@skillsmith/core 0.5.4 → 0.5.6

package/dist/api/types.d.ts

@@ -0,0 +1,264 @@
+/**
+ * API Types matching OpenAPI specification
+ * @module api/types
+ *
+ * These types are aligned with docs/api/openapi.yaml for type-safe API interactions.
+ * Uses snake_case for API wire format compatibility.
+ */
+/**
+ * Trust tier levels from API
+ */
+export type ApiTrustTier = 'verified' | 'community' | 'experimental' | 'unknown';
+/**
+ * Skill category filter values
+ */
+export type ApiCategory = 'Development' | 'Testing' | 'DevOps' | 'Documentation' | 'Productivity' | 'Security';
+/**
+ * Project type for recommendations
+ */
+export type ApiProjectType = 'web' | 'api' | 'cli' | 'mobile' | 'data' | 'ml';
+/**
+ * Skill entity from API
+ *
+ * Represents a skill record with all properties.
+ * Uses snake_case to match API wire format.
+ */
+export interface ApiSkill {
+    /** Unique skill identifier (UUID) */
+    id: string;
+    /** Skill name */
+    name: string;
+    /** Skill description */
+    description: string | null;
+    /** Skill author */
+    author: string | null;
+    /** Source repository URL */
+    repo_url: string | null;
+    /** Quality score (0-1 scale) */
+    quality_score: number | null;
+    /** Trust level */
+    trust_tier: ApiTrustTier;
+    /** Tags for categorization */
+    tags: string[];
+    /** GitHub stars count */
+    stars: number | null;
+    /** Creation timestamp (ISO 8601) */
+    created_at: string;
+    /** Last update timestamp (ISO 8601) */
+    updated_at: string;
+    /** Associated category names (joined from skill_categories by skills-get) */
+    categories?: string[];
+    /**
+     * SMI-4240: Security scan fields returned by skills-get via `...skill` spread.
+     * All optional/nullable to preserve compatibility with pre-4240 responses and
+     * with endpoints like skills-search that don't select these columns.
+     */
+    /** Security score 0-100 (lower is safer); null until first scan */
+    security_score?: number | null;
+    /** ISO 8601 timestamp of last security scan; null until first scan */
+    last_scanned_at?: string | null;
+    /** Security findings array (jsonb); length drives findingsCount derivation */
+    security_findings?: unknown[] | null;
+    /** True when the skill is quarantined due to security score threshold */
+    quarantined?: boolean;
+}
+/**
+ * Search result from API (Skill with rank)
+ */
+export interface ApiSearchResult extends ApiSkill {
+    /** Search relevance rank */
+    rank?: number;
+}
+/**
+ * Search parameters for skills-search endpoint
+ */
+export interface SearchParams {
+    /** Search query (optional if filters provided) */
+    query: string;
+    /** Filter by category name */
+    category?: ApiCategory;
+    /** Filter by trust level */
+    trust_tier?: ApiTrustTier;
+    /** Minimum quality score (0-100) */
+    min_score?: number;
+    /** Maximum results to return (default 20, max 100) */
+    limit?: number;
+    /** Pagination offset (default 0) */
+    offset?: number;
+}
+/**
+ * Search response metadata
+ */
+export interface SearchResponseMeta {
+    /** Original search query */
+    query: string;
+    /** Total matching results */
+    total: number;
+    /** Results limit */
+    limit: number;
+    /** Pagination offset */
+    offset: number;
+    /** Applied filters */
+    filters: {
+        category: string | null;
+        trust_tier: string | null;
+        min_score: number | null;
+    };
+}
+/**
+ * Search response from API
+ */
+export interface SearchResponse {
+    /** Search results */
+    data: ApiSearchResult[];
+    /** Response metadata */
+    meta: SearchResponseMeta;
+}
+/**
+ * Recommended skill with relevance score
+ */
+export interface RecommendedSkill extends ApiSkill {
+    /** Relevance score for the given stack */
+    relevance_score?: number;
+}
+/**
+ * Recommendation request parameters
+ */
+export interface RecommendParams {
+    /** Technology stack (1-10 items) */
+    stack: string[];
+    /** Type of project */
+    project_type?: ApiProjectType;
+    /** Maximum recommendations (default 10, max 50) */
+    limit?: number;
+}
+/**
+ * Recommendation response metadata
+ */
+export interface RecommendResponseMeta {
+    /** Technology stack from request */
+    stack: string[];
+    /** Project type from request */
+    project_type: string | null;
+    /** Total recommendations */
+    total: number;
+    /** Results limit */
+    limit: number;
+}
+/**
+ * Recommendation response from API
+ */
+export interface RecommendResponse {
+    /** Recommended skills */
+    data: RecommendedSkill[];
+    /** Response metadata */
+    meta: RecommendResponseMeta;
+}
+/**
+ * Get skill response from API
+ */
+export interface SkillResponse {
+    /** Skill data */
+    data: ApiSkill;
+}
+/**
+ * Health status response
+ */
+export interface HealthStatus {
+    /** Service status */
+    status: 'healthy' | 'degraded' | 'unhealthy';
+    /** Status timestamp (ISO 8601) */
+    timestamp: string;
+    /** API version */
+    version: string;
+}
+/**
+ * Telemetry event types
+ */
+export type TelemetryEventType = 'skill_view' | 'skill_install' | 'skill_uninstall' | 'skill_rate' | 'search' | 'recommend' | 'compare' | 'validate';
+/**
+ * Telemetry event metadata
+ */
+export interface TelemetryMetadata {
+    /** Search query */
