@skillsmith/core 0.5.6 → 0.5.7

package/dist/api/types.d.ts

@@ -1,264 +0,0 @@
-/**
- * API Types matching OpenAPI specification
- * @module api/types
- *
- * These types are aligned with docs/api/openapi.yaml for type-safe API interactions.
- * Uses snake_case for API wire format compatibility.
- */
-/**
- * Trust tier levels from API
- */
-export type ApiTrustTier = 'verified' | 'community' | 'experimental' | 'unknown';
-/**
- * Skill category filter values
- */
-export type ApiCategory = 'Development' | 'Testing' | 'DevOps' | 'Documentation' | 'Productivity' | 'Security';
-/**
- * Project type for recommendations
- */
-export type ApiProjectType = 'web' | 'api' | 'cli' | 'mobile' | 'data' | 'ml';
-/**
- * Skill entity from API
- *
- * Represents a skill record with all properties.
- * Uses snake_case to match API wire format.
- */
-export interface ApiSkill {
-    /** Unique skill identifier (UUID) */
-    id: string;
-    /** Skill name */
-    name: string;
-    /** Skill description */
-    description: string | null;
-    /** Skill author */
-    author: string | null;
-    /** Source repository URL */
-    repo_url: string | null;
-    /** Quality score (0-1 scale) */
-    quality_score: number | null;
-    /** Trust level */
-    trust_tier: ApiTrustTier;
-    /** Tags for categorization */
-    tags: string[];
-    /** GitHub stars count */
-    stars: number | null;
-    /** Creation timestamp (ISO 8601) */
-    created_at: string;
-    /** Last update timestamp (ISO 8601) */
-    updated_at: string;
-    /** Associated category names (joined from skill_categories by skills-get) */
-    categories?: string[];
-    /**
-     * SMI-4240: Security scan fields returned by skills-get via `...skill` spread.
-     * All optional/nullable to preserve compatibility with pre-4240 responses and
-     * with endpoints like skills-search that don't select these columns.
-     */
-    /** Security score 0-100 (lower is safer); null until first scan */
-    security_score?: number | null;
-    /** ISO 8601 timestamp of last security scan; null until first scan */
-    last_scanned_at?: string | null;
-    /** Security findings array (jsonb); length drives findingsCount derivation */
-    security_findings?: unknown[] | null;
-    /** True when the skill is quarantined due to security score threshold */
-    quarantined?: boolean;
-}
-/**
- * Search result from API (Skill with rank)
- */
-export interface ApiSearchResult extends ApiSkill {
-    /** Search relevance rank */
-    rank?: number;
-}
-/**
- * Search parameters for skills-search endpoint
- */
-export interface SearchParams {
-    /** Search query (optional if filters provided) */
-    query: string;
-    /** Filter by category name */
-    category?: ApiCategory;
-    /** Filter by trust level */
-    trust_tier?: ApiTrustTier;
-    /** Minimum quality score (0-100) */
-    min_score?: number;
-    /** Maximum results to return (default 20, max 100) */
-    limit?: number;
-    /** Pagination offset (default 0) */
-    offset?: number;
-}
-/**
- * Search response metadata
- */
-export interface SearchResponseMeta {
-    /** Original search query */
-    query: string;
-    /** Total matching results */
-    total: number;
-    /** Results limit */
-    limit: number;
-    /** Pagination offset */
-    offset: number;
-    /** Applied filters */
-    filters: {
-        category: string | null;
-        trust_tier: string | null;
-        min_score: number | null;
-    };
-}
-/**
- * Search response from API
- */
-export interface SearchResponse {
-    /** Search results */
-    data: ApiSearchResult[];
-    /** Response metadata */
-    meta: SearchResponseMeta;
-}
-/**
- * Recommended skill with relevance score
- */
-export interface RecommendedSkill extends ApiSkill {
-    /** Relevance score for the given stack */
-    relevance_score?: number;
-}
-/**
- * Recommendation request parameters
- */
-export interface RecommendParams {
-    /** Technology stack (1-10 items) */
-    stack: string[];
-    /** Type of project */
-    project_type?: ApiProjectType;
-    /** Maximum recommendations (default 10, max 50) */
-    limit?: number;
-}
-/**
- * Recommendation response metadata
- */
-export interface RecommendResponseMeta {
-    /** Technology stack from request */
-    stack: string[];
-    /** Project type from request */
-    project_type: string | null;
-    /** Total recommendations */
-    total: number;
-    /** Results limit */
-    limit: number;
-}
-/**
- * Recommendation response from API
- */
-export interface RecommendResponse {
-    /** Recommended skills */
-    data: RecommendedSkill[];
-    /** Response metadata */
-    meta: RecommendResponseMeta;
-}
-/**
- * Get skill response from API
- */
-export interface SkillResponse {
-    /** Skill data */
-    data: ApiSkill;
-}
-/**
- * Health status response
- */
-export interface HealthStatus {
-    /** Service status */
-    status: 'healthy' | 'degraded' | 'unhealthy';
-    /** Status timestamp (ISO 8601) */
-    timestamp: string;
-    /** API version */
-    version: string;
-}
-/**
- * Telemetry event types
- */
-export type TelemetryEventType = 'skill_view' | 'skill_install' | 'skill_uninstall' | 'skill_rate' | 'search' | 'recommend' | 'compare' | 'validate';
-/**
- * Telemetry event metadata
- */
-export interface TelemetryMetadata {
-    /** Search query */
