shakers-cli-beta 0.10.4 → 0.12.0

package/src/certify-dimension-client.js

@@ -4,7 +4,6 @@
 
 const { postJsonWithTimeout } = require('./backend-request');
 const { reasonForError } = require('./onboarding-client');
-const { toUpperLang } = require('./lang-codes');
 
 const DEFAULT_TIMEOUT_MS = 20000;
 
@@ -154,87 +153,9 @@ async function discoverOfferableDimensions(deps = {}, { accessToken, hubAccessTo
   return { ok: true, mainRole: mine.mainRole, offerable, unmatched };
 }
 
-async function requestCreateCertificationInterview(
-  { dimensionKey, languageCode, accessToken } = {},
-  { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
-) {
-  if (!endpoint) return { ok: false, reason: 'no-endpoint' };
-  if (!dimensionKey) return { ok: false, reason: 'no-dimension' };
-  const body = { dimensionKey };
-  if (languageCode) body.languageCode = toUpperLang(languageCode);
-  let res;
-  try {
-    res = await postJsonWithTimeout(endpoint, body, timeoutMs, 'POST', null, bearerHeaders(accessToken));
-  } catch (e) {
-    return { ok: false, reason: (e && e.kind) || 'network-error' };
-  }
-  if (res.status < 200 || res.status >= 300) {
-    const reason = reasonForError(res.status, res.raw);
-    if (reason !== 'dimension-on-cooldown') return { ok: false, reason };
-    // certs puts the date in the message only: "... available on 2026-10-28T14:50:38.265Z".
-    const available = String(res.raw || '').match(/available on (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/);
-    return { ok: false, reason, availableOn: available ? available[1] : null };
-  }
-  const data = payloadOf(res.raw);
-  const interviewId = pick(data || {}, ['interviewId', 'id']);
-  if (!interviewId) return { ok: false, reason: 'bad-response' };
-  return { ok: true, interviewId, language: pick(data || {}, ['language', 'languageCode']) || null };
-}
-
-// Poll the verdict; a 2xx/404/425/202 with no band yet resolves `ready:false` (retriable).
-async function requestCertificationReport(
-  { interviewId, accessToken } = {},
-  { base, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
-) {
-  if (!base) return { ok: false, reason: 'no-endpoint' };
-  if (!interviewId) return { ok: false, reason: 'no-interview' };
-  const url = `${base.replace(/\/+$/, '')}/${encodeURIComponent(interviewId)}/report`;
-  let res;
-  try {
-    res = await postJsonWithTimeout(url, null, timeoutMs, 'GET', null, bearerHeaders(accessToken));
-  } catch (e) {
-    return { ok: false, reason: (e && e.kind) || 'network-error' };
-  }
-  if (res.status === 404 || res.status === 425 || res.status === 202) return { ok: true, ready: false, report: null };
-  if (res.status < 200 || res.status >= 300) return { ok: false, reason: reasonForError(res.status, res.raw) };
-  const data = payloadOf(res.raw);
-  if (data === undefined || data === null || typeof data !== 'object') return { ok: true, ready: false, report: null };
-  const band = pick(data, ['band', 'level', 'combinedLevel']);
-  // A report with too little evidence for a level has band null; it is still finished.
-  if (!band && !pick(data, ['evaluationId'])) return { ok: true, ready: false, report: null };
-  return { ok: true, ready: true, report: data };
-}
-
-// The case the web preview shows before starting (works `get-dimension-case`): the exercise statement, else the
-// version's brief. `case: null` for a template with neither.
-async function requestDimensionCase(
-  { dimensionKey, accessToken } = {},
-  { base, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
-) {
-  if (!base) return { ok: false, reason: 'no-endpoint' };
-  if (!dimensionKey) return { ok: false, reason: 'no-dimension' };
-  const path = String(dimensionKey).split('/').map(encodeURIComponent).join('/');
-  const url = `${base.replace(/\/+$/, '')}/dimension/${path}/case`;
-  let res;
-  try {
-    res = await postJsonWithTimeout(url, null, timeoutMs, 'GET', null, bearerHeaders(accessToken));
-  } catch (e) {
-    return { ok: false, reason: (e && e.kind) || 'network-error' };
-  }
-  if (res.status < 200 || res.status >= 300) return { ok: false, reason: reasonForError(res.status, res.raw) };
-  const data = payloadOf(res.raw);
-  if (!data || typeof data !== 'object') return { ok: false, reason: 'bad-response' };
-  const text = (value) => (typeof value === 'string' && value.trim() ? value.trim() : null);
-  const brief = text(data.statement) || text(data.candidateBrief);
-  return { ok: true, case: brief ? { brief, testType: text(data.testType) } : null };
-}
-
 module.exports = {
   requestMyCertifications,
   requestTemplatesByDimension,
-  requestCreateCertificationInterview,
-  requestCertificationReport,
-  requestDimensionCase,
   composeDimensionKey,
   composeOfferableDimensions,
   discoverOfferableDimensions,