+    query?: string;
+    /** Number of results */
+    results_count?: number;
+    /** Operation duration in ms */
+    duration_ms?: number;
+    /** Client version */
+    version?: string;
+    /** Client platform */
+    platform?: string;
+}
+/**
+ * Telemetry event payload
+ */
+export interface TelemetryEventPayload {
+    /** Event type */
+    event: TelemetryEventType;
+    /** Associated skill ID */
+    skill_id?: string;
+    /** Anonymous client identifier (hex string) */
+    anonymous_id: string;
+    /** Optional event metadata */
+    metadata?: TelemetryMetadata;
+}
+/**
+ * Telemetry response
+ */
+export interface TelemetryResponse {
+    /** Success indicator */
+    ok: boolean;
+}
+/**
+ * API error response
+ */
+export interface ApiErrorResponse {
+    /** Error message */
+    error: string;
+    /** Additional error details */
+    details?: Record<string, unknown>;
+}
+/**
+ * Rate limit information from response headers
+ */
+export interface RateLimitInfo {
+    /** Maximum requests per minute */
+    limit: number;
+    /** Remaining requests in current window */
+    remaining: number;
+    /** Unix timestamp when limit resets */
+    reset: number;
+    /** Request tracking ID */
+    requestId?: string;
+}
+/**
+ * API client configuration options
+ */
+export interface ApiClientOptions {
+    /** Base URL for API (default: https://api.skillsmith.app) */
+    baseUrl?: string;
+    /** Request timeout in ms (default: 10000) */
+    timeout?: number;
+    /** Cache TTL in ms (default: 86400000 - 24h) */
+    cacheTtl?: number;
+    /** Enable offline mode */
+    offlineMode?: boolean;
+    /** Supabase anon key for authentication */
+    anonKey?: string;
+    /** Max retry attempts (default: 3) */
+    maxRetries?: number;
+    /** Enable debug logging */
+    debug?: boolean;
+}
+/**
+ * Generic API response wrapper
+ */
+export interface ApiResponse<T> {
+    /** Response data */
+    data: T;
+    /** Response metadata */
+    meta?: Record<string, unknown>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/api/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/api/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,WAAW,GAAG,cAAc,GAAG,SAAS,CAAA;AAMhF;;GAEG;AACH,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,SAAS,GACT,QAAQ,GACR,eAAe,GACf,cAAc,GACd,UAAU,CAAA;AAMd;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAA;AAM7E;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,wBAAwB;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,mBAAmB;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,gCAAgC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,kBAAkB;IAClB,UAAU,EAAE,YAAY,CAAA;IACxB,8BAA8B;IAC9B,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,yBAAyB;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB;;;;OAIG;IACH,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;IACpC,yEAAyE;IACzE,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAMD;;GAEG;AACH,MAAM,WAAW,eAAgB,SAAQ,QAAQ;IAC/C,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAA;IACb,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,WAAW,CAAA;IACtB,4BAA4B;IAC5B,UAAU,CAAC,EAAE,YAAY,CAAA;IACzB,oCAAoC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB;IACtB,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KACzB,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,qBAAqB;IACrB,IAAI,EAAE,eAAe,EAAE,CAAA;IACvB,wBAAwB;IACxB,IAAI,EAAE,kBAAkB,CAAA;CACzB;AAMD;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,QAAQ;IAChD,0CAA0C;IAC1C,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,oCAAoC;IACpC,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,sBAAsB;IACtB,YAAY,CAAC,EAAE,cAAc,CAAA;IAC7B,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,oCAAoC;IACpC,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,gCAAgC;IAChC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,yBAAyB;IACzB,IAAI,EAAE,gBAAgB,EAAE,CAAA;IACxB,wBAAwB;IACxB,IAAI,EAAE,qBAAqB,CAAA;CAC5B;AAMD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,iBAAiB;IACjB,IAAI,EAAE,QAAQ,CAAA;CACf;AAMD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,qBAAqB;IACrB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,CAAA;IAC5C,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,kBAAkB;IAClB,OAAO,EAAE,MAAM,CAAA;CAChB;AAMD;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAC1B,YAAY,GACZ,eAAe,GACf,iBAAiB,GACjB,YAAY,GACZ,QAAQ,GACR,WAAW,GACX,SAAS,GACT,UAAU,CAAA;AAEd;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wBAAwB;IACxB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,+BAA+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qBAAqB;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,iBAAiB;IACjB,KAAK,EAAE,kBAAkB,CAAA;IACzB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAA;IACpB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,iBAAiB,CAAA;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,wBAAwB;IACxB,EAAE,EAAE,OAAO,CAAA;CACZ;AAMD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAMD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAMD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,0BAA0B;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sCAAsC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAMD;;GAEG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,oBAAoB;IACpB,IAAI,EAAE,CAAC,CAAA;IACP,wBAAwB;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B"}

