC1E,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE3E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,WAAW;YACxB,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAC/B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC1E,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE3E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAElD,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,iFAAiF;AACjF,8FAA8F;AAC9F,wFAAwF;AACxF,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC9F,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE7E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,UAAU;YACvB,YAAY,EAAE,UAAU;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,2CAA2C;YAC9E,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAE9C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC/B,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC9F,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE7E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAElD,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAE9C,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QACzB,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAC7D,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAChD,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE7E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,oBAAoB;YACjC,YAAY,EAAE,gBAAgB;YAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,uCAAuC;YACvE,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC;YAC9C,WAAW,EAAE,cAAc;YAC3B,YAAY,EAAE,cAAc;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACjC,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAExD,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAE9C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACnC,MAAM,CAAC,kBAAkB,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAA;QACjE,MAAM,CAAC,gBAAgB,CAAC,CAAC,oBAAoB,CAC3C,MAAM,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CACzD,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAC7D,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAChD,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE7E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,YAAY;YACzB,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC;YAC9C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACjC,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAExD,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAE9C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC9F,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAE7E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,oBAAoB;YACjC,YAAY,EAAE,SAAS;YACvB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;YAC9B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAErD,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAE9C,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/api/index.d.ts

@@ -7,7 +7,9 @@
  * SMI-1300: API types matching OpenAPI spec
  */
 export { SkillsmithApiClient, createApiClient, generateAnonymousId, ApiClientError, type ApiClientConfig, type ApiResponse, type ApiErrorResponse, type ApiSearchResult, type RecommendationRequest, type TelemetryEvent, } from './client.js';
+export { getPrivateRegistrySkillContent, type PrivateRegistrySkillContent, type PrivateRegistryGetErrorCode, type PrivateRegistryGetResult, type GetPrivateRegistrySkillContentParams, } from './client.private-registry.js';
 export { EventBatcher, createEventBatcher, type EventBatcherOptions, type BatchFlushFn, } from './event-batcher.js';
+export { deriveSecuritySummaryFromApiSkill, deriveSecuritySummaryFromSkillRow, } from './security-summary.js';
 export { ApiCache, createCache, getGlobalCache, DEFAULT_TTL, type CacheConfig, type CacheStats, } from './cache.js';
 export { API_TRUST_TIERS, API_CATEGORIES } from './types.js';
 export type { ApiTrustTier, ApiCategory, ApiProjectType, ApiSkill, ApiSearchResult as OpenApiSearchResult, RecommendedSkill, SearchParams, SearchResponse, SearchResponseMeta, RecommendParams, RecommendResponse, RecommendResponseMeta, SkillResponse, HealthStatus, TelemetryEventType, TelemetryMetadata, TelemetryEventPayload, TelemetryResponse, ApiErrorResponse as OpenApiErrorResponse, RateLimitInfo, ApiClientOptions, ApiResponse as OpenApiResponse, } from './types.js';

package/dist/src/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,GACpB,MAAM,aAAa,CAAA;AAGpB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAA;AAM3B,OAAO,EACL,QAAQ,EACR,WAAW,EACX,cAAc,EACd,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAA;AAMnB,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE5D,YAAY,EAEV,YAAY,EACZ,WAAW,EACX,cAAc,EAEd,QAAQ,EACR,eAAe,IAAI,mBAAmB,EACtC,gBAAgB,EAEhB,YAAY,EACZ,cAAc,EACd,kBAAkB,EAElB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EAErB,aAAa,EAEb,YAAY,EAEZ,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EAEjB,gBAAgB,IAAI,oBAAoB,EAExC,aAAa,EAEb,gBAAgB,EAEhB,WAAW,IAAI,eAAe,GAC/B,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,GACpB,MAAM,aAAa,CAAA;AAIpB,OAAO,EACL,8BAA8B,EAC9B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,oCAAoC,GAC1C,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAA;AAO3B,OAAO,EACL,iCAAiC,EACjC,iCAAiC,GAClC,MAAM,uBAAuB,CAAA;AAM9B,OAAO,EACL,QAAQ,EACR,WAAW,EACX,cAAc,EACd,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAA;AAMnB,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE5D,YAAY,EAEV,YAAY,EACZ,WAAW,EACX,cAAc,EAEd,QAAQ,EACR,eAAe,IAAI,mBAAmB,EACtC,gBAAgB,EAEhB,YAAY,EACZ,cAAc,EACd,kBAAkB,EAElB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EAErB,aAAa,EAEb,YAAY,EAEZ,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EAEjB,gBAAgB,IAAI,oBAAoB,EAExC,aAAa,EAEb,gBAAgB,EAEhB,WAAW,IAAI,eAAe,GAC/B,MAAM,YAAY,CAAA"}