package/src/certify-dimension-flow.js

@@ -1,28 +1,33 @@
 'use strict';
 
-// `certify` dimension flow: discover -> pick -> create -> LiveKit interview -> poll verdict.
+// `certify` dimension flow: discover -> pick -> hand over the web deep link. The interview runs on the web.
 
 const { runInteractiveMultiSelect } = require('./interactive-select');
 
 function makeCertifyDimensionDeps(overrides = {}) {
   const config = require('./config');
   const client = require('./certify-dimension-client');
-  const onboardingFlow = require('./onboarding-flow');
   return {
-    getCertificationInterviewsEndpoint: config.getCertificationInterviewsEndpoint,
-    // `{certsBase}/interviews` — shared base for LiveKit start/complete + the report poll.
-    getInterviewsBase: config.getOnboardingInterviewsEndpoint,
+    getTalentProfileUrl: config.getTalentProfileUrl,
     discoverOfferableDimensions: (opts) => client.discoverOfferableDimensions({}, opts),
-    requestCreateCertificationInterview: client.requestCreateCertificationInterview,
-    requestCertificationReport: client.requestCertificationReport,
-    requestDimensionCase: client.requestDimensionCase,
-    conductLivekitInterview: onboardingFlow.conductLivekitInterview,
-    onboardingDeps: onboardingFlow.makeDeps(),
-    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+    buildWebLink,
     ...overrides,
   };
 }
 
+// The web route validates the decoded `dimension` param against `^[^/]+\/[^/]+$`,
+// so the separator slash stays literal and each segment is url-encoded.
+function buildWebLink(profileUrl, { clusterId, slug } = {}) {
+  if (!profileUrl || !clusterId || !slug) return null;
+  let origin;
+  try {
+    origin = new URL(profileUrl).origin;
+  } catch {
+    return null;
+  }
+  return `${origin}/certifications?dimension=${encodeURIComponent(clusterId)}/${encodeURIComponent(slug)}`;
+}
+
 // Numbered fallback when `ask` can't release stdin for raw mode.
 async function askNumberedChoice(ask, promptText, count) {
   const raw = (await ask(promptText)).trim();
@@ -62,53 +67,6 @@ function resolveDimensionArg(arg, items) {
   return items.find((d) => d.dimensionKey === raw || d.slug === raw) || undefined;
 }
 
-// The evaluation lands one to two minutes after the interview ends, four when the queue is busy.
-async function pollReport(deps, { interviewId, accessToken }, { base, attempts = 60, intervalMs = 5000 } = {}) {
-  for (let i = 0; i < attempts; i++) {
-    const res = await deps.requestCertificationReport({ interviewId, accessToken }, { base });
-    if (!res.ok) return { ok: false, reason: res.reason };
-    if (res.ready) return { ok: true, report: res.report };
-    if (i < attempts - 1) await deps.sleep(intervalMs);
-  }
-  return { ok: false, reason: 'timeout' };
-}
-
-function formatDay(iso, lang) {
-  const d = iso ? new Date(iso) : null;
-  if (!d || Number.isNaN(d.getTime())) return null;
-  return d.toLocaleDateString(lang === 'en' ? 'en-GB' : 'es-ES', { day: 'numeric', month: 'long', year: 'numeric' });
-}
-
-function renderVerdict(report, cd) {
-  const lines = [];
-  const band = report.band || report.level || report.combinedLevel;
-  const dimension = report.dimensionName || report.dimension || report.dimensionKey;
-  if (dimension) lines.push(cd.verdictDimension(dimension));
-  if (band) lines.push(cd.verdictBand(band));
-  if (typeof report.certified === 'boolean') lines.push(report.certified ? cd.verdictCertified : cd.verdictNotCertified);
-  const summary = report.summary || report.rationale || report.feedback;
-  if (typeof summary === 'string' && summary.trim()) lines.push(summary.trim());
-  const areas = Array.isArray(report.areas) ? report.areas : null;
-  if (areas && areas.length) {
-    for (const a of areas) {
-      const name = a && (a.name || a.area || a.tag);
-      const note = a && (a.note || a.comment);
-      if (name) lines.push(`- ${name}${note ? `: ${note}` : ''}`);
-    }
-  }
-  return lines.join('\n  ');
-}
-
-// The statement is Markdown; the terminal shows it without the emphasis markers.
-function renderCase(dimensionCase, cd) {
-  const brief = dimensionCase.brief.replace(/(\*\*|__)(.+?)\1/g, '$2');
-  const expectations = cd.caseExpectations[dimensionCase.testType];
-  const lines = brief.split('\n');
-  if (expectations) lines.push('', cd.caseExpectationsTitle, ...Object.values(expectations).map((e) => `- ${e}`));
-  lines.push('', cd.caseBeforeStart);
-  return lines.join('\n  ');
-}
-
 async function runCertifyDimension({ io, ask, stdinIsTTY, session, lang, catalog, opts = {}, deps = makeCertifyDimensionDeps() }) {
   const cd = catalog.certifyDimension;
   const accessToken = session ? session.accessToken : null;
@@ -157,60 +115,21 @@ async function runCertifyDimension({ io, ask, stdinIsTTY, session, lang, catalog
     }
   }
 