-    query?: string;
-    /** Number of results */
-    results_count?: number;
-    /** Operation duration in ms */
-    duration_ms?: number;
-    /** Client version */
-    version?: string;
-    /** Client platform */
-    platform?: string;
-}
-/**
- * Telemetry event payload
- */
-export interface TelemetryEventPayload {
-    /** Event type */
-    event: TelemetryEventType;
-    /** Associated skill ID */
-    skill_id?: string;
-    /** Anonymous client identifier (hex string) */
-    anonymous_id: string;
-    /** Optional event metadata */
-    metadata?: TelemetryMetadata;
-}
-/**
- * Telemetry response
- */
-export interface TelemetryResponse {
-    /** Success indicator */
-    ok: boolean;
-}
-/**
- * API error response
- */
-export interface ApiErrorResponse {
-    /** Error message */
-    error: string;
-    /** Additional error details */
-    details?: Record<string, unknown>;
-}
-/**
- * Rate limit information from response headers
- */
-export interface RateLimitInfo {
-    /** Maximum requests per minute */
-    limit: number;
-    /** Remaining requests in current window */
-    remaining: number;
-    /** Unix timestamp when limit resets */
-    reset: number;
-    /** Request tracking ID */
-    requestId?: string;
-}
-/**
- * API client configuration options
- */
-export interface ApiClientOptions {
-    /** Base URL for API (default: https://api.skillsmith.app) */
-    baseUrl?: string;
-    /** Request timeout in ms (default: 10000) */
-    timeout?: number;
-    /** Cache TTL in ms (default: 86400000 - 24h) */
-    cacheTtl?: number;
-    /** Enable offline mode */
-    offlineMode?: boolean;
-    /** Supabase anon key for authentication */
-    anonKey?: string;
-    /** Max retry attempts (default: 3) */
-    maxRetries?: number;
-    /** Enable debug logging */
-    debug?: boolean;
-}
-/**
- * Generic API response wrapper
- */
-export interface ApiResponse<T> {
-    /** Response data */
-    data: T;
-    /** Response metadata */
-    meta?: Record<string, unknown>;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/api/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/api/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,WAAW,GAAG,cAAc,GAAG,SAAS,CAAA;AAMhF;;GAEG;AACH,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,SAAS,GACT,QAAQ,GACR,eAAe,GACf,cAAc,GACd,UAAU,CAAA;AAMd;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAA;AAM7E;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,wBAAwB;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,mBAAmB;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,gCAAgC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,kBAAkB;IAClB,UAAU,EAAE,YAAY,CAAA;IACxB,8BAA8B;IAC9B,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,yBAAyB;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB;;;;OAIG;IACH,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;IACpC,yEAAyE;IACzE,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAMD;;GAEG;AACH,MAAM,WAAW,eAAgB,SAAQ,QAAQ;IAC/C,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAA;IACb,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,WAAW,CAAA;IACtB,4BAA4B;IAC5B,UAAU,CAAC,EAAE,YAAY,CAAA;IACzB,oCAAoC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB;IACtB,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KACzB,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,qBAAqB;IACrB,IAAI,EAAE,eAAe,EAAE,CAAA;IACvB,wBAAwB;IACxB,IAAI,EAAE,kBAAkB,CAAA;CACzB;AAMD;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,QAAQ;IAChD,0CAA0C;IAC1C,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,oCAAoC;IACpC,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,sBAAsB;IACtB,YAAY,CAAC,EAAE,cAAc,CAAA;IAC7B,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,oCAAoC;IACpC,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,gCAAgC;IAChC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,yBAAyB;IACzB,IAAI,EAAE,gBAAgB,EAAE,CAAA;IACxB,wBAAwB;IACxB,IAAI,EAAE,qBAAqB,CAAA;CAC5B;AAMD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,iBAAiB;IACjB,IAAI,EAAE,QAAQ,CAAA;CACf;AAMD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,qBAAqB;IACrB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,CAAA;IAC5C,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,kBAAkB;IAClB,OAAO,EAAE,MAAM,CAAA;CAChB;AAMD;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAC1B,YAAY,GACZ,eAAe,GACf,iBAAiB,GACjB,YAAY,GACZ,QAAQ,GACR,WAAW,GACX,SAAS,GACT,UAAU,CAAA;AAEd;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wBAAwB;IACxB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,+BAA+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qBAAqB;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,iBAAiB;IACjB,KAAK,EAAE,kBAAkB,CAAA;IACzB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAA;IACpB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,iBAAiB,CAAA;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,wBAAwB;IACxB,EAAE,EAAE,OAAO,CAAA;CACZ;AAMD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAMD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAMD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,0BAA0B;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sCAAsC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAMD;;GAEG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,oBAAoB;IACpB,IAAI,EAAE,CAAC,CAAA;IACP,wBAAwB;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B"}