package/dist/src/api/index.js

@@ -10,8 +10,17 @@
 // API Client
 // ============================================================================
 export { SkillsmithApiClient, createApiClient, generateAnonymousId, ApiClientError, } from './client.js';
+// SMI-5905 Wave 4: private-registry content fetch — the CLI's only transport
+// to `private_registry_skills.content` (see client.private-registry.ts header).
+export { getPrivateRegistrySkillContent, } from './client.private-registry.js';
 // SMI-4119: Event batching
 export { EventBatcher, createEventBatcher, } from './event-batcher.js';
+// SMI-5897 (C-15): shared security-summary derivation — CLI (`toSkill()`)
+// and MCP tool call sites both import this instead of independently
+// reconstructing the passed/riskScore/findingsCount/scannedAt logic.
+// SMI-5897 (Wave 4 fix): sibling `deriveSecuritySummaryFromSkillRow()` for
+// the local-DB-shaped (pre-computed field) call sites.
+export { deriveSecuritySummaryFromApiSkill, deriveSecuritySummaryFromSkillRow, } from './security-summary.js';
 // ============================================================================
 // API Cache
 // ============================================================================

package/dist/src/api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,cAAc,GAOf,MAAM,aAAa,CAAA;AAEpB,2BAA2B;AAC3B,OAAO,EACL,YAAY,EACZ,kBAAkB,GAGnB,MAAM,oBAAoB,CAAA;AAE3B,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,OAAO,EACL,QAAQ,EACR,WAAW,EACX,cAAc,EACd,WAAW,GAGZ,MAAM,YAAY,CAAA;AAEnB,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,cAAc,GAOf,MAAM,aAAa,CAAA;AAEpB,6EAA6E;AAC7E,gFAAgF;AAChF,OAAO,EACL,8BAA8B,GAK/B,MAAM,8BAA8B,CAAA;AAErC,2BAA2B;AAC3B,OAAO,EACL,YAAY,EACZ,kBAAkB,GAGnB,MAAM,oBAAoB,CAAA;AAE3B,0EAA0E;AAC1E,oEAAoE;AACpE,qEAAqE;AACrE,2EAA2E;AAC3E,uDAAuD;AACvD,OAAO,EACL,iCAAiC,EACjC,iCAAiC,GAClC,MAAM,uBAAuB,CAAA;AAE9B,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,OAAO,EACL,QAAQ,EACR,WAAW,EACX,cAAc,EACd,WAAW,GAGZ,MAAM,YAAY,CAAA;AAEnB,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}