package/dist/api/types.js

@@ -0,0 +1,9 @@
+/**
+ * API Types matching OpenAPI specification
+ * @module api/types
+ *
+ * These types are aligned with docs/api/openapi.yaml for type-safe API interactions.
+ * Uses snake_case for API wire format compatibility.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/api/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/api/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/api/utils.d.ts

@@ -0,0 +1,54 @@
+/**
+ * API Utility Functions
+ * @module api/utils
+ *
+ * Helper functions for API client operations
+ */
+/**
+ * Calculate delay with exponential backoff and jitter
+ *
+ * @param attempt - Current attempt number (0-indexed)
+ * @param baseDelay - Base delay in milliseconds (default: 1000)
+ * @returns Delay in milliseconds (capped at 30000)
+ */
+export declare function calculateBackoff(attempt: number, baseDelay?: number): number;
+/**
+ * Generate anonymous ID for telemetry using cryptographic randomness.
+ * Returns a UUID v4 format string (e.g., "550e8400-e29b-41d4-a716-446655440000").
+ *
+ * Note: This generates a fresh ID per session - it is NOT stored persistently.
+ * For persistent anonymous IDs, the caller must handle storage.
+ */
+export declare function generateAnonymousId(): string;
+/**
+ * Build request headers for API calls
+ *
+ * @param anonKey - Optional Supabase anon key for authentication
+ * @returns Headers object
+ */
+export declare function buildRequestHeaders(anonKey?: string): Record<string, string>;
+/**
+ * Production API URL for Skillsmith registry.
+ * This is the public API endpoint that all users should use.
+ */
+export declare const PRODUCTION_API_URL = "https://api.skillsmith.app/functions/v1";
+/**
+ * Production Supabase anon key for authenticated API access.
+ * This key is safe to expose - it only provides RLS-based access, not admin access.
+ * Without this, users hit the 10-request trial limit and get 0 results.
+ *
+ * SMI-1949: SMI-1948 fix was incomplete - added URL but not anon key.
+ */
+export declare const PRODUCTION_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InZyY256cG1uZHRyb3F4eG9xa3p5Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3Njc4MzgwNzQsImV4cCI6MjA4MzQxNDA3NH0.WNK5jaNG3twxApOva5A1ZlCaZb5hVqBYtNJezRrR4t8";
+/**
+ * Default base URL for API client.
+ *
+ * Priority order:
+ * 1. SKILLSMITH_API_URL env var (for custom deployments)
+ * 2. SUPABASE_URL env var (for development with local Supabase)
+ * 3. Production API URL (default for all users)
+ *
+ * SMI-1948: Previously fell back to undefined, causing offline mode for all users.
+ */
+export declare const DEFAULT_BASE_URL: string;
+//# sourceMappingURL=utils.d.ts.map