package/dist/api/types.js

@@ -1,9 +0,0 @@
-/**
- * API Types matching OpenAPI specification
- * @module api/types
- *
- * These types are aligned with docs/api/openapi.yaml for type-safe API interactions.
- * Uses snake_case for API wire format compatibility.
- */
-export {};
-//# sourceMappingURL=types.js.map

package/dist/api/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/api/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/api/utils.d.ts

@@ -1,54 +0,0 @@
-/**
- * API Utility Functions
- * @module api/utils
- *
- * Helper functions for API client operations
- */
-/**
- * Calculate delay with exponential backoff and jitter
- *
- * @param attempt - Current attempt number (0-indexed)
- * @param baseDelay - Base delay in milliseconds (default: 1000)
- * @returns Delay in milliseconds (capped at 30000)
- */
-export declare function calculateBackoff(attempt: number, baseDelay?: number): number;
-/**
- * Generate anonymous ID for telemetry using cryptographic randomness.
- * Returns a UUID v4 format string (e.g., "550e8400-e29b-41d4-a716-446655440000").
- *
- * Note: This generates a fresh ID per session - it is NOT stored persistently.
- * For persistent anonymous IDs, the caller must handle storage.
- */
-export declare function generateAnonymousId(): string;
-/**
- * Build request headers for API calls
- *
- * @param anonKey - Optional Supabase anon key for authentication
- * @returns Headers object
- */
-export declare function buildRequestHeaders(anonKey?: string): Record<string, string>;
-/**
- * Production API URL for Skillsmith registry.
- * This is the public API endpoint that all users should use.
- */
-export declare const PRODUCTION_API_URL = "https://api.skillsmith.app/functions/v1";
-/**
- * Production Supabase anon key for authenticated API access.
- * This key is safe to expose - it only provides RLS-based access, not admin access.
- * Without this, users hit the 10-request trial limit and get 0 results.
- *
- * SMI-1949: SMI-1948 fix was incomplete - added URL but not anon key.
- */
-export declare const PRODUCTION_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InZyY256cG1uZHRyb3F4eG9xa3p5Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3Njc4MzgwNzQsImV4cCI6MjA4MzQxNDA3NH0.WNK5jaNG3twxApOva5A1ZlCaZb5hVqBYtNJezRrR4t8";
-/**
- * Default base URL for API client.
- *
- * Priority order:
- * 1. SKILLSMITH_API_URL env var (for custom deployments)
- * 2. SUPABASE_URL env var (for development with local Supabase)
- * 3. Production API URL (default for all users)
- *
- * SMI-1948: Previously fell back to undefined, causing offline mode for all users.
- */
-export declare const DEFAULT_BASE_URL: string;
-//# sourceMappingURL=utils.d.ts.map