package/dist/src/api/security-summary.d.ts

@@ -0,0 +1,73 @@
+/**
+ * @fileoverview Shared derivation of a `SecuritySummary` from an API skill row,
+ * and from a pre-computed local-DB-shaped skill row.
+ * @module @skillsmith/core/api/security-summary
+ * @see SMI-4240: original inline derivation in mcp-server's get-skill.ts
+ * @see SMI-5562: extracted to mcp-server's utils/security-summary.ts so
+ *   get-skill.ts, recommend.ts, and search.ts share a single implementation
+ *   instead of triplicating the logic.
+ * @see SMI-5897 (C-15): moved here from mcp-server so `SkillsmithApiClient.toSkill()`
+ *   (CLI path) can share the exact same derivation instead of hardcoding
+ *   `riskScore: null, securityFindingsCount: 0, securityScannedAt: null,
+ *   securityPassed: null` for every API-sourced skill — which caused CLI
+ *   `info`/`search` to show "Not scanned" for skills MCP correctly reported
+ *   as passed. Both `toSkill()` and mcp-server's tool call sites now import
+ *   this one function, so the two surfaces cannot re-diverge.
+ * @see SMI-5897 (Wave 4 fix): `deriveSecuritySummaryFromSkillRow()` added
+ *   alongside `deriveSecuritySummaryFromApiSkill()` — the local-DB-path
+ *   sibling for the SAME undefined-when-never-scanned contract, but over the
+ *   pre-computed `securityPassed`/`riskScore`/`securityFindingsCount`/
+ *   `securityScannedAt` field shape (as opposed to the raw API row's
+ *   `last_scanned_at`/`quarantined`/`security_score`/`security_findings`
+ *   columns). `recommend.helpers.ts`'s `buildDbFallbackRecommendation` had
+ *   this exact ternary inline already; `search.helpers.ts`'s
+ *   `mapLocalSkillToSearchResult` and `get-skill.ts`'s local-DB branch built
+ *   the security object unconditionally, violating the contract for a
+ *   never-scanned skill. All three now share this one function.
+ */
+import type { ApiSkill } from './types.js';
+import type { SecuritySummary } from '../types.js';
+/**
+ * Derive a `SecuritySummary` from an API skill row's flat security columns.
+ *
+ * Returns `undefined` when the skill has never been scanned
+ * (`last_scanned_at == null`) — never scanned is a distinct state from
+ * "scanned but no verdict" and callers must not conflate the two by
+ * shipping a placeholder `{ passed: null, ... }` object for skills that
+ * were never scanned at all.
+ *
+ * `security_findings_count` is not a stored column — `findingsCount` is
+ * always derived from the length of the `security_findings` jsonb array
+ * (defensively 0 when the value is missing or not an array).
+ *
+ * @param apiSkill - Object carrying the flat security columns from an
+ *   `ApiSkill`/`ApiSearchResult` row (registry API response shape).
+ * @returns The derived summary, or `undefined` when never scanned.
+ */
+export declare function deriveSecuritySummaryFromApiSkill(apiSkill: Pick<ApiSkill, 'last_scanned_at' | 'quarantined' | 'security_score' | 'security_findings'>): SecuritySummary | undefined;
+/**
+ * Derive a `SecuritySummary` from a local-DB-shaped skill row's PRE-COMPUTED
+ * flat security fields (`securityPassed`/`riskScore`/`securityFindingsCount`/
+ * `securityScannedAt` — a different shape from {@link deriveSecuritySummaryFromApiSkill}'s
+ * raw API-row columns).
+ *
+ * Same contract as {@link deriveSecuritySummaryFromApiSkill}: returns
+ * `undefined` when the skill has never been scanned (`securityScannedAt ==
+ * null`) — never scanned is a distinct state from "scanned but no verdict"
+ * and callers must not conflate the two by shipping a placeholder
+ * `{ passed: null, ... }` object for skills that were never scanned at all.
+ * `passed`/`riskScore` pass through RAW — never coerce/default to a
+ * fabricated value, which would misread as "confirmed clean/scanned."
+ *
+ * @param skill - Object carrying the pre-computed flat security fields
+ *   present on both a local `Skill` repository row and `SkillData`
+ *   (mcp-server's recommend matcher shape).
+ * @returns The derived summary, or `undefined` when never scanned.
+ */
+export declare function deriveSecuritySummaryFromSkillRow(skill: {
+    securityPassed: boolean | null;
+    riskScore: number | null;
+    securityFindingsCount: number;
+    securityScannedAt: string | null;
+}): SecuritySummary | undefined;
+//# sourceMappingURL=security-summary.d.ts.map

package/dist/src/api/security-summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-summary.d.ts","sourceRoot":"","sources":["../../../src/api/security-summary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,IAAI,CACZ,QAAQ,EACR,iBAAiB,GAAG,aAAa,GAAG,gBAAgB,GAAG,mBAAmB,CAC3E,GACA,eAAe,GAAG,SAAS,CAa7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,cAAc,EAAE,OAAO,GAAG,IAAI,CAAA;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,qBAAqB,EAAE,MAAM,CAAA;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC,GAAG,eAAe,GAAG,SAAS,CAW9B"}