package/dist/api/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/api/utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,MAAM,CAI1E;AAMD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAyB5C;AAMD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAY5E;AAMD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,4CAA4C,CAAA;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,qNACoL,CAAA;AAEpN;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,QAEiE,CAAA"}

package/dist/api/utils.js

@@ -0,0 +1,104 @@
+/**
+ * API Utility Functions
+ * @module api/utils
+ *
+ * Helper functions for API client operations
+ */
+// ============================================================================
+// Backoff Calculation
+// ============================================================================
+/**
+ * Calculate delay with exponential backoff and jitter
+ *
+ * @param attempt - Current attempt number (0-indexed)
+ * @param baseDelay - Base delay in milliseconds (default: 1000)
+ * @returns Delay in milliseconds (capped at 30000)
+ */
+export function calculateBackoff(attempt, baseDelay = 1000) {
+    const exponentialDelay = baseDelay * Math.pow(2, attempt);
+    const jitter = Math.random() * 0.3 * exponentialDelay;
+    return Math.min(exponentialDelay + jitter, 30000); // Max 30s
+}
+// ============================================================================
+// Anonymous ID Generation
+// ============================================================================
+/**
+ * Generate anonymous ID for telemetry using cryptographic randomness.
+ * Returns a UUID v4 format string (e.g., "550e8400-e29b-41d4-a716-446655440000").
+ *
+ * Note: This generates a fresh ID per session - it is NOT stored persistently.
+ * For persistent anonymous IDs, the caller must handle storage.
+ */
+export function generateAnonymousId() {
+    // Use Node.js crypto.randomUUID() for cryptographically secure random IDs
+    // This is available in Node.js 14.17.0+ and all modern browsers
+    if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {
+        return crypto.randomUUID();
+    }
+    // Fallback for older environments: use crypto.getRandomValues if available
+    if (typeof crypto !== 'undefined' && typeof crypto.getRandomValues === 'function') {
+        const bytes = new Uint8Array(16);
+        crypto.getRandomValues(bytes);
+        // Set version (4) and variant (RFC4122) bits
+        bytes[6] = (bytes[6] & 0x0f) | 0x40;
+        bytes[8] = (bytes[8] & 0x3f) | 0x80;
+        const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+        return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+    }
+    // Last resort fallback (not cryptographically secure, but functional)
+    const chars = 'abcdef0123456789';
+    let id = '';
+    for (let i = 0; i < 32; i++) {
+        id += chars[Math.floor(Math.random() * chars.length)];
+    }
+    return `${id.slice(0, 8)}-${id.slice(8, 12)}-${id.slice(12, 16)}-${id.slice(16, 20)}-${id.slice(20)}`;
+}
+// ============================================================================
+// Request Header Builder
+// ============================================================================
+/**
+ * Build request headers for API calls
+ *
+ * @param anonKey - Optional Supabase anon key for authentication
+ * @returns Headers object
+ */
+export function buildRequestHeaders(anonKey) {
+    const headers = {
+        'Content-Type': 'application/json',
+        'x-request-id': `client-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+    };
+    if (anonKey) {
+        headers['Authorization'] = `Bearer ${anonKey}`;
+        headers['apikey'] = anonKey;
+    }
+    return headers;
+}
+// ============================================================================
+// URL Constants
+// ============================================================================
+/**
+ * Production API URL for Skillsmith registry.
+ * This is the public API endpoint that all users should use.
+ */
+export const PRODUCTION_API_URL = 'https://api.skillsmith.app/functions/v1';
+/**
+ * Production Supabase anon key for authenticated API access.
+ * This key is safe to expose - it only provides RLS-based access, not admin access.
+ * Without this, users hit the 10-request trial limit and get 0 results.
+ *
+ * SMI-1949: SMI-1948 fix was incomplete - added URL but not anon key.
+ */
+export const PRODUCTION_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InZyY256cG1uZHRyb3F4eG9xa3p5Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3Njc4MzgwNzQsImV4cCI6MjA4MzQxNDA3NH0.WNK5jaNG3twxApOva5A1ZlCaZb5hVqBYtNJezRrR4t8';
+/**
+ * Default base URL for API client.
+ *
+ * Priority order:
+ * 1. SKILLSMITH_API_URL env var (for custom deployments)
+ * 2. SUPABASE_URL env var (for development with local Supabase)
+ * 3. Production API URL (default for all users)
+ *
+ * SMI-1948: Previously fell back to undefined, causing offline mode for all users.
+ */
+export const DEFAULT_BASE_URL = process.env.SKILLSMITH_API_URL ||
+    (process.env.SUPABASE_URL ? `${process.env.SUPABASE_URL}/functions/v1` : PRODUCTION_API_URL);
+//# sourceMappingURL=utils.js.map