-  const createEndpoint = deps.getCertificationInterviewsEndpoint();
-  const created = await io.withProgress(cd.creating, () =>
-    deps.requestCreateCertificationInterview(
-      { dimensionKey: chosen.dimensionKey, languageCode: lang, accessToken },
-      { endpoint: createEndpoint },
-    ));
-  if (!created.ok) {
-    io.error(created.reason === 'dimension-on-cooldown'
-      ? cd.onCooldown(formatDay(created.availableOn, lang))
-      : cd.createFailed(created.reason));
-    return { ok: false, reason: created.reason, step: 'create' };
-  }
-
-  // A failed read leaves the run as it was before the case existed, like the web preview does.
-  const caseRead = await deps.requestDimensionCase(
-    { dimensionKey: chosen.dimensionKey, accessToken },
-    { base: deps.getInterviewsBase() },
-  );
-  if (caseRead.ok && caseRead.case) {
-    io.section(cd.caseTitle);
-    io.notify(renderCase(caseRead.case, cd));
-    if (stdinIsTTY) await ask(`  ${cd.caseReadyPrompt}`);
-  }
-
-  const interview = await deps.conductLivekitInterview(io, deps.onboardingDeps, {
-    interviewId: created.interviewId,
-    language: lang,
-    plain: true,
-  });
-  if (!interview.ok) {
-    io.warn(interview.reason === 'needs-web' ? cd.needsWeb : cd.interviewUnavailable(interview.reason));
-    return { ok: false, reason: interview.reason, step: 'interview' };
-  }
-
-  const reportBase = deps.getInterviewsBase();
-  const polled = await io.withProgress(cd.reportPolling, () =>
-    pollReport(deps, { interviewId: created.interviewId, accessToken }, { base: reportBase }));
-  if (!polled.ok) {
-    io.warn(polled.reason === 'timeout' ? cd.reportTimeout : cd.reportFailed(polled.reason));
-    return { ok: true, completed: 'interview', verdict: null };
+  const link = deps.buildWebLink(deps.getTalentProfileUrl(), { clusterId: chosen.clusterId, slug: chosen.slug });
+  if (!link) {
+    io.warn(cd.webHandoffNoLink);
+    return { ok: true, handoff: null, dimension: chosen.dimensionKey };
   }
 
-  io.section(cd.verdictTitle);
-  io.notify(renderVerdict(polled.report, cd));
-  io.success(cd.done);
-  return { ok: true, completed: 'interview', verdict: polled.report };
+  io.notify(cd.webHandoff);
+  io.notify(cd.webHandoffLink(link));
+  return { ok: true, handoff: link, dimension: chosen.dimensionKey };
 }
 
 module.exports = {
   makeCertifyDimensionDeps,
   runCertifyDimension,
+  buildWebLink,
   chooseDimension,
   resolveDimensionArg,
-  pollReport,
-  renderVerdict,
-  renderCase,
 };