package/dist/src/api/security-summary.js

@@ -0,0 +1,88 @@
+/**
+ * @fileoverview Shared derivation of a `SecuritySummary` from an API skill row,
+ * and from a pre-computed local-DB-shaped skill row.
+ * @module @skillsmith/core/api/security-summary
+ * @see SMI-4240: original inline derivation in mcp-server's get-skill.ts
+ * @see SMI-5562: extracted to mcp-server's utils/security-summary.ts so
+ *   get-skill.ts, recommend.ts, and search.ts share a single implementation
+ *   instead of triplicating the logic.
+ * @see SMI-5897 (C-15): moved here from mcp-server so `SkillsmithApiClient.toSkill()`
+ *   (CLI path) can share the exact same derivation instead of hardcoding
+ *   `riskScore: null, securityFindingsCount: 0, securityScannedAt: null,
+ *   securityPassed: null` for every API-sourced skill — which caused CLI
+ *   `info`/`search` to show "Not scanned" for skills MCP correctly reported
+ *   as passed. Both `toSkill()` and mcp-server's tool call sites now import
+ *   this one function, so the two surfaces cannot re-diverge.
+ * @see SMI-5897 (Wave 4 fix): `deriveSecuritySummaryFromSkillRow()` added
+ *   alongside `deriveSecuritySummaryFromApiSkill()` — the local-DB-path
+ *   sibling for the SAME undefined-when-never-scanned contract, but over the
+ *   pre-computed `securityPassed`/`riskScore`/`securityFindingsCount`/
+ *   `securityScannedAt` field shape (as opposed to the raw API row's
+ *   `last_scanned_at`/`quarantined`/`security_score`/`security_findings`
+ *   columns). `recommend.helpers.ts`'s `buildDbFallbackRecommendation` had
+ *   this exact ternary inline already; `search.helpers.ts`'s
+ *   `mapLocalSkillToSearchResult` and `get-skill.ts`'s local-DB branch built
+ *   the security object unconditionally, violating the contract for a
+ *   never-scanned skill. All three now share this one function.
+ */
+/**
+ * Derive a `SecuritySummary` from an API skill row's flat security columns.
+ *
+ * Returns `undefined` when the skill has never been scanned
+ * (`last_scanned_at == null`) — never scanned is a distinct state from
+ * "scanned but no verdict" and callers must not conflate the two by
+ * shipping a placeholder `{ passed: null, ... }` object for skills that
+ * were never scanned at all.
+ *
+ * `security_findings_count` is not a stored column — `findingsCount` is
+ * always derived from the length of the `security_findings` jsonb array
+ * (defensively 0 when the value is missing or not an array).
+ *
+ * @param apiSkill - Object carrying the flat security columns from an
+ *   `ApiSkill`/`ApiSearchResult` row (registry API response shape).
+ * @returns The derived summary, or `undefined` when never scanned.
+ */
+export function deriveSecuritySummaryFromApiSkill(apiSkill) {
+    if (apiSkill.last_scanned_at == null) {
+        return undefined;
+    }
+    return {
+        passed: apiSkill.quarantined === true ? false : apiSkill.security_score == null ? null : true,
+        riskScore: apiSkill.security_score ?? null,
+        findingsCount: Array.isArray(apiSkill.security_findings)
+            ? apiSkill.security_findings.length
+            : 0,
+        scannedAt: apiSkill.last_scanned_at,
+    };
+}
+/**
+ * Derive a `SecuritySummary` from a local-DB-shaped skill row's PRE-COMPUTED
+ * flat security fields (`securityPassed`/`riskScore`/`securityFindingsCount`/
+ * `securityScannedAt` — a different shape from {@link deriveSecuritySummaryFromApiSkill}'s
+ * raw API-row columns).
+ *
+ * Same contract as {@link deriveSecuritySummaryFromApiSkill}: returns
+ * `undefined` when the skill has never been scanned (`securityScannedAt ==
+ * null`) — never scanned is a distinct state from "scanned but no verdict"
+ * and callers must not conflate the two by shipping a placeholder
+ * `{ passed: null, ... }` object for skills that were never scanned at all.
+ * `passed`/`riskScore` pass through RAW — never coerce/default to a
+ * fabricated value, which would misread as "confirmed clean/scanned."
+ *
+ * @param skill - Object carrying the pre-computed flat security fields
+ *   present on both a local `Skill` repository row and `SkillData`
+ *   (mcp-server's recommend matcher shape).
+ * @returns The derived summary, or `undefined` when never scanned.
+ */
+export function deriveSecuritySummaryFromSkillRow(skill) {
+    if (skill.securityScannedAt == null) {
+        return undefined;
+    }
+    return {
+        passed: skill.securityPassed,
+        riskScore: skill.riskScore,
+        findingsCount: skill.securityFindingsCount,
+        scannedAt: skill.securityScannedAt,
+    };
+}
+//# sourceMappingURL=security-summary.js.map