package/dist/api/utils.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/api/utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,MAAM,CAI1E;AAMD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAyB5C;AAMD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAY5E;AAMD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,4CAA4C,CAAA;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,qNACoL,CAAA;AAEpN;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,QAEiE,CAAA"}

package/dist/api/utils.js

@@ -1,104 +0,0 @@
-/**
- * API Utility Functions
- * @module api/utils
- *
- * Helper functions for API client operations
- */
-// ============================================================================
-// Backoff Calculation
-// ============================================================================
-/**
- * Calculate delay with exponential backoff and jitter
- *
- * @param attempt - Current attempt number (0-indexed)
- * @param baseDelay - Base delay in milliseconds (default: 1000)
- * @returns Delay in milliseconds (capped at 30000)
- */
-export function calculateBackoff(attempt, baseDelay = 1000) {
-    const exponentialDelay = baseDelay * Math.pow(2, attempt);
-    const jitter = Math.random() * 0.3 * exponentialDelay;
-    return Math.min(exponentialDelay + jitter, 30000); // Max 30s
-}
-// ============================================================================
-// Anonymous ID Generation
-// ============================================================================
-/**
- * Generate anonymous ID for telemetry using cryptographic randomness.
- * Returns a UUID v4 format string (e.g., "550e8400-e29b-41d4-a716-446655440000").
- *
- * Note: This generates a fresh ID per session - it is NOT stored persistently.
- * For persistent anonymous IDs, the caller must handle storage.
- */
-export function generateAnonymousId() {
-    // Use Node.js crypto.randomUUID() for cryptographically secure random IDs
-    // This is available in Node.js 14.17.0+ and all modern browsers
-    if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {
-        return crypto.randomUUID();
-    }
-    // Fallback for older environments: use crypto.getRandomValues if available
-    if (typeof crypto !== 'undefined' && typeof crypto.getRandomValues === 'function') {
-        const bytes = new Uint8Array(16);
-        crypto.getRandomValues(bytes);
-        // Set version (4) and variant (RFC4122) bits
-        bytes[6] = (bytes[6] & 0x0f) | 0x40;
-        bytes[8] = (bytes[8] & 0x3f) | 0x80;
-        const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
-        return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-    }
-    // Last resort fallback (not cryptographically secure, but functional)
-    const chars = 'abcdef0123456789';
-    let id = '';
-    for (let i = 0; i < 32; i++) {
-        id += chars[Math.floor(Math.random() * chars.length)];
-    }
-    return `${id.slice(0, 8)}-${id.slice(8, 12)}-${id.slice(12, 16)}-${id.slice(16, 20)}-${id.slice(20)}`;
-}
-// ============================================================================
-// Request Header Builder
-// ============================================================================
-/**
- * Build request headers for API calls
- *
- * @param anonKey - Optional Supabase anon key for authentication
- * @returns Headers object
- */
-export function buildRequestHeaders(anonKey) {
-    const headers = {
-        'Content-Type': 'application/json',
-        'x-request-id': `client-${Date.now()}-${Math.random().toString(36).slice(2)}`,
-    };
-    if (anonKey) {
-        headers['Authorization'] = `Bearer ${anonKey}`;
-        headers['apikey'] = anonKey;
-    }
-    return headers;
-}
-// ============================================================================
-// URL Constants
-// ============================================================================
-/**
- * Production API URL for Skillsmith registry.
- * This is the public API endpoint that all users should use.
- */
-export const PRODUCTION_API_URL = 'https://api.skillsmith.app/functions/v1';
-/**
- * Production Supabase anon key for authenticated API access.
- * This key is safe to expose - it only provides RLS-based access, not admin access.
- * Without this, users hit the 10-request trial limit and get 0 results.
- *
- * SMI-1949: SMI-1948 fix was incomplete - added URL but not anon key.
- */
-export const PRODUCTION_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InZyY256cG1uZHRyb3F4eG9xa3p5Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3Njc4MzgwNzQsImV4cCI6MjA4MzQxNDA3NH0.WNK5jaNG3twxApOva5A1ZlCaZb5hVqBYtNJezRrR4t8';
-/**
- * Default base URL for API client.
- *
- * Priority order:
- * 1. SKILLSMITH_API_URL env var (for custom deployments)
- * 2. SUPABASE_URL env var (for development with local Supabase)
- * 3. Production API URL (default for all users)
- *
- * SMI-1948: Previously fell back to undefined, causing offline mode for all users.
- */
-export const DEFAULT_BASE_URL = process.env.SKILLSMITH_API_URL ||
-    (process.env.SUPABASE_URL ? `${process.env.SUPABASE_URL}/functions/v1` : PRODUCTION_API_URL);
-//# sourceMappingURL=utils.js.map