package/dist/api/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/api/utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,SAAS,GAAG,IAAI;IAChE,MAAM,gBAAgB,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,gBAAgB,CAAA;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,MAAM,EAAE,KAAK,CAAC,CAAA,CAAC,UAAU;AAC9D,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,0EAA0E;IAC1E,gEAAgE;IAChE,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC7E,OAAO,MAAM,CAAC,UAAU,EAAE,CAAA;IAC5B,CAAC;IAED,2EAA2E;IAC3E,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QAC7B,6CAA6C;QAC7C,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAA;QACnC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAA;QACnC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9E,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAA;IAC5G,CAAC;IAED,sEAAsE;IACtE,MAAM,KAAK,GAAG,kBAAkB,CAAA;IAChC,IAAI,EAAE,GAAG,EAAE,CAAA;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAA;AACvG,CAAC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,cAAc,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;KAC9E,CAAA;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,OAAO,EAAE,CAAA;QAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAA;IAC7B,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,yCAAyC,CAAA;AAE3E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,kNAAkN,CAAA;AAEpN;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,OAAO,CAAC,GAAG,CAAC,kBAAkB;IAC9B,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,eAAe,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAA"}

package/dist/audit/remote-audit.d.ts

@@ -0,0 +1,28 @@
+export interface InstallEventPayload {
+    skillId: string;
+    source: 'mcp' | 'cli' | 'vscode';
+    success: boolean;
+    durationMs?: number;
+    trustTier?: string;
+    errorCode?: string;
+}
+/**
+ * Emit a skill-install event to Skillsmith's remote telemetry endpoint.
+ *
+ * Best-effort: never throws, never blocks the caller. Silently skips in these cases:
+ * - No API key available (CLI offline / unauthenticated)
+ * - SKILLSMITH_TELEMETRY=0 (opt-out)
+ * - Network / endpoint failure
+ *
+ * The API key is mapped to a namespaced, non-reversible telemetry actor ID
+ * (HMAC-SHA-256 keyed by `skillsmith-telemetry-actor:v1`) before transmission.
+ * The server stores that digest as `actor` — never the raw key, never an
+ * email, never a user ID.
+ *
+ * Event shape when emitted:
+ *   event_type: "telemetry:skill_install"
+ *   actor:      hmac_sha256("skillsmith-telemetry-actor:v1", apiKey) hex
+ *   metadata:   { skill_id, source, success, duration_ms?, trust_tier?, error_code? }
+ */
+export declare function emitInstallEvent(payload: InstallEventPayload): Promise<void>;
+//# sourceMappingURL=remote-audit.d.ts.map

package/dist/audit/remote-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-audit.d.ts","sourceRoot":"","sources":["../../src/audit/remote-audit.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAyCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgClF"}