package/src/command-audit.js

@@ -0,0 +1,105 @@
+'use strict';
+
+const os = require('os');
+const path = require('path');
+const { scrubSecrets } = require('./agent-synthesis');
+const { loadAuthSession } = require('./auth-session-store');
+const { getCertsBase } = require('./config');
+const { postJsonWithTimeout } = require('./backend-request');
+
+// Fire-and-forget: short timeout, every error swallowed, so a logging failure never blocks or fails a command.
+const AUDIT_TIMEOUT_MS = 1500;
+
+// Capped at 200 chars AFTER scrubbing (mirrors MAX_COMMAND_LEN in session-scan.js) so a secret straddling the cut cannot leak.
+const MAX_ARGS_LEN = 200;
+
+function cliVersion() {
+  try {
+    return require(path.join(__dirname, '..', 'package.json')).version || null;
+  } catch {
+    return null;
+  }
+}
+
+// Scrub THEN cap: scrubSecrets can GROW text, so the cap is measured on the scrubbed string that goes on the wire.
+function redactArgs(argv) {
+  if (!Array.isArray(argv) || argv.length === 0) return null;
+  const scrubbed = scrubSecrets(argv.join(' ')).trim().slice(0, MAX_ARGS_LEN);
+  return scrubbed || null;
+}
+
+// Anonymous runs carry only a best-effort machine hint; authenticated runs identify via the Bearer instead.
+function machineHint() {
+  let osUser = null;
+  try {
+    const info = os.userInfo();
+    osUser = info && typeof info.username === 'string' ? info.username : null;
+  } catch {
+    osUser = null;
+  }
+  let hostname = null;
+  try {
+    hostname = os.hostname() || null;
+  } catch {
+    hostname = null;
+  }
+  return { osUser, hostname };
+}
+
+// Builds the record + headers; returns null when there is no endpoint to post to.
+function buildAudit(command, argv, env) {
+  let base;
+  try {
+    base = getCertsBase(env);
+  } catch {
+    base = null;
+  }
+  if (!base) return null;
+
+  const session = loadAuthSession(env);
+  const token =
+    session && (session.accessToken || session.hubAccessToken)
+      ? session.accessToken || session.hubAccessToken
+      : null;
+
+  const body = {
+    command: String(command || 'unknown').slice(0, 100),
+    args: redactArgs(argv),
+    cliVersion: cliVersion(),
+    clientTimestamp: new Date().toISOString(),
+  };
+
+  // Machine hint only when anonymous; identity comes from the token otherwise.
+  if (!token) {
+    const { osUser, hostname } = machineHint();
+    body.osUser = osUser;
+    body.hostname = hostname;
+  }
+
+  const headers = token ? { Authorization: `Bearer ${token}` } : null;
+  const endpoint = `${base.replace(/\/+$/, '')}/cli/command-log`;
+  return { endpoint, body, headers };
+}
+
+// Emits ONE fire-and-forget audit record; never throws or rejects. Returns the `.catch`-guarded promise so tests can await it (production does not).
+function emitCommandAudit({ command, argv = [], env = process.env } = {}) {
+  try {
+    const audit = buildAudit(command, argv, env);
+    if (!audit) return Promise.resolve();
+    return postJsonWithTimeout(
+      audit.endpoint,
+      audit.body,
+      AUDIT_TIMEOUT_MS,
+      'POST',
+      null,
+      audit.headers,
+    ).then(
+      () => {},
+      () => {},
+    );
+  } catch {
+    return Promise.resolve();
+  }
+}
+
+module.exports = { emitCommandAudit, redactArgs, buildAudit };

package/src/config.js

@@ -264,7 +264,7 @@ function getAuthTokenEndpoint(env = process.env) {
 function getCompleteRegistrationEndpoint(env = process.env) {
   const explicit = readEnv(env, 'COMPLETE_REGISTRATION_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/auth/complete-registration');
+  return deriveFromHub(env, 'works/talent/auth/complete-registration');
 }
 
 // Google via device flow (RFC 8628): the Hub broker owns all Google config; the CLI holds no client_id.
@@ -287,7 +287,7 @@ function getDeviceTokenEndpoint(env = process.env) {
 function getMyCertificationsEndpoint(env = process.env) {
   const explicit = readEnv(env, 'MY_CERTIFICATIONS_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/certifications/me');
+  return deriveFromHub(env, 'works/talent/certifications/me');
 }
 