package/dist/src/api/security-summary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-summary.js","sourceRoot":"","sources":["../../../src/api/security-summary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iCAAiC,CAC/C,QAGC;IAED,IAAI,QAAQ,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;QACrC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC7F,SAAS,EAAE,QAAQ,CAAC,cAAc,IAAI,IAAI;QAC1C,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACtD,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM;YACnC,CAAC,CAAC,CAAC;QACL,SAAS,EAAE,QAAQ,CAAC,eAAe;KACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iCAAiC,CAAC,KAKjD;IACC,IAAI,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;QACpC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,cAAc;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,qBAAqB;QAC1C,SAAS,EAAE,KAAK,CAAC,iBAAiB;KACnC,CAAA;AACH,CAAC"}

package/dist/src/api/security-summary.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * SMI-5562: Unit coverage for the shared security-summary derivation helper,
+ * extracted from get-skill.ts's inline derivation (SMI-4240).
+ * SMI-5897 (C-15): moved from packages/mcp-server/src/utils/security-summary.test.ts
+ * to packages/core so the CLI (`SkillsmithApiClient.toSkill()`) and MCP tool
+ * call sites share and test one implementation.
+ */
+export {};
+//# sourceMappingURL=security-summary.test.d.ts.map

package/dist/src/api/security-summary.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-summary.test.d.ts","sourceRoot":"","sources":["../../../src/api/security-summary.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/src/api/security-summary.test.js

@@ -0,0 +1,94 @@
+/**
+ * SMI-5562: Unit coverage for the shared security-summary derivation helper,
+ * extracted from get-skill.ts's inline derivation (SMI-4240).
+ * SMI-5897 (C-15): moved from packages/mcp-server/src/utils/security-summary.test.ts
+ * to packages/core so the CLI (`SkillsmithApiClient.toSkill()`) and MCP tool
+ * call sites share and test one implementation.
+ */
+import { describe, it, expect } from 'vitest';
+import { deriveSecuritySummaryFromApiSkill } from './security-summary.js';
+describe('deriveSecuritySummaryFromApiSkill', () => {
+    it('returns undefined when the skill has never been scanned (last_scanned_at null)', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: null,
+            quarantined: false,
+            security_score: null,
+            security_findings: null,
+        });
+        expect(result).toBeUndefined();
+    });
+    it('returns undefined when last_scanned_at is undefined', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: undefined,
+            quarantined: undefined,
+            security_score: undefined,
+            security_findings: undefined,
+        });
+        expect(result).toBeUndefined();
+    });
+    it('returns passed: false when quarantined, regardless of security_score', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: '2026-06-01T00:00:00.000Z',
+            quarantined: true,
+            // A low score would otherwise read as "clean" — quarantined must win.
+            security_score: 0,
+            security_findings: [],
+        });
+        expect(result?.passed).toBe(false);
+    });
+    it('returns passed: null when scanned but no security_score is recorded yet', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: '2026-06-01T00:00:00.000Z',
+            quarantined: false,
+            security_score: null,
+            security_findings: null,
+        });
+        expect(result?.passed).toBeNull();
+        expect(result?.riskScore).toBeNull();
+    });
+    it('returns passed: true for a clean scanned skill with a recorded score', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: '2026-06-01T00:00:00.000Z',
+            quarantined: false,
+            security_score: 0,
+            security_findings: [],
+        });
+        expect(result).toEqual({
+            passed: true,
+            riskScore: 0,
+            findingsCount: 0,
+            scannedAt: '2026-06-01T00:00:00.000Z',
+        });
+    });
+    it('derives findingsCount from the security_findings array length', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: '2026-06-01T00:00:00.000Z',
+            quarantined: false,
+            security_score: 42,
+            security_findings: [{ rule: 'a' }, { rule: 'b' }, { rule: 'c' }],
+        });
+        expect(result?.findingsCount).toBe(3);
+    });
+    it('defaults findingsCount to 0 when security_findings is not an array', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: '2026-06-01T00:00:00.000Z',
+            quarantined: false,
+            security_score: 10,
+            // Defensive non-array case — should never happen at runtime (jsonb column),
+            // but the derivation must not throw or miscount.
+            security_findings: undefined,
+        });
+        expect(result?.findingsCount).toBe(0);
+    });
+    it('passes riskScore through as null (never a fabricated 0) when unscored', () => {
+        const result = deriveSecuritySummaryFromApiSkill({
+            last_scanned_at: '2026-06-01T00:00:00.000Z',
+            quarantined: false,
+            security_score: null,
+            security_findings: [{ rule: 'pending-review' }],
+        });
+        expect(result?.riskScore).toBeNull();
+        expect(result?.findingsCount).toBe(1);
+    });
+});
+//# sourceMappingURL=security-summary.test.js.map