package/dist/audit/remote-audit.js

@@ -0,0 +1,90 @@
+import { createHmac } from 'node:crypto';
+import { getApiKey } from '../config/index.js';
+const DEFAULT_API_BASE = 'https://api.skillsmith.app';
+const EVENT_ENDPOINT = '/functions/v1/events';
+const REQUEST_TIMEOUT_MS = 2000;
+/**
+ * HMAC key used to derive the telemetry actor ID from the caller's API key.
+ *
+ * This is NOT password storage — it is a keyed, deterministic, non-reversible
+ * correlation ID used to distinguish one caller from another in aggregate
+ * telemetry. HMAC-SHA-256 is the correct primitive for that use case:
+ *  - Keyed construction cleanly signals "opaque identifier derivation", not
+ *    password hashing.
+ *  - Fast (no KDF latency on the hot install path).
+ *  - Deterministic so the same API key always maps to the same actor ID,
+ *    enabling per-caller aggregation server-side.
+ *
+ * A slow KDF (bcrypt/scrypt/Argon2) would be inappropriate here — it adds
+ * latency without changing any security property we need.
+ */
+const TELEMETRY_ACTOR_KEY = 'skillsmith-telemetry-actor:v1';
+function hashForActor(apiKey) {
+    // lgtm[js/insufficient-password-hash] This is deterministic correlation-ID
+    // derivation via HMAC-SHA-256 — not password storage. See TELEMETRY_ACTOR_KEY
+    // doc-comment above for full rationale (false positive in CodeQL's taint
+    // tracking which flags any flow from an API-key-like source into a crypto
+    // function, regardless of construction).
+    return createHmac('sha256', TELEMETRY_ACTOR_KEY).update(apiKey).digest('hex');
+}
+function getApiBase() {
+    return process.env.SKILLSMITH_API_URL || DEFAULT_API_BASE;
+}
+function isDisabled() {
+    const flag = process.env.SKILLSMITH_TELEMETRY;
+    return flag === '0' || flag === 'false' || flag === 'off';
+}
+/**
+ * Emit a skill-install event to Skillsmith's remote telemetry endpoint.
+ *
+ * Best-effort: never throws, never blocks the caller. Silently skips in these cases:
+ * - No API key available (CLI offline / unauthenticated)
+ * - SKILLSMITH_TELEMETRY=0 (opt-out)
+ * - Network / endpoint failure
+ *
+ * The API key is mapped to a namespaced, non-reversible telemetry actor ID
+ * (HMAC-SHA-256 keyed by `skillsmith-telemetry-actor:v1`) before transmission.
+ * The server stores that digest as `actor` — never the raw key, never an
+ * email, never a user ID.
+ *
+ * Event shape when emitted:
+ *   event_type: "telemetry:skill_install"
+ *   actor:      hmac_sha256("skillsmith-telemetry-actor:v1", apiKey) hex
+ *   metadata:   { skill_id, source, success, duration_ms?, trust_tier?, error_code? }
+ */
+export async function emitInstallEvent(payload) {
+    if (isDisabled())
+        return;
+    const apiKey = getApiKey();
+    if (!apiKey)
+        return;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    try {
+        await fetch(`${getApiBase()}${EVENT_ENDPOINT}`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            signal: controller.signal,
+            body: JSON.stringify({
+                event: 'skill_install',
+                anonymous_id: hashForActor(apiKey),
+                metadata: {
+                    skill_id: payload.skillId,
+                    source: payload.source,
+                    success: payload.success,
+                    ...(payload.durationMs !== undefined && { duration_ms: payload.durationMs }),
+                    ...(payload.trustTier !== undefined && { trust_tier: payload.trustTier }),
+                    ...(payload.errorCode !== undefined && { error_code: payload.errorCode }),
+                },
+            }),
+        });
+    }
+    catch {
+        // Best-effort: swallow all errors (network, abort, endpoint down).
+        // Telemetry failures must never break the install flow.
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=remote-audit.js.map

package/dist/audit/remote-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-audit.js","sourceRoot":"","sources":["../../src/audit/remote-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAW9C,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AACrD,MAAM,cAAc,GAAG,sBAAsB,CAAA;AAC7C,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAE/B;;;;;;;;;;;;;;GAcG;AACH,MAAM,mBAAmB,GAAG,+BAA+B,CAAA;AAE3D,SAAS,YAAY,CAAC,MAAc;IAClC,2EAA2E;IAC3E,8EAA8E;IAC9E,yEAAyE;IACzE,0EAA0E;IAC1E,yCAAyC;IACzC,OAAO,UAAU,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC/E,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,gBAAgB,CAAA;AAC3D,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAA;IAC7C,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAA4B;IACjE,IAAI,UAAU,EAAE;QAAE,OAAM;IACxB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;IAC1B,IAAI,CAAC,MAAM;QAAE,OAAM;IAEnB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAA;IAEtE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,UAAU,EAAE,GAAG,cAAc,EAAE,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,eAAe;gBACtB,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC;gBAClC,QAAQ,EAAE;oBACR,QAAQ,EAAE,OAAO,CAAC,OAAO;oBACzB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;oBAC5E,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;oBACzE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;iBAC1E;aACF,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,wDAAwD;IAC1D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;AACH,CAAC"}

package/dist/audit/remote-audit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=remote-audit.test.d.ts.map

package/dist/audit/remote-audit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-audit.test.d.ts","sourceRoot":"","sources":["../../src/audit/remote-audit.test.ts"],"names":[],"mappings":""}