 // Role/cluster endpoints (hub, talent Bearer). available-roles = the catalog the
@@ -296,19 +296,19 @@ function getMyCertificationsEndpoint(env = process.env) {
 function getAvailableRolesEndpoint(env = process.env) {
   const explicit = readEnv(env, 'AVAILABLE_ROLES_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/certifications/me/available-roles');
+  return deriveFromHub(env, 'works/talent/certifications/me/available-roles');
 }
 
 function getSetMainRoleEndpoint(env = process.env) {
   const explicit = readEnv(env, 'SET_MAIN_ROLE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/certifications/me/main-role');
+  return deriveFromHub(env, 'works/talent/certifications/me/main-role');
 }
 
 function getAssignedClustersEndpoint(env = process.env) {
   const explicit = readEnv(env, 'ASSIGNED_CLUSTERS_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/talents/me/work-details/assigned-clusters');
+  return deriveFromHub(env, 'works/talent/me/work-details/assigned-clusters');
 }
 
 function getTemplatesByDimensionEndpoint(env = process.env) {
@@ -326,12 +326,20 @@ function getMyAssessmentsEndpoint(env = process.env) {
   return base ? `${base}/users/me/assessments` : null;
 }
 
+// `certify` creates its dimension interview here (certs, talent Bearer).
+function getCertificationInterviewsEndpoint(env = process.env) {
+  const explicit = readEnv(env, 'CERTIFICATION_INTERVIEWS_ENDPOINT');
+  if (explicit && explicit.trim()) return explicit.trim();
+  const base = getCertsBase(env);
+  return base ? `${base}/users/me/certification-interviews` : null;
+}
+
 // Find Positions list (hub `works/positions/find`, talent Bearer). Serves the
 // All/Recommended/Saved tabs via `criteria.savedByMe`; ordered by match desc.
 function getFindPositionsEndpoint(env = process.env) {
   const explicit = readEnv(env, 'FIND_POSITIONS_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/positions/find');
+  return deriveFromHub(env, 'works/talent/positions/find');
 }
 
 // Marketplace read/write (hub, talent Bearer). The id-taking getters return null
@@ -340,20 +348,20 @@ function getPositionDetailEndpoint(positionId, env = process.env) {
   const explicit = readEnv(env, 'POSITION_DETAIL_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
   if (positionId == null || typeof positionId === 'object') return null;
-  return deriveFromHub(env, `works/positions/${encodeURIComponent(positionId)}/detail`);
+  return deriveFromHub(env, `works/talent/positions/${encodeURIComponent(positionId)}/detail`);
 }
 
 function getSavePositionEndpoint(env = process.env) {
   const explicit = readEnv(env, 'SAVE_POSITION_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/saved-positions');
+  return deriveFromHub(env, 'works/talent/saved-positions');
 }
 
 function getUnsavePositionEndpoint(positionId, env = process.env) {
   const explicit = readEnv(env, 'UNSAVE_POSITION_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
   if (positionId == null || typeof positionId === 'object') return null;
-  return deriveFromHub(env, `works/saved-positions/${encodeURIComponent(positionId)}`);
+  return deriveFromHub(env, `works/talent/saved-positions/${encodeURIComponent(positionId)}`);
 }
 
 function getReceivedInvitationsEndpoint(env = process.env) {
@@ -365,7 +373,7 @@ function getReceivedInvitationsEndpoint(env = process.env) {
 function getMyCandidaturesEndpoint(env = process.env) {
   const explicit = readEnv(env, 'MY_CANDIDATURES_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/candidatures/me');
+  return deriveFromHub(env, 'works/talent/candidatures/me');
 }
 
 function getMeAvailabilityEndpoint(env = process.env) {
@@ -377,13 +385,13 @@ function getMeAvailabilityEndpoint(env = process.env) {
 function getMeProfileEndpoint(env = process.env) {
   const explicit = readEnv(env, 'ME_PROFILE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/me/profile');
+  return deriveFromHub(env, 'works/talent/me/profile-summary');
 }
 
 function getTalentMeProfileEndpoint(env = process.env) {
   const explicit = readEnv(env, 'TALENT_ME_PROFILE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/talents/me/profile');
+  return deriveFromHub(env, 'works/talent/me/profile');
 }
 
 // Alma (the AI assistant) is a SEPARATE service — NOT derived from hubBase.
@@ -444,7 +452,7 @@ function getUsageReportEndpoint(env = process.env) {
 function getAiProfileEndpoint(env = process.env) {
   const explicit = readEnv(env, 'AI_PROFILE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/me/ai-profile');
+  return deriveFromHub(env, 'works/talent/me/ai-profile');
 }
 