package/dist/api/utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/api/utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,SAAS,GAAG,IAAI;IAChE,MAAM,gBAAgB,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,gBAAgB,CAAA;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,MAAM,EAAE,KAAK,CAAC,CAAA,CAAC,UAAU;AAC9D,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,0EAA0E;IAC1E,gEAAgE;IAChE,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC7E,OAAO,MAAM,CAAC,UAAU,EAAE,CAAA;IAC5B,CAAC;IAED,2EAA2E;IAC3E,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QAC7B,6CAA6C;QAC7C,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAA;QACnC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAA;QACnC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9E,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAA;IAC5G,CAAC;IAED,sEAAsE;IACtE,MAAM,KAAK,GAAG,kBAAkB,CAAA;IAChC,IAAI,EAAE,GAAG,EAAE,CAAA;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAA;AACvG,CAAC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,cAAc,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;KAC9E,CAAA;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,OAAO,EAAE,CAAA;QAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAA;IAC7B,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,yCAAyC,CAAA;AAE3E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,kNAAkN,CAAA;AAEpN;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,OAAO,CAAC,GAAG,CAAC,kBAAkB;IAC9B,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,eAAe,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAA"}

package/dist/audit/remote-audit.d.ts

@@ -1,28 +0,0 @@
-export interface InstallEventPayload {
-    skillId: string;
-    source: 'mcp' | 'cli' | 'vscode';
-    success: boolean;
-    durationMs?: number;
-    trustTier?: string;
-    errorCode?: string;
-}
-/**
- * Emit a skill-install event to Skillsmith's remote telemetry endpoint.
- *
- * Best-effort: never throws, never blocks the caller. Silently skips in these cases:
- * - No API key available (CLI offline / unauthenticated)
- * - SKILLSMITH_TELEMETRY=0 (opt-out)
- * - Network / endpoint failure
- *
- * The API key is mapped to a namespaced, non-reversible telemetry actor ID
- * (HMAC-SHA-256 keyed by `skillsmith-telemetry-actor:v1`) before transmission.
- * The server stores that digest as `actor` — never the raw key, never an
- * email, never a user ID.
- *
- * Event shape when emitted:
- *   event_type: "telemetry:skill_install"
- *   actor:      hmac_sha256("skillsmith-telemetry-actor:v1", apiKey) hex
- *   metadata:   { skill_id, source, success, duration_ms?, trust_tier?, error_code? }
- */
-export declare function emitInstallEvent(payload: InstallEventPayload): Promise<void>;
-//# sourceMappingURL=remote-audit.d.ts.map

package/dist/audit/remote-audit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"remote-audit.d.ts","sourceRoot":"","sources":["../../src/audit/remote-audit.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAyCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgClF"}