package/dist/src/api/security-summary.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-summary.test.js","sourceRoot":"","sources":["../../../src/api/security-summary.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAA;AAEzE,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,SAAS;YAC1B,WAAW,EAAE,SAAS;YACtB,cAAc,EAAE,SAAS;YACzB,iBAAiB,EAAE,SAAS;SAC7B,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,0BAA0B;YAC3C,WAAW,EAAE,IAAI;YACjB,sEAAsE;YACtE,cAAc,EAAE,CAAC;YACjB,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,0BAA0B;YAC3C,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QACjC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,0BAA0B;YAC3C,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,CAAC;YACjB,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,CAAC;YACZ,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,0BAA0B;SACtC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,0BAA0B;YAC3C,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,EAAE;YAClB,iBAAiB,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;SACjE,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,0BAA0B;YAC3C,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,EAAE;YAClB,4EAA4E;YAC5E,iDAAiD;YACjD,iBAAiB,EAAE,SAAS;SAC7B,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,MAAM,GAAG,iCAAiC,CAAC;YAC/C,eAAe,EAAE,0BAA0B;YAC3C,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;SAChD,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAA;QACpC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/compatibility/slugs.d.ts

@@ -16,9 +16,13 @@ export type CompatibilitySlug = (typeof COMPATIBILITY_SLUGS)[number];
 export declare const COMPATIBILITY_LABELS: Record<CompatibilitySlug, string>;
 /**
  * Slugs that are filterable/browsable but have NO install target yet — the
- * install-client enum (`install/paths.ts` `ClientId`) lacks them. Adding
- * `antigravity`/`gemini` ClientIds + auto-detect is Phase 2c (SMI-5179). Until
- * then the UI labels these "browse-only" rather than implying installability.
+ * install-client enum (`install/paths.ts` `ClientId`) lacks them.
+ * `antigravity` was un-deferred (SMI-5982 Wave 6) — it now has a real
+ * `ClientId` + `CLIENT_NATIVE_PATHS` entry, so it moved out of this list.
+ * `gemini` has no install target (it names a model family, not a distinct
+ * install client) and remains browse-only; adding it (if ever justified) is
+ * still Phase 2c (SMI-5179). Until then the UI labels `gemini` "browse-only"
+ * rather than implying installability.
  */
 export declare const BROWSE_ONLY_SLUGS: readonly CompatibilitySlug[];
 /**

package/dist/src/compatibility/slugs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slugs.d.ts","sourceRoot":"","sources":["../../../src/compatibility/slugs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,6FAA6F;AAC7F,eAAO,MAAM,mBAAmB,6FAQtB,CAAA;AAEV,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAQlE,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,iBAAiB,EAA8B,CAAA;AAExF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAM1E,CAAA;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD"}
+{"version":3,"file":"slugs.d.ts","sourceRoot":"","sources":["../../../src/compatibility/slugs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,6FAA6F;AAC7F,eAAO,MAAM,mBAAmB,6FAQtB,CAAA;AAEV,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAQlE,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,iBAAiB,EAAe,CAAA;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAS1E,CAAA;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD"}