 // Evidence emission endpoint for the `cli_scan` instrument (talents-ai-score Phase 2).
@@ -476,7 +484,7 @@ function getPortfolioDraftDescriptionEndpoint(env = process.env) {
 function getPortfolioUpdateEndpoint(env = process.env) {
   const explicit = readEnv(env, 'PORTFOLIO_UPDATE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/portfolios');
+  return deriveFromHub(env, 'works/talent/portfolios');
 }
 
 function getAgentsDeclareEndpoint(env = process.env) {
@@ -502,7 +510,7 @@ function getAgentPortfoliosEndpoint(agentId, env = process.env) {
   // Null on missing/non-scalar id: no bogus URL, and keeps config.test.js's `fn(env)`
   // getter sweep honest when the env object lands in `agentId`.
   if (agentId == null || typeof agentId === 'object') return null;
-  return deriveFromHub(env, `works/me/agents/${encodeURIComponent(agentId)}/portfolios`);
+  return deriveFromHub(env, `works/talent/me/agents/${encodeURIComponent(agentId)}/portfolios`);
 }
 
 // Onboarding endpoints (evaluation-mcp, ADR-011..015/024 — the register flow).
@@ -533,7 +541,7 @@ function getSignUpEndpoint(env = process.env) {
 function getImportProfileEndpoint(env = process.env) {
   const explicit = readEnv(env, 'IMPORT_PROFILE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/me/import-profile');
+  return deriveFromHub(env, 'works/talent/me/import-profile');
 }
 
 // MCP sign-up (ticket 39540): public UNREGISTERED + claim code, its import status, and the one-time web login.
@@ -542,7 +550,7 @@ function getMcpSignupEndpoint(env = process.env) {
 }
 
 function getMyImportStatusEndpoint(env = process.env) {
-  return deriveFromHub(env, 'works/me/import-profile/status');
+  return deriveFromHub(env, 'works/talent/me/import-profile/status');
 }
 
 function getOneTimeTokenEndpoint(env = process.env) {
@@ -564,25 +572,25 @@ function getOneTimeLoginUrl(token, env = process.env) {
 function getProfessionalDetailsEndpoint(env = process.env) {
   const explicit = readEnv(env, 'PROFESSIONAL_DETAILS_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/me/professional-details');
+  return deriveFromHub(env, 'works/talent/me/professional-details');
 }
 
 function getPricingRateEndpoint(env = process.env) {
   const explicit = readEnv(env, 'PRICING_RATE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/talents/me/work-details/pricing-rate');
+  return deriveFromHub(env, 'works/talent/me/work-details/pricing-rate');
 }
 
 function getSetAvailabilityEndpoint(env = process.env) {
   const explicit = readEnv(env, 'AVAILABILITY_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/talents/me/work-details/availability');
+  return deriveFromHub(env, 'works/talent/me/work-details/availability');
 }
 
 function getLanguagesEndpoint(env = process.env) {
   const explicit = readEnv(env, 'LANGUAGES_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/talents/me/work-details/languages');
+  return deriveFromHub(env, 'works/talent/me/work-details/languages');
 }
 
 function getLanguagesCatalogEndpoint(env = process.env) {
@@ -616,7 +624,7 @@ function getTranslationsEndpoint(env = process.env) {
 function getTalentMeEndpoint(env = process.env) {
   const explicit = readEnv(env, 'TALENT_ME_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/me');
+  return deriveFromHub(env, 'works/users/me');
 }
 
 function getOnboardingInterviewsEndpoint(env = process.env) {
@@ -758,6 +766,7 @@ module.exports = {
   getAssignedClustersEndpoint,
   getTemplatesByDimensionEndpoint,
   getMyAssessmentsEndpoint,
+  getCertificationInterviewsEndpoint,
   // Find Positions list (`find-projects` command / `find_projects` MCP tool).
   getFindPositionsEndpoint,
   // Marketplace (show-project / save-project / unsave-project / invitations).

package/src/find-projects-client.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Find Positions list client (hub `works/positions/find`, talent Bearer). Each
+// Find Positions list client. Each
 // item carries the parent Project's id/name — a "project" here is the Position's
 // parent, not a separate list. Pagination (limit/offset) and filters map to the
 // endpoint's `criteria`; the server orders by match desc and returns the total.