package/dist/audit/remote-audit.js

@@ -1,90 +0,0 @@
-import { createHmac } from 'node:crypto';
-import { getApiKey } from '../config/index.js';
-const DEFAULT_API_BASE = 'https://api.skillsmith.app';
-const EVENT_ENDPOINT = '/functions/v1/events';
-const REQUEST_TIMEOUT_MS = 2000;
-/**
- * HMAC key used to derive the telemetry actor ID from the caller's API key.
- *
- * This is NOT password storage — it is a keyed, deterministic, non-reversible
- * correlation ID used to distinguish one caller from another in aggregate
- * telemetry. HMAC-SHA-256 is the correct primitive for that use case:
- *  - Keyed construction cleanly signals "opaque identifier derivation", not
- *    password hashing.
- *  - Fast (no KDF latency on the hot install path).
- *  - Deterministic so the same API key always maps to the same actor ID,
- *    enabling per-caller aggregation server-side.
- *
- * A slow KDF (bcrypt/scrypt/Argon2) would be inappropriate here — it adds
- * latency without changing any security property we need.
- */
-const TELEMETRY_ACTOR_KEY = 'skillsmith-telemetry-actor:v1';
-function hashForActor(apiKey) {
-    // lgtm[js/insufficient-password-hash] This is deterministic correlation-ID
-    // derivation via HMAC-SHA-256 — not password storage. See TELEMETRY_ACTOR_KEY
-    // doc-comment above for full rationale (false positive in CodeQL's taint
-    // tracking which flags any flow from an API-key-like source into a crypto
-    // function, regardless of construction).
-    return createHmac('sha256', TELEMETRY_ACTOR_KEY).update(apiKey).digest('hex');
-}
-function getApiBase() {
-    return process.env.SKILLSMITH_API_URL || DEFAULT_API_BASE;
-}
-function isDisabled() {
-    const flag = process.env.SKILLSMITH_TELEMETRY;
-    return flag === '0' || flag === 'false' || flag === 'off';
-}
-/**
- * Emit a skill-install event to Skillsmith's remote telemetry endpoint.
- *
- * Best-effort: never throws, never blocks the caller. Silently skips in these cases:
- * - No API key available (CLI offline / unauthenticated)
- * - SKILLSMITH_TELEMETRY=0 (opt-out)
- * - Network / endpoint failure
- *
- * The API key is mapped to a namespaced, non-reversible telemetry actor ID
- * (HMAC-SHA-256 keyed by `skillsmith-telemetry-actor:v1`) before transmission.
- * The server stores that digest as `actor` — never the raw key, never an
- * email, never a user ID.
- *
- * Event shape when emitted:
- *   event_type: "telemetry:skill_install"
- *   actor:      hmac_sha256("skillsmith-telemetry-actor:v1", apiKey) hex
- *   metadata:   { skill_id, source, success, duration_ms?, trust_tier?, error_code? }
- */
-export async function emitInstallEvent(payload) {
-    if (isDisabled())
-        return;
-    const apiKey = getApiKey();
-    if (!apiKey)
-        return;
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
-    try {
-        await fetch(`${getApiBase()}${EVENT_ENDPOINT}`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            signal: controller.signal,
-            body: JSON.stringify({
-                event: 'skill_install',
-                anonymous_id: hashForActor(apiKey),
-                metadata: {
-                    skill_id: payload.skillId,
-                    source: payload.source,
-                    success: payload.success,
-                    ...(payload.durationMs !== undefined && { duration_ms: payload.durationMs }),
-                    ...(payload.trustTier !== undefined && { trust_tier: payload.trustTier }),
-                    ...(payload.errorCode !== undefined && { error_code: payload.errorCode }),
-                },
-            }),
-        });
-    }
-    catch {
-        // Best-effort: swallow all errors (network, abort, endpoint down).
-        // Telemetry failures must never break the install flow.
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-//# sourceMappingURL=remote-audit.js.map

package/dist/audit/remote-audit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"remote-audit.js","sourceRoot":"","sources":["../../src/audit/remote-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAW9C,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AACrD,MAAM,cAAc,GAAG,sBAAsB,CAAA;AAC7C,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAE/B;;;;;;;;;;;;;;GAcG;AACH,MAAM,mBAAmB,GAAG,+BAA+B,CAAA;AAE3D,SAAS,YAAY,CAAC,MAAc;IAClC,2EAA2E;IAC3E,8EAA8E;IAC9E,yEAAyE;IACzE,0EAA0E;IAC1E,yCAAyC;IACzC,OAAO,UAAU,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC/E,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,gBAAgB,CAAA;AAC3D,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAA;IAC7C,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAA4B;IACjE,IAAI,UAAU,EAAE;QAAE,OAAM;IACxB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;IAC1B,IAAI,CAAC,MAAM;QAAE,OAAM;IAEnB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAA;IAEtE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,UAAU,EAAE,GAAG,cAAc,EAAE,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,eAAe;gBACtB,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC;gBAClC,QAAQ,EAAE;oBACR,QAAQ,EAAE,OAAO,CAAC,OAAO;oBACzB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;oBAC5E,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;oBACzE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;iBAC1E;aACF,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,wDAAwD;IAC1D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;AACH,CAAC"}

package/dist/audit/remote-audit.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=remote-audit.test.d.ts.map

package/dist/audit/remote-audit.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"remote-audit.test.d.ts","sourceRoot":"","sources":["../../src/audit/remote-audit.test.ts"],"names":[],"mappings